@wowok/agent-mcp 3.4.3 → 3.4.4

package/dist/knowledge/baselines/rules/arb.json.good

@@ -0,0 +1,174 @@
+{
+  "comment": "Arb rule pack (R-ARB) — declarative form of the retired in-code Arb risk rules. Facts are produced by the kernel extractor (arb-risk.ts, bound to the on-chain arb limits); rules only reference fact names. Levels/wording can be retuned per rule and rules can be disabled (enabled=false, trace left) via the judgment document — factory rules can never be deleted or invented here.",
+  "facts": {
+    "status_display": "Rendered current Arb status code ('?' when the context carries none) — evidence annotation for transition checks.",
+    "invalid_transition": "A state transition targets an invalid next state in the Arb 7-state machine.",
+    "withdraw_too_early": "The caller attempts withdraw before the post-arbitration lock duration has elapsed.",
+    "votor_count": "Number of voters recorded (or about to be recorded) on the Arb.",
+    "votor_count_at_limit": "votor_count has reached MAX_VOTOR_COUNT (chain-limit comparison sunk into the extractor).",
+    "voting_deadline_none": "voting_deadline is None (open-ended vote that never auto-expires).",
+    "expects_proposition_event": "The caller expects proposition edits to emit a discrete event.",
+    "indemnity_none": "indemnity is None (the ruling carries no compensation).",
+    "weight_concentrated": "The Arbitration rule gives disproportionate voting weight to one voter.",
+    "expects_status_enum": "The caller expects status fields to be a Move enum (they are u8 constants).",
+    "escrow_released_before_case": "Escrow refunds on the case's order predate the case filing (refund→claim ordering) — caller supplies from escrow forensics (allocation balance vs order amount; refund event timestamps vs case creation time).",
+    "escrow_deficit_display": "Rendered escrow deficit — the order principal that already flowed out of the escrow ('?' when unknown).",
+    "max_votor_count": "KERNEL CONSTANT — maximum voters per Arb (MAX_VOTOR_COUNT).",
+    "withdraw_duration_time_ms": "KERNEL CONSTANT — post-arbitration withdraw lock in milliseconds (WITHDRAW_DURATION_TIME)."
+  },
+  "rules": [
+    {
+      "rule_id": "R-ARB-01",
+      "dimension": "lifecycle",
+      "trigger": "a state transition targets an invalid next state",
+      "cases": [
+        {
+          "when": { "field": "invalid_transition", "op": "eq", "value": true },
+          "level": "high",
+          "title": "7-state machine — invalid transitions can deadlock the arbitration",
+          "description": "Arb has a 7-state machine (u8 constants, not an enum). A NEW case starts at Arbitrator_confirming(1) — Principal_confirming(0) is ONLY reachable via reset(). Forward path: 1 → Voting(2) via arbitrator_confirm → Arbitrated(3) via the ruling (indemnity set, capped at 3x order amount, enforced at award time) → Finished(5) via the compensation claim, or Objectionable(4) via objection. reset() reverts {1, 4} back to 0 and CLEARS indemnity + votes. withdraw (fee sweep) goes 5→6 immediately, or 3→6 after WITHDRAW_DURATION_TIME when no objection was filed. Each op asserts the current status; calling an op out of order aborts with E_STATUS_NOT_MATCH (3). Repeated mis-calls leave the Arb stuck in a non-terminal state with no automatic recovery.",
+          "scenario": "Caller calls vote() when status is still Arbitrator_confirming; abort blocks progress",
+          "mitigation": "Strictly validate the current status before submitting any Arb op. The SDK should expose a status-aware state machine helper. Provide a recovery path (reset) for Arbitrator_confirming and Objectionable states.",
+          "evidence": "invalid_transition=true (status=${status_display})",
+          "stakeholders": ["principal", "arbitrator", "voter"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-ARB-02",
+      "dimension": "lifecycle",
+      "trigger": "withdraw attempted before the withdraw lock duration elapses",
+      "cases": [
+        {
+          "when": { "field": "withdraw_too_early", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "WITHDRAW_DURATION_TIME=${withdraw_duration_time_ms}ms (30 days) — funds locked",
+          "description": "After arbitration, the fee Balance can only be withdrawn after WITHDRAW_DURATION_TIME=${withdraw_duration_time_ms}ms (30 days) when status is Arbitrated(3) with no objection filed (silence = acceptance). From Finished(5), withdraw is immediate. From Objectionable(4), withdraw is NEVER possible (protocol 141): a contested case keeps its fee escrowed until the principal closes the objection cycle — reset → order.arb_confirm → new ruling → unchallenged. States 0/1/2 are also rejected.",
+          "scenario": "Arbitrator finishes a case but must wait 30 days to claim the fee",
+          "mitigation": "Surface the unlock timestamp in the UI. To shorten the lock, drive the case to Finished(5) via finish() rather than leaving it in Arbitrated/Objectionable.",
+          "evidence": "withdraw_too_early=true (limit=${withdraw_duration_time_ms}ms)",
+          "stakeholders": ["principal", "arbitrator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-ARB-03",
+      "dimension": "structural",
+      "trigger": "voter count reaches MAX_VOTOR_COUNT",
+      "cases": [
+        {
+          "when": { "field": "votor_count_at_limit", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "MAX_VOTOR_COUNT=${max_votor_count} permissive — voting efficiency cost",
+          "description": "A single Arb may record up to MAX_VOTOR_COUNT=${max_votor_count} voters. The limit aborts with E_MAX_VOTOR_COUNT (6) only at the boundary. 520 voters in one Arb inflates the voted vector, slowing tally and gas, and complicates weighted-quorum reasoning.",
+          "scenario": "Arbitration allows 520 voters; tallying the vote vector is slow and gas-heavy",
+          "mitigation": "Business layer should self-limit voter count based on the Arbitration rule's quorum. For large juries, shard across multiple Arb instances or aggregate off-chain.",
+          "evidence": "votor_count=${votor_count}, limit=${max_votor_count}",
+          "stakeholders": ["voter", "arbitrator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-ARB-04",
+      "dimension": "semantic",
+      "trigger": "caller expects proposition edits to emit a discrete event",
+      "cases": [
+        {
+          "when": { "field": "expects_proposition_event", "op": "eq", "value": true },
+          "level": "low",
+          "title": "Proposition edits may not emit a discrete event — indexers must infer",
+          "description": "Editing propositions updates the proposition vector in place. Unlike state transitions (which emit ArbEvent), proposition edits may not produce a discrete event — indexers must infer changes by diffing the proposition vector across polls.",
+          "scenario": "Indexer expects a PropositionChangedEvent; none is emitted, UI fails to refresh",
+          "mitigation": "External indexers should poll the proposition vector. UI should display 'propositions may have changed' on each poll rather than relying on event-driven refresh.",
+          "evidence": "expects_proposition_event=true (poll instead)",
+          "stakeholders": ["arbitrator", "voter"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-ARB-05",
+      "dimension": "semantic",
+      "trigger": "voting_deadline is None (open-ended vote)",
+      "cases": [
+        {
+          "when": { "field": "voting_deadline_none", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "voting_deadline is Option<u64> — None means open-ended vote",
+          "description": "voting_deadline is Option<u64>. When None, voting has no deadline (open-ended) and E_VOTING_DEADLINE_PASSED (7) never triggers. When Some(t), vote() aborts if clock.timestamp_ms() > t. Callers who assume a default deadline may be surprised by an open-ended vote that never finalizes.",
+          "scenario": "Voter assumes a deadline; voting_deadline is None and the case stalls indefinitely",
+          "mitigation": "Document that None means open-ended. Arbitrators should set an explicit deadline when confirming the case unless they intend an open vote. SDK should surface voting_deadline prominently.",
+          "evidence": "voting_deadline_none=true (open-ended vote)",
+          "stakeholders": ["voter", "arbitrator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-ARB-06",
+      "dimension": "semantic",
+      "trigger": "indemnity is None (no compensation)",
+      "cases": [
+        {
+          "when": { "field": "indemnity_none", "op": "eq", "value": true },
+          "level": "low",
+          "title": "indemnity is Option<Indemnity> — None means no compensation",
+          "description": "indemnity is Option<Indemnity>. When None, the arbitration produces no compensation (e.g. a pure declaratory ruling). Consumers who assume a non-null indemnity will mis-handle None cases. finish() returns the indemnity amount (0 when None).",
+          "scenario": "Principal expects compensation; indemnity is None and finish() returns 0",
+          "mitigation": "Document that None means no compensation. UI should show 'no compensation awarded' rather than 'compensation pending'.",
+          "evidence": "indemnity_none=true (no compensation)",
+          "stakeholders": ["principal"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-ARB-07",
+      "dimension": "permission",
+      "trigger": "the Arbitration rule concentrates weight in one voter",
+      "cases": [
+        {
+          "when": { "field": "weight_concentrated", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "Voted.weight is set by the Arbitration rule — concentrated weight risk",
+          "description": "Voted.weight (u32) is assigned by the Arbitration object's voting_guard logic, not by the voter. If the Arbitration rule concentrates weight in one voter (e.g. an admin with weight 1000 vs. others with weight 1), a single voter can dictate the outcome. The Arb contract itself does not detect concentration — that is the Arbitration designer's responsibility.",
+          "scenario": "Arbitration rule gives one voter weight 1000; that voter single-handedly decides the case",
+          "mitigation": "Weight does NOT gate verdicts on-chain (any single ballot yields an executable verdict — M-F), so capping weight changes nothing. Integrity comes from ADMISSION: keep the voting_guard roster tight and grant arbitration permission 358 only to intended voters.",
+          "evidence": "weight_concentrated=true (rule-level risk)",
+          "stakeholders": ["voter", "arbitrator"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-ARB-08",
+      "dimension": "semantic",
+      "trigger": "caller expects a Move enum for statuses",
+      "cases": [
+        {
+          "when": { "field": "expects_status_enum", "op": "eq", "value": true },
+          "level": "low",
+          "title": "Status uses u8 constants — Move enum is commented out",
+          "description": "The 7 statuses are defined as u8 constants (Status_Principal_confirming=0, etc.). The Move enum definition is commented out. Consumers cannot rely on a type-safe enum and must compare against magic numbers. A future Wow release enabling the enum would be a breaking change to downstream code.",
+          "scenario": "Developer expects a Status enum; only u8 constants are available, causing type errors",
+          "mitigation": "SDK should expose a TypeScript enum mirroring the u8 constants. Document that the Move enum is intentionally disabled and may be enabled in a future version.",
+          "evidence": "expects_status_enum=true (only u8 constants exist)",
+          "stakeholders": ["system"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-ARB-09",
+      "dimension": "semantic",
+      "trigger": "escrow refunds on the case's order predate the case filing",
+      "cases": [
+        {
+          "when": { "field": "escrow_released_before_case", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Refund-then-claim ordering — the principal may recover twice",
+          "description": "The order's escrow was already released BEFORE this case was filed (deficit ${escrow_deficit_display}). Neither ordering is closed on-chain (the on-chain order deliberately ships no receive-gate): after this claim settles the refund allocator can still split the remaining escrow unless its Guard is gated on order.claimed_by some==false. The discriminating evidence is fully on-chain: (1) refund/alloc event timestamps vs the case creation time — the decisive ordering signal; (2) escrow balance vs order amount (the deficit); (3) the order's progress path (visited refund terminals); (4) the owner receive history.",
+          "scenario": "Buyer collects a refund via the refund track, then files a dispute and claims the indemnity on top",
+          "mitigation": "At ruling time the netting is polarity-bound (rex5 B-66): payouts released TO THE ORDER (buyer-side refund rail, per Payment record recipients) → net the indemnity against the refunded principal, compensate the delta; payouts released to NON-order recipients (merchant/Entity settlement or recover) → the buyer's loss is the FULL price and the indemnity must NOT be reduced. A positive deficit alone proves only that money left the escrow, never who received it. The defendant attaches the escrow forensics (with per-payout polarity) to the case statement.",
+          "evidence": "escrow_released_before_case=true (deficit=${escrow_deficit_display})",
+          "stakeholders": ["principal", "arbitrator", "voter"]
+        }
+      ]
+    }
+  ]
+}

package/dist/knowledge/baselines/rules/arbitration.json.good

@@ -0,0 +1,393 @@
+{
+  "comment": "Arbitration rule pack (R-AB) — declarative form of the retired in-code Arbitration risk rules (objectType 'arb', L1/L2 assess path). Facts are produced by the kernel extractor (arbitration-risk.ts, bound to the arbitration ledger and on-chain fee/vote semantics); rules only reference fact names. Levels/wording can be retuned per rule and rules can be disabled (enabled=false, trace left) via the judgment document — factory rules can never be deleted or invented here.",
+  "facts": {
+    "voting_guard_add_set": "The context carries a voting_guard add/set op (a projected voting_guard list mutation).",
+    "voting_guard_new_count": "Projected voting_guard entry count after the op: guards.length for 'set', current on-chain count + guards.length for 'add'.",
+    "max_voting_guard_count": "KERNEL CONSTANT — on-chain MAX_VOTING_GUARD_COUNT bound imported from @wowok/wowok.",
+    "voting_guard_count_exceeded": "True when the projected voting_guard entry count exceeds MAX_VOTING_GUARD_COUNT (first-hit scan of the guards list).",
+    "dispute_present": "The context carries a dispute payload (truthy ctx.dispute).",
+    "dispute_fee_insufficient": "True when the dispute fee (balance form) is below the current on-chain arbitration fee (BigInt comparison, mirroring E_FEE_NOT_ENOUGH).",
+    "dispute_fee_provided": "Dispute fee balance rendered in base units (BigInt string form).",
+    "arbitration_fee_required": "Current on-chain arbitration fee rendered in base units (BigInt string form).",
+    "current_bPaused": "Echo of the on-chain Arbitration.bPaused flag (strict boolean).",
+    "voting_deadline_selected": "The voting_deadline under review (confirm.voting_deadline, else voting_deadline_change.voting_deadline).",
+    "current_timestamp_ms": "Echo of the current clock reading used for the deadline comparison.",
+    "voting_deadline_in_past": "True when the selected voting_deadline is already elapsed at the current timestamp.",
+    "vote_voting_guard": "The Guard id the vote claims (vote.voting_guard).",
+    "vote_present": "The context carries a vote op payload (plain or weighted).",
+    "voting_guard_list_empty": "True when the on-chain Arbitration.voting_guard list is missing or empty.",
+    "vote_guard_registered": "True when the claimed vote Guard is found in the on-chain voting_guard list.",
+    "registered_voting_guards": "Comma-joined on-chain voting_guard address list (display form).",
+    "weight_guard_identifier_over": "True when a submitted vote_weight.GuardIdentifier exceeds the u8 bound (first offender in list order wins).",
+    "weight_guard_identifier_value": "The offending GuardIdentifier value.",
+    "weight_fixed_over": "True when a submitted vote_weight.FixedValue exceeds the u32 bound (first offender in list order wins).",
+    "weight_fixed_value": "The offending FixedValue value.",
+    "weight_collusion_dominant": "True when at least 2 guards carry fixed weights and one fixed weight controls more than 50% of the fixed-weight total.",
+    "weight_max": "Largest single fixed vote weight in the submission.",
+    "weight_total": "Sum of all fixed vote weights in the submission.",
+    "weight_ratio_pct": "Dominance ratio (max/total) in percent with one decimal place (display string).",
+    "builder": "Echo of the target owner address for an ownership transfer (ctx.builder).",
+    "arbitration_op_present": "The context carries an arbitration (ruling) op payload.",
+    "current_arb_status": "Echo of the current on-chain Arb status.",
+    "expected_arb_status": "Echo of the Arb status the operation expects.",
+    "arb_transition_invalid": "True when current → expected is not a valid 7-state flow transition (arbitration-ledger kernel).",
+    "arb_status_terminal": "True when the current Arb status is terminal (Finished/Withdrawn).",
+    "arb_terminal_op_blocked": "True when a non-withdraw operation targets a terminal Arb.",
+    "reset_present": "The context carries a reset op payload (truthy ctx.reset).",
+    "reset_arb": "Target Arb object id of the reset op (display form).",
+    "fees_transfer_present": "The context carries a fees_transfer op payload.",
+    "fees_transfer_dest": "Rendered transfer destination: 'Allocation <id>' or 'Treasury <id>'.",
+    "fees_transfer_remark": "Rendered payment remark of the fees_transfer op.",
+    "dispute_order": "Order object id the dispute is filed against (display form)."
+  },
+  "rules": [
+    {
+      "rule_id": "R-AB-1-01",
+      "dimension": "structural",
+      "trigger": "voting_guard count exceeds MAX_VOTING_GUARD_COUNT (50)",
+      "cases": [
+        {
+          "when": { "field": "voting_guard_count_exceeded", "op": "eq", "value": true },
+          "level": "high",
+          "title": "voting_guard count exceeds limit",
+          "description": "voting_guard would have ${voting_guard_new_count} entries, exceeds MAX_VOTING_GUARD_COUNT ${max_voting_guard_count}",
+          "scenario": "Adding too many voting guards",
+          "mitigation": "Remove unused guards before adding new ones; max ${max_voting_guard_count}",
+          "evidence": "count=${voting_guard_new_count}",
+          "stakeholders": ["owner", "arbiter"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-1-02",
+      "dimension": "structural",
+      "trigger": "Dispute fee below arbitration.fee threshold",
+      "cases": [
+        {
+          "when": { "field": "dispute_fee_insufficient", "op": "eq", "value": true },
+          "level": "critical",
+          "title": "Dispute fee insufficient (E_FEE_NOT_ENOUGH)",
+          "description": "Provided fee ${dispute_fee_provided} < required ${arbitration_fee_required}",
+          "scenario": "Filing dispute with insufficient fee",
+          "mitigation": "Increase dispute.fee.balance to >= ${arbitration_fee_required}",
+          "evidence": "provided=${dispute_fee_provided}, required=${arbitration_fee_required}",
+          "stakeholders": ["disputant"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-1-03",
+      "dimension": "structural",
+      "trigger": "Arbitration paused (bPaused=true) — dispute will fail with E_PAUSED",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "dispute_present", "op": "eq", "value": true },
+            { "field": "current_bPaused", "op": "eq", "value": true }
+          ] },
+          "level": "high",
+          "title": "Arbitration paused — cannot file dispute",
+          "description": "Arbitration.bPaused=true; dispute() will abort with E_PAUSED",
+          "scenario": "Filing dispute against a paused Arbitration",
+          "mitigation": "Call pause(false) (requires ARBITRATION_PAUSE=356) to resume",
+          "evidence": "bPaused=true",
+          "stakeholders": ["disputant"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-1-04",
+      "dimension": "structural",
+      "trigger": "voting_deadline in the past — vote will be rejected",
+      "cases": [
+        {
+          "when": { "field": "voting_deadline_in_past", "op": "eq", "value": true },
+          "level": "high",
+          "title": "voting_deadline in the past",
+          "description": "Deadline ${voting_deadline_selected} is before current time ${current_timestamp_ms}",
+          "scenario": "Setting voting deadline to an already-elapsed timestamp",
+          "mitigation": "Use a future timestamp (e.g. now + 7 days in ms)",
+          "evidence": "deadline=${voting_deadline_selected}, now=${current_timestamp_ms}",
+          "stakeholders": ["voter", "arbiter"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-2-01",
+      "dimension": "semantic",
+      "trigger": "voting_guard misconfiguration — dispute cannot be resolved",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "vote_voting_guard", "op": "truthy" },
+            { "field": "voting_guard_list_empty", "op": "eq", "value": true }
+          ] },
+          "level": "high",
+          "title": "voting_guard misconfiguration — dispute cannot be resolved",
+          "description": "vote.voting_guard provided but Arbitration.voting_guard is empty; E_VOTING_GUARD_NOT_FOUND will abort",
+          "scenario": "voting_guard misconfiguration prevents vote — dispute stuck",
+          "mitigation": "Either add the Guard to the voting_guard list (354) or use an open vote without a voting_guard list",
+          "evidence": "vote.voting_guard=${vote_voting_guard}",
+          "stakeholders": ["voter", "arbiter", "disputant"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "A dispute that cannot proceed to a vote cannot produce a ruling — the disputant's compensation path stalls until the voting_guard setup is repaired." }
+            ],
+            "gain_paths": []
+          }
+        },
+        {
+          "when": { "all": [
+            { "field": "vote_voting_guard", "op": "truthy" },
+            { "field": "voting_guard_list_empty", "op": "eq", "value": false },
+            { "field": "vote_guard_registered", "op": "eq", "value": false }
+          ] },
+          "level": "high",
+          "title": "voting_guard misconfiguration — dispute cannot be resolved",
+          "description": "vote.voting_guard ${vote_voting_guard} not in Arbitration.voting_guard list",
+          "scenario": "Voter's Guard not registered — vote will fail with E_VOTING_GUARD_NOT_FOUND",
+          "mitigation": "Add guard ${vote_voting_guard} via voting_guard_add (354), or use a registered guard",
+          "evidence": "provided=${vote_voting_guard}, registered=${registered_voting_guards}",
+          "stakeholders": ["voter", "arbiter", "disputant"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "A dispute that cannot proceed to a vote cannot produce a ruling — the disputant's compensation path stalls until the voting_guard setup is repaired." }
+            ],
+            "gain_paths": []
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-2-03",
+      "dimension": "semantic",
+      "trigger": "VoteValue.GuardIdentifier with non-numeric Guard submission type",
+      "cases": [
+        {
+          "when": { "field": "weight_guard_identifier_over", "op": "eq", "value": true },
+          "level": "high",
+          "title": "GuardIdentifier index > u8::max (255)",
+          "description": "GuardIdentifier ${weight_guard_identifier_value} exceeds u8 max (255)",
+          "scenario": "Setting GuardIdentifier index beyond u8 range",
+          "mitigation": "Use GuardIdentifier index 0-255",
+          "evidence": "identifier=${weight_guard_identifier_value}",
+          "stakeholders": ["owner"]
+        },
+        {
+          "when": { "field": "weight_fixed_over", "op": "eq", "value": true },
+          "level": "high",
+          "title": "FixedValue > u32::max (4294967295)",
+          "description": "FixedValue ${weight_fixed_value} exceeds u32 max",
+          "scenario": "Setting FixedValue beyond u32 range",
+          "mitigation": "Use FixedValue 0-4294967295",
+          "evidence": "fixed=${weight_fixed_value}",
+          "stakeholders": ["owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-2-04",
+      "dimension": "semantic",
+      "trigger": "Plain (open) vote on an Arbitration with an empty voting_guard — NOT permissionless",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "vote_present", "op": "eq", "value": true },
+            { "field": "voting_guard_list_empty", "op": "eq", "value": true }
+          ] },
+          "level": "medium",
+          "title": "Open vote is permission-gated (358), not permissionless",
+          "description": "voting_guard is empty (equal weight, 1 person 1 vote) but vote() still asserts ARBITRATION_VOTE=358 — an account without 358 is rejected with E_PERMISSION_DENIED (code 5)",
+          "scenario": "Assuming 'empty voting_guard' means anyone can vote",
+          "mitigation": "Grant ARBITRATION_VOTE=358 to every intended voter via the Arbitration's Permission object; or configure a voting_guard list (354) for weighted voting",
+          "evidence": "voting_guard=empty",
+          "stakeholders": ["voter", "arbiter", "disputant"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "If 358 is not granted to the disputant, the disputant cannot vote in their own case — the ruling proceeds without their input." }
+            ],
+            "gain_paths": []
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-3-01",
+      "dimension": "authority",
+      "trigger": "Arbiter collusion — single voter controls >50% of total weight",
+      "cases": [
+        {
+          "when": { "field": "weight_collusion_dominant", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "Arbiter collusion risk — single guard controls >50% weight",
+          "description": "One voting_guard has ${weight_max} of ${weight_total} total weight (${weight_ratio_pct}%)",
+          "scenario": "Weighted voting with dominant arbiter — can single-handedly decide rulings",
+          "mitigation": "Distribute weight more evenly, or require multi-arbiter consensus",
+          "evidence": "max=${weight_max}, total=${weight_total}, ratio=${weight_ratio_pct}%",
+          "stakeholders": ["owner", "disputant"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "A single dominant voter can decide compensation rulings alone — the disputant's claim outcome rests on one party's discretion." }
+            ],
+            "gain_paths": [
+              {
+                "role": "neutral",
+                "path": "The dominant guard rules in favor of whoever can influence it, deciding the payout direction single-handedly.",
+                "viability": "conditional",
+                "gate": "Executes only if the dominant guard is actually captured or biased — the rule flags weight concentration, not an observed influence."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-3-02",
+      "dimension": "authority",
+      "trigger": "Permission over-concentration — single admin (owner)",
+      "cases": [
+        {
+          "when": { "field": "builder", "op": "truthy" },
+          "level": "high",
+          "title": "Arbitration ownership transfer — IRREVERSIBLE",
+          "description": "Transferring Arbitration to ${builder}; original owner loses all control permanently",
+          "scenario": "Transferring Arbitration ownership",
+          "mitigation": "1) Verify new owner twice. 2) Confirm new owner has 350-368 permissions configured. 3) Coordinate before transfer.",
+          "evidence": "new_owner=${builder}",
+          "stakeholders": ["owner"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "arbitrator", "basis": "The original owner loses all control permanently — including fee-withdrawal rights over the arbitration balance." }
+            ],
+            "gain_paths": [
+              {
+                "role": "neutral",
+                "path": "Whichever address is submitted becomes the arbitration owner with full 350-368 permission control and fee-withdrawal rights.",
+                "viability": "viable",
+                "gate": "No destination verification on-chain — the transfer executes as submitted and cannot be undone."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-3-03",
+      "dimension": "authority",
+      "trigger": "ARBITRATION_ARBITRATION (359) granted to wide audience",
+      "cases": [
+        {
+          "when": { "all": [
+            { "field": "arbitration_op_present", "op": "eq", "value": true },
+            { "field": "voting_guard_list_empty", "op": "eq", "value": true }
+          ] },
+          "level": "medium",
+          "title": "Ruling without voting_guard — single-arbiter can rule unchallenged",
+          "description": "Ruling (359) without a voting_guard restriction means any permission holder can unilaterally decide",
+          "scenario": "Single-arbiter Arbitration without consensus check",
+          "mitigation": "Configure voting_guard (354) to require multi-arbiter consensus before ruling",
+          "evidence": "voting_guard=empty",
+          "stakeholders": ["disputant", "voter"],
+          "exposure": {
+            "loss_parties": [
+              { "role": "buyer", "basis": "Without a consensus check the dispute outcome rests on one holder's unilateral decision — no multi-arbiter balance protects the claim." }
+            ],
+            "gain_paths": [
+              {
+                "role": "neutral",
+                "path": "A 359-permission holder rules unilaterally in favor of whichever party benefits from the payout direction.",
+                "viability": "conditional",
+                "gate": "Executes only if a ruling holder actually abuses the unrestricted power — the rule flags the missing consensus check, not an observed abuse."
+              }
+            ]
+          }
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-4-01",
+      "dimension": "lifecycle",
+      "trigger": "Invalid Arb status transition (7-state flow violation)",
+      "cases": [
+        {
+          "when": { "field": "arb_transition_invalid", "op": "eq", "value": true },
+          "level": "critical",
+          "title": "Invalid Arb status transition",
+          "description": "${current_arb_status} → ${expected_arb_status} is not a valid 7-state flow transition",
+          "scenario": "Attempting operation out of order (e.g. vote before confirm)",
+          "mitigation": "Follow the 7-state flow: Principal_confirming → Arbitrator_confirming → Voting → Arbitrated → Objectionable → Finished/Withdrawn",
+          "evidence": "${current_arb_status} → ${expected_arb_status}",
+          "stakeholders": ["arbiter", "disputant"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-4-02",
+      "dimension": "lifecycle",
+      "trigger": "Operation on terminal Arb status (Finished/Withdrawn)",
+      "cases": [
+        {
+          "when": { "field": "arb_terminal_op_blocked", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Operation on terminal Arb status — irreversible",
+          "description": "Arb is in terminal status ${current_arb_status}; only the fee withdrawal is allowed",
+          "scenario": "Voting/ruling/reset on a Finished or Withdrawn Arb",
+          "mitigation": "Open a new Arb case via a new dispute filing if further arbitration is needed",
+          "evidence": "status=${current_arb_status}",
+          "stakeholders": ["arbiter", "disputant"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-4-03",
+      "dimension": "lifecycle",
+      "trigger": "reset operation — may indefinitely extend arbitration",
+      "cases": [
+        {
+          "when": { "field": "reset_present", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "reset operation — arbitration lifecycle extended",
+          "description": "reset on Arb ${reset_arb} restarts lifecycle to Principal_confirming; feedback required",
+          "scenario": "Disputant objects to ruling and resubmits materials",
+          "mitigation": "Track reset count — consider capping resets to prevent abuse",
+          "evidence": "arb=${reset_arb}",
+          "stakeholders": ["arbiter", "disputant"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-5-01",
+      "dimension": "cross_object",
+      "trigger": "fee allocation / transfer unfair distribution — destination not verified",
+      "cases": [
+        {
+          "when": { "field": "fees_transfer_present", "op": "eq", "value": true },
+          "level": "medium",
+          "title": "Fee allocation / transfer — verify destination fairness",
+          "description": "All Arbitration.balance will be transferred to ${fees_transfer_dest}; ensure destination policy is fair to arbiters",
+          "scenario": "Distributing arbitration fees without verifying allocation rules",
+          "mitigation": "Verify ${fees_transfer_dest} has fair distribution policy; consider allocating to arbiters' Allocation",
+          "evidence": "dest=${fees_transfer_dest}, remark=${fees_transfer_remark}",
+          "stakeholders": ["arbiter", "owner"]
+        }
+      ]
+    },
+    {
+      "rule_id": "R-AB-5-02",
+      "dimension": "cross_object",
+      "trigger": "Dispute filed but Order op permission not verified — E_NOT_OP_PERMISSION",
+      "cases": [
+        {
+          "when": { "field": "dispute_present", "op": "eq", "value": true },
+          "level": "high",
+          "title": "Order op permission required for dispute",
+          "description": "dispute on Order ${dispute_order} requires the Order's operation-permission check; signer must have Order's dispute permission",
+          "scenario": "Filing dispute without Order op permission",
+          "mitigation": "Ensure signer has Order's dispute operation permission (custom index or builtin)",
+          "evidence": "order=${dispute_order}",
+          "stakeholders": ["disputant"]
+        }
+      ]
+    }
+  ]
+}