@wowok/agent-mcp 3.1.3 → 3.1.5

package/dist/knowledge/baselines/rules/order.json

@@ -0,0 +1,549 @@
+{
+  "comment": "Order rule pack (R-O) — declarative form of the retired in-code Order risk rules. Facts are produced by the kernel extractor (order-risk.ts, bound to the live agent/dispute limits and the first-offender scans over items/agents); rules only reference fact names. Levels/wording can be retuned per rule and rules can be disabled (enabled=false, trace left) via the judgment document — factory rules can never be deleted or invented here.",
+  "facts": {
+    "object": "Order object address (present → the informational naming/observability rules surface).",
+    "is_buy_operation": "Whether the context is a create-via-service::buy operation.",
+    "operation": "The Order operation being attempted (set_agent_list, update_required_info, progress_advance, arb_*, receive, transfer_to, service_buy).",
+    "items_count": "KERNEL — number of items in the buy payload.",
+    "items_empty_hash_present": "KERNEL — first-offender scan: some item has a missing/empty wip_hash.",
+    "items_empty_hash_name": "KERNEL — rendered name of the first empty-wip_hash item ('undefined' when the item carries no name field).",
+    "distinct_agents": "KERNEL — distinct agent count of a set_agent_list payload (Set-deduped, matching the on-chain re-add semantics).",
+    "agents_input_count": "KERNEL — raw input agent-list length (0 when the agents array is absent).",
+    "agents_over_max": "KERNEL — distinct_agents exceeds MAX_AGENT_COUNT (chain-limit comparison sunk into the extractor).",
+    "max_agent_count": "KERNEL CONSTANT — live MAX_AGENT_COUNT from the published package.",
+    "dispute_count": "KERNEL — current dispute count, defaulting to 0.",
+    "disputes_at_max": "KERNEL — dispute_count has reached MAX_DISPUTE_COUNT.",
+    "max_dispute_count": "KERNEL CONSTANT — live MAX_DISPUTE_COUNT from the published package.",
+    "claimed_by_set": "Whether the Order's claimed_by flag is set.",
+    "claimed_by_display": "KERNEL — rendered claimed_by flag ('false' when absent, mirroring the retired default).",
+    "current_service_machine": "Current Service.machine address (snapshot divergence probe).",
+    "order_machine_snapshot": "The Order's machine snapshot (copied from the Service at buy time).",
+    "machine_snapshot_diverges": "KERNEL — both machine addresses present and different (fact-to-fact comparison sunk into the extractor).",
+    "progress_bound": "Whether a Progress object is bound to the Order.",
+    "receiving_exists": "Whether a Receiving object exists at the caller's address (the real receive gate created by the allocation payout).",
+    "caller_is_owner": "Whether the caller is the Order owner.",
+    "caller_is_agent": "Whether the caller is an agent on the Order.",
+    "service_published": "Whether the target Service is published (buy pre-flight).",
+    "service_paused": "Whether the target Service is paused (buy pre-flight).",
+    "transfer_to_new_owner_display": "KERNEL — rendered new owner address ('(unknown)' when absent).",
+    "new_owner_str": "KERNEL — String()-rendered new owner address ('undefined' when absent, mirroring the retired template literal)."
+  },
+  "rules": [
+    {
+      "rule_id": "R-O-1-01",
+      "dimension": "structural",
+      "trigger": "Order has 14 fields but no Permission field (unique among 22 objects)",
+      "cases": [
+        {
+          "when": { "field": "is_buy_operation", "op": "eq", "value": true },
+          "level": "low",
+          "title": "Order uses owner/agent dual-layer (no Permission)",
+          "description": "Order is the only business object among 22 WoWok objects that does NOT use the Permission system. All access control flows through inline owner-only and owner-or-agent permission checks.",
+          "scenario": "Developer assumes Order uses Permission and writes permission::check logic",
+          "mitigation": "Use owner/agent checks directly. Do NOT attempt to apply a Permission object to Order.",
+          "evidence": "no_permission_field",
+          "stakeholders": ["system", "owner", "agent"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-1-02",
+      "dimension": "structural",
+      "trigger": "Item count check (informational; no Move-level limit on items)",
+      "cases": [
+        {
+          "when": { "field": "items_count", "op": "gt", "value": 50 },
+          "level": "low",
+          "title": "Large items list may exceed tx size limits",
+          "description": "${items_count} items in a single Order — no protocol limit, but large lists increase transaction size and may hit gas/size limits",
+          "scenario": "Bulk purchase with many line items",
+          "mitigation": "Split into multiple Orders if items > 50",
+          "evidence": "items_count=${items_count}",
+          "stakeholders": ["owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-1-03",
+      "dimension": "structural",
+      "trigger": "dispute count >= MAX_DISPUTE_COUNT (10)",
+      "cases": [
+        {
+          "when": { "field": "disputes_at_max", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Dispute count at MAX_DISPUTE_COUNT limit",
+          "description": "Order already has ${dispute_count} disputes (MAX_DISPUTE_COUNT=${max_dispute_count}). Next dispute() call will abort E_MAX_DISPUTE_COUNT.",
+          "scenario": "Filing 11th dispute on an Order with 10 existing disputes",
+          "mitigation": "Resolve existing disputes (via arb_claim_compensation) before filing new ones. Note: claimed_by blocks ALL future disputes.",
+          "evidence": "dispute_count=${dispute_count}",
+          "stakeholders": ["owner", "agent", "arbitrator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-1-04",
+      "dimension": "structural",
+      "trigger": "set agent list — list REPLACEMENT semantics (omitted agents lose access) and distinct count limit",
+      "cases": [
+        {
+          "when": { "field": "agents_over_max", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Distinct agent count exceeds MAX_AGENT_COUNT",
+          "description": "Attempting to set ${distinct_agents} distinct agents (input ${agents_input_count}; duplicates are deduped on-chain). Move asserts length < MAX_AGENT_COUNT (${max_agent_count}) before each push — the call will abort E_MAX_AGENT_COUNT.",
+          "scenario": "Setting 11 distinct agents in one call",
+          "mitigation": "Reduce to at most ${max_agent_count} distinct agents per call, or set in two batches (second call REPLACES the first — union the lists manually).",
+          "evidence": "distinct_agents=${distinct_agents}, input_count=${agents_input_count}, max=${max_agent_count}",
+          "stakeholders": ["owner", "system"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-1-05",
+      "dimension": "structural",
+      "trigger": "wip_hash is empty string in any item",
+      "cases": [
+        {
+          "when": { "field": "items_empty_hash_present", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Empty wip_hash in item",
+          "description": "Item \"${items_empty_hash_name}\" has empty wip_hash. Move rejects empty strings (F-O-18).",
+          "scenario": "User submits item without computing WIP hash",
+          "mitigation": "Compute wip_hash from the work-in-progress file content before the buy.",
+          "evidence": "item=${items_empty_hash_name}",
+          "stakeholders": ["owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-2-01",
+      "dimension": "semantic",
+      "trigger": "Order.machine snapshot differs from current Service.machine",
+      "cases": [
+        {
+          "when": { "field": "machine_snapshot_diverges", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Machine snapshot diverges from Service.machine",
+          "description": "Order.machine=${order_machine_snapshot} was snapshotted at buy time. Service.machine is now ${current_service_machine}. Same Service has Orders running different Machine versions.",
+          "scenario": "Service provider upgrades Machine after some Orders are created",
+          "mitigation": "Audit each Order's machine snapshot separately. Document Machine version per Order. Plan migration paths for legacy Orders.",
+          "evidence": "order_machine=${order_machine_snapshot}, service_machine=${current_service_machine}",
+          "stakeholders": ["owner", "service_provider", "arbitrator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-2-02",
+      "dimension": "semantic",
+      "trigger": "SDK uses 'builder' field for Move's 'owner' field (naming deviation)",
+      "cases": [
+        {
+          "when": { "field": "object", "op": "truthy" },
+          "level": "medium",
+          "title": "SDK builder ≠ Move owner (only naming deviation in 22 objects)",
+          "description": "SDK ObjectOrder.builder corresponds to Move Order.owner. This is the only field name deviation across all 22 WoWok objects. All Order knowledge uses Move's 'owner' as canonical.",
+          "scenario": "Developer reads SDK 'builder' and assumes it's a different concept from owner",
+          "mitigation": "Use moveToSdkField()/sdkToMoveField() helpers from order-ledger.ts. Document 'builder = owner' in all SDK consumers.",
+          "evidence": "sdk_field=builder, move_field=owner",
+          "stakeholders": ["system"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-2-03",
+      "dimension": "semantic",
+      "trigger": "E_PROGRESS_NOT_SPECIFIED — single real semantics (order creation without Progress), commonly misdocumented as an agent-list/ownership freeze",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "operation", "op": "eq", "value": "service_buy" },
+            { "field": "progress_bound", "op": "eq", "value": false }
+          ] },
+          "level": "high",
+          "title": "Order creation will abort E_PROGRESS_NOT_SPECIFIED — machine bound but Progress missing",
+          "description": "Order creation asserts progress.is_some() whenever machine.is_some(). A buy against a machine-driven Service MUST bind a Progress object (via the service's bind-order-progress call) before the order record is created, else E_PROGRESS_NOT_SPECIFIED (code 3).",
+          "scenario": "Machine-driven Service purchased without creating/binding the Progress object first",
+          "mitigation": "Bind Progress before the order record is created: use the service's bind-order-progress call, which performs the package-internal progress binding. Note: setting the agent list / transferring ownership are NOT affected — they are never frozen by Progress binding.",
+          "evidence": "operation=${operation}, progress_bound=${progress_bound}",
+          "stakeholders": ["owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-2-04",
+      "dimension": "semantic",
+      "trigger": "SaleItem.item → PurchasedItem.name field name mapping",
+      "cases": [
+        {
+          "when": { "field": "is_buy_operation", "op": "eq", "value": true },
+          "level": "low",
+          "title": "SaleItem.item (Move) maps to PurchasedItem.name (SDK)",
+          "description": "Move struct SaleItem uses field 'item', but SDK ObjectOrder.items uses field 'name'. This is the second naming deviation in Order system (after builder/owner).",
+          "scenario": "Cross-layer data mapping between Move and SDK",
+          "mitigation": "Use consistent SDK field names in user-facing code; document Move ↔ SDK mapping in audit logs.",
+          "evidence": "move_field=SaleItem.item, sdk_field=PurchasedItem.name",
+          "stakeholders": ["system"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-3-01",
+      "dimension": "authority",
+      "trigger": "Agent attempts receive or transfer_to (L1 owner-only operations)",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "operation", "op": "in", "value": ["receive", "transfer_to"] },
+            { "field": "caller_is_agent", "op": "truthy" },
+            { "field": "caller_is_owner", "op": "falsy" }
+          ] },
+          "level": "high",
+          "title": "Agent attempting owner-only operation",
+          "description": "Agent cannot call ${operation} — these are L1 owner-only operations. Agent can operate progress/arb_*/required_info but CANNOT receive funds or transfer ownership.",
+          "scenario": "Logistics agent tries to collect payment on behalf of buyer",
+          "mitigation": "Owner must call receive/transfer_to directly. If delegation is needed, owner can transfer_to a multi-sig wallet that includes the agent.",
+          "evidence": "operation=${operation}, caller=agent",
+          "stakeholders": ["agent", "owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-3-02",
+      "dimension": "authority",
+      "trigger": "Non-owner non-agent attempts operation (no permission)",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "operation", "op": "present" },
+            { "field": "caller_is_owner", "op": "eq", "value": false },
+            { "field": "caller_is_agent", "op": "eq", "value": false }
+          ] },
+          "level": "high",
+          "title": "Non-owner non-agent attempting operation",
+          "description": "Caller is neither owner nor agent. L2 operations (progress, arb_confirm, arb_objection) require the owner-or-agent permission check — aborts E_NOT_OP_PERMISSION. L1 operations (transfer_to, set agent list, update required_info) additionally require the owner-only check — aborts E_NOT_THE_OWNER.",
+          "scenario": "Random address attempts to advance someone else's Order",
+          "mitigation": "Verify caller is owner or in agent[] before submitting transaction.",
+          "evidence": "operation=${operation}, caller=unauthorized",
+          "stakeholders": ["system"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-3-03",
+      "dimension": "authority",
+      "trigger": "arb_claim_compensation called (sets claimed_by, irreversible)",
+      "cases": [
+        {
+          "when": { "field": "operation", "op": "eq", "value": "arb_claim_compensation" },
+          "level": "high",
+          "title": "arb_claim_compensation is IRREVERSIBLE (claimed_by one-time set)",
+          "description": "Setting claimed_by is permanent. After this call: (1) claimed_by cannot be reset, (2) NO new disputes can be filed (E_ORDER_ALREADY_CLAIMED), (3) all unresolved disputes become unactionable. If first compensation is insufficient, buyer has no recourse.",
+          "scenario": "Buyer claims partial compensation, then discovers additional damages",
+          "mitigation": "BEFORE claiming: (1) enumerate ALL disputes, (2) ensure proposition covers all damages, (3) confirm Arb ruling is final. Add explicit user confirmation (C-O-08).",
+          "evidence": "operation=arb_claim_compensation, current_claimed_by=${claimed_by_display}",
+          "stakeholders": ["owner", "agent", "arbitrator"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "Claiming permanently consumes the dispute channel: every unresolved dispute becomes unactionable and no new dispute can ever be filed, so any shortfall in this first payout is unrecoverable." }
+            ],
+            "gain_paths": []
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-3-04",
+      "dimension": "authority",
+      "trigger": "dispute attempted after claimed_by is set",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "claimed_by_set", "op": "truthy" },
+            { "field": "operation", "op": "in", "value": ["arb_confirm", "arb_objection"] }
+          ] },
+          "level": "high",
+          "title": "Cannot file new dispute after claimed_by is set",
+          "description": "Order.claimed_by is set — any new dispute() call aborts E_ORDER_ALREADY_CLAIMED. arb_confirm/arb_objection trigger dispute() internally.",
+          "scenario": "Buyer claims compensation then tries to file additional dispute",
+          "mitigation": "Resolve ALL disputes BEFORE calling arb_claim_compensation. claimed_by is terminal for dispute flow.",
+          "evidence": "operation=${operation}, claimed_by_set=true",
+          "stakeholders": ["owner", "agent"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-4-01",
+      "dimension": "lifecycle",
+      "trigger": "Attempt to create Order independently (not via the buy flow)",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "is_buy_operation", "op": "eq", "value": false },
+            { "field": "operation", "op": "eq", "value": "service_buy" },
+            { "field": "object", "op": "falsy" }
+          ] },
+          "level": "critical",
+          "title": "Order cannot be created independently (compound creation only)",
+          "description": "Order record creation is package-only — only the buy flow can create Orders. Any attempt to create one directly will fail at the Move module boundary. Order + Allocation + Progress are created atomically in one transaction.",
+          "scenario": "Developer tries to construct Order independently for testing",
+          "mitigation": "Always use the buy flow to create Orders. For testing, deploy a minimal Service with machine/allocators configured.",
+          "evidence": "independent_creation_attempted",
+          "stakeholders": ["system", "owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-4-02",
+      "dimension": "lifecycle",
+      "trigger": "set agent list attempted mid-fulfillment (Progress bound) — replacement may revoke active agents",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "operation", "op": "eq", "value": "set_agent_list" },
+            { "field": "progress_bound", "op": "truthy" }
+          ] },
+          "level": "medium",
+          "title": "Mid-fulfillment agent-list replacement — replacement may silently revoke active agents",
+          "description": "Setting the agent list is allowed at ANY time (no Progress freeze exists on-chain), but it REPLACES the entire list: an active agent omitted from the new list immediately loses L2 access (Progress advance, arb operations) and their EntityOrders role record is removed. A workflow waiting on that agent to advance Progress would stall.",
+          "scenario": "Owner adjusts the agent list mid-fulfillment and accidentally drops the agent responsible for the next Progress node",
+          "mitigation": "When changing agents mid-fulfillment, always include the union of current active agents plus the additions. Query the current agent list first (order query), merge, then submit.",
+          "evidence": "operation=set_agent_list, progress_bound=${progress_bound}",
+          "stakeholders": ["owner", "agent"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "If the workflow was waiting on the dropped agent, the order stalls at that node — escrowed order funds freeze until the agent list is repaired." },
+              { "role": "merchant", "basis": "The merchant revenue share of the same stalled orders freezes with them." }
+            ],
+            "gain_paths": []
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-4-03",
+      "dimension": "lifecycle",
+      "trigger": "Progress advance attempted without progress bound",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "operation", "op": "eq", "value": "progress_advance" },
+            { "field": "progress_bound", "op": "eq", "value": false }
+          ] },
+          "level": "high",
+          "title": "Cannot advance Progress — no Progress bound to Order",
+          "description": "Order has no progress field set (Service had no machine configured). Cannot advance a non-existent Progress. SDK CallOrder validates this pre-flight (CallOrder_Data.progress requires order.machine and order.progress).",
+          "scenario": "Buyer tries to advance Progress on an Order created from a Service without machine",
+          "mitigation": "Use a Service with machine configured. If manual lifecycle is needed, track state off-chain.",
+          "evidence": "operation=progress_advance, progress_bound=false",
+          "stakeholders": ["owner", "agent"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-4-04",
+      "dimension": "lifecycle",
+      "trigger": "arb_confirm/arb_objection/arb_claim_compensation (irreversible Arb operations)",
+      "cases": [
+        {
+          "when": { "field": "operation", "op": "in", "value": ["arb_confirm", "arb_objection", "arb_claim_compensation"] },
+          "level": "high",
+          "title": "${operation} is irreversible (triggers Arb flow)",
+          "description": "${operation} triggers the Arbitration workflow which cannot be undone. arb_confirm files a new dispute, arb_objection requests re-arbitration, arb_claim_compensation sets claimed_by permanently.",
+          "scenario": "User accidentally files arb_confirm without understanding consequences",
+          "mitigation": "Add explicit user confirmation (C-O-08, C-O-11, C-O-12) before these operations. Show warning text describing irreversibility.",
+          "evidence": "operation=${operation}",
+          "stakeholders": ["owner", "agent", "arbitrator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-4-05",
+      "dimension": "lifecycle",
+      "trigger": "receive attempted but no Receiving exists at the caller's address (the allocation payout has not distributed a payment)",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "operation", "op": "eq", "value": "receive" },
+            { "field": "receiving_exists", "op": "eq", "value": false }
+          ] },
+          "level": "high",
+          "title": "receive blocked — no Receiving object (the allocation payout has not run)",
+          "description": "Receiving the payment is gated by Receiving existence: the allocation payout must have run on the Order's Allocation object and included the caller's address in the payment recipients. Without a Receiving, the transaction cannot be constructed (no E_ORDER_DELIVERING abort exists on-chain — Progress terminal state is NOT a receive gate).",
+          "scenario": "Buyer tries to collect a payment before the allocation flow has distributed it",
+          "mitigation": "1) Confirm the allocation payout has run on the Order's Allocation (query its payment vector) 2) Confirm the caller's address is in the allocator's sharing recipients 3) Retry receive with the correct Receiving object ID. If the merchant withholds allocation, file arb_confirm to dispute.",
+          "evidence": "operation=receive, receiving_exists=${receiving_exists}",
+          "stakeholders": ["owner"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "The payout cannot be collected: with no Receiving at the caller's address there is no receive path — the buyer's share sits undistributed in the Allocation." }
+            ],
+            "gain_paths": [
+              {
+                "role": "merchant",
+                "path": "Withholding the allocation run keeps the order's escrow undistributed instead of paying the buyer's share out.",
+                "viability": "conditional",
+                "gate": "Executes only if the merchant actually withholds the allocation rather than the payout merely pending — the buyer's remedy is filing a dispute."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-4-06",
+      "dimension": "lifecycle",
+      "trigger": "transfer_to attempted (irreversible ownership transfer)",
+      "cases": [
+        {
+          "when": { "field": "operation", "op": "eq", "value": "transfer_to" },
+          "level": "critical",
+          "title": "transfer_to is IRREVERSIBLE — new owner takes over ALL permissions",
+          "description": "Ownership transfer to ${transfer_to_new_owner_display} is permanent. New owner becomes the sole receiver of payments and gains full L1 control. Original owner loses ALL access.",
+          "scenario": "Buyer transfers Order to wrong address by mistake",
+          "mitigation": "1) Verify new owner address twice. 2) Coordinate with new owner before transfer. 3) Add explicit user confirmation (C-O-10). Note: transfer_to is allowed at any time (no Progress freeze exists).",
+          "evidence": "new_owner=${new_owner_str}",
+          "stakeholders": ["owner"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "The original owner loses ALL access and payment receivership the moment the transfer lands — there is no reversal path." }
+            ],
+            "gain_paths": [
+              {
+                "role": "neutral",
+                "path": "Whichever address is submitted becomes the sole receiver of all remaining payments and the full L1 controller of the Order.",
+                "viability": "viable",
+                "gate": "The Move layer performs no destination verification — the transfer executes exactly as submitted and cannot be undone."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-5-01",
+      "dimension": "cross_object",
+      "trigger": "Service.machine upgraded after Order creation (snapshot divergence)",
+      "cases": [
+        {
+          "when": { "field": "is_buy_operation", "op": "eq", "value": true },
+          "level": "low",
+          "title": "Service snapshot mechanism — order.machine is a copy, not a reference",
+          "description": "When the buy flow creates an Order, order.machine is COPIED from service.machine. Future Service.machine upgrades do NOT affect this Order. Same Service may have Orders running different Machine versions.",
+          "scenario": "Service provider upgrades Machine workflow — old Orders keep old workflow",
+          "mitigation": "Track Machine version per Order (via order.machine address). Plan migration paths for legacy Orders. Document that old Orders are decoupled.",
+          "evidence": "snapshot_mechanism",
+          "stakeholders": ["owner", "service_provider", "arbitrator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-5-02",
+      "dimension": "cross_object",
+      "trigger": "Order references Progress that no longer exists or is corrupted",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "progress_bound", "op": "truthy" },
+            { "field": "object", "op": "truthy" }
+          ] },
+          "level": "medium",
+          "title": "Order-Progress 1:1 binding (E_PROGRESS_ALREADY_SPECIFIED)",
+          "description": "Order.progress is one-time-set at binding (package-only). Cannot be rebound. If Progress object is corrupted, Order becomes stuck — cannot advance, cannot rebind.",
+          "scenario": "Progress object becomes unresponsive or corrupted",
+          "mitigation": "Ensure Progress integrity via Machine audit before publishing Service. Use arb_claim_compensation as escape hatch if Progress is stuck.",
+          "evidence": "progress_bound=${progress_bound}",
+          "stakeholders": ["owner", "agent"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-5-03",
+      "dimension": "cross_object",
+      "trigger": "Order references Allocation that no longer exists or is corrupted",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "object", "op": "truthy" },
+            { "field": "progress_bound", "op": "truthy" }
+          ] },
+          "level": "medium",
+          "title": "Order-Allocation 1:1 binding (E_ALLOCATION_ALREADY_SPECIFIED)",
+          "description": "Order.allocation is one-time-set at binding (package-only). Cannot be rebound. If Allocation object is corrupted, fund distribution is blocked.",
+          "scenario": "Allocation object has wrong allocator configuration",
+          "mitigation": "Audit order_allocators configuration on Service BEFORE publishing. Use compensation_fund as fallback fund source.",
+          "evidence": "allocation_binding",
+          "stakeholders": ["owner", "service_provider"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-5-04",
+      "dimension": "cross_object",
+      "trigger": "Arbitration dispute appended to Order.dispute list",
+      "cases": [
+        {
+          "when": { "field": "operation", "op": "eq", "value": "arb_confirm" },
+          "level": "low",
+          "title": "Arb object will be appended to order.dispute (package-only dispute())",
+          "description": "arb_confirm triggers the Arb module to append the Arb object to the order.dispute list (package-internal). Max 10 disputes (MAX_DISPUTE_COUNT). Frozen when claimed_by is set.",
+          "scenario": "Multiple arb_confirm calls create multiple Arb objects on same Order",
+          "mitigation": "Track dispute count. Once at 10, no more disputes can be filed. Resolve existing disputes before filing new ones.",
+          "evidence": "operation=arb_confirm, current_disputes=${dispute_count}",
+          "stakeholders": ["arbitrator", "owner", "agent"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-5-05",
+      "dimension": "cross_object",
+      "trigger": "External system expects OrderCompletedEvent (does not exist)",
+      "cases": [
+        {
+          "when": { "any": [
+            { "field": "is_buy_operation", "op": "truthy" },
+            { "field": "object", "op": "truthy" }
+          ] },
+          "level": "medium",
+          "title": "Only NewOrderEvent emitted — no OrderCompletedEvent",
+          "description": "Move contract ONLY emits NewOrderEvent at creation. Order completion/cancellation/refund are IMPLICIT — must be inferred by querying Progress.current_node (terminal? cancel?) or Order.claimed_by. External monitoring requires polling, not event-driven.",
+          "scenario": "Analytics dashboard expects OrderCompletedEvent to track completion rate",
+          "mitigation": "Build composite query: NewOrderEvent + Order.progress query → infer completion. Document this limitation in monitoring tools. Long-term: advocate for Move upgrade to add OrderCompletedEvent.",
+          "evidence": "no_order_completed_event",
+          "stakeholders": ["system"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-O-5-06",
+      "dimension": "cross_object",
+      "trigger": "buy pre-flight: Service not published or paused",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "is_buy_operation", "op": "truthy" },
+            { "field": "service_published", "op": "eq", "value": false }
+          ] },
+          "level": "critical",
+          "title": "Service not published — the buy will abort E_NOT_PUBLISHED",
+          "description": "Cannot create Order from an unpublished Service. Service must be published (bPublished=true) before the buy can be called.",
+          "scenario": "Buyer attempts to purchase from a draft Service",
+          "mitigation": "Verify Service.bPublished=true before buying. Service owner must publish the Service first.",
+          "evidence": "service_published=${service_published}",
+          "stakeholders": ["owner"]
+        },
+        {
+          "when": { "all": [
+            { "field": "is_buy_operation", "op": "truthy" },
+            { "field": "service_paused", "op": "eq", "value": true }
+          ] },
+          "level": "critical",
+          "title": "Service paused — the buy will abort E_PAUSED",
+          "description": "Cannot create Order from a paused Service. Service must be unpaused before the buy can be called.",
+          "scenario": "Buyer attempts to purchase from a paused Service (e.g. during maintenance)",
+          "mitigation": "Wait for the Service owner to unpause. Check Service.paused before buying.",
+          "evidence": "service_paused=${service_paused}",
+          "stakeholders": ["owner"]
+        }
+      ]
+    }
+  ]
+}