@wowok/agent-mcp 3.2.0 → 3.2.2

package/dist/knowledge/audit-rules.js

@@ -1 +1 @@
-export function salesItemsOf(a){if(Array['isArray'](a?.['sales']))return a['sales'];if(Array['isArray'](a?.['sales']?.['sales']))return a['sales']['sales'];return[];}export function allocatorCountOf(a){const b=a?.['order_allocators'];if(Array['isArray'](b))return b['length'];if(Array['isArray'](b?.['allocators']))return b['allocators']['length'];return 0x0;}export function arbitrationRefsOf(b){const c=b?.['arbitrations'];if(Array['isArray'](c))return c['filter'](e=>typeof e==='string');if(Array['isArray'](c?.['objects']))return c['objects']['filter'](e=>typeof e==='string');return[];}export function compensationFundOf(a){if(a?.['compensation_fund_add']?.['balance']!=null)return a['compensation_fund_add']['balance'];if(a?.['compensation_fund']!=null)return a['compensation_fund'];return undefined;}export function serviceNameOf(a){if(typeof a?.['object']==='string')return a['object'];if(typeof a?.['object']?.['name']==='string'&&a['object']['name'])return a['object']['name'];if(typeof a?.['namedNew']?.['name']==='string'&&a['namedNew']['name'])return a['namedNew']['name'];return undefined;}export function typeParameterOf(a){if(typeof a?.['type_parameter']==='string'&&a['type_parameter'])return a['type_parameter'];if(typeof a?.['object']?.['type_parameter']==='string'&&a['object']['type_parameter'])return a['object']['type_parameter'];if(typeof a?.['namedNew']?.['type_parameter']==='string'&&a['namedNew']['type_parameter'])return a['namedNew']['type_parameter'];return undefined;}export const ANTI_PATTERN_NODE_REGEX=/(^|_)(disputed?|arbitration|arb)(_|$)|^(refund|refunded|deposit_refunded|deposit_deducted|cancel|cancelled)$/i;export function auditMachineNodes(a){const b=[],c=[];if(!Array['isArray'](a)||a['length']===0x0)return c['push']('pre_publish:\x20machine\x20node\x20set\x20unavailable\x20—\x20topology\x20not\x20verifiable;\x20'+'verify\x20via\x20machineNode2file\x20BEFORE\x20publish\x20(immutable\x20after\x20publish,\x20IMMUT-001)'),{'critical':b,'warnings':c};const d=a;for(const q of d){const r=typeof q?.['name']==='string'?q['name']:'';r&&ANTI_PATTERN_NODE_REGEX['test'](r)&&b['push']('R-M1-11:\x20machine\x20node\x20\x22'+r+'\x22\x20models\x20dispute/refund\x20flow\x20—\x20'+'refunds\x20must\x20route\x20via\x20an\x20Allocator\x20triggered\x20by\x20business\x20states,\x20'+'disputes\x20via\x20the\x20separate\x20Arbitration\x20object\x20(off-Machine)');}const e=new Set();for(const s of d){const t=typeof s?.['name']==='string'?s['name']:'';if(!t)continue;e['has'](t)&&b['push']('MC-C-04:\x20duplicate\x20machine\x20node\x20name\x20\x22'+t+'\x22\x20—\x20on-chain\x20will\x20reject\x20the\x20publish\x20transaction'),e['add'](t);}const g=d['some'](u=>Array['isArray'](u?.['pairs'])&&u['pairs']['some'](v=>v?.['prev_node']===''));!g&&b['push']('Machine\x20has\x20no\x20entry\x20pair\x20(prev_node=\x22\x22)\x20—\x20Progress\x20can\x20never\x20advance\x20'+'from\x20the\x20initial\x20state;\x20orders\x20are\x20permanently\x20stuck');const h=new Map();for(const u of d){const v=typeof u?.['name']==='string'?u['name']:'';if(!v)continue;if(!h['has'](v))h['set'](v,[]);for(const w of u?.['pairs']??[]){const x=w?.['prev_node'];if(typeof x==='string'&&x!==''){const y=h['get'](x);if(y)y['push'](v);else h['set'](x,[v]);}}}const i=0x0,j=0x1,k=0x2,l=new Map(),m=[],o=z=>{l['set'](z,j);for(const A of h['get'](z)??[]){const B=l['get'](A)??i;if(B===j)m['push'](z+'->'+A);else B===i&&o(A);}l['set'](z,k);};for(const z of h['keys']()){if((l['get'](z)??i)===i)o(z);}m['length']>0x0&&c['push']('pre_publish:\x20machine\x20contains\x20loop\x20back-edge(s)\x20'+m['join'](',\x20')+'\x20—\x20on-chain\x20a\x20revisit\x20'+'is\x20NOT\x20verified\x20to\x20re-fund\x20the\x20Allocation.\x20Every\x20renewal/loop\x20forward\x20MUST\x20carry\x20the\x20new-period\x20'+'payment\x20into\x20the\x20order\x20escrow\x20atomically\x20(create\x20the\x20period\x20payment,\x20receive\x20it\x20into\x20the\x20'+'allocation,\x20and\x20advance\x20the\x20progress\x20—\x20all\x20in\x20one\x20transaction),\x20or\x20the\x20loop\x20allows\x20zero-value\x20'+'re-delivery\x20cycles\x20(test/11\x20R2-F3).\x20'+'Recommended:\x20bind\x20a\x20fund-gate\x20Guard\x20on\x20the\x20loop\x20forward\x20(allocation\x20balance\x20>=\x20period\x20price)\x20—\x20'+'note\x20the\x20allocation.balance\x20query\x20is\x20not\x20yet\x20available\x20on-chain,\x20so\x20per-period\x20NEW\x20Orders\x20remain\x20'+'the\x20safe\x20default\x20for\x20long\x20subscriptions.');for(const A of d){const B=typeof A?.['name']==='string'?A['name']:'?';for(const C of A?.['pairs']??[]){for(const D of C?.['forwards']??[]){const E=D?.['namedOperator']!==undefined&&D?.['namedOperator']!==null,F=D?.['permissionIndex']!==undefined&&D?.['permissionIndex']!==null,G=D?.['guard']!==undefined&&D?.['guard']!==null;!E&&!F&&!G&&c['push']('pre_publish:\x20node\x20\x22'+B+'\x22\x20forward\x20\x22'+String(D?.['name']??'?')+'\x22\x20has\x20no\x20executor\x20binding\x20(namedOperator\x20/\x20permissionIndex\x20/\x20guard)\x20—\x20no\x20one\x20can\x20advance\x20it');}}}return{'critical':b,'warnings':c};}export const AUDIT_RULES=[{'id':'audit_machine_bound','description':'Service\x20should\x20have\x20a\x20Machine\x20workflow\x20bound\x20before\x20publish','severity':'warning','fields':['machine'],'check':(a,b)=>{if(!a?.['publish'])return!![];return!!a?.['machine'];},'message':()=>'Publishing\x20a\x20service\x20without\x20a\x20Machine\x20workflow.\x20Customers\x20won\x27t\x20have\x20a\x20structured\x20order\x20process.','recommendation':'Create\x20a\x20Machine\x20(workflow\x20template)\x20and\x20bind\x20it\x20to\x20the\x20service\x20before\x20publishing.\x20The\x20machine\x20field\x20becomes\x20IMMUTABLE\x20after\x20publish.'},{'id':'audit_order_allocators','description':'Service\x20should\x20have\x20order_allocators\x20for\x20fund\x20distribution','severity':'warning','fields':['order_allocators'],'check':a=>{if(!a?.['publish'])return!![];return allocatorCountOf(a)>0x0;},'message':()=>'Publishing\x20a\x20service\x20without\x20order_allocators.\x20Order\x20funds\x20cannot\x20be\x20auto-distributed\x20to\x20suppliers.','recommendation':'Configure\x20order_allocators\x20before\x20publishing\x20—\x20this\x20field\x20becomes\x20IMMUTABLE\x20after\x20publish.'},{'id':'audit_buy_guard','description':'Service\x20should\x20have\x20a\x20buy_guard\x20for\x20customer\x20screening','severity':'info','fields':['buy_guard'],'check':a=>!!a?.['buy_guard'],'message':()=>'No\x20buy_guard\x20configured\x20—\x20anyone\x20can\x20purchase\x20this\x20service\x20without\x20verification.','recommendation':'Consider\x20adding\x20a\x20Guard\x20to\x20verify\x20customer\x20eligibility\x20(e.g.,\x20identity,\x20wallet\x20balance,\x20location).'},{'id':'audit_arb_alloc_boundary','description':'Arbitration\x20and\x20Allocator\x20coexist\x20→\x20surface\x20the\x20two-system\x20boundary\x20reminder','severity':'warning','fields':['arbitrations','compensation_fund_add','compensation_fund','order_allocators'],'check':a=>{if(!a?.['publish'])return!![];const b=arbitrationRefsOf(a)['length']>0x0||compensationFundOf(a)!==undefined;return!(b&&allocatorCountOf(a)>0x0);},'message':()=>'Arbitration\x20and\x20Allocator\x20are\x20INDEPENDENT\x20systems\x20by\x20design:\x20a\x20ruling\x20records\x20the\x20case\x20and\x20pays\x20from\x20the\x20service\x20compensation\x20fund\x20—\x20it\x20never\x20moves\x20escrow\x20and\x20never\x20advances\x20the\x20workflow.\x20With\x20both\x20configured,\x20a\x20buyer\x20can\x20receive\x20BOTH\x20the\x20arbitration\x20compensation\x20AND\x20a\x20full\x20escrow\x20refund\x20unless\x20the\x20refund/settlement\x20path\x20is\x20gated.\x20This\x20is\x20a\x20boundary\x20reminder,\x20not\x20a\x20defect\x20—\x20verify\x20the\x20coupling\x20check\x20was\x20done\x20deliberately.','recommendation':'Gate\x20the\x20refund/settlement\x20allocator\x27s\x20Guard\x20on\x20order.claimed_by\x20(read-only\x20cross-system\x20evidence\x20—\x20the\x20sanctioned\x20link),\x20or\x20hold\x20the\x20final\x20settlement\x20forward\x20until\x20the\x20case\x20closes.\x20Do\x20NOT\x20couple\x20the\x20systems\x20the\x20other\x20way\x20(no\x20dispute\x20state\x20on\x20the\x20order\x20flow,\x20no\x20workflow\x20step\x20into\x20arbitration):\x20coupling\x20opens\x20the\x20double-pay\x20path.\x20For\x20per-case\x20fund\x20actions,\x20the\x20deposit-reimbursement\x20pattern\x20(guard-design\x20patterns)\x20is\x20the\x20supported\x20route.'},{'id':'audit_compensation_fund','description':'Service\x20should\x20have\x20a\x20compensation_fund\x20for\x20trust','severity':'warning','fields':['compensation_fund_add','compensation_fund'],'check':a=>compensationFundOf(a)!==undefined,'message':()=>'No\x20compensation_fund\x20configured.\x20Customers\x20have\x20no\x20financial\x20protection\x20if\x20you\x20fail\x20to\x20deliver.','recommendation':'Deposit\x20via\x20compensation_fund_add\x20{balance}\x20to\x20enable\x20arbitration\x20payouts.\x20The\x20fund\x20deters\x20fraud\x20and\x20enables\x20arbitration\x20claims.'},{'id':'audit_arbitrations','description':'Service\x20should\x20have\x20arbitration\x20options\x20for\x20dispute\x20resolution','severity':'info','fields':['arbitrations'],'check':a=>arbitrationRefsOf(a)['length']>0x0,'message':()=>'No\x20arbitration\x20configured.\x20Disputes\x20cannot\x20be\x20resolved\x20through\x20a\x20third\x20party.','recommendation':'Add\x20at\x20least\x20one\x20Arbitration\x20object\x20via\x20arbitrations:{op:\x27add\x27,\x20objects:[...]}\x20to\x20enable\x20on-chain\x20dispute\x20resolution.'},{'id':'audit_price','description':'Service\x20should\x20have\x20at\x20least\x20one\x20priced\x20sale\x20item','severity':'error','fields':['sales'],'check':a=>{const b=salesItemsOf(a);if(b['length']===0x0)return!![];return b['some'](c=>c?.['price']!==undefined&&c?.['price']!==null);},'message':()=>'Sales\x20list\x20present\x20but\x20no\x20item\x20has\x20a\x20price.\x20Customers\x20cannot\x20place\x20orders\x20without\x20knowing\x20the\x20cost.','recommendation':'Set\x20price\x20on\x20each\x20sales\x20item\x20(smallest-unit\x20string\x20or\x20display\x20form\x20like\x20\x272.5WOW\x27).'},{'id':'audit_description','description':'Service\x20should\x20have\x20a\x20description','severity':'warning','fields':['description'],'check':a=>typeof a?.['description']==='string'&&a['description']['length']>0x0,'message':()=>'Service\x20has\x20no\x20description.\x20Customers\x20won\x27t\x20understand\x20what\x20you\x27re\x20offering.','recommendation':'Write\x20a\x20clear\x20description\x20of\x20the\x20service,\x20including\x20deliverables,\x20timelines,\x20and\x20terms.'},{'id':'audit_named_new_name','description':'Service\x20being\x20created\x20should\x20have\x20a\x20name','severity':'warning','check':a=>serviceNameOf(a)!==undefined,'message':()=>'Creating\x20a\x20service\x20without\x20a\x20name\x20makes\x20it\x20hard\x20to\x20reference\x20and\x20organize.','recommendation':'Set\x20object:{name:\x20...}\x20(or\x20namedNew.name)\x20following\x20the\x20convention:\x20<projectPrefix>_<service>_<purpose>.'},{'id':'audit_customer_required_needs_um','description':'customer_required\x20requires\x20a\x20Contact\x20bound\x20via\x20um\x20(SDK-enforced\x20hard\x20link;\x20mirrored\x20here)','severity':'error','fields':['customer_required','um'],'check':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];if(b['length']===0x0)return!![];return!!a?.['um'];},'message':()=>'customer_required\x20is\x20set\x20but\x20no\x20Contact\x20is\x20bound\x20via\x20um\x20—\x20customers\x20cannot\x20deliver\x20the\x20required\x20private\x20information\x20through\x20end-to-end\x20encrypted\x20Messenger.','recommendation':'Bind\x20um:{Contact\x20name/id}\x20in\x20the\x20same\x20call\x20(SDK\x20order_new\x20will\x20fail\x20the\x20buyer\x20otherwise).'},{'id':'audit_customer_required_is_declared_not_enforced','description':'customer_required\x20has\x20no\x20on-chain\x20enforcement\x20at\x20buy\x20time\x20—\x20a\x20Guard\x20must\x20gate\x20fulfilment','severity':'warning','fields':['customer_required'],'check':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];return b['length']===0x0;},'message':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];return'customer_required\x20('+b['length']+'\x20field(s):\x20'+b['join'](',\x20')+')\x20is\x20DECLARATIVE\x20ONLY:\x20the\x20on-chain\x20purchase\x20entry\x20never\x20reads\x20it\x20(service.move:399-419),\x20so\x20an\x20order\x20that\x20supplies\x20none\x20of\x20these\x20fields\x20is\x20still\x20created\x20and\x20progresses.\x20Nothing\x20on-chain\x20will\x20stop\x20it.';},'recommendation':'Bind\x20pattern.required_info_evidence_gate\x20(schema_query\x20action=get_guard_design_patterns)\x20on\x20the\x20first\x20forward\x20that\x20needs\x20the\x20information:\x20query\x20\x27order.required_info\x20some\x27\x20(1572)\x20over\x20the\x20Order.\x20The\x20buyer\x20records\x20the\x20credential\x20via\x20order_required_info_update:\x20EITHER\x20the\x20merchant\x27s\x20IM\x20user\x20address\x20resolved\x20from\x20the\x20Service\x27s\x20Contact\x20(zero\x20cost,\x20address\x20record\x20only)\x20OR\x20an\x20on-chain\x20WTS\x20Proof\x20object\x20address\x20(embeds\x20the\x20merchant\x20IM\x20address\x20and\x20the\x20last-message\x20timestamp;\x20costs\x20gas,\x20publicly\x20verifiable).\x20\x27order.required_info\x27\x20(1573)\x20returns\x20the\x20recorded\x20address\x20but\x20aborts\x20while\x20nothing\x20is\x20recorded\x20—\x20gate\x20on\x201572\x20first.'},{'id':'audit_dangling_deps','description':'Service\x20dependencies\x20should\x20be\x20fully\x20created','severity':'error','check':(a,b)=>{if(!a?.['publish'])return!![];if(!b?.['graph'])return!![];const c=b['graph']['findDanglingDependencies']()??[];return c['length']===0x0;},'message':()=>'Service\x20references\x20objects\x20that\x20are\x20not\x20yet\x20created.\x20Publishing\x20will\x20lock\x20these\x20references.','recommendation':'Ensure\x20all\x20referenced\x20objects\x20(machine,\x20allocators,\x20guards)\x20are\x20created\x20and\x20finalized\x20before\x20publishing.'},{'id':'audit_type_parameter','description':'Service\x20should\x20have\x20a\x20token\x20type\x20specified','severity':'info','fields':['type_parameter','namedNew'],'check':a=>typeParameterOf(a)!==undefined,'message':()=>'No\x20payment\x20token\x20type\x20specified.\x20Defaulting\x20to\x20WOW\x20(0x2::wow::WOW).','recommendation':'Explicitly\x20set\x20type_parameter\x20(inside\x20object:{...})\x20if\x20you\x20want\x20to\x20accept\x20non-WOW\x20tokens\x20(e.g.,\x20USDT,\x20ETH).'}];const RULE_INDEX=new Map(AUDIT_RULES['map'](a=>[a['id'],a]));export function auditService(a,b){const c=[],d=a?.['publish']===!![]&&typeof a?.['object']==='string';for(const e of AUDIT_RULES){try{if(d&&e['fields']&&!e['fields']['some'](g=>a[g]!==undefined))continue;!e['check'](a,b)&&c['push']({'rule_id':e['id'],'severity':e['severity'],'message':e['message'](a),'recommendation':e['recommendation']});}catch{}}return c;}export function hasBlockingErrors(a){return a['some'](b=>b['severity']==='error');}export function getErrors(a){return a['filter'](b=>b['severity']==='error');}export function getWarnings(a){return a['filter'](b=>b['severity']==='warning');}export function summarizeFindings(a){if(a['length']===0x0)return'All\x20audit\x20checks\x20passed.';const b=getErrors(a),c=getWarnings(a),d=a['filter'](g=>g['severity']==='info'),e=[];if(b['length']>0x0)e['push'](b['length']+'\x20error(s)');if(c['length']>0x0)e['push'](c['length']+'\x20warning(s)');if(d['length']>0x0)e['push'](d['length']+'\x20info');return'Audit:\x20'+e['join'](',\x20')+'.\x20Review\x20before\x20publishing.';}export const AUDIT_RULES_VERSION=0x3;
+import{MAX_INDEMNITY_MULTIPLE}from'./onchain-constants.js';import{lintForwardAmbiguity}from'./machine-topology.js';function numericAmount(a){if(typeof a==='number')return Number['isFinite'](a)?a:undefined;if(typeof a==='string'){const b=a['trim']();if(/^\d+$/['test'](b))return Number(b);}return undefined;}export function salesItemsOf(a){if(Array['isArray'](a?.['sales']))return a['sales'];if(Array['isArray'](a?.['sales']?.['sales']))return a['sales']['sales'];return[];}export function allocatorCountOf(a){const b=a?.['order_allocators'];if(Array['isArray'](b))return b['length'];if(Array['isArray'](b?.['allocators']))return b['allocators']['length'];return 0x0;}export function arbitrationRefsOf(b){const c=b?.['arbitrations'];if(Array['isArray'](c))return c['filter'](e=>typeof e==='string');if(Array['isArray'](c?.['objects']))return c['objects']['filter'](e=>typeof e==='string');return[];}export function compensationFundOf(a){if(a?.['compensation_fund_add']?.['balance']!=null)return a['compensation_fund_add']['balance'];if(a?.['compensation_fund']!=null)return a['compensation_fund'];return undefined;}export function serviceNameOf(a){if(typeof a?.['object']==='string')return a['object'];if(typeof a?.['object']?.['name']==='string'&&a['object']['name'])return a['object']['name'];if(typeof a?.['namedNew']?.['name']==='string'&&a['namedNew']['name'])return a['namedNew']['name'];return undefined;}export function typeParameterOf(a){if(typeof a?.['type_parameter']==='string'&&a['type_parameter'])return a['type_parameter'];if(typeof a?.['object']?.['type_parameter']==='string'&&a['object']['type_parameter'])return a['object']['type_parameter'];if(typeof a?.['namedNew']?.['type_parameter']==='string'&&a['namedNew']['type_parameter'])return a['namedNew']['type_parameter'];return undefined;}export const ANTI_PATTERN_NODE_REGEX=/(^|_)(disputed?|arbitration|arb)(_|$)|^(refund|refunded|deposit_refunded|deposit_deducted|cancel|cancelled)$/i;export function auditMachineNodes(a){const b=[],c=[];if(!Array['isArray'](a)||a['length']===0x0)return c['push']('pre_publish:\x20machine\x20node\x20set\x20unavailable\x20—\x20topology\x20not\x20verifiable;\x20'+'verify\x20via\x20machineNode2file\x20BEFORE\x20publish\x20(immutable\x20after\x20publish,\x20IMMUT-001)'),{'critical':b,'warnings':c};const d=a;for(const r of d){const s=typeof r?.['name']==='string'?r['name']:'';s&&ANTI_PATTERN_NODE_REGEX['test'](s)&&b['push']('R-M1-11:\x20machine\x20node\x20\x22'+s+'\x22\x20models\x20dispute/refund\x20flow\x20—\x20'+'refunds\x20must\x20route\x20via\x20an\x20Allocator\x20triggered\x20by\x20business\x20states,\x20'+'disputes\x20via\x20the\x20separate\x20Arbitration\x20object\x20(off-Machine)');}const e=new Set();for(const t of d){const u=typeof t?.['name']==='string'?t['name']:'';if(!u)continue;e['has'](u)&&b['push']('MC-C-04:\x20duplicate\x20machine\x20node\x20name\x20\x22'+u+'\x22\x20—\x20on-chain\x20will\x20reject\x20the\x20publish\x20transaction'),e['add'](u);}const g=d['some'](v=>Array['isArray'](v?.['pairs'])&&v['pairs']['some'](w=>w?.['prev_node']===''));!g&&b['push']('Machine\x20has\x20no\x20entry\x20pair\x20(prev_node=\x22\x22)\x20—\x20Progress\x20can\x20never\x20advance\x20'+'from\x20the\x20initial\x20state;\x20orders\x20are\x20permanently\x20stuck');const h=new Map();for(const v of d){const w=typeof v?.['name']==='string'?v['name']:'';if(!w)continue;if(!h['has'](w))h['set'](w,[]);for(const x of v?.['pairs']??[]){const y=x?.['prev_node'];if(typeof y==='string'&&y!==''){const z=h['get'](y);if(z)z['push'](w);else h['set'](y,[w]);}}}const i=0x0,j=0x1,k=0x2,l=new Map(),m=[],o=A=>{l['set'](A,j);for(const B of h['get'](A)??[]){const C=l['get'](B)??i;if(C===j)m['push'](A+'->'+B);else C===i&&o(B);}l['set'](A,k);};for(const A of h['keys']()){if((l['get'](A)??i)===i)o(A);}m['length']>0x0&&c['push']('pre_publish:\x20machine\x20contains\x20loop\x20back-edge(s)\x20'+m['join'](',\x20')+'\x20—\x20on-chain\x20a\x20revisit\x20'+'is\x20NOT\x20verified\x20to\x20re-fund\x20the\x20Allocation.\x20Every\x20renewal/loop\x20forward\x20MUST\x20carry\x20the\x20new-period\x20'+'payment\x20into\x20the\x20order\x20escrow\x20atomically\x20(create\x20the\x20period\x20payment,\x20receive\x20it\x20into\x20the\x20'+'allocation,\x20and\x20advance\x20the\x20progress\x20—\x20all\x20in\x20one\x20transaction),\x20or\x20the\x20loop\x20allows\x20zero-value\x20'+'re-delivery\x20cycles\x20(test/11\x20R2-F3).\x20'+'Recommended:\x20bind\x20a\x20fund-gate\x20Guard\x20on\x20the\x20loop\x20forward\x20(allocation\x20balance\x20>=\x20period\x20price)\x20—\x20'+'note\x20the\x20allocation.balance\x20query\x20is\x20not\x20yet\x20available\x20on-chain,\x20so\x20per-period\x20NEW\x20Orders\x20remain\x20'+'the\x20safe\x20default\x20for\x20long\x20subscriptions.');for(const B of d){const C=typeof B?.['name']==='string'?B['name']:'?';for(const D of B?.['pairs']??[]){for(const E of D?.['forwards']??[]){const F=E?.['namedOperator']!==undefined&&E?.['namedOperator']!==null,G=E?.['permissionIndex']!==undefined&&E?.['permissionIndex']!==null,H=E?.['guard']!==undefined&&E?.['guard']!==null;!F&&!G&&!H&&c['push']('pre_publish:\x20node\x20\x22'+C+'\x22\x20forward\x20\x22'+String(E?.['name']??'?')+'\x22\x20has\x20no\x20executor\x20binding\x20(namedOperator\x20/\x20permissionIndex\x20/\x20guard)\x20—\x20no\x20one\x20can\x20advance\x20it');}}}const q=lintForwardAmbiguity(a,'pre_publish');return b['push'](...q['critical']),c['push'](...q['warnings']),{'critical':b,'warnings':c};}export const AUDIT_RULES=[{'id':'audit_machine_bound','description':'Service\x20should\x20have\x20a\x20Machine\x20workflow\x20bound\x20before\x20publish','severity':'warning','fields':['machine'],'check':(a,b)=>{if(!a?.['publish'])return!![];return!!a?.['machine'];},'message':()=>'Publishing\x20a\x20service\x20without\x20a\x20Machine\x20workflow.\x20Customers\x20won\x27t\x20have\x20a\x20structured\x20order\x20process.','recommendation':'Create\x20a\x20Machine\x20(workflow\x20template)\x20and\x20bind\x20it\x20to\x20the\x20service\x20before\x20publishing.\x20The\x20machine\x20field\x20becomes\x20IMMUTABLE\x20after\x20publish.'},{'id':'audit_order_allocators','description':'Service\x20should\x20have\x20order_allocators\x20for\x20fund\x20distribution','severity':'warning','fields':['order_allocators'],'check':a=>{if(!a?.['publish'])return!![];return allocatorCountOf(a)>0x0;},'message':()=>'Publishing\x20a\x20service\x20without\x20order_allocators.\x20Order\x20funds\x20cannot\x20be\x20auto-distributed\x20to\x20suppliers.','recommendation':'Configure\x20order_allocators\x20before\x20publishing\x20—\x20this\x20field\x20becomes\x20IMMUTABLE\x20after\x20publish.'},{'id':'audit_buy_guard','description':'Service\x20should\x20have\x20a\x20buy_guard\x20for\x20customer\x20screening','severity':'info','fields':['buy_guard'],'check':a=>!!a?.['buy_guard'],'message':()=>'No\x20buy_guard\x20configured\x20—\x20anyone\x20can\x20purchase\x20this\x20service\x20without\x20verification.','recommendation':'Consider\x20adding\x20a\x20Guard\x20to\x20verify\x20customer\x20eligibility\x20(e.g.,\x20identity,\x20wallet\x20balance,\x20location).'},{'id':'audit_arb_alloc_boundary','description':'Arbitration\x20and\x20Allocator\x20coexist\x20→\x20surface\x20the\x20two-system\x20boundary\x20reminder','severity':'warning','fields':['arbitrations','compensation_fund_add','compensation_fund','order_allocators'],'check':a=>{if(!a?.['publish'])return!![];const b=arbitrationRefsOf(a)['length']>0x0||compensationFundOf(a)!==undefined;return!(b&&allocatorCountOf(a)>0x0);},'message':()=>'Arbitration\x20and\x20Allocator\x20are\x20INDEPENDENT\x20systems\x20by\x20design:\x20a\x20ruling\x20records\x20the\x20case\x20and\x20pays\x20from\x20the\x20service\x20compensation\x20fund\x20—\x20it\x20never\x20moves\x20escrow\x20and\x20never\x20advances\x20the\x20workflow.\x20With\x20both\x20configured,\x20a\x20buyer\x20can\x20receive\x20BOTH\x20the\x20arbitration\x20compensation\x20AND\x20a\x20full\x20escrow\x20refund\x20unless\x20the\x20refund/settlement\x20path\x20is\x20gated.\x20This\x20is\x20a\x20boundary\x20reminder,\x20not\x20a\x20defect\x20—\x20verify\x20the\x20coupling\x20check\x20was\x20done\x20deliberately.','recommendation':'Gate\x20the\x20refund/settlement\x20allocator\x27s\x20Guard\x20on\x20order.claimed_by\x20(read-only\x20cross-system\x20evidence\x20—\x20the\x20sanctioned\x20link),\x20or\x20hold\x20the\x20final\x20settlement\x20forward\x20until\x20the\x20case\x20closes.\x20Do\x20NOT\x20couple\x20the\x20systems\x20the\x20other\x20way\x20(no\x20dispute\x20state\x20on\x20the\x20order\x20flow,\x20no\x20workflow\x20step\x20into\x20arbitration):\x20coupling\x20opens\x20the\x20double-pay\x20path.\x20For\x20per-case\x20fund\x20actions,\x20the\x20deposit-reimbursement\x20pattern\x20(guard-design\x20patterns)\x20is\x20the\x20supported\x20route.'},{'id':'audit_compensation_fund','description':'Service\x20should\x20have\x20a\x20compensation_fund\x20for\x20trust','severity':'warning','fields':['compensation_fund_add','compensation_fund'],'check':a=>compensationFundOf(a)!==undefined,'message':()=>'No\x20compensation_fund\x20configured.\x20Customers\x20have\x20no\x20financial\x20protection\x20if\x20you\x20fail\x20to\x20deliver.','recommendation':'Deposit\x20via\x20compensation_fund_add\x20{balance}\x20to\x20enable\x20arbitration\x20payouts.\x20The\x20fund\x20deters\x20fraud\x20and\x20enables\x20arbitration\x20claims.'},{'id':'audit_arbitrations','description':'Service\x20should\x20have\x20arbitration\x20options\x20for\x20dispute\x20resolution','severity':'info','fields':['arbitrations'],'check':a=>arbitrationRefsOf(a)['length']>0x0,'message':()=>'No\x20arbitration\x20configured.\x20Disputes\x20cannot\x20be\x20resolved\x20through\x20a\x20third\x20party.','recommendation':'Add\x20at\x20least\x20one\x20Arbitration\x20object\x20via\x20arbitrations:{op:\x27add\x27,\x20objects:[...]}\x20to\x20enable\x20on-chain\x20dispute\x20resolution.'},{'id':'audit_arbitration_removal_strands_awards','description':'Removing\x20an\x20authorized\x20venue\x20can\x20strand\x20an\x20award\x20it\x20already\x20ruled\x20on','severity':'error','fields':['arbitrations'],'check':a=>{const b=a?.['arbitrations']?.['remove']??a?.['arbitrations']?.['clear'],c=Array['isArray'](b)?b['length']>0x0:a?.['arbitrations']?.['op']==='clear';if(!c)return!![];if(arbitrationRefsOf(a)['length']>0x0)return!![];return compensationFundOf(a)===undefined;},'message':a=>{const b=a?.['arbitrations']?.['clear']?'every\x20authorized\x20venue':'venue(s)\x20'+(a?.['arbitrations']?.['remove']??[])['join'](',\x20');return'Removing\x20'+b+'\x20while\x20a\x20compensation\x20fund\x20is\x20configured\x20makes\x20any\x20award\x20it\x20already\x20ruled\x20on\x20UNPAYABLE:\x20an\x20on-chain\x20payout\x20now\x20requires\x20the\x20deciding\x20venue\x20to\x20still\x20be\x20on\x20the\x20Service\x27s\x20allowlist,\x20so\x20paying\x20out\x20aborts\x20with\x20E_ARBITRATION_NOT_ALLOWED=39\x20and\x20the\x20escrowed\x20funds\x20stay\x20stranded.';},'recommendation':'Before\x20removing\x20a\x20venue,\x20confirm\x20no\x20case\x20it\x20ruled\x20on\x20is\x20still\x20awaiting\x20compensation\x20payout\x20(query\x20the\x20Arb\x20objects\x20for\x20status\x20Arbitrated,\x20not\x20Finished).\x20Add\x20the\x20replacement\x20venue\x20FIRST,\x20drain\x20the\x20old\x20venue\x27s\x20cases,\x20and\x20only\x20then\x20remove\x20it.\x20A\x20buyer\x20should\x20never\x20be\x20left\x20holding\x20an\x20uncollectable\x20award.'},{'id':'audit_price','description':'Service\x20should\x20have\x20at\x20least\x20one\x20priced\x20sale\x20item','severity':'error','fields':['sales'],'check':a=>{const b=salesItemsOf(a);if(b['length']===0x0)return!![];return b['some'](c=>c?.['price']!==undefined&&c?.['price']!==null);},'message':()=>'Sales\x20list\x20present\x20but\x20no\x20item\x20has\x20a\x20price.\x20Customers\x20cannot\x20place\x20orders\x20without\x20knowing\x20the\x20cost.','recommendation':'Set\x20price\x20on\x20each\x20sales\x20item\x20(smallest-unit\x20string\x20or\x20display\x20form\x20like\x20\x272.5WOW\x27).'},{'id':'audit_compensation_fund_covers_award_ceiling','description':'compensation_fund\x20must\x20cover\x20the\x203x\x20award\x20ceiling\x20of\x20the\x20largest\x20sale','severity':'warning','fields':['compensation_fund_add','compensation_fund','sales'],'check':a=>{if(!a?.['publish'])return!![];const b=compensationFundOf(a);if(b===undefined)return!![];const c=numericAmount(b);if(c===undefined)return!![];if(c===0x0)return![];const e=salesItemsOf(a)['map'](g=>numericAmount(g?.['price']))['filter'](g=>g!==undefined&&g>0x0);if(e['length']===0x0)return!![];const f=e['reduce']((g,h)=>g+h,0x0);return c>=MAX_INDEMNITY_MULTIPLE*f;},'message':()=>'compensation_fund\x20does\x20not\x20cover\x20the\x20award\x20ceiling.\x20An\x20award\x20is\x20hard-capped\x20at\x20'+MAX_INDEMNITY_MULTIPLE+'x\x20'+'the\x20order\x20amount\x20(arb.move\x20MAX_INDEMNITY_MULTIPLE,\x20enforced\x20at\x20ruling\x20time),\x20so\x20a\x20ruling\x20at\x20the\x20ceiling\x20'+'would\x20abort\x20the\x20buyer\x27s\x20claim\x20with\x2027\x20(E_COMPENSATION_NOT_MATCH)\x20—\x20the\x20ruling\x20stands\x20but\x20is\x20unpayable\x20'+'until\x20you\x20deposit,\x20and\x20the\x20abort\x20does\x20NOT\x20consume\x20the\x20claim.','recommendation':'Top\x20up\x20to\x20at\x20least\x20'+MAX_INDEMNITY_MULTIPLE+'x\x20your\x20largest\x20single\x20order\x20via\x20compensation_fund_add.\x20Above\x20'+(MAX_INDEMNITY_MULTIPLE+'x\x20is\x20optional:\x20it\x20only\x20buys\x20tolerance\x20for\x20several\x20CONCURRENT\x20claims\x20against\x20the\x20')+'one\x20per-Service\x20pool\x20(there\x20is\x20no\x20on-chain\x20concurrency\x20limit),\x20which\x20is\x20a\x20capital-allocation\x20choice.'},{'id':'audit_description','description':'Service\x20should\x20have\x20a\x20description','severity':'warning','fields':['description'],'check':a=>typeof a?.['description']==='string'&&a['description']['length']>0x0,'message':()=>'Service\x20has\x20no\x20description.\x20Customers\x20won\x27t\x20understand\x20what\x20you\x27re\x20offering.','recommendation':'Write\x20a\x20clear\x20description\x20of\x20the\x20service,\x20including\x20deliverables,\x20timelines,\x20and\x20terms.'},{'id':'audit_named_new_name','description':'Service\x20being\x20created\x20should\x20have\x20a\x20name','severity':'warning','check':a=>serviceNameOf(a)!==undefined,'message':()=>'Creating\x20a\x20service\x20without\x20a\x20name\x20makes\x20it\x20hard\x20to\x20reference\x20and\x20organize.','recommendation':'Set\x20object:{name:\x20...}\x20(or\x20namedNew.name)\x20following\x20the\x20convention:\x20<projectPrefix>_<service>_<purpose>.'},{'id':'audit_customer_required_needs_um','description':'customer_required\x20requires\x20a\x20Contact\x20bound\x20via\x20um\x20(SDK-enforced\x20hard\x20link;\x20mirrored\x20here)','severity':'error','fields':['customer_required','um'],'check':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];if(b['length']===0x0)return!![];return!!a?.['um'];},'message':()=>'customer_required\x20is\x20set\x20but\x20no\x20Contact\x20is\x20bound\x20via\x20um\x20—\x20customers\x20cannot\x20deliver\x20the\x20required\x20private\x20information\x20through\x20end-to-end\x20encrypted\x20Messenger.','recommendation':'Bind\x20um:{Contact\x20name/id}\x20in\x20the\x20same\x20call\x20(SDK\x20order_new\x20will\x20fail\x20the\x20buyer\x20otherwise).'},{'id':'audit_customer_required_is_declared_not_enforced','description':'customer_required\x20has\x20no\x20on-chain\x20enforcement\x20at\x20buy\x20time\x20—\x20a\x20Guard\x20must\x20gate\x20fulfilment','severity':'warning','fields':['customer_required'],'check':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];return b['length']===0x0;},'message':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];return'customer_required\x20('+b['length']+'\x20field(s):\x20'+b['join'](',\x20')+')\x20is\x20DECLARATIVE\x20ONLY:\x20the\x20on-chain\x20purchase\x20entry\x20never\x20reads\x20this\x20list,\x20so\x20an\x20order\x20that\x20supplies\x20none\x20of\x20these\x20fields\x20is\x20still\x20created\x20and\x20progresses.\x20Nothing\x20on-chain\x20will\x20stop\x20it.';},'recommendation':'Bind\x20pattern.required_info_evidence_gate\x20(schema_query\x20action=get_guard_design_patterns)\x20on\x20the\x20first\x20forward\x20that\x20needs\x20the\x20information:\x20query\x20\x27order.required_info\x20some\x27\x20(1572)\x20over\x20the\x20Order.\x20The\x20buyer\x20records\x20the\x20credential\x20via\x20order_required_info_update:\x20EITHER\x20the\x20merchant\x27s\x20IM\x20user\x20address\x20resolved\x20from\x20the\x20Service\x27s\x20Contact\x20(zero\x20cost,\x20address\x20record\x20only)\x20OR\x20an\x20on-chain\x20WTS\x20Proof\x20object\x20address\x20(embeds\x20the\x20merchant\x20IM\x20address\x20and\x20the\x20last-message\x20timestamp;\x20costs\x20gas,\x20publicly\x20verifiable).\x20\x27order.required_info\x27\x20(1573)\x20returns\x20the\x20recorded\x20address\x20but\x20aborts\x20while\x20nothing\x20is\x20recorded\x20—\x20gate\x20on\x201572\x20first.'},{'id':'audit_dangling_deps','description':'Service\x20dependencies\x20should\x20be\x20fully\x20created','severity':'error','check':(a,b)=>{if(!a?.['publish'])return!![];if(!b?.['graph'])return!![];const c=b['graph']['findDanglingDependencies']()??[];return c['length']===0x0;},'message':()=>'Service\x20references\x20objects\x20that\x20are\x20not\x20yet\x20created.\x20Publishing\x20will\x20lock\x20these\x20references.','recommendation':'Ensure\x20all\x20referenced\x20objects\x20(machine,\x20allocators,\x20guards)\x20are\x20created\x20and\x20finalized\x20before\x20publishing.'},{'id':'audit_type_parameter','description':'Service\x20should\x20have\x20a\x20token\x20type\x20specified','severity':'info','fields':['type_parameter','namedNew'],'check':a=>typeParameterOf(a)!==undefined,'message':()=>'No\x20payment\x20token\x20type\x20specified.\x20Defaulting\x20to\x20WOW\x20(0x2::wow::WOW).','recommendation':'Explicitly\x20set\x20type_parameter\x20(inside\x20object:{...})\x20if\x20you\x20want\x20to\x20accept\x20non-WOW\x20tokens\x20(e.g.,\x20USDT,\x20ETH).'}];const RULE_INDEX=new Map(AUDIT_RULES['map'](a=>[a['id'],a]));function readSeverityOverrides(){try{const {getJudgmentDoc:a}=require('../config/judgment.js');if(typeof a!=='function')return{};const b=a()?.['rules']?.['domains'];if(!b||typeof b!=='object')return{};const c={};for(const d of Object['values'](b)){const e=d?.['severity_overrides'];if(!e||typeof e!=='object')continue;for(const [f,g]of Object['entries'](e)){if(g==='error'||g==='warning'||g==='info')c[f]=g;}}return c;}catch{return{};}}export function auditService(a,b){const c=[],d=a?.['publish']===!![]&&typeof a?.['object']==='string',e=readSeverityOverrides();for(const f of AUDIT_RULES){try{if(d&&f['fields']&&!f['fields']['some'](g=>a[g]!==undefined))continue;!f['check'](a,b)&&c['push']({'rule_id':f['id'],'severity':e[f['id']]??f['severity'],'message':f['message'](a),'recommendation':f['recommendation']});}catch{}}return c;}export function hasBlockingErrors(a){return a['some'](b=>b['severity']==='error');}export function getErrors(a){return a['filter'](b=>b['severity']==='error');}export function getWarnings(a){return a['filter'](b=>b['severity']==='warning');}export function summarizeFindings(a){if(a['length']===0x0)return'All\x20audit\x20checks\x20passed.';const b=getErrors(a),c=getWarnings(a),d=a['filter'](g=>g['severity']==='info'),e=[];if(b['length']>0x0)e['push'](b['length']+'\x20error(s)');if(c['length']>0x0)e['push'](c['length']+'\x20warning(s)');if(d['length']>0x0)e['push'](d['length']+'\x20info');return'Audit:\x20'+e['join'](',\x20')+'.\x20Review\x20before\x20publishing.';}export const AUDIT_RULES_VERSION=0x5;

package/dist/knowledge/baselines/rules/allocation.json

@@ -1,5 +1,5 @@
 {
-  "comment": "Allocation rule pack (R-A) — declarative form of the retired in-code Allocation risk rules. Facts are produced by the kernel extractor (allocation-risk.ts, bound to the allocation-ledger constants and the canonical recipient-constraint doctrine); rules only reference fact names. First-offender walks (empty sharing, rate/amount violations, weak guards) are sunk into the extractor. Levels/wording can be retuned per rule and rules can be disabled (enabled=false, trace left) via the judgment document — factory rules can never be deleted or invented here.",
+  "comment": "Allocation rule pack (R-A) — declarative form of the retired in-code Allocation risk rules. Facts are produced by the kernel extractor (allocation-risk.ts, bound to the allocation-ledger constants and the canonical recipient-constraint doctrine); rules only reference fact names. First-offender walks (empty sharing, rate/amount violations, weak guards) are sunk into the extractor. Levels/wording can be retuned per rule and rules can be disabled (enabled=false, trace left) via the judgment document — factory rules can never be deleted or invented here. RETRACTION (2026-10-06): R-RECIPIENT-03 previously cited `const ERECIPIENT_ZERO_ENTITY: u64 = 20` at allocation.move:64-67, asserted at allocation.move:259-268, as verbatim Move source. That quote was FABRICATED — `grep ERECIPIENT_ZERO_ENTITY` over all of D:\\wowok\\wow returns 0 .move hits and git history never contained it; the real const E* block is allocation.move:22-62 + :75 and occupies 1..19 with no 20. The rule text below now cites the verified coordinates. Do not restore the constant or the error-code parity claim.",
   "facts": {
     "allocators_config_present": "An allocators_config block is present in the context.",
     "allocators_count": "Number of allocators in allocators_config (undefined when the block is absent).",
@@ -35,6 +35,10 @@
     "guard_id_bad_identifier": "First GuardIdentifier recipient whose Passport table entry is known and not address-typed (undefined when none).",
     "guard_id_bad_type": "Declared Passport table type of the offending identifier.",
     "guard_id_bad_index": "Allocator index carrying the offending GuardIdentifier recipient.",
+    "entity_recipient_bad_count": "Number of sharing rows whose Entity recipient is unusable — empty/omitted name_or_address, a literal zero address, or (when the caller supplies builder_address) the deploying account. Judged by the shared guard (entity-recipient-guard.ts, R-RECIPIENT-03); 0 when the table carries no Entity row or carries none that is unusable.",
+    "entity_recipient_bad_count_display": "Rendered entity_recipient_bad_count ('0' when none) for evidence display.",
+    "entity_recipient_bad_rows_csv_sp": "Offending rows as 'Allocator[<i>].sharing[<j>] (<reason>)' joined with ', ' (description display form; undefined when none).",
+    "entity_recipient_bad_rows_csv": "Offending rows as 'Allocator[<i>].sharing[<j>] (<reason>)' joined with ',' (evidence display form; undefined when none).",
     "duplicate_guards_present": "Two or more allocators reference the same Guard object address.",
     "allocators_total": "Total allocator count (duplicate scan).",
     "allocators_unique": "Unique Guard address count (duplicate scan).",
@@ -518,6 +522,32 @@
           "stakeholders": ["owner"]
         }
       ]
+    },
+    {
+      "rule_id": "R-RECIPIENT-03",
+      "dimension": "semantic",
+      "trigger": "A sharing row pays an Entity recipient whose name_or_address is omitted, blank, the literal zero address, or the deploying account",
+      "cases": [
+        {
+          "when": { "field": "entity_recipient_bad_count", "op": "gte", "value": 1 },
+          "level": "critical",
+          "title": "${entity_recipient_bad_count_display} sharing row(s) pay an unnamed Entity — the share goes to the DEPLOYING ACCOUNT: ${entity_recipient_bad_rows_csv_sp}",
+          "description": "Offending sharing row(s): ${entity_recipient_bad_rows_csv_sp}. A recipient row reading { who: { Entity: { name_or_address: \"\" } } } (or with the key omitted entirely) is NOT a no-op: the SDK resolver substitutes the DEFAULT LOCAL ACCOUNT before the address ever reaches Move, so the order escrow pays the account that ran the deploy instead of any intended third party. There is no on-chain defence at all: allocation.move:250-255 swallows Recipient::Entity in a (_) catch-all at allocator_add, and allocation.move:451-453 / :514 forward the raw address to payment::new at payout, so the chain accepts ANY Entity address and a degenerate one silently burns the share permanently. DIRECT-SALES INVARIANT (verbatim, shared with the tool-constraint layer and the pre-call gate): WoWok is DIRECT SALES: the merchant pays gas only and there is NO platform commission, so no allocator sharing row may pay the deploying account. An omitted / empty / unresolved Entity recipient is NOT a no-op — the SDK resolves it to the DEFAULT LOCAL ACCOUNT (ts-sdk/packages/wowok/src/w/local/index.ts:89-91 -> Account.Instance().get_address(undefined)), so the share silently leaves the escrow to whoever ran the deploy. AUDIT INVARIANT: any allocator sharing item resolving to the platform/builder entity with a non-zero share is an ERROR under direct-sales. Under direct sales there is no platform to pay, so an unnamed Entity row is never legitimate.",
+          "scenario": "A sharing row is authored with a blank, omitted, zero, or builder-equivalent Entity recipient — typically a placeholder the author intended to fill in, or a 'platform' leg copied from an incumbent marketplace split that this protocol has no recipient for.",
+          "mitigation": "WoWok is DIRECT SALES: the merchant pays gas only and there is NO platform commission, so no allocator sharing row may pay the deploying account. An omitted / empty / unresolved Entity recipient is NOT a no-op — the SDK resolves it to the DEFAULT LOCAL ACCOUNT (ts-sdk/packages/wowok/src/w/local/index.ts:89-91 -> Account.Instance().get_address(undefined)), so the share silently leaves the escrow to whoever ran the deploy. AUDIT INVARIANT: any allocator sharing item resolving to the platform/builder entity with a non-zero share is an ERROR under direct-sales. How to fix the allocator table: (a) the merchant keeps the WHOLE sale — ONE sharing row { who: { GuardIdentifier: 0 }, sharing: 10000, mode: \"Rate\" }, the refund track anchored via payment_info.for_object so only the order owner can receive it; (b) a GENUINE third party must be an EXPLICIT, non-empty Entity the buyer can see BEFORE ordering — { who: { Entity: { name_or_address: \"<mark_name_or_0x_address>\" } } }; (c) NEVER use { Signer: \"signer\" } for a refund — it pays tx_context::sender, i.e. whoever runs the alloc() call; (d) order_allocators is PERMANENTLY IMMUTABLE after publish (no pause+lock escape), so fix the recipient table BEFORE publish, not after.",
+          "evidence": "badRows=${entity_recipient_bad_rows_csv}, count=${entity_recipient_bad_count_display}",
+          "stakeholders": ["owner", "recipient", "service_provider"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "The buyer's escrowed order funds are the pool being drained: a share routed to the deploying account is money the buyer paid that never reaches the party the template named, and no receipt, constraint, or audit trail distinguishes it from a legitimate payout." },
+              { "role": "merchant", "basis": "A third-party share (supplier, orchestrator, arbitrator fee) credited to the deploying account inflates the merchant's own take while the genuine recipient is unpaid — the ledger a buyer reads before ordering no longer matches where the money lands." }
+            ],
+            "gain_paths": [
+              { "role": "collaborator", "path": "Whoever holds the DEFAULT LOCAL ACCOUNT at deploy time (the deploying account) receives the unnamed share verbatim, because the SDK resolves the blank Entity to that account and the chain records it as a plain Recipient::Entity payout.", "viability": "viable", "gate": "Direct-pay and unconditional: nothing in Move distinguishes a substituted recipient from an authored one. allocation.move:250-255 matches only Recipient::GuardIdentifier and lets Recipient::Entity fall through a (_) catch-all, and allocation.move:451-453 / :514 forward the raw address to payment::new with no check at all — so there is no chain-side assertion left to fire." }
+            ]
+          }
+        }
+      ]
     }
   ]
 }

package/dist/knowledge/builtin-templates.d.ts

@@ -19,9 +19,11 @@ export interface ArchetypeTemplate {
     user_inputs: string[];
     key_risk: string;
     build_notes: string[];
+    payment_model?: "milestone" | "subscription" | "escrow";
+    arbitration_mode?: "none" | "merchant_pick" | "mutual_pick" | "third_party";
     time_anchors?: Record<string, string>;
 }
-export declare const BUILTIN_TEMPLATES_VERSION = 17;
+export declare const BUILTIN_TEMPLATES_VERSION = 21;
 export declare const BUILTIN_TEMPLATES: ArchetypeTemplate[];
 export declare const TEMPLATE_KEYWORDS: Record<string, string[]>;
 export declare function getBuiltinTemplate(id: string): ArchetypeTemplate | undefined;