failproofai 1.0.7-beta.1 → 1.0.7

package/src/hooks/policy-authority.ts

@@ -1,333 +0,0 @@
-/**
- * Policy authority: who has the last word on a policy's deny or instruct once
- * Jev is configured. See {@link PolicyAuthority} for the two values and
- * `docs/policies/authority.mdx` for the builtin table.
- *
- * Every route a policy arrives by — a builtin, the user's own policy file, an
- * installed pack, a cloud assignment — declares its authority somewhere
- * different. This module is the one place those declarations are read and
- * judged, so the rule cannot drift between them:
- *
- * - `hard` is the default and the answer to anything unclear. Absent, a value
- *   that is not one of the two, a `reviewedBy` that is empty or malformed or
- *   names a check this build does not have, or an `alwaysOn` policy: all hard.
- * - `reviewable` means Jev may clear the policy's verdict — and only through the
- *   semantic policies it names, every one of which must have been asked.
- *
- * Nothing here decides anything at evaluation time. It resolves a declaration
- * once, at registration, and `registerPolicy` stores the result, so what sits in
- * the registry is already the effective authority.
- */
-import { existsSync } from "node:fs";
-import { jevConfigFile } from "./fp-home";
-import { hookLogWarn } from "./hook-logger";
-import { effectiveAuthority } from "./policy-types";
-import type { CustomHook, PolicyAuthority, PolicyCatalogEntry } from "./policy-types";
-
-/**
- * A declaration as it arrives, before anything has vouched for it. Fields are
- * `unknown` because three of the four sources are files on disk written by
- * somebody else.
- */
-export interface AuthorityDeclaration {
-  authority?: unknown;
-  reviewedBy?: unknown;
-  /** The self-protection guard. Always hard, whatever else it says. */
-  alwaysOn?: boolean;
-}
-
-/** The shape-valid authority fields a parsed record (a pack entry, a cloud assignment) carries. */
-export interface AuthorityFields {
-  authority?: PolicyAuthority;
-  reviewedBy?: string[];
-}
-
-/** What a registered policy carries: already judged, and honest to its type. */
-export interface ResolvedAuthority {
-  authority: PolicyAuthority;
-  /** Present exactly when `authority` is `reviewable`. Deduplicated, in declared order. */
-  reviewedBy?: string[];
-  /**
-   * Why a `reviewable` declaration was not honored, for a warning. Absent when
-   * nothing asked for `reviewable` — a policy that is simply hard is not news.
-   */
-  downgraded?: string;
-}
-
-/**
- * The names `reviewedBy` may use: the semantic policies in
- * `src/hooks/semantic/policies.ts`. Not the probes (`INJECTION_PROBE`,
- * `SCOPE_PROBE`, the task probes) — those are inputs to Jev's decision, not
- * checks a regex verdict can be cleared by.
- *
- * Written out rather than read off `SEMANTIC_POLICIES`, and pinned to it by
- * `policy-authority.test.ts`. The registry imports this module, so a runtime
- * import of the semantic policies would load all sixteen of Jev's prompts on
- * every hook event of a machine that never configured Jev, and bundle them into
- * every pack artifact that registers a policy.
- */
-export const SEMANTIC_POLICY_NAMES = [
-  "destructive-deletion",
-  "production-infra-change",
-  "git-history-rewrite",
-  "push-to-protected-branch",
-  "commit-on-protected-branch",
-  "secret-exposure",
-  "credential-exfiltration",
-  "remote-code-execution",
-  "privilege-escalation",
-  "database-destruction",
-  "read-outside-workspace",
-  "agent-config-tampering",
-  "system-modification",
-  "env-secrets-dump",
-  "external-destructive-action",
-  "external-data-egress",
-] as const;
-
-/**
- * The compiled-in reviewer set, and the DEFAULT rather than the only one.
- *
- * A pack that declares its own `semantic` entries replaces
- * `SEMANTIC_POLICIES` wholesale on the machine that installed it, so the names
- * a `reviewedBy` may use there are the pack's. Callers that know which set is
- * live pass it (`effectiveReviewerNames()` in `pack-manifest.ts`, which reads
- * the manifest and imports nothing from `semantic/`); everyone else gets this
- * one, which is what a machine with no pack runs.
- */
-export const SEMANTIC_REVIEWER_NAMES: ReadonlySet<string> = new Set(SEMANTIC_POLICY_NAMES);
-
-const isName = (n: unknown): n is string => typeof n === "string" && n.length > 0;
-
-/**
- * Judge one declaration.
- *
- * Stricter than `effectiveAuthority`, which is the §7 contract and needs only
- * one usable name: here EVERY entry must be a semantic policy this build has,
- * and anything else makes the whole declaration hard rather than being dropped.
- * `reviewedBy` is a conjunction, so dropping a name the author wrote — a typo, a
- * stray `7` — would let Jev clear the policy on fewer checks than they asked
- * for. It is also the safe direction for version skew: a pack built against a
- * newer semantic set, installed on an older build, enforces as hard rather than
- * as reviewable-by-less.
- *
- * What this returns is what `registerPolicy` stores, so a registered policy's
- * `reviewedBy` is always clean and the two functions agree on it.
- *
- * @param knownReviewers - the semantic policies that CAN be asked on this
- *   machine. Defaults to the compiled-in set, which is what runs until a pack
- *   ships its own; see {@link SEMANTIC_REVIEWER_NAMES}. It is a parameter rather
- *   than a lookup because this module is imported by the registry, and reading
- *   which set is live means reading a file — a cost registration is willing to
- *   pay once and this judgement must not pay per call.
- */
-export function resolvePolicyAuthority(
-  decl: AuthorityDeclaration | undefined,
-  knownReviewers: ReadonlySet<string> = SEMANTIC_REVIEWER_NAMES,
-): ResolvedAuthority {
-  const declaredReviewable = decl?.authority === "reviewable";
-  if (!decl || effectiveAuthority(decl) === "hard") {
-    if (!declaredReviewable) return { authority: "hard" };
-    return { authority: "hard", downgraded: whyHard(decl!) };
-  }
-  const names = decl.reviewedBy as unknown[];
-  if (!names.every(isName)) {
-    return { authority: "hard", downgraded: "reviewedBy is not a list of semantic policy names" };
-  }
-  const unknown = names.filter((n) => !knownReviewers.has(n));
-  if (unknown.length > 0) {
-    return {
-      authority: "hard",
-      downgraded:
-        `reviewedBy names ${unknown.map((n) => JSON.stringify(n)).join(", ")}, ` +
-        `which ${unknown.length === 1 ? "is not a semantic policy" : "are not semantic policies"} in this build`,
-    };
-  }
-  return { authority: "reviewable", reviewedBy: [...new Set(names)] };
-}
-
-function whyHard(decl: AuthorityDeclaration): string {
-  if (decl.alwaysOn === true) return "it is alwaysOn, and the self-protection guard is never reviewable";
-  if (!Array.isArray(decl.reviewedBy) || decl.reviewedBy.length === 0) {
-    return "reviewedBy does not name any semantic policy";
-  }
-  return "reviewedBy is not a list of semantic policy names";
-}
-
-/**
- * The shape-valid authority fields of a serialized policy entry, for parsers.
- *
- * Invalid fields are DROPPED, never thrown on. A pack or cloud deployment that
- * is refused over a typo in an optional field fails closed and denies every
- * tool call its policies cover; dropping the field makes that one policy hard,
- * which is the default the typo would have produced at registration anyway.
- * Names are not checked against the semantic set here — that is a property of
- * the build reading the entry, not of the entry, and is judged at registration.
- */
-export function authorityFieldsOf(raw: Record<string, unknown>): AuthorityFields {
-  const out: AuthorityFields = {};
-  if (raw.authority === "hard" || raw.authority === "reviewable") out.authority = raw.authority;
-  const list = raw.reviewedBy;
-  if (Array.isArray(list) && list.length > 0 && list.every(isName)) {
-    out.reviewedBy = [...(list as string[])];
-  }
-  return out;
-}
-
-/**
- * Why a declaration cannot be PUBLISHED as written, or `undefined` when it can.
- *
- * For build steps — `scripts/build-policy-pack.mjs` and `failproofai publish`.
- * The loaders drop a malformed field and registration downgrades a refused
- * `reviewable`, both toward hard and both only as a warning, because by then the
- * pack is installed and refusing it would fail it closed. At build time nothing
- * is installed yet, so refusing costs nobody anything, while shipping the
- * declaration would make the policy silently hard on every machine that
- * installs it — a decision its author made, quietly not taking effect.
- *
- * An empty `reviewedBy` on a hard policy is not a problem: it says nothing.
- */
-export function authorityProblem(
-  decl: AuthorityDeclaration,
-  /**
-   * The reviewers the pack being built will SHIP WITH — its own `semantic`
-   * entries when it declares any, this build's set otherwise. A pack that
-   * carries both halves of the two-tier set names its own checks, and refusing
-   * that would make the feature unpublishable by the tool that implements it.
-   */
-  knownReviewers: ReadonlySet<string> = SEMANTIC_REVIEWER_NAMES,
-): string | undefined {
-  if (decl.authority !== undefined && decl.authority !== "hard" && decl.authority !== "reviewable") {
-    const t = typeof decl.authority;
-    return `authority must be "hard" or "reviewable", and is ${t === "string" ? JSON.stringify(decl.authority) : `${/^[aeiou]/.test(t) ? "an" : "a"} ${t}`}`;
-  }
-  if (decl.reviewedBy !== undefined && !(Array.isArray(decl.reviewedBy) && decl.reviewedBy.every(isName))) {
-    return "reviewedBy must be a list of semantic policy names";
-  }
-  const { downgraded } = resolvePolicyAuthority(decl, knownReviewers);
-  return downgraded ? `authority "reviewable" was refused — ${downgraded}` : undefined;
-}
-
-/**
- * The authority fields a pack MANIFEST should carry for one entry: resolved, as
- * the registry will store them, so the manifest says exactly what takes effect.
- * Throws, naming the entry, on anything {@link authorityProblem} refuses.
- */
-export function manifestAuthority(
-  entry: AuthorityDeclaration & { name: string },
-  knownReviewers: ReadonlySet<string> = SEMANTIC_REVIEWER_NAMES,
-): {
-  authority: PolicyAuthority;
-  reviewedBy?: string[];
-} {
-  const problem = authorityProblem(entry, knownReviewers);
-  if (problem) throw new Error(`${entry.name}: ${problem}`);
-  const { authority, reviewedBy } = resolvePolicyAuthority(entry, knownReviewers);
-  return reviewedBy ? { authority, reviewedBy } : { authority };
-}
-
-/**
- * One authority for several declarations that land on ONE registration.
- *
- * Artifacts are content-addressed, so two cloud assignments or two packs whose
- * code is byte-identical load as one policy (the collapse in
- * `custom-hooks-loader.ts`). Keeping one of their declarations would let the
- * order of `active.json` or `installed.json` decide — and let one pack's
- * manifest, or one team's assignment, make another's policy reviewable.
- *
- * So it resolves toward HARD, the way the collapse resolves the effect toward
- * enforce: reviewable only when EVERY declaration resolves to reviewable, and
- * then through the UNION of their checks (more checks that must all come back
- * clear is stricter, never weaker). Otherwise it takes the first declaration
- * that is not reviewable, so a refused one is still reported at registration.
- *
- * Returns `record` itself when its own fields already say that, and a copy with
- * only the two authority fields replaced otherwise. `overruled` is true when
- * some declaration asked for reviewable, validly, and did not get it.
- */
-export function withMergedAuthority<T extends AuthorityFields>(
-  record: T,
-  declarations: ReadonlyArray<AuthorityFields>,
-): { merged: T; overruled: boolean } {
-  const resolved = declarations.map((d) => resolvePolicyAuthority(d));
-  const allReviewable = resolved.length > 0 && resolved.every((r) => r.authority === "reviewable");
-  const fields: AuthorityFields = allReviewable
-    ? { authority: "reviewable", reviewedBy: [...new Set(resolved.flatMap((r) => r.reviewedBy ?? []))] }
-    : fieldsOf(declarations[resolved.findIndex((r) => r.authority !== "reviewable")] ?? {});
-  const overruled = !allReviewable && resolved.some((r) => r.authority === "reviewable");
-  const same =
-    record.authority === fields.authority &&
-    JSON.stringify(record.reviewedBy) === JSON.stringify(fields.reviewedBy);
-  if (same) return { merged: record, overruled };
-  const { authority: _a, reviewedBy: _r, ...rest } = record;
-  return { merged: { ...rest, ...fields } as T, overruled };
-}
-
-/** The authority fields a record actually carries, and nothing else. */
-function fieldsOf(d: AuthorityFields): AuthorityFields {
-  return {
-    ...(d.authority !== undefined ? { authority: d.authority } : {}),
-    ...(d.reviewedBy !== undefined ? { reviewedBy: d.reviewedBy } : {}),
-  };
-}
-
-const warnedAuthority = new Set<string>();
-
-/**
- * Say that an authority declaration was not honored — once per process, and
- * only once Jev is configured (a global `jev.json` exists).
- *
- * Without Jev, authority decides nothing, so there is nothing to tell anyone —
- * and a warning is not free: it goes to the hook's stderr, which some CLIs show
- * as the deny text itself, on every event, for every machine that installed a
- * pack built against a newer semantic set. Once per process keeps the daemon's
- * warm worker from repeating it for every tool call. Authors are told at build
- * time as well: `failproofai publish` refuses what this would warn about.
- *
- * Presence of the file rather than a validated load: a machine where someone
- * has started configuring Jev is where the answer to "why does Jev never clear
- * this policy" is wanted, and a stat keeps the semantic modules unloaded.
- */
-export function warnAuthority(message: string): void {
-  try {
-    if (!existsSync(jevConfigFile())) return;
-  } catch {
-    return;
-  }
-  if (warnedAuthority.has(message)) return;
-  warnedAuthority.add(message);
-  hookLogWarn(message);
-}
-
-/**
- * Where a loaded hook's authority is declared, by the route it arrived on.
- *
- * - **Cloud-managed:** the artifact record in the active deployment. A cloud
- *   policy's authority is a central decision, so code inside the artifact
- *   cannot grant itself `reviewable`.
- * - **Pack:** the pack's own manifest entry for that policy, matched by name —
- *   the same place its `params` schema is read from. A pack can only ever
- *   describe its own policies this way: its names cannot contain `/`, and they
- *   register under `pack/<id>@<version>/`, so no manifest can reach a builtin
- *   or another pack's policy. A policy the artifact registers but the manifest
- *   does not declare has no entry and is hard. When packs share one artifact,
- *   the loader has already merged their entries toward hard
- *   ({@link withMergedAuthority}), so no one of them decides for the others.
- * - **The user's own file:** the hook itself.
- */
-export function authorityDeclarationFor(
-  hook: Pick<CustomHook, "name" | "authority" | "reviewedBy">,
-  source: {
-    cloudManaged?: { authority?: unknown; reviewedBy?: unknown };
-    pack?: { policies: PolicyCatalogEntry[] };
-  },
-): AuthorityDeclaration {
-  if (source.cloudManaged) {
-    return { authority: source.cloudManaged.authority, reviewedBy: source.cloudManaged.reviewedBy };
-  }
-  if (source.pack) {
-    const entry = source.pack.policies.find((p) => p.name === hook.name);
-    return { authority: entry?.authority, reviewedBy: entry?.reviewedBy };
-  }
-  return { authority: hook.authority, reviewedBy: hook.reviewedBy };
-}

package/src/hooks/policy-reviewability.ts

@@ -1,229 +0,0 @@
-/**
- * How much of what this machine enforces Jev is allowed to CLEAR — the
- * diagnostic half of `policy-authority.ts`, and nothing else.
- *
- * ## The silence this exists to break
- *
- * Authority decides one thing: whether Jev may clear a regex policy's deny or
- * instruct (`combine.ts`, which returns early unless the authority is
- * `reviewable`). Absent means `hard`, and that default is right — it is what
- * keeps an unknown pack, cloud or custom policy from being weakened by a
- * classifier nobody asked about it.
- *
- * It is also completely silent. `authority` and `reviewedBy` reach a pack
- * through its manifest, and the only thing that writes them there is
- * `scripts/build-policy-pack.mjs`, which ships WITH this release. So a pack
- * published before it declares none, every policy in it resolves to `hard`
- * with nothing downgraded, and `warnAuthority` — which only speaks when a
- * `reviewable` declaration was not honored — has nothing to say. The result a
- * customer gets is the deny half of the two-tier evaluator working exactly as
- * documented, the clear half unable to fire once, and no diagnostic anywhere:
- * `jev status` says `on`, the fallback rate says the calls are being answered,
- * and `cleared` says `nothing` forever.
- *
- * This module counts. It changes no policy's authority and no verdict, it is
- * never imported from the hook path, and a machine with no `jev.json` never
- * reaches a caller of it.
- *
- * ## What "enabled" means here
- *
- * The same thing it means in `handler.ts`, read from the same files, without
- * loading or executing a policy:
- *
- * - **Installed packs** — each pack's manifest entries, narrowed by its
- *   `enabled` selection (absent means the whole pack). A pack's `clis`
- *   narrowing is NOT applied: there is no agent CLI in a status command, and
- *   the honest answer to "what could Jev clear on this machine" spans all of
- *   them.
- * - **Builtins** — this build's catalog, under the same migration shim the
- *   handler applies: they enforce only while no pack is installed. The
- *   `alwaysOn` guard is counted always, because it registers always (and is
- *   hard always, so it can only ever lower the ratio).
- * - **Cloud assignments** — the active deployment's records, whose authority is
- *   declared by whoever deployed them. One record per assignment; an artifact
- *   that registers several hooks is still one central decision.
- *
- * Two things are deliberately NOT counted, and `customFiles` is what says so
- * out loud when it matters:
- *
- * - **Policies from the user's own files.** A custom hook declares its
- *   authority inside the module, so counting one means importing and running
- *   somebody's JavaScript — from a settings page, on every read. The count of
- *   configured custom policy PATHS is reported instead, and the summary says
- *   in words that those policies were not counted.
- * - **A session pause.** It suspends local policy for minutes, and a warning
- *   about a policy set that is coming back shortly would be noise.
- */
-import { readActiveCloudManagedPolicies } from "./cloud-managed-policies";
-import { configuredCustomPolicyPaths, readMergedHooksConfig } from "./hooks-config";
-import { hasInstalledPacks, packSemantic, readInstalledPacks } from "./pack-manifest";
-import { resolvePolicyAuthority } from "./policy-authority";
-import { POLICY_CATALOG } from "./policy-catalog";
-import { normalizePolicyName } from "./policy-registry";
-import type { HooksConfig } from "./policy-types";
-
-/** Anything that carries an authority declaration: a catalog entry, a pack entry, a cloud record. */
-export interface AuthorityRecord {
-  authority?: unknown;
-  reviewedBy?: unknown;
-  alwaysOn?: boolean;
-}
-
-export interface ReviewableCoverage {
-  /** Enabled policies whose authority could be read without running code. */
-  enabled: number;
-  /** Of those, the ones Jev may clear a deny or an instruct from. */
-  reviewable: number;
-  /** Configured custom policy paths, whose policies are not in the counts above. */
-  customFiles: number;
-}
-
-/** The command that replaces a pack with one built by this release. */
-export const RETAKE_PACK_COMMAND = "failproofai policies add FailproofAI/policies";
-
-/**
- * Count a policy set by the authority it would REGISTER with —
- * `resolvePolicyAuthority`, the rule `registerPolicy` applies — so this cannot
- * report a clear that would not happen or hide one that would.
- *
- * Deliberately not `effectiveAuthority`, the looser §7 contract `jev-review.ts`
- * asks at evaluation time. That one needs a single non-empty name and is right
- * where it is asked, because by then the registry holds a `reviewedBy` that
- * registration already cleaned, and on cleaned records the two rules agree.
- * Nothing counted HERE has been through registration: these records are read
- * straight off a pack manifest, this build's catalog and the cloud deployment.
- * So a declaration naming a check this build does not have — `reviewedBy:
- * ["future-check"]`, which is what a pack built against a NEWER semantic set
- * looks like here — is reviewable to the loose rule and hard in the registry,
- * and counting it would report a clear that can never happen while
- * `reviewableProblem` stayed silent about the machine it exists to warn.
- */
-export function countReviewable(
-  policies: Iterable<AuthorityRecord>,
-  /**
-   * The semantic checks that can be asked on this machine. Defaults to the
-   * compiled-in set; `surveyReviewableCoverage` passes the pack's when one
-   * declares its own, because otherwise this diagnostic reports "0 of 11
-   * reviewable" on exactly the machines the feature was built for — the ones
-   * running a pack that carries both tiers.
-   */
-  knownReviewers?: ReadonlySet<string>,
-): {
-  enabled: number;
-  reviewable: number;
-} {
-  let enabled = 0;
-  let reviewable = 0;
-  for (const p of policies) {
-    enabled += 1;
-    if (resolvePolicyAuthority(p, knownReviewers).authority === "reviewable") reviewable += 1;
-  }
-  return { enabled, reviewable };
-}
-
-/**
- * What this machine's enabled policy set looks like to Jev. Reads three files
- * and no policy: see the header for what is in the counts and what is not.
- *
- * Every source is wrapped, and an unreadable one contributes nothing rather
- * than throwing — the same fail-open posture `handler.ts` takes for packs and
- * cloud policies, for the same reason: this is a diagnostic, and one corrupt
- * byte must not replace a settings page with an error boundary.
- */
-export function surveyReviewableCoverage(cwd?: string): ReviewableCoverage {
-  const records: AuthorityRecord[] = [];
-
-  let packsInstalled = false;
-  /**
-   * The reviewers a pack brought with it. Collected from the SAME read as the
-   * policies rather than through `effectiveReviewerNames()`, which would re-read
-   * and re-verify every artifact for an answer already in hand — and would, for
-   * one read of a manifest being rewritten underneath, be able to disagree with
-   * the records counted here.
-   *
-   * A pack's `enabled` selection is deliberately not applied: it narrows which
-   * of its REGEX policies register, and its semantic set is not selectable.
-   */
-  const packReviewers = new Set<string>();
-  try {
-    packsInstalled = hasInstalledPacks();
-    for (const pack of readInstalledPacks().packs) {
-      const selected = pack.enabled;
-      records.push(...(selected ? pack.policies.filter((p) => selected.includes(p.name)) : pack.policies));
-      for (const entry of packSemantic(pack)) packReviewers.add(entry.name);
-    }
-  } catch {
-    // An unreadable manifest enforces nothing; `readInstalledPacks` already
-    // reports that to the hook log on the path that cares.
-  }
-
-  let config: HooksConfig;
-  try {
-    config = readMergedHooksConfig(cwd);
-  } catch {
-    config = { enabledPolicies: [] };
-  }
-  // The migration shim, exactly as `handler.ts` applies it: this build's
-  // builtins enforce only until a pack is installed.
-  const legacyEnabled = new Set(packsInstalled ? [] : config.enabledPolicies.map(normalizePolicyName));
-  for (const policy of POLICY_CATALOG) {
-    if (policy.alwaysOn || legacyEnabled.has(normalizePolicyName(policy.name))) records.push(policy);
-  }
-
-  try {
-    for (const assignment of readActiveCloudManagedPolicies()) {
-      records.push({ authority: assignment.authority, reviewedBy: assignment.reviewedBy });
-    }
-  } catch {
-    // Same fail-open as the handler's own read of this file.
-  }
-
-  let customFiles = 0;
-  try {
-    customFiles = configuredCustomPolicyPaths(config).length;
-  } catch {
-    customFiles = 0;
-  }
-
-  return { ...countReviewable(records, packReviewers.size > 0 ? packReviewers : undefined), customFiles };
-}
-
-/**
- * The one line both surfaces show: the count, in the words `jev status` and the
- * dashboard panel must agree on. A non-zero count is worth saying too — it is
- * how someone learns how much of their policy set Jev can act on at all.
- */
-export function reviewableSummary(coverage: ReviewableCoverage): string {
-  const { enabled, reviewable } = coverage;
-  // Said out loud rather than folded into the number, because a custom policy
-  // CAN be reviewable and this count would not know: reading that declaration
-  // means importing and running the file it lives in.
-  const tail = coverage.customFiles > 0 ? " (policies from your own files are not counted)" : "";
-  if (enabled === 0) return `No policies are enabled here, so there is nothing for Jev to clear${tail}.`;
-  const noun = enabled === 1 ? "1 enabled policy is" : `${enabled} enabled policies are`;
-  if (reviewable === 0) return `0 of ${noun} reviewable${tail}.`;
-  return `${reviewable} of ${noun} reviewable: Jev may clear a deny or an instruction from those, and from no others${tail}.`;
-}
-
-/**
- * Why Jev can never clear anything here, and what fixes it — or null when it
- * can clear something, which needs no explanation.
- *
- * It states the observation before naming the usual cause, because the cause is
- * the usual one and not the only one: a machine can also reach zero by enabling
- * only hard policies, or by having nothing but the self-protection guard. The
- * remedy is the same in each case, and it is one command.
- *
- * Nothing is diagnosed for an empty policy set: there is no clear to lose, and
- * an authority warning to someone who enforces nothing answers a question they
- * did not ask.
- */
-export function reviewableProblem(coverage: ReviewableCoverage): string | null {
-  if (coverage.enabled === 0 || coverage.reviewable > 0) return null;
-  return (
-    "Jev can add a deny or an instruction on this machine, but it can never clear one. " +
-    "No enabled policy is marked reviewable — a policy pack published before this release carries no such marks — " +
-    `so re-take the pack (\`${RETAKE_PACK_COMMAND}\`) to get a marked copy, ` +
-    "or enforce this build's builtin policies, which carry them."
-  );
-}