@wowok/agent-mcp 3.2.4 → 3.2.6

package/dist/knowledge/audit-rules.js

@@ -1 +1 @@
-import{MAX_INDEMNITY_MULTIPLE}from'./onchain-constants.js';import{lintForwardAmbiguity}from'./machine-topology.js';function numericAmount(a){if(typeof a==='number')return Number['isFinite'](a)?a:undefined;if(typeof a==='string'){const b=a['trim']();if(/^\d+$/['test'](b))return Number(b);}return undefined;}export function salesItemsOf(a){if(Array['isArray'](a?.['sales']))return a['sales'];if(Array['isArray'](a?.['sales']?.['sales']))return a['sales']['sales'];return[];}export function allocatorCountOf(a){const b=a?.['order_allocators'];if(Array['isArray'](b))return b['length'];if(Array['isArray'](b?.['allocators']))return b['allocators']['length'];return 0x0;}export function arbitrationRefsOf(b){const c=b?.['arbitrations'];if(Array['isArray'](c))return c['filter'](e=>typeof e==='string');if(Array['isArray'](c?.['objects']))return c['objects']['filter'](e=>typeof e==='string');return[];}export function compensationFundOf(a){if(a?.['compensation_fund_add']?.['balance']!=null)return a['compensation_fund_add']['balance'];if(a?.['compensation_fund']!=null)return a['compensation_fund'];return undefined;}export function serviceNameOf(a){if(typeof a?.['object']==='string')return a['object'];if(typeof a?.['object']?.['name']==='string'&&a['object']['name'])return a['object']['name'];if(typeof a?.['namedNew']?.['name']==='string'&&a['namedNew']['name'])return a['namedNew']['name'];return undefined;}export function typeParameterOf(a){if(typeof a?.['type_parameter']==='string'&&a['type_parameter'])return a['type_parameter'];if(typeof a?.['object']?.['type_parameter']==='string'&&a['object']['type_parameter'])return a['object']['type_parameter'];if(typeof a?.['namedNew']?.['type_parameter']==='string'&&a['namedNew']['type_parameter'])return a['namedNew']['type_parameter'];return undefined;}export const ANTI_PATTERN_NODE_REGEX=/(^|_)(disputed?|arbitration|arb)(_|$)|^(refund|refunded|deposit_refunded|deposit_deducted|cancel|cancelled)$/i;export function auditMachineNodes(a){const b=[],c=[];if(!Array['isArray'](a)||a['length']===0x0)return c['push']('pre_publish:\x20machine\x20node\x20set\x20unavailable\x20—\x20topology\x20not\x20verifiable;\x20'+'verify\x20via\x20machineNode2file\x20BEFORE\x20publish\x20(immutable\x20after\x20publish,\x20IMMUT-001)'),{'critical':b,'warnings':c};const d=a;for(const r of d){const s=typeof r?.['name']==='string'?r['name']:'';s&&ANTI_PATTERN_NODE_REGEX['test'](s)&&b['push']('R-M1-11:\x20machine\x20node\x20\x22'+s+'\x22\x20models\x20dispute/refund\x20flow\x20—\x20'+'refunds\x20must\x20route\x20via\x20an\x20Allocator\x20triggered\x20by\x20business\x20states,\x20'+'disputes\x20via\x20the\x20separate\x20Arbitration\x20object\x20(off-Machine)');}const e=new Set();for(const t of d){const u=typeof t?.['name']==='string'?t['name']:'';if(!u)continue;e['has'](u)&&b['push']('MC-C-04:\x20duplicate\x20machine\x20node\x20name\x20\x22'+u+'\x22\x20—\x20on-chain\x20will\x20reject\x20the\x20publish\x20transaction'),e['add'](u);}const g=d['some'](v=>Array['isArray'](v?.['pairs'])&&v['pairs']['some'](w=>w?.['prev_node']===''));!g&&b['push']('Machine\x20has\x20no\x20entry\x20pair\x20(prev_node=\x22\x22)\x20—\x20Progress\x20can\x20never\x20advance\x20'+'from\x20the\x20initial\x20state;\x20orders\x20are\x20permanently\x20stuck');const h=new Map();for(const v of d){const w=typeof v?.['name']==='string'?v['name']:'';if(!w)continue;if(!h['has'](w))h['set'](w,[]);for(const x of v?.['pairs']??[]){const y=x?.['prev_node'];if(typeof y==='string'&&y!==''){const z=h['get'](y);if(z)z['push'](w);else h['set'](y,[w]);}}}const i=0x0,j=0x1,k=0x2,l=new Map(),m=[],o=A=>{l['set'](A,j);for(const B of h['get'](A)??[]){const C=l['get'](B)??i;if(C===j)m['push'](A+'->'+B);else C===i&&o(B);}l['set'](A,k);};for(const A of h['keys']()){if((l['get'](A)??i)===i)o(A);}m['length']>0x0&&c['push']('pre_publish:\x20machine\x20contains\x20loop\x20back-edge(s)\x20'+m['join'](',\x20')+'\x20—\x20on-chain\x20a\x20revisit\x20'+'is\x20NOT\x20verified\x20to\x20re-fund\x20the\x20Allocation.\x20Every\x20renewal/loop\x20forward\x20MUST\x20carry\x20the\x20new-period\x20'+'payment\x20into\x20the\x20order\x20escrow\x20atomically\x20(create\x20the\x20period\x20payment,\x20receive\x20it\x20into\x20the\x20'+'allocation,\x20and\x20advance\x20the\x20progress\x20—\x20all\x20in\x20one\x20transaction),\x20or\x20the\x20loop\x20allows\x20zero-value\x20'+'re-delivery\x20cycles\x20(test/11\x20R2-F3).\x20'+'Recommended:\x20bind\x20a\x20fund-gate\x20Guard\x20on\x20the\x20loop\x20forward\x20(allocation\x20balance\x20>=\x20period\x20price)\x20—\x20'+'note\x20the\x20allocation.balance\x20query\x20is\x20not\x20yet\x20available\x20on-chain,\x20so\x20per-period\x20NEW\x20Orders\x20remain\x20'+'the\x20safe\x20default\x20for\x20long\x20subscriptions.');for(const B of d){const C=typeof B?.['name']==='string'?B['name']:'?';for(const D of B?.['pairs']??[]){for(const E of D?.['forwards']??[]){const F=E?.['namedOperator']!==undefined&&E?.['namedOperator']!==null,G=E?.['permissionIndex']!==undefined&&E?.['permissionIndex']!==null,H=E?.['guard']!==undefined&&E?.['guard']!==null;!F&&!G&&!H&&c['push']('pre_publish:\x20node\x20\x22'+C+'\x22\x20forward\x20\x22'+String(E?.['name']??'?')+'\x22\x20has\x20no\x20executor\x20binding\x20(namedOperator\x20/\x20permissionIndex\x20/\x20guard)\x20—\x20no\x20one\x20can\x20advance\x20it');}}}const q=lintForwardAmbiguity(a,'pre_publish');return b['push'](...q['critical']),c['push'](...q['warnings']),{'critical':b,'warnings':c};}export const AUDIT_RULES=[{'id':'audit_machine_bound','description':'Service\x20should\x20have\x20a\x20Machine\x20workflow\x20bound\x20before\x20publish','severity':'warning','fields':['machine'],'check':(a,b)=>{if(!a?.['publish'])return!![];return!!a?.['machine'];},'message':()=>'Publishing\x20a\x20service\x20without\x20a\x20Machine\x20workflow.\x20Customers\x20won\x27t\x20have\x20a\x20structured\x20order\x20process.','recommendation':'Create\x20a\x20Machine\x20(workflow\x20template)\x20and\x20bind\x20it\x20to\x20the\x20service\x20before\x20publishing.\x20The\x20machine\x20field\x20becomes\x20IMMUTABLE\x20after\x20publish.'},{'id':'audit_order_allocators','description':'Service\x20should\x20have\x20order_allocators\x20for\x20fund\x20distribution','severity':'warning','fields':['order_allocators'],'check':a=>{if(!a?.['publish'])return!![];return allocatorCountOf(a)>0x0;},'message':()=>'Publishing\x20a\x20service\x20without\x20order_allocators.\x20Order\x20funds\x20cannot\x20be\x20auto-distributed\x20to\x20suppliers.','recommendation':'Configure\x20order_allocators\x20before\x20publishing\x20—\x20this\x20field\x20becomes\x20IMMUTABLE\x20after\x20publish.'},{'id':'audit_buy_guard','description':'Service\x20should\x20have\x20a\x20buy_guard\x20for\x20customer\x20screening','severity':'info','fields':['buy_guard'],'check':a=>!!a?.['buy_guard'],'message':()=>'No\x20buy_guard\x20configured\x20—\x20anyone\x20can\x20purchase\x20this\x20service\x20without\x20verification.','recommendation':'Consider\x20adding\x20a\x20Guard\x20to\x20verify\x20customer\x20eligibility\x20(e.g.,\x20identity,\x20wallet\x20balance,\x20location).'},{'id':'audit_arb_alloc_boundary','description':'Arbitration\x20and\x20Allocator\x20coexist\x20→\x20surface\x20the\x20two-system\x20boundary\x20reminder','severity':'warning','fields':['arbitrations','compensation_fund_add','compensation_fund','order_allocators'],'check':a=>{if(!a?.['publish'])return!![];const b=arbitrationRefsOf(a)['length']>0x0||compensationFundOf(a)!==undefined;return!(b&&allocatorCountOf(a)>0x0);},'message':()=>'Arbitration\x20and\x20Allocator\x20are\x20INDEPENDENT\x20systems\x20by\x20design:\x20a\x20ruling\x20records\x20the\x20case\x20and\x20pays\x20from\x20the\x20service\x20compensation\x20fund\x20—\x20it\x20never\x20moves\x20escrow\x20and\x20never\x20advances\x20the\x20workflow.\x20With\x20both\x20configured,\x20a\x20buyer\x20can\x20receive\x20BOTH\x20the\x20arbitration\x20compensation\x20AND\x20a\x20full\x20escrow\x20refund\x20unless\x20the\x20refund/settlement\x20path\x20is\x20gated.\x20This\x20is\x20a\x20boundary\x20reminder,\x20not\x20a\x20defect\x20—\x20verify\x20the\x20coupling\x20check\x20was\x20done\x20deliberately.','recommendation':'Gate\x20the\x20refund/settlement\x20allocator\x27s\x20Guard\x20on\x20order.claimed_by\x20(read-only\x20cross-system\x20evidence\x20—\x20the\x20sanctioned\x20link),\x20or\x20hold\x20the\x20final\x20settlement\x20forward\x20until\x20the\x20case\x20closes.\x20Do\x20NOT\x20couple\x20the\x20systems\x20the\x20other\x20way\x20(no\x20dispute\x20state\x20on\x20the\x20order\x20flow,\x20no\x20workflow\x20step\x20into\x20arbitration):\x20coupling\x20opens\x20the\x20double-pay\x20path.\x20For\x20per-case\x20fund\x20actions,\x20the\x20deposit-reimbursement\x20pattern\x20(guard-design\x20patterns)\x20is\x20the\x20supported\x20route.'},{'id':'audit_compensation_fund','description':'Service\x20should\x20have\x20a\x20compensation_fund\x20for\x20trust','severity':'warning','fields':['compensation_fund_add','compensation_fund'],'check':a=>compensationFundOf(a)!==undefined,'message':()=>'No\x20compensation_fund\x20configured.\x20Customers\x20have\x20no\x20financial\x20protection\x20if\x20you\x20fail\x20to\x20deliver.','recommendation':'Deposit\x20via\x20compensation_fund_add\x20{balance}\x20to\x20enable\x20arbitration\x20payouts.\x20The\x20fund\x20deters\x20fraud\x20and\x20enables\x20arbitration\x20claims.'},{'id':'audit_arbitrations','description':'Service\x20should\x20have\x20arbitration\x20options\x20for\x20dispute\x20resolution','severity':'info','fields':['arbitrations'],'check':a=>arbitrationRefsOf(a)['length']>0x0,'message':()=>'No\x20arbitration\x20configured.\x20Disputes\x20cannot\x20be\x20resolved\x20through\x20a\x20third\x20party.','recommendation':'Add\x20at\x20least\x20one\x20Arbitration\x20object\x20via\x20arbitrations:{op:\x27add\x27,\x20objects:[...]}\x20to\x20enable\x20on-chain\x20dispute\x20resolution.'},{'id':'audit_arbitration_removal_strands_awards','description':'Removing\x20an\x20authorized\x20venue\x20can\x20strand\x20an\x20award\x20it\x20already\x20ruled\x20on','severity':'error','fields':['arbitrations'],'check':a=>{const b=a?.['arbitrations']?.['remove']??a?.['arbitrations']?.['clear'],c=Array['isArray'](b)?b['length']>0x0:a?.['arbitrations']?.['op']==='clear';if(!c)return!![];if(arbitrationRefsOf(a)['length']>0x0)return!![];return compensationFundOf(a)===undefined;},'message':a=>{const b=a?.['arbitrations']?.['clear']?'every\x20authorized\x20venue':'venue(s)\x20'+(a?.['arbitrations']?.['remove']??[])['join'](',\x20');return'Removing\x20'+b+'\x20while\x20a\x20compensation\x20fund\x20is\x20configured\x20makes\x20any\x20award\x20it\x20already\x20ruled\x20on\x20UNPAYABLE:\x20an\x20on-chain\x20payout\x20now\x20requires\x20the\x20deciding\x20venue\x20to\x20still\x20be\x20on\x20the\x20Service\x27s\x20allowlist,\x20so\x20paying\x20out\x20aborts\x20with\x20E_ARBITRATION_NOT_ALLOWED=39\x20and\x20the\x20escrowed\x20funds\x20stay\x20stranded.';},'recommendation':'Before\x20removing\x20a\x20venue,\x20confirm\x20no\x20case\x20it\x20ruled\x20on\x20is\x20still\x20awaiting\x20compensation\x20payout\x20(query\x20the\x20Arb\x20objects\x20for\x20status\x20Arbitrated,\x20not\x20Finished).\x20Add\x20the\x20replacement\x20venue\x20FIRST,\x20drain\x20the\x20old\x20venue\x27s\x20cases,\x20and\x20only\x20then\x20remove\x20it.\x20A\x20buyer\x20should\x20never\x20be\x20left\x20holding\x20an\x20uncollectable\x20award.'},{'id':'audit_price','description':'Service\x20should\x20have\x20at\x20least\x20one\x20priced\x20sale\x20item','severity':'error','fields':['sales'],'check':a=>{const b=salesItemsOf(a);if(b['length']===0x0)return!![];return b['some'](c=>c?.['price']!==undefined&&c?.['price']!==null);},'message':()=>'Sales\x20list\x20present\x20but\x20no\x20item\x20has\x20a\x20price.\x20Customers\x20cannot\x20place\x20orders\x20without\x20knowing\x20the\x20cost.','recommendation':'Set\x20price\x20on\x20each\x20sales\x20item\x20(smallest-unit\x20string\x20or\x20display\x20form\x20like\x20\x272.5WOW\x27).'},{'id':'audit_compensation_fund_covers_award_ceiling','description':'compensation_fund\x20must\x20cover\x20the\x203x\x20award\x20ceiling\x20of\x20the\x20largest\x20sale','severity':'warning','fields':['compensation_fund_add','compensation_fund','sales'],'check':a=>{if(!a?.['publish'])return!![];const b=compensationFundOf(a);if(b===undefined)return!![];const c=numericAmount(b);if(c===undefined)return!![];if(c===0x0)return![];const e=salesItemsOf(a)['map'](g=>numericAmount(g?.['price']))['filter'](g=>g!==undefined&&g>0x0);if(e['length']===0x0)return!![];const f=e['reduce']((g,h)=>g+h,0x0);return c>=MAX_INDEMNITY_MULTIPLE*f;},'message':()=>'compensation_fund\x20does\x20not\x20cover\x20the\x20award\x20ceiling.\x20An\x20award\x20is\x20hard-capped\x20at\x20'+MAX_INDEMNITY_MULTIPLE+'x\x20'+'the\x20order\x20amount\x20(arb.move\x20MAX_INDEMNITY_MULTIPLE,\x20enforced\x20at\x20ruling\x20time),\x20so\x20a\x20ruling\x20at\x20the\x20ceiling\x20'+'would\x20abort\x20the\x20buyer\x27s\x20claim\x20with\x2027\x20(E_COMPENSATION_NOT_MATCH)\x20—\x20the\x20ruling\x20stands\x20but\x20is\x20unpayable\x20'+'until\x20you\x20deposit,\x20and\x20the\x20abort\x20does\x20NOT\x20consume\x20the\x20claim.','recommendation':'Top\x20up\x20to\x20at\x20least\x20'+MAX_INDEMNITY_MULTIPLE+'x\x20your\x20largest\x20single\x20order\x20via\x20compensation_fund_add.\x20Above\x20'+(MAX_INDEMNITY_MULTIPLE+'x\x20is\x20optional:\x20it\x20only\x20buys\x20tolerance\x20for\x20several\x20CONCURRENT\x20claims\x20against\x20the\x20')+'one\x20per-Service\x20pool\x20(there\x20is\x20no\x20on-chain\x20concurrency\x20limit),\x20which\x20is\x20a\x20capital-allocation\x20choice.'},{'id':'audit_description','description':'Service\x20should\x20have\x20a\x20description','severity':'warning','fields':['description'],'check':a=>typeof a?.['description']==='string'&&a['description']['length']>0x0,'message':()=>'Service\x20has\x20no\x20description.\x20Customers\x20won\x27t\x20understand\x20what\x20you\x27re\x20offering.','recommendation':'Write\x20a\x20clear\x20description\x20of\x20the\x20service,\x20including\x20deliverables,\x20timelines,\x20and\x20terms.'},{'id':'audit_named_new_name','description':'Service\x20being\x20created\x20should\x20have\x20a\x20name','severity':'warning','check':a=>serviceNameOf(a)!==undefined,'message':()=>'Creating\x20a\x20service\x20without\x20a\x20name\x20makes\x20it\x20hard\x20to\x20reference\x20and\x20organize.','recommendation':'Set\x20object:{name:\x20...}\x20(or\x20namedNew.name)\x20following\x20the\x20convention:\x20<projectPrefix>_<service>_<purpose>.'},{'id':'audit_customer_required_needs_um','description':'customer_required\x20requires\x20a\x20Contact\x20bound\x20via\x20um\x20(SDK-enforced\x20hard\x20link;\x20mirrored\x20here)','severity':'error','fields':['customer_required','um'],'check':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];if(b['length']===0x0)return!![];return!!a?.['um'];},'message':()=>'customer_required\x20is\x20set\x20but\x20no\x20Contact\x20is\x20bound\x20via\x20um\x20—\x20customers\x20cannot\x20deliver\x20the\x20required\x20private\x20information\x20through\x20end-to-end\x20encrypted\x20Messenger.','recommendation':'Bind\x20um:{Contact\x20name/id}\x20in\x20the\x20same\x20call\x20(SDK\x20order_new\x20will\x20fail\x20the\x20buyer\x20otherwise).'},{'id':'audit_customer_required_is_declared_not_enforced','description':'customer_required\x20has\x20no\x20on-chain\x20enforcement\x20at\x20buy\x20time\x20—\x20a\x20Guard\x20must\x20gate\x20fulfilment','severity':'warning','fields':['customer_required'],'check':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];return b['length']===0x0;},'message':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];return'customer_required\x20('+b['length']+'\x20field(s):\x20'+b['join'](',\x20')+')\x20is\x20DECLARATIVE\x20ONLY:\x20the\x20on-chain\x20purchase\x20entry\x20never\x20reads\x20this\x20list,\x20so\x20an\x20order\x20that\x20supplies\x20none\x20of\x20these\x20fields\x20is\x20still\x20created\x20and\x20progresses.\x20Nothing\x20on-chain\x20will\x20stop\x20it.';},'recommendation':'Bind\x20pattern.required_info_evidence_gate\x20(schema_query\x20action=get_guard_design_patterns)\x20on\x20the\x20first\x20forward\x20that\x20needs\x20the\x20information:\x20query\x20\x27order.required_info\x20some\x27\x20(1572)\x20over\x20the\x20Order.\x20The\x20buyer\x20records\x20the\x20credential\x20via\x20order_required_info_update:\x20EITHER\x20the\x20merchant\x27s\x20IM\x20user\x20address\x20resolved\x20from\x20the\x20Service\x27s\x20Contact\x20(zero\x20cost,\x20address\x20record\x20only)\x20OR\x20an\x20on-chain\x20WTS\x20Proof\x20object\x20address\x20(embeds\x20the\x20merchant\x20IM\x20address\x20and\x20the\x20last-message\x20timestamp;\x20costs\x20gas,\x20publicly\x20verifiable).\x20\x27order.required_info\x27\x20(1573)\x20returns\x20the\x20recorded\x20address\x20but\x20aborts\x20while\x20nothing\x20is\x20recorded\x20—\x20gate\x20on\x201572\x20first.'},{'id':'audit_dangling_deps','description':'Service\x20dependencies\x20should\x20be\x20fully\x20created','severity':'error','check':(a,b)=>{if(!a?.['publish'])return!![];if(!b?.['graph'])return!![];const c=b['graph']['findDanglingDependencies']()??[];return c['length']===0x0;},'message':()=>'Service\x20references\x20objects\x20that\x20are\x20not\x20yet\x20created.\x20Publishing\x20will\x20lock\x20these\x20references.','recommendation':'Ensure\x20all\x20referenced\x20objects\x20(machine,\x20allocators,\x20guards)\x20are\x20created\x20and\x20finalized\x20before\x20publishing.'},{'id':'audit_type_parameter','description':'Service\x20should\x20have\x20a\x20token\x20type\x20specified','severity':'info','fields':['type_parameter','namedNew'],'check':a=>typeParameterOf(a)!==undefined,'message':()=>'No\x20payment\x20token\x20type\x20specified.\x20Defaulting\x20to\x20WOW\x20(0x2::wow::WOW).','recommendation':'Explicitly\x20set\x20type_parameter\x20(inside\x20object:{...})\x20if\x20you\x20want\x20to\x20accept\x20non-WOW\x20tokens\x20(e.g.,\x20USDT,\x20ETH).'}];const RULE_INDEX=new Map(AUDIT_RULES['map'](a=>[a['id'],a]));function readSeverityOverrides(){try{const {getJudgmentDoc:a}=require('../config/judgment.js');if(typeof a!=='function')return{};const b=a()?.['rules']?.['domains'];if(!b||typeof b!=='object')return{};const c={};for(const d of Object['values'](b)){const e=d?.['severity_overrides'];if(!e||typeof e!=='object')continue;for(const [f,g]of Object['entries'](e)){if(g==='error'||g==='warning'||g==='info')c[f]=g;}}return c;}catch{return{};}}export function auditService(a,b){const c=[],d=a?.['publish']===!![]&&typeof a?.['object']==='string',e=readSeverityOverrides();for(const f of AUDIT_RULES){try{if(d&&f['fields']&&!f['fields']['some'](g=>a[g]!==undefined))continue;!f['check'](a,b)&&c['push']({'rule_id':f['id'],'severity':e[f['id']]??f['severity'],'message':f['message'](a),'recommendation':f['recommendation']});}catch{}}return c;}export function hasBlockingErrors(a){return a['some'](b=>b['severity']==='error');}export function getErrors(a){return a['filter'](b=>b['severity']==='error');}export function getWarnings(a){return a['filter'](b=>b['severity']==='warning');}export function summarizeFindings(a){if(a['length']===0x0)return'All\x20audit\x20checks\x20passed.';const b=getErrors(a),c=getWarnings(a),d=a['filter'](g=>g['severity']==='info'),e=[];if(b['length']>0x0)e['push'](b['length']+'\x20error(s)');if(c['length']>0x0)e['push'](c['length']+'\x20warning(s)');if(d['length']>0x0)e['push'](d['length']+'\x20info');return'Audit:\x20'+e['join'](',\x20')+'.\x20Review\x20before\x20publishing.';}export const AUDIT_RULES_VERSION=0x5;
+import{MAX_INDEMNITY_MULTIPLE}from'./onchain-constants.js';import{lintForwardAmbiguity}from'./machine-topology.js';function numericAmount(a){if(typeof a==='number')return Number['isFinite'](a)?a:undefined;if(typeof a==='string'){const b=a['trim']();if(/^\d+$/['test'](b))return Number(b);}return undefined;}export function salesItemsOf(a){if(Array['isArray'](a?.['sales']))return a['sales'];if(Array['isArray'](a?.['sales']?.['sales']))return a['sales']['sales'];return[];}export function allocatorCountOf(a){const b=a?.['order_allocators'];if(Array['isArray'](b))return b['length'];if(Array['isArray'](b?.['allocators']))return b['allocators']['length'];return 0x0;}export function arbitrationRefsOf(b){const c=b?.['arbitrations'];if(Array['isArray'](c))return c['filter'](e=>typeof e==='string');if(Array['isArray'](c?.['objects']))return c['objects']['filter'](e=>typeof e==='string');return[];}export function compensationFundOf(a){if(a?.['compensation_fund_add']?.['balance']!=null)return a['compensation_fund_add']['balance'];if(a?.['compensation_fund']!=null)return a['compensation_fund'];return undefined;}export function serviceNameOf(a){if(typeof a?.['object']==='string')return a['object'];if(typeof a?.['object']?.['name']==='string'&&a['object']['name'])return a['object']['name'];if(typeof a?.['namedNew']?.['name']==='string'&&a['namedNew']['name'])return a['namedNew']['name'];return undefined;}export function typeParameterOf(a){if(typeof a?.['type_parameter']==='string'&&a['type_parameter'])return a['type_parameter'];if(typeof a?.['object']?.['type_parameter']==='string'&&a['object']['type_parameter'])return a['object']['type_parameter'];if(typeof a?.['namedNew']?.['type_parameter']==='string'&&a['namedNew']['type_parameter'])return a['namedNew']['type_parameter'];return undefined;}export const DISPUTE_FAMILY_NODE_REGEX=/(^|_)(disputed?|arbitration|arb)(_|$)/i;export const FUND_TERMINAL_NODE_REGEX=/^(refund|refunded|deposit_refunded|deposit_deducted|cancel|cancelled)$/i;export const ANTI_PATTERN_NODE_REGEX=new RegExp(DISPUTE_FAMILY_NODE_REGEX['source']+'|'+FUND_TERMINAL_NODE_REGEX['source'],'i');export function auditMachineNodes(a){const b=[],c=[];if(!Array['isArray'](a)||a['length']===0x0)return c['push']('pre_publish:\x20machine\x20node\x20set\x20unavailable\x20—\x20topology\x20not\x20verifiable;\x20'+'verify\x20via\x20machineNode2file\x20BEFORE\x20publish\x20(immutable\x20after\x20publish,\x20IMMUT-001)'),{'critical':b,'warnings':c};const d=a;for(const r of d){const s=typeof r?.['name']==='string'?r['name']:'';s&&ANTI_PATTERN_NODE_REGEX['test'](s)&&b['push']('R-M1-11:\x20machine\x20node\x20\x22'+s+'\x22\x20models\x20dispute/refund\x20flow\x20—\x20'+'refunds\x20must\x20route\x20via\x20an\x20Allocator\x20triggered\x20by\x20business\x20states,\x20'+'disputes\x20via\x20the\x20separate\x20Arbitration\x20object\x20(off-Machine)');}const e=new Set();for(const t of d){const u=typeof t?.['name']==='string'?t['name']:'';if(!u)continue;e['has'](u)&&b['push']('MC-C-04:\x20duplicate\x20machine\x20node\x20name\x20\x22'+u+'\x22\x20—\x20on-chain\x20will\x20reject\x20the\x20publish\x20transaction'),e['add'](u);}const g=d['some'](v=>Array['isArray'](v?.['pairs'])&&v['pairs']['some'](w=>w?.['prev_node']===''));!g&&b['push']('Machine\x20has\x20no\x20entry\x20pair\x20(prev_node=\x22\x22)\x20—\x20Progress\x20can\x20never\x20advance\x20'+'from\x20the\x20initial\x20state;\x20orders\x20are\x20permanently\x20stuck');const h=new Map();for(const v of d){const w=typeof v?.['name']==='string'?v['name']:'';if(!w)continue;if(!h['has'](w))h['set'](w,[]);for(const x of v?.['pairs']??[]){const y=x?.['prev_node'];if(typeof y==='string'&&y!==''){const z=h['get'](y);if(z)z['push'](w);else h['set'](y,[w]);}}}const i=0x0,j=0x1,k=0x2,l=new Map(),m=[],o=A=>{l['set'](A,j);for(const B of h['get'](A)??[]){const C=l['get'](B)??i;if(C===j)m['push'](A+'->'+B);else C===i&&o(B);}l['set'](A,k);};for(const A of h['keys']()){if((l['get'](A)??i)===i)o(A);}m['length']>0x0&&c['push']('pre_publish:\x20machine\x20contains\x20loop\x20back-edge(s)\x20'+m['join'](',\x20')+'\x20—\x20on-chain\x20a\x20revisit\x20'+'is\x20NOT\x20verified\x20to\x20re-fund\x20the\x20Allocation.\x20Every\x20renewal/loop\x20forward\x20MUST\x20carry\x20the\x20new-period\x20'+'payment\x20into\x20the\x20order\x20escrow\x20atomically\x20(create\x20the\x20period\x20payment,\x20receive\x20it\x20into\x20the\x20'+'allocation,\x20and\x20advance\x20the\x20progress\x20—\x20all\x20in\x20one\x20transaction),\x20or\x20the\x20loop\x20allows\x20zero-value\x20'+'re-delivery\x20cycles\x20(test/11\x20R2-F3).\x20'+'Recommended:\x20bind\x20a\x20fund-gate\x20Guard\x20on\x20the\x20loop\x20forward\x20(allocation\x20balance\x20>=\x20period\x20price)\x20—\x20'+'note\x20the\x20allocation.balance\x20query\x20is\x20not\x20yet\x20available\x20on-chain,\x20so\x20per-period\x20NEW\x20Orders\x20remain\x20'+'the\x20safe\x20default\x20for\x20long\x20subscriptions.');for(const B of d){const C=typeof B?.['name']==='string'?B['name']:'?';for(const D of B?.['pairs']??[]){for(const E of D?.['forwards']??[]){const F=E?.['namedOperator']!==undefined&&E?.['namedOperator']!==null,G=E?.['permissionIndex']!==undefined&&E?.['permissionIndex']!==null,H=E?.['guard']!==undefined&&E?.['guard']!==null;!F&&!G&&!H&&c['push']('pre_publish:\x20node\x20\x22'+C+'\x22\x20forward\x20\x22'+String(E?.['name']??'?')+'\x22\x20has\x20no\x20executor\x20binding\x20(namedOperator\x20/\x20permissionIndex\x20/\x20guard)\x20—\x20no\x20one\x20can\x20advance\x20it');}}}const q=lintForwardAmbiguity(a,'pre_publish');return b['push'](...q['critical']),c['push'](...q['warnings']),{'critical':b,'warnings':c};}export const AUDIT_RULES=[{'id':'audit_machine_bound','description':'Service\x20should\x20have\x20a\x20Machine\x20workflow\x20bound\x20before\x20publish','severity':'warning','fields':['machine'],'check':(a,b)=>{if(!a?.['publish'])return!![];return!!a?.['machine'];},'message':()=>'Publishing\x20a\x20service\x20without\x20a\x20Machine\x20workflow.\x20Customers\x20won\x27t\x20have\x20a\x20structured\x20order\x20process.','recommendation':'Create\x20a\x20Machine\x20(workflow\x20template)\x20and\x20bind\x20it\x20to\x20the\x20service\x20before\x20publishing.\x20The\x20machine\x20field\x20becomes\x20IMMUTABLE\x20after\x20publish.'},{'id':'audit_order_allocators','description':'Service\x20should\x20have\x20order_allocators\x20for\x20fund\x20distribution','severity':'warning','fields':['order_allocators'],'check':a=>{if(!a?.['publish'])return!![];return allocatorCountOf(a)>0x0;},'message':()=>'Publishing\x20a\x20service\x20without\x20order_allocators.\x20Order\x20funds\x20cannot\x20be\x20auto-distributed\x20to\x20suppliers.','recommendation':'Configure\x20order_allocators\x20before\x20publishing\x20—\x20this\x20field\x20becomes\x20IMMUTABLE\x20after\x20publish.'},{'id':'audit_buy_guard','description':'Service\x20should\x20have\x20a\x20buy_guard\x20for\x20customer\x20screening','severity':'info','fields':['buy_guard'],'check':a=>!!a?.['buy_guard'],'message':()=>'No\x20buy_guard\x20configured\x20—\x20anyone\x20can\x20purchase\x20this\x20service\x20without\x20verification.','recommendation':'Consider\x20adding\x20a\x20Guard\x20to\x20verify\x20customer\x20eligibility\x20(e.g.,\x20identity,\x20wallet\x20balance,\x20location).'},{'id':'audit_arb_alloc_boundary','description':'Arbitration\x20and\x20Allocator\x20coexist\x20→\x20surface\x20the\x20two-system\x20boundary\x20reminder','severity':'warning','fields':['arbitrations','compensation_fund_add','compensation_fund','order_allocators'],'check':a=>{if(!a?.['publish'])return!![];const b=arbitrationRefsOf(a)['length']>0x0||compensationFundOf(a)!==undefined;return!(b&&allocatorCountOf(a)>0x0);},'message':()=>'Arbitration\x20and\x20Allocator\x20are\x20INDEPENDENT\x20systems\x20by\x20design:\x20a\x20ruling\x20records\x20the\x20case\x20and\x20pays\x20from\x20the\x20service\x20compensation\x20fund\x20—\x20it\x20never\x20moves\x20escrow\x20and\x20never\x20advances\x20the\x20workflow.\x20With\x20both\x20configured,\x20a\x20buyer\x20can\x20receive\x20BOTH\x20the\x20arbitration\x20compensation\x20AND\x20a\x20full\x20escrow\x20refund\x20unless\x20the\x20refund/settlement\x20path\x20is\x20gated.\x20This\x20is\x20a\x20boundary\x20reminder,\x20not\x20a\x20defect\x20—\x20verify\x20the\x20coupling\x20check\x20was\x20done\x20deliberately.','recommendation':'Gate\x20the\x20refund/settlement\x20allocator\x27s\x20Guard\x20on\x20order.claimed_by\x20(read-only\x20cross-system\x20evidence\x20—\x20the\x20sanctioned\x20link),\x20or\x20hold\x20the\x20final\x20settlement\x20forward\x20until\x20the\x20case\x20closes.\x20Do\x20NOT\x20couple\x20the\x20systems\x20the\x20other\x20way\x20(no\x20dispute\x20state\x20on\x20the\x20order\x20flow,\x20no\x20workflow\x20step\x20into\x20arbitration):\x20coupling\x20opens\x20the\x20double-pay\x20path.\x20For\x20per-case\x20fund\x20actions,\x20the\x20deposit-reimbursement\x20pattern\x20(guard-design\x20patterns)\x20is\x20the\x20supported\x20route.'},{'id':'audit_compensation_fund','description':'Service\x20should\x20have\x20a\x20compensation_fund\x20for\x20trust','severity':'warning','fields':['compensation_fund_add','compensation_fund'],'check':a=>compensationFundOf(a)!==undefined,'message':()=>'No\x20compensation_fund\x20configured.\x20Customers\x20have\x20no\x20financial\x20protection\x20if\x20you\x20fail\x20to\x20deliver.','recommendation':'Deposit\x20via\x20compensation_fund_add\x20{balance}\x20to\x20enable\x20arbitration\x20payouts.\x20The\x20fund\x20deters\x20fraud\x20and\x20enables\x20arbitration\x20claims.'},{'id':'audit_arbitrations','description':'Service\x20should\x20have\x20arbitration\x20options\x20for\x20dispute\x20resolution','severity':'info','fields':['arbitrations'],'check':a=>arbitrationRefsOf(a)['length']>0x0,'message':()=>'No\x20arbitration\x20configured.\x20Disputes\x20cannot\x20be\x20resolved\x20through\x20a\x20third\x20party.','recommendation':'Add\x20at\x20least\x20one\x20Arbitration\x20object\x20via\x20arbitrations:{op:\x27add\x27,\x20objects:[...]}\x20to\x20enable\x20on-chain\x20dispute\x20resolution.'},{'id':'audit_arbitration_removal_strands_awards','description':'Removing\x20an\x20authorized\x20venue\x20can\x20strand\x20an\x20award\x20it\x20already\x20ruled\x20on','severity':'error','fields':['arbitrations'],'check':a=>{const b=a?.['arbitrations']?.['remove']??a?.['arbitrations']?.['clear'],c=Array['isArray'](b)?b['length']>0x0:a?.['arbitrations']?.['op']==='clear';if(!c)return!![];if(arbitrationRefsOf(a)['length']>0x0)return!![];return compensationFundOf(a)===undefined;},'message':a=>{const b=a?.['arbitrations']?.['clear']?'every\x20authorized\x20venue':'venue(s)\x20'+(a?.['arbitrations']?.['remove']??[])['join'](',\x20');return'Removing\x20'+b+'\x20while\x20a\x20compensation\x20fund\x20is\x20configured\x20makes\x20any\x20award\x20it\x20already\x20ruled\x20on\x20UNPAYABLE:\x20an\x20on-chain\x20payout\x20now\x20requires\x20the\x20deciding\x20venue\x20to\x20still\x20be\x20on\x20the\x20Service\x27s\x20allowlist,\x20so\x20paying\x20out\x20aborts\x20with\x20E_ARBITRATION_NOT_ALLOWED=39\x20and\x20the\x20escrowed\x20funds\x20stay\x20stranded.';},'recommendation':'Before\x20removing\x20a\x20venue,\x20confirm\x20no\x20case\x20it\x20ruled\x20on\x20is\x20still\x20awaiting\x20compensation\x20payout\x20(query\x20the\x20Arb\x20objects\x20for\x20status\x20Arbitrated,\x20not\x20Finished).\x20Add\x20the\x20replacement\x20venue\x20FIRST,\x20drain\x20the\x20old\x20venue\x27s\x20cases,\x20and\x20only\x20then\x20remove\x20it.\x20A\x20buyer\x20should\x20never\x20be\x20left\x20holding\x20an\x20uncollectable\x20award.'},{'id':'audit_price','description':'Service\x20should\x20have\x20at\x20least\x20one\x20priced\x20sale\x20item','severity':'error','fields':['sales'],'check':a=>{const b=salesItemsOf(a);if(b['length']===0x0)return!![];return b['some'](c=>c?.['price']!==undefined&&c?.['price']!==null);},'message':()=>'Sales\x20list\x20present\x20but\x20no\x20item\x20has\x20a\x20price.\x20Customers\x20cannot\x20place\x20orders\x20without\x20knowing\x20the\x20cost.','recommendation':'Set\x20price\x20on\x20each\x20sales\x20item\x20(smallest-unit\x20string\x20or\x20display\x20form\x20like\x20\x272.5WOW\x27).'},{'id':'audit_compensation_fund_covers_award_ceiling','description':'compensation_fund\x20must\x20cover\x20the\x203x\x20award\x20ceiling\x20of\x20the\x20largest\x20sale','severity':'warning','fields':['compensation_fund_add','compensation_fund','sales'],'check':a=>{if(!a?.['publish'])return!![];const b=compensationFundOf(a);if(b===undefined)return!![];const c=numericAmount(b);if(c===undefined)return!![];if(c===0x0)return![];const e=salesItemsOf(a)['map'](g=>numericAmount(g?.['price']))['filter'](g=>g!==undefined&&g>0x0);if(e['length']===0x0)return!![];const f=e['reduce']((g,h)=>g+h,0x0);return c>=MAX_INDEMNITY_MULTIPLE*f;},'message':()=>'compensation_fund\x20does\x20not\x20cover\x20the\x20award\x20ceiling.\x20An\x20award\x20is\x20hard-capped\x20at\x20'+MAX_INDEMNITY_MULTIPLE+'x\x20'+'the\x20order\x20amount\x20(arb.move\x20MAX_INDEMNITY_MULTIPLE,\x20enforced\x20at\x20ruling\x20time),\x20so\x20a\x20ruling\x20at\x20the\x20ceiling\x20'+'would\x20abort\x20the\x20buyer\x27s\x20claim\x20with\x2027\x20(E_COMPENSATION_NOT_MATCH)\x20—\x20the\x20ruling\x20stands\x20but\x20is\x20unpayable\x20'+'until\x20you\x20deposit,\x20and\x20the\x20abort\x20does\x20NOT\x20consume\x20the\x20claim.','recommendation':'Top\x20up\x20to\x20at\x20least\x20'+MAX_INDEMNITY_MULTIPLE+'x\x20your\x20largest\x20single\x20order\x20via\x20compensation_fund_add.\x20Above\x20'+(MAX_INDEMNITY_MULTIPLE+'x\x20is\x20optional:\x20it\x20only\x20buys\x20tolerance\x20for\x20several\x20CONCURRENT\x20claims\x20against\x20the\x20')+'one\x20per-Service\x20pool\x20(there\x20is\x20no\x20on-chain\x20concurrency\x20limit),\x20which\x20is\x20a\x20capital-allocation\x20choice.'},{'id':'audit_description','description':'Service\x20should\x20have\x20a\x20description','severity':'warning','fields':['description'],'check':a=>typeof a?.['description']==='string'&&a['description']['length']>0x0,'message':()=>'Service\x20has\x20no\x20description.\x20Customers\x20won\x27t\x20understand\x20what\x20you\x27re\x20offering.','recommendation':'Write\x20a\x20clear\x20description\x20of\x20the\x20service,\x20including\x20deliverables,\x20timelines,\x20and\x20terms.'},{'id':'audit_named_new_name','description':'Service\x20being\x20created\x20should\x20have\x20a\x20name','severity':'warning','check':a=>serviceNameOf(a)!==undefined,'message':()=>'Creating\x20a\x20service\x20without\x20a\x20name\x20makes\x20it\x20hard\x20to\x20reference\x20and\x20organize.','recommendation':'Set\x20object:{name:\x20...}\x20(or\x20namedNew.name)\x20following\x20the\x20convention:\x20<projectPrefix>_<service>_<purpose>.'},{'id':'audit_customer_required_needs_um','description':'customer_required\x20requires\x20a\x20Contact\x20bound\x20via\x20um\x20(SDK-enforced\x20hard\x20link;\x20mirrored\x20here)','severity':'error','fields':['customer_required','um'],'check':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];if(b['length']===0x0)return!![];return!!a?.['um'];},'message':()=>'customer_required\x20is\x20set\x20but\x20no\x20Contact\x20is\x20bound\x20via\x20um\x20—\x20customers\x20cannot\x20deliver\x20the\x20required\x20private\x20information\x20through\x20end-to-end\x20encrypted\x20Messenger.','recommendation':'Bind\x20um:{Contact\x20name/id}\x20in\x20the\x20same\x20call\x20(SDK\x20order_new\x20will\x20fail\x20the\x20buyer\x20otherwise).'},{'id':'audit_customer_required_is_declared_not_enforced','description':'customer_required\x20has\x20no\x20on-chain\x20enforcement\x20at\x20buy\x20time\x20—\x20a\x20Guard\x20must\x20gate\x20fulfilment','severity':'warning','fields':['customer_required'],'check':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];return b['length']===0x0;},'message':a=>{const b=Array['isArray'](a?.['customer_required'])?a['customer_required']:[];return'customer_required\x20('+b['length']+'\x20field(s):\x20'+b['join'](',\x20')+')\x20is\x20DECLARATIVE\x20ONLY:\x20the\x20on-chain\x20purchase\x20entry\x20never\x20reads\x20this\x20list,\x20so\x20an\x20order\x20that\x20supplies\x20none\x20of\x20these\x20fields\x20is\x20still\x20created\x20and\x20progresses.\x20Nothing\x20on-chain\x20will\x20stop\x20it.';},'recommendation':'Bind\x20pattern.required_info_evidence_gate\x20(schema_query\x20action=get_guard_design_patterns)\x20on\x20the\x20first\x20forward\x20that\x20needs\x20the\x20information:\x20query\x20\x27order.required_info\x20some\x27\x20(1572)\x20over\x20the\x20Order.\x20The\x20buyer\x20records\x20the\x20credential\x20via\x20order_required_info_update:\x20EITHER\x20the\x20merchant\x27s\x20IM\x20user\x20address\x20resolved\x20from\x20the\x20Service\x27s\x20Contact\x20(zero\x20cost,\x20address\x20record\x20only)\x20OR\x20an\x20on-chain\x20WTS\x20Proof\x20object\x20address\x20(embeds\x20the\x20merchant\x20IM\x20address\x20and\x20the\x20last-message\x20timestamp;\x20costs\x20gas,\x20publicly\x20verifiable).\x20\x27order.required_info\x27\x20(1573)\x20returns\x20the\x20recorded\x20address\x20but\x20aborts\x20while\x20nothing\x20is\x20recorded\x20—\x20gate\x20on\x201572\x20first.'},{'id':'audit_dangling_deps','description':'Service\x20dependencies\x20should\x20be\x20fully\x20created','severity':'error','check':(a,b)=>{if(!a?.['publish'])return!![];if(!b?.['graph'])return!![];const c=b['graph']['findDanglingDependencies']()??[];return c['length']===0x0;},'message':()=>'Service\x20references\x20objects\x20that\x20are\x20not\x20yet\x20created.\x20Publishing\x20will\x20lock\x20these\x20references.','recommendation':'Ensure\x20all\x20referenced\x20objects\x20(machine,\x20allocators,\x20guards)\x20are\x20created\x20and\x20finalized\x20before\x20publishing.'},{'id':'audit_type_parameter','description':'Service\x20should\x20have\x20a\x20token\x20type\x20specified','severity':'info','fields':['type_parameter','namedNew'],'check':a=>typeParameterOf(a)!==undefined,'message':()=>'No\x20payment\x20token\x20type\x20specified.\x20Defaulting\x20to\x20WOW\x20(0x2::wow::WOW).','recommendation':'Explicitly\x20set\x20type_parameter\x20(inside\x20object:{...})\x20if\x20you\x20want\x20to\x20accept\x20non-WOW\x20tokens\x20(e.g.,\x20USDT,\x20ETH).'}];const RULE_INDEX=new Map(AUDIT_RULES['map'](a=>[a['id'],a]));function readSeverityOverrides(){try{const {getJudgmentDoc:a}=require('../config/judgment.js');if(typeof a!=='function')return{};const b=a()?.['rules']?.['domains'];if(!b||typeof b!=='object')return{};const c={};for(const d of Object['values'](b)){const e=d?.['severity_overrides'];if(!e||typeof e!=='object')continue;for(const [f,g]of Object['entries'](e)){if(g==='error'||g==='warning'||g==='info')c[f]=g;}}return c;}catch{return{};}}export function auditService(a,b){const c=[],d=a?.['publish']===!![]&&typeof a?.['object']==='string',e=readSeverityOverrides();for(const f of AUDIT_RULES){try{if(d&&f['fields']&&!f['fields']['some'](g=>a[g]!==undefined))continue;!f['check'](a,b)&&c['push']({'rule_id':f['id'],'severity':e[f['id']]??f['severity'],'message':f['message'](a),'recommendation':f['recommendation']});}catch{}}return c;}export function hasBlockingErrors(a){return a['some'](b=>b['severity']==='error');}export function getErrors(a){return a['filter'](b=>b['severity']==='error');}export function getWarnings(a){return a['filter'](b=>b['severity']==='warning');}export function summarizeFindings(a){if(a['length']===0x0)return'All\x20audit\x20checks\x20passed.';const b=getErrors(a),c=getWarnings(a),d=a['filter'](g=>g['severity']==='info'),e=[];if(b['length']>0x0)e['push'](b['length']+'\x20error(s)');if(c['length']>0x0)e['push'](c['length']+'\x20warning(s)');if(d['length']>0x0)e['push'](d['length']+'\x20info');return'Audit:\x20'+e['join'](',\x20')+'.\x20Review\x20before\x20publishing.';}export const AUDIT_RULES_VERSION=0x5;

package/dist/knowledge/baselines/rules/allocation.json

@@ -452,17 +452,17 @@
     {
       "rule_id": "R-A-4-01",
       "dimension": "lifecycle",
-      "trigger": "caller-specified guard with no matching Allocator — aborts with E_ALLOCATOR_NOT_MATCHED",
+      "trigger": "FUTURE-CALL advisory (not a statement about the current call's arguments): a multi-Allocation config with no fallback Allocator — a later alloc() whose alloc_by_guard does not match any Allocator aborts with E_ALLOCATOR_NOT_MATCHED",
       "cases": [
         {
           "when": { "all": [
             { "field": "allocators_config_present", "op": "eq", "value": true },
             { "field": "allocators_count", "op": "gt", "value": 1 },
-            { "field": "has_fallback_allocator", "op": "falsy" }
+            { "field": "has_fallback_allocator", "op": "eq", "value": false }
           ] },
-          "level": "critical",
-          "title": "caller-specified guard with no matching Allocator — aborts with E_ALLOCATOR_NOT_MATCHED",
-          "description": "Multi-Allocation configuration (${allocators_count} Allocators) without alternative Allocator. alloc() is driven by the caller explicitly specifying an Allocator via alloc_by_guard: if the guard address does not match any allocators[].guard, alloc() aborts with E_ALLOCATOR_NOT_MATCHED (allocation.move:295) — the transaction reverts and funds remain in the order escrow, not stuck in Allocation.balance. Linked to guard-risk.ts R-X1-05.",
+          "level": "high",
+          "title": "No fallback Allocator: a FUTURE alloc() with an unmatched guard aborts with E_ALLOCATOR_NOT_MATCHED",
+          "description": "Multi-Allocation configuration (${allocators_count} Allocators) where the caller context explicitly reports NO alternative Allocator. An ABSENT caller context does not fire this rule (unknown is not declined — the Amazon P2-11 false-positive class). This finding is about FUTURE trigger calls, not the current call's parameters. alloc() is driven by the caller explicitly specifying an Allocator via alloc_by_guard: if the guard address does not match any allocators[].guard, alloc() aborts with E_ALLOCATOR_NOT_MATCHED (allocation.move:295) — the transaction reverts and funds remain in the order escrow, not stuck in Allocation.balance. Linked to guard-risk.ts R-X1-05.",
           "scenario": "Caller passes a guard address not present in allocators[] (e.g. wrong Guard object, or order state not matching any terminal node)",
           "mitigation": "1) The caller should verify alloc_by_guard ∈ allocators[].guard address set before calling alloc(). 2) Provide an alternative Allocator and document the caller's retry strategy. 3) Catch the abort and surface the mismatch to the operator.",
           "evidence": "allocators=${allocators_count}, hasFallback=${has_fallback_allocator_display}",

package/dist/knowledge/baselines/rules/arb.json

@@ -162,7 +162,7 @@
           "when": { "field": "escrow_released_before_case", "op": "eq", "value": true },
           "level": "high",
           "title": "Refund-then-claim ordering — the principal may recover twice",
-          "description": "The order's escrow was already released BEFORE this case was filed (deficit ${escrow_deficit_display}). The claim→refund direction is on-chain closed — the order seals itself once a claim settles — but the reverse ordering is NOT: the principal can still claim the indemnity on top of the refunded principal. The discriminating evidence is fully on-chain: (1) refund/alloc event timestamps vs the case creation time — the decisive ordering signal; (2) escrow balance vs order amount (the deficit); (3) the order's progress path (visited refund terminals); (4) the owner receive history.",
+          "description": "The order's escrow was already released BEFORE this case was filed (deficit ${escrow_deficit_display}). Neither ordering is closed on-chain (order.move:213-234 deliberately ships no receive-gate): after this claim settles the refund allocator can still split the remaining escrow unless its Guard is gated on order.claimed_by some==false. The discriminating evidence is fully on-chain: (1) refund/alloc event timestamps vs the case creation time — the decisive ordering signal; (2) escrow balance vs order amount (the deficit); (3) the order's progress path (visited refund terminals); (4) the owner receive history.",
           "scenario": "Buyer collects a refund via the refund track, then files a dispute and claims the indemnity on top",
           "mitigation": "At ruling time, net the indemnity against the principal already refunded — compensate the delta, not the full loss. The defendant attaches the escrow forensics to the case statement; tooling refuses to drive the claim for an order whose escrow was already released to the buyer.",
           "evidence": "escrow_released_before_case=true (deficit=${escrow_deficit_display})",

package/dist/knowledge/baselines/rules/guard.json

@@ -52,7 +52,7 @@
     "rc3_03_no_type_count": "KERNEL — submitted Address entries missing the object_type annotation.",
     "rc3_03_evidence": "KERNEL — final evidence listing the missing-object_type or annotated entries.",
     "rc3_05_applies": "KERNEL — a project-relevant object (Order/Progress/Arb) is submitted in an affected scene without a project-binding query (1563/1560/1250/1402/1401) in the root.",
-    "rc3_05_critical": "KERNEL — the scene belongs to the critical set (machine_forward_guard / service_order_allocators_guard).",
+    "rc3_05_critical": "KERNEL — the scene belongs to the critical set. Since protocol v148 (assert_task_binding live) the set is machine_forward_guard only: the forward-stage replay past acceptance gates is not closed by the chain, while allocator scenes carry the v148 chain backstop and grade info.",
     "rc3_05_unbound_csv": "KERNEL — unbound project-relevant submission entries rendered '#id(Order|Progress|Arb|inferred …)', comma joined.",
     "rc3_05_scene_label": "KERNEL — scene label for the evidence ('unknown scene (conservative flag)' when absent).",
     "rc3_06_applies": "KERNEL — allocators scene, Guard without Signer binding, and sharing is not provably Entity/GuardIdentifier-only.",
@@ -112,7 +112,7 @@
           "title": "arb.status==5 gate is transient: fee withdrawal permanently kills the refund edge",
           "description": "arb.status is a U8 lifecycle state. After a ruling the case sits at 5 (Finished), but a legitimate arb_withdraw by the arbitrator advances it to 6 (Withdrawn) — the gate silently flips false and never returns. Guard AND Machine are immutable after publish (IMMUT-001), so any forward gated on ==5 dies permanently and strands its funds (verified on testnet, booking o10: 1.5 WOW locked with no on-chain exit).",
           "scenario": "Arbitration refund forward gated on arb.status==5: the arbitrator withdraws the case fee before the refund executes — the forward aborts forever",
-          "mitigation": "Gate on the withdraw-stable ruling signal instead: arb.indemnity some == true (Bool — set by the ruling, never cleared by arb_withdraw; cleared by reset, which correctly re-gates). Template: tpl_forward_arb_ruling_won. Time-bounded variant: arb.indemnity.time (U64 ruling timestamp).",
+          "mitigation": "Gate on the stable ruling signal instead: arb.indemnity some == true (Bool — set by the ruling; arb_withdraw sweeps only the fee balance and never touches it, so a fee withdrawal cannot clear it; cleared by reset, which correctly re-gates). Template: tpl_forward_arb_ruling_won. Time-bounded variant: arb.indemnity.time (U64 ruling timestamp). Merchant-favor dismissal edges: tpl_forward_arb_ruling_dismissed (arb.indemnity.amount == 0 — fail-closed on the None field).",
           "evidence": "Root queries arb.status; table pins a constant numeric value of 5 (Finished).",
           "stakeholders": ["provider", "customer"]
         }
@@ -472,24 +472,24 @@
         },
         {
           "when": { "all": [{ "field": "rc3_05_applies", "op": "eq", "value": true }, { "field": "rc3_05_critical", "op": "eq", "value": false }] },
-          "level": "high",
-          "title": "Submitted Order/Progress/Arb is NOT verified to belong to the current project (cross-project bypass — CRITICAL trust-boundary gap)",
+          "level": "info",
+          "title": "Submitted Order/Progress/Arb is NOT verified to belong to the current project — advisory: the chain now rejects cross-order submissions at the Progress layer (protocol v148, N-1 assert_task_binding); keep the project binding as defense-in-depth",
           "description": "Guard accepts runtime-submitted Order/Progress/Arb object(s) [${rc3_05_unbound_csv}] but the root does NOT verify the submitted object belongs to the current project (no query of order.service/order.machine/progress.machine/arb.service compared to a project constant).\n\nTRUST-BOUNDARY GAP (verified via Move source):\n  - The Passport submission is built by the CALLER, not auto-injected by the runtime\n  - the guard verification receives ONLY the caller-provided submission bytes — it never sees the Progress/Order actually being forwarded\n  - the passport-driven forward performs NO linkage check between the passport submission and the Progress under advancement\n  - Even the order forward's E_ORDER_NOT_MATCH only checks the separate `order:&Order` parameter, NOT the order_id embedded in the passport submission\n\nEXPLOIT (scene=${rc3_05_scene_label}):\n  1. Attacker holds Order Y from project B (where progress.current_time is old enough to pass the time-lock)\n  2. Attacker calls forward on Order X's Progress (project A, freshly entered the node)\n  3. Attacker submits Order Y's ID in the passport (lying about which order is being forwarded)\n  4. Guard's witness=100 reads Order Y's Progress -> time-lock passes (Order Y is old)\n  5. forward actually executes on Order X's Progress -> TIME-LOCK BYPASSED\n\nThis is distinct from R-C3-01 (Signer binding — WHO can submit) and R-C3-03 (type matching — WHAT type is submitted). R-C3-05 addresses WHETHER the submitted object belongs to the current project — a third orthogonal axis of submission trust. Even with R-C3-01 satisfied (authorized Signer) and R-C3-03 satisfied (correct type), the Signer can still submit an unrelated project's object.",
           "scenario": "Cross-project bypass: authorized signer submits an unrelated project's order/progress/arb to bypass time-lock, status, or allocation conditions",
           "mitigation": "Add a project-binding check to the root (wrap existing root in logic_and):\n  - For submitted Order: add logic_equal[query(1563: order.service), identifier[N](project_service_address)] — RECOMMENDED (service is the canonical project anchor)\n  - For submitted Order: add logic_equal[query(1560: order.machine), identifier[N](project_machine_address)] — alternative (machine anchor)\n  - For submitted Progress: add logic_equal[query(1250: progress.machine), identifier[N](project_machine_address)]\n  - For submitted Arb: add logic_equal[query(1402: arb.service), identifier[N](project_service_address)]\n  - Use witness=102 (TypeOrderService) on the submitted Order to derive the Service, then compare to the project service constant\n\nIntentional cross-project exception: if the Guard is DESIGNED to accept cross-project submissions (rare), document this explicitly in the description and add a binding_hint annotation 'cross_project_intentional:true' to suppress this rule.",
-          "evidence": "Unbound submitted project-relevant entries: ${rc3_05_unbound_csv}. Scene: ${rc3_05_scene_label}. Missing project-binding queries: none of [1563(order.service), 1560(order.machine), 1250(progress.machine), 1402(arb.service)] present in root.",
+          "evidence": "Unbound submitted project-relevant entries: ${rc3_05_unbound_csv}. Scene: ${rc3_05_scene_label}. Missing project-binding queries: none of [1563(order.service), 1560(order.machine), 1250(progress.machine), 1402(arb.service)] present in root. Chain backstop (protocol v148): progress.move assert_task_binding requires the passport's identifier-254 submission to equal Progress.task on every guard-gated forward of a task-bound Progress — cross-order replay aborts with 11 (binding required) / 12 (binding mismatch).",
           "stakeholders": ["customer", "provider", "arbitrator"],
           "exposure": {
             "loss_parties": [
-              { "role": "merchant", "basis": "Time-lock, status and allocation conditions stop protecting the project — funds can be released before the merchant's obligations are met." },
-              { "role": "buyer", "basis": "The buyer's order protections (time-locks, status gates) can be bypassed with a foreign project's object." }
+              { "role": "merchant", "basis": "Historical (pre-v148): time-lock, status and allocation conditions stopped protecting the project — funds could be released before the merchant's obligations were met. Since protocol v148 the chain rejects cross-order evidence at the Progress layer, so this loss path no longer materializes." },
+              { "role": "buyer", "basis": "Historical (pre-v148): the buyer's order protections (time-locks, status gates) could be bypassed with a foreign project's object. Since protocol v148 the task binding closes that path; the missing project queries remain a defense-in-depth gap only." }
             ],
             "gain_paths": [
               {
                 "role": "neutral",
                 "path": "The caller submits an unrelated project's order/progress id in the passport while forwarding the real Progress; the Guard witness reads the foreign object and passes.",
-                "viability": "viable",
-                "gate": "The runtime never links the passport submission to the Progress under advancement — the bypass executes exactly as described in the exploit."
+                "viability": "blocked",
+                "gate": "protocol v148 assert_task_binding runs on every guard-gated forward of a task-bound Progress and aborts when the identifier-254 submission does not equal Progress.task — the forged-evidence forward is rejected by the chain after guard verification, before the node can advance."
               }
             ]
           }

package/dist/knowledge/baselines/rules/machine.json

@@ -22,7 +22,7 @@
     "first_missing_guard_forward_name": "First-offender — name of the first Forward referencing a Guard outside the published set (absent when none).",
     "first_missing_guard_guard": "That Forward's Guard address.",
     "first_retained_no_guard_forward_name": "First-offender — name of the first Forward carrying retained_submission without any Guard (absent when none).",
-    "first_noperm_forward_name": "First-offender — name of the first Forward with NONE of namedOperator, permissionIndex, or Guard (absent when none). A Guard-only forward IS executable: the verified Guard replaces both identity pre-checks through the Passport path.",
+    "first_noperm_forward_name": "First-offender — name of the first Forward with NONE of namedOperator, permissionIndex, or Guard (absent when none). Note: a Guard-only forward is constructible (forward_with_guard, runtime-verified via the Passport path) but is REJECTED at publish today — assert_publishable requires namedOperator or permissionIndex on EVERY forward (machine.move:460-463, E_FORWARD_NO_IDENTITY 21); the constructor/publish disagreement is a pending chain decision, so treat Guard as a post-verification addition, never the sole binding.",
     "first_noperm_prev": "That Forward's Pair prev_node.",
     "first_noperm_next": "That Forward's Pair next_node.",
     "first_both_forward_name": "First-offender — name of the first Forward with BOTH namedOperator and permissionIndex set (absent when none).",
@@ -202,7 +202,7 @@
     {
       "rule_id": "R-M1-11",
       "dimension": "structural",
-      "trigger": "Two-tier node-name match, identical to the template-scanner / mode-actions / audit-rules enforcement regex /(^|_)(disputed?|arbitration|arb)(_|$)|^(refund|refunded|deposit_refunded|deposit_deducted|cancel|cancelled)$/i — dispute family matches any underscore segment (a dispute never lives inside the Machine); fund terminals match EXACT names only. Business states that ROUTE allocator refunds ('closed_cancel', 'cancel_requested', 'refund_requested', 'return_approved', 'returned') do NOT match. — catalog stub: the retired check was not implemented",
+      "trigger": "Two-tier node-name match, single-sourced in knowledge/audit-rules.ts (ANTI_PATTERN_NODE_REGEX = DISPUTE_FAMILY_NODE_REGEX | FUND_TERMINAL_NODE_REGEX): /(^|_)(disputed?|arbitration|arb)(_|$)|^(refund|refunded|deposit_refunded|deposit_deducted|cancel|cancelled)$/i — dispute family matches any underscore segment (a dispute never lives inside the Machine); fund terminals match EXACT names only. Business states that ROUTE allocator refunds ('closed_cancel', 'cancel_requested', 'refund_requested', 'return_approved', 'returned') do NOT match. The template scanner's R-M1-11 adds one guard-anchored exemption: a fund-terminal node whose refund-track allocator row binds (guard_key) a guard that names that state downgrades to a LOW finding — the wrap publish gate (auditMachineNodes) stays strict. — catalog stub: the retired check was not implemented",
       "cases": [
         {
           "when": { "field": "always_true", "op": "eq", "value": false },
@@ -387,14 +387,14 @@
     {
       "rule_id": "R-M3-01",
       "dimension": "permission",
-      "trigger": "Check each forward has at least one executor binding: namedOperator, permissionIndex, or Guard (Guard-only is valid — verified via Passport)",
+      "trigger": "Check each forward has at least one executor binding: namedOperator, permissionIndex, or Guard (a Guard-only forward passes this structural audit but is still rejected at publish by E_FORWARD_NO_IDENTITY — the identity fields remain mandatory until the chain unifies the two constructors)",
       "cases": [
         {
           "when": { "field": "first_noperm_forward_name", "op": "present" },
           "level": "critical",
           "title": "Forward without permission",
           "description": "Forward has no executor binding at all — neither namedOperator, permissionIndex, nor Guard. Cannot be executed (the plain forward constructor aborts E_PERMISSION_NOT_DEFINED).",
-          "mitigation": "Set namedOperator='' for OrderHolder, set permissionIndex, or bind a Guard (a Guard-only forward is executable through the Passport path — the verified Guard replaces both identity pre-checks).",
+          "mitigation": "Set namedOperator='' for OrderHolder, or set permissionIndex. Binding a Guard alone does NOT publish (E_FORWARD_NO_IDENTITY rejects Guard-only forwards): a Guard is a post-verification addition on top of an identity field, never a replacement.",
           "evidence": "Forward \"${first_noperm_forward_name}\" in Pair (${first_noperm_prev} -> ${first_noperm_next}) has no executor binding.",
           "exposure": {
             "loss_parties": [
@@ -472,7 +472,7 @@
           "level": "medium",
           "title": "Permission game imbalance",
           "description": "One party has excessive permission, can unilaterally advance workflow. Game theory imbalance.",
-          "mitigation": "Use dual-signature (threshold=2) or multi-signature mechanism to balance power."
+          "mitigation": "Use dual-signature (threshold=2 with two DISTINCT operator-bound forwards, each weight 1) or a multi-signature mechanism to balance power. Note: threshold=2 alone does not guarantee two different people — one forward of weight 2 passes alone, and permission admins hold every index."
         }
       ]
     },

package/dist/knowledge/baselines/rules/order.json

@@ -236,7 +236,7 @@
           "when": { "field": "operation", "op": "eq", "value": "arb_claim_compensation" },
           "level": "high",
           "title": "arb_claim_compensation is IRREVERSIBLE (claimed_by one-time set)",
-          "description": "Setting claimed_by is permanent. After this call: (1) claimed_by cannot be reset, (2) NO new disputes can be filed (E_ORDER_ALREADY_CLAIMED), (3) all unresolved disputes become unactionable, (4) the order seals itself — the owner receive entries abort, so any escrow balance still on the order becomes unclaimable. If first compensation is insufficient, buyer has no recourse.",
+          "description": "Setting claimed_by is permanent. After this call: (1) claimed_by cannot be reset, (2) NO new disputes can be filed (E_ORDER_ALREADY_CLAIMED), (3) all unresolved disputes become unactionable, (4) NO on-chain seal follows — the owner receive entries are deliberately ungated (order.move:213-234), so escrow still on the order remains claimable; enforce any refund-vs-claim exclusion by gating the refund allocator on order.claimed_by some==false. If first compensation is insufficient, buyer has no recourse.",
           "scenario": "Buyer claims partial compensation, then discovers additional damages",
           "mitigation": "BEFORE claiming: (1) enumerate ALL disputes, (2) ensure proposition covers all damages, (3) confirm Arb ruling is final. Add explicit user confirmation (C-O-08).",
           "evidence": "operation=arb_claim_compensation, current_claimed_by=${claimed_by_display}",

package/dist/knowledge/builtin-templates.d.ts

@@ -23,8 +23,9 @@ export interface ArchetypeTemplate {
     arbitration_mode?: "none" | "merchant_pick" | "mutual_pick" | "third_party";
     time_anchors?: Record<string, string>;
 }
-export declare const BUILTIN_TEMPLATES_VERSION = 33;
+export declare const BUILTIN_TEMPLATES_VERSION = 38;
 export declare const BUILTIN_TEMPLATES: ArchetypeTemplate[];
 export declare const TEMPLATE_KEYWORDS: Record<string, string[]>;
 export declare function getBuiltinTemplate(id: string): ArchetypeTemplate | undefined;
 export declare function listBuiltinTemplates(): ArchetypeTemplate[];
+export declare function validateBuiltinTemplateCatalog(entries?: ArchetypeTemplate[]): void;