fraim 2.0.360-next.0 → 2.0.360-next.1

package/dist/registry/domains.json

@@ -0,0 +1,159 @@
+{
+  "schemaVersion": 2,
+  "mapVersion": 3,
+  "domains": {
+    "global": {
+      "purpose": "Shared integrity, authority, communication and evidence mandates",
+      "rules": [
+        "rules/constitution.md",
+        "rules/evidence-cardinality.md"
+      ]
+    },
+    "ai-engineering": {
+      "purpose": "Build and validate AI systems",
+      "rules": [
+        "rules/ai-engineering/ai-engineering.md"
+      ]
+    },
+    "bank-compliance": {
+      "purpose": "Review banking compliance evidence",
+      "rules": [
+        "rules/bank-compliance/bank-compliance.md"
+      ]
+    },
+    "bank-operations": {
+      "purpose": "Prepare banking and KYC operations",
+      "rules": [
+        "rules/bank-operations/bank-operations.md"
+      ]
+    },
+    "career": {
+      "purpose": "Support professional development",
+      "rules": []
+    },
+    "customer": {
+      "purpose": "Support customer relationships and systems",
+      "rules": [
+        "rules/customer/customer.md"
+      ]
+    },
+    "design": {
+      "purpose": "Create and evaluate user experiences and brand systems",
+      "rules": [
+        "rules/design/design.md"
+      ]
+    },
+    "dev-ops": {
+      "purpose": "Operate infrastructure and production services",
+      "rules": [
+        "rules/dev-ops/dev-ops.md"
+      ]
+    },
+    "engineering": {
+      "purpose": "Implement and maintain software",
+      "rules": [
+        "rules/engineering/engineering.md"
+      ]
+    },
+    "executive-assistance": {
+      "purpose": "Support executive coordination",
+      "rules": []
+    },
+    "finance": {
+      "purpose": "Analyze finances and prepare funding",
+      "rules": [
+        "rules/finance/finance.md"
+      ]
+    },
+    "fraim": {
+      "purpose": "Author and maintain FRAIM capabilities",
+      "rules": [
+        "rules/fraim/artifact-boundaries.md"
+      ]
+    },
+    "go-to-market": {
+      "purpose": "Plan and execute market positioning, demand and launches",
+      "rules": [
+        "rules/go-to-market/go-to-market.md"
+      ]
+    },
+    "inclusion": {
+      "purpose": "Evaluate inclusion policy and workforce evidence",
+      "rules": [
+        "rules/inclusion/inclusion.md"
+      ]
+    },
+    "legal": {
+      "purpose": "Prepare legal analysis and filings for qualified review",
+      "rules": [
+        "rules/legal/legal.md"
+      ]
+    },
+    "management": {
+      "purpose": "Coordinate people and work",
+      "rules": []
+    },
+    "people-ops": {
+      "purpose": "Support workforce operations",
+      "rules": [
+        "rules/people-ops/people-ops.md"
+      ]
+    },
+    "procurement": {
+      "purpose": "Evaluate suppliers and prepare purchasing decisions",
+      "rules": [
+        "rules/procurement/procurement.md"
+      ]
+    },
+    "product": {
+      "purpose": "Define and validate customer outcomes",
+      "rules": [
+        "rules/product/product.md"
+      ]
+    },
+    "project-management": {
+      "purpose": "Plan and govern delivery",
+      "rules": [
+        "rules/project-management/project-management.md"
+      ]
+    },
+    "quality-assurance": {
+      "purpose": "Validate product behavior and quality",
+      "rules": [
+        "rules/quality-assurance/quality-assurance.md"
+      ]
+    },
+    "recruiting": {
+      "purpose": "Source and assess candidates",
+      "rules": [
+        "rules/recruiting/recruiting.md"
+      ]
+    },
+    "sales": {
+      "purpose": "Advance named customer opportunities and commercial deals",
+      "rules": [
+        "rules/sales/sales.md"
+      ]
+    },
+    "salesforce": {
+      "purpose": "Configure Salesforce workflows and data",
+      "rules": [
+        "rules/salesforce/salesforce.md"
+      ]
+    },
+    "security": {
+      "purpose": "Assess security and compliance controls",
+      "rules": [
+        "rules/security/security.md"
+      ]
+    },
+    "strategy": {
+      "purpose": "Develop organizational strategy",
+      "rules": []
+    },
+    "travel": {
+      "purpose": "Plan travel",
+      "rules": []
+    }
+  }
+}

package/dist/registry/scripts/domains/catalog.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafeRegistryPath = isSafeRegistryPath;
+exports.jobDomainFromRegistryPath = jobDomainFromRegistryPath;
+exports.validateDomainCatalog = validateDomainCatalog;
+exports.mergeDomainCatalog = mergeDomainCatalog;
+exports.selectCatalogDomain = selectCatalogDomain;
+function hasOwn(value, key) {
+    return Object.prototype.hasOwnProperty.call(value, key);
+}
+function isSafeDomainId(domain) {
+    return /^[a-z][a-z-]*$/.test(domain) && !['__proto__', 'constructor', 'prototype'].includes(domain);
+}
+function isSafeRegistryPath(value, kind) {
+    return typeof value === 'string' && new RegExp(`^${kind}/[a-zA-Z0-9_/-]+\\.md$`).test(value)
+        && !value.includes('//') && !value.split('/').some(part => part === '.' || part === '..');
+}
+/** Extract a folder, never a frontmatter declaration, leaf-name alias or employee. */
+function jobDomainFromRegistryPath(path) {
+    if (typeof path !== 'string')
+        return null;
+    const clean = path.replace(/\\/g, '/').replace(/^registry\//, '');
+    if (!isSafeRegistryPath(clean, 'jobs'))
+        return null;
+    const rolePath = /^jobs\/(?:ai-employee|ai-manager|personalized-employee)\//.test(clean);
+    const match = clean.match(rolePath
+        ? /^jobs\/(?:ai-employee|ai-manager|personalized-employee)\/([a-z][a-z-]*)\/[^/]+\.md$/
+        : /^jobs\/([a-z][a-z-]*)\/[^/]+\.md$/);
+    return match && isSafeDomainId(match[1]) ? match[1] : null;
+}
+function validateDomainCatalog(value) {
+    const errors = [];
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return ['Catalog must be an object'];
+    const catalog = value;
+    if (catalog.schemaVersion !== 2)
+        errors.push('Unsupported catalog schemaVersion');
+    if (!Number.isInteger(catalog.mapVersion) || catalog.mapVersion < 3)
+        errors.push('Invalid catalog mapVersion');
+    if (hasOwn(catalog, 'unmigratedJobs'))
+        errors.push('Job rollout lists are obsolete; folders own domains');
+    if (!hasOwn(catalog, 'domains') || !catalog.domains || typeof catalog.domains !== 'object' || Array.isArray(catalog.domains))
+        return [...errors, 'Missing domains'];
+    if (!hasOwn(catalog.domains, 'global'))
+        errors.push('Missing global domain');
+    for (const [domain, definition] of Object.entries(catalog.domains)) {
+        if (!isSafeDomainId(domain))
+            errors.push(`Invalid domain: ${domain}`);
+        if (!definition || typeof definition !== 'object' || Array.isArray(definition)) {
+            errors.push(`Invalid definition: ${domain}`);
+            continue;
+        }
+        if (hasOwn(definition, 'jobs'))
+            errors.push(`Job membership is obsolete: ${domain}`);
+        if (!hasOwn(definition, 'purpose') || typeof definition.purpose !== 'string' || !definition.purpose.trim())
+            errors.push(`Missing purpose: ${domain}`);
+        if (!hasOwn(definition, 'rules') || !Array.isArray(definition.rules))
+            errors.push(`Missing rules: ${domain}`);
+        else {
+            const paths = new Set();
+            for (const rule of definition.rules) {
+                if (!isSafeRegistryPath(rule, 'rules'))
+                    errors.push(`Invalid rule path: ${rule}`);
+                if (paths.has(rule))
+                    errors.push(`Duplicate rule: ${rule}`);
+                paths.add(rule);
+            }
+            if (domain === 'global' && !paths.has('rules/constitution.md'))
+                errors.push('Global rules must include the constitution');
+        }
+    }
+    return errors;
+}
+/** Authorized overlays configure rules; they cannot reassign a job or employee. */
+function mergeDomainCatalog(base, extension) {
+    const baseErrors = validateDomainCatalog(base);
+    if (baseErrors.length)
+        throw new Error(baseErrors.join('; '));
+    if (!extension || typeof extension !== 'object' || Array.isArray(extension)
+        || !hasOwn(extension, 'domains') || !extension.domains || typeof extension.domains !== 'object' || Array.isArray(extension.domains)) {
+        throw new Error('Catalog extension must define domains');
+    }
+    if (extension.schemaVersion !== undefined && extension.schemaVersion !== 2)
+        throw new Error('Unsupported catalog extension schemaVersion');
+    if (hasOwn(extension, 'unmigratedJobs'))
+        throw new Error('Job rollout lists are obsolete; folders own domains');
+    const result = JSON.parse(JSON.stringify(base));
+    for (const [domain, definition] of Object.entries(extension.domains)) {
+        if (!isSafeDomainId(domain))
+            throw new Error(`Invalid domain: ${domain}`);
+        if (!definition || typeof definition !== 'object' || Array.isArray(definition))
+            throw new Error(`Invalid definition: ${domain}`);
+        result.domains[domain] = { ...(hasOwn(result.domains, domain) ? result.domains[domain] : {}), ...definition };
+    }
+    if (extension.mapVersion !== undefined)
+        result.mapVersion = extension.mapVersion;
+    const errors = validateDomainCatalog(result);
+    if (errors.length)
+        throw new Error(errors.join('; '));
+    return result;
+}
+function selectCatalogDomain(catalog, jobPath) {
+    // A broken sibling rule list must not change this job's folder identity.
+    if (!catalog || catalog.schemaVersion !== 2 || !catalog.domains || typeof catalog.domains !== 'object'
+        || Array.isArray(catalog.domains))
+        return { domain: null, selection: 'unknown' };
+    if (!jobPath)
+        return { domain: 'global', selection: 'connect' };
+    const domain = jobDomainFromRegistryPath(jobPath);
+    return domain && hasOwn(catalog.domains, domain)
+        ? { domain, selection: 'mapped' } : { domain: null, selection: 'unknown' };
+}

package/dist/registry/scripts/learning/entry-authoring.js

@@ -4,49 +4,87 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.deriveDomain = deriveDomain;
+exports.storedEntryDomain = storedEntryDomain;
+exports.selectStoredLearningEntries = selectStoredLearningEntries;
 exports.readerWordCount = readerWordCount;
 exports.validateEntry = validateEntry;
 exports.renderEntry = renderEntry;
 exports.isLearningScaffolding = isLearningScaffolding;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const catalog_1 = require("../domains/catalog");
 // Relative to the shipped helper, never to the job's working directory.
-const map = JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(__dirname, 'learning-domains.json'), 'utf8'));
-function deriveDomain(origins) {
+let catalog = { schemaVersion: 2, mapVersion: 0, domains: {} };
+try {
+    const candidate = JSON.parse(node_fs_1.default.readFileSync(node_path_1.default.join(__dirname, '..', '..', 'domains.json'), 'utf8'));
+    if (candidate?.schemaVersion !== 2 || !candidate.domains || typeof candidate.domains !== 'object' || Array.isArray(candidate.domains))
+        throw new Error('Invalid domain catalog');
+    catalog = candidate;
+}
+catch {
+    console.warn('Learning domain catalog unavailable: restore or sync domains.json beside the installed scripts, then retry domain resolution. Existing source files are preserved.');
+}
+const domainData = (effectiveCatalog) => ({ mapVersion: effectiveCatalog?.mapVersion ?? 0, domains: effectiveCatalog?.schemaVersion === 2 && effectiveCatalog.domains && typeof effectiveCatalog.domains === 'object' && !Array.isArray(effectiveCatalog.domains) ? Object.keys(effectiveCatalog.domains).filter(domain => domain !== 'global' && /^[a-z][a-z-]*$/.test(domain)) : [] });
+function deriveDomain(origins, effectiveCatalog = catalog) {
+    const map = domainData(effectiveCatalog);
     const unknown = (reason) => ({ status: 'needs-domain', value: null, reason, mapVersion: map.mapVersion });
     if (!origins.length)
         return unknown('No originating job recorded');
     const decisions = [];
     for (const origin of origins) {
-        let declaration;
-        const frontmatter = origin.content?.match(/^\uFEFF?---\r?\n([\s\S]*?)\r?\n---/);
-        if (frontmatter) {
-            try {
-                declaration = JSON.parse(frontmatter[1]).domain;
-            }
-            catch {
-                declaration = frontmatter[1].match(/^domain:\s*["']?([\w-]+)/m)?.[1];
-            }
-        }
-        if (declaration !== undefined) {
-            if (declaration !== 'global' && !map.domains.includes(String(declaration)))
-                return unknown(`Invalid domain declaration for ${origin.name}`);
-            decisions.push({ value: String(declaration), basis: 'job-declaration' });
+        // Current folder identity wins; job declarations are no longer domain authority.
+        // Missing provenance is not a connect request and must remain unresolved.
+        const selected = origin.registryPath ? (0, catalog_1.selectCatalogDomain)(effectiveCatalog, origin.registryPath) : null;
+        if (selected?.selection === 'mapped') {
+            decisions.push({ value: selected.domain, basis: 'catalog' });
             continue;
         }
-        const clean = origin.registryPath?.replace(/\\/g, '/').replace(/^\/?registry\//, '');
-        const category = clean?.match(/^jobs\/(?:ai-employee\/|ai-manager\/|personalized-employee\/)?([^/]+)\/[^/]+\.md$/)?.[1];
-        if (!category)
-            return unknown(`No mapped job path for ${origin.name}`);
-        const value = map.jobDomainMap[category] || (map.globalJobCategories.includes(category) ? 'global' : null);
-        if (!value)
-            return unknown(`Unmapped category for ${origin.name}`);
-        decisions.push({ value, basis: 'category' });
+        return unknown(`No current domain folder for ${origin.name}; retain original provenance for review`);
     }
     if (new Set(decisions.map(d => d.value)).size !== 1)
         return unknown('Originating jobs span multiple domains');
     return { status: 'resolved', ...decisions[0], mapVersion: map.mapVersion };
 }
+/** Resolve an existing entry without rewriting its source, ID, dates or approval. */
+function storedEntryDomain(content, storageDomain, effectiveCatalog = catalog) {
+    const map = domainData(effectiveCatalog);
+    const unknown = (reason) => ({ status: 'needs-domain', value: null, reason, mapVersion: map.mapVersion });
+    const fields = (label) => [...content.matchAll(new RegExp(`^\\*\\*${label}\\*\\*:\\s*([^\\r\\n]+)\\r?$`, 'gm'))].map(match => match[1].trim());
+    const domains = fields('Domain');
+    const bases = fields('Domain basis');
+    if (domains.length > 1 || bases.length > 1)
+        return unknown('Conflicting domain metadata');
+    const basis = bases[0]?.match(/^(manager|catalog|category|job-declaration); map (\d+)$/);
+    const declared = domains[0];
+    if (basis && (basis[1] === 'manager' || Number(basis[2]) >= 3)) {
+        if (!declared || !['global', ...map.domains].includes(declared))
+            return unknown('Retired or invalid explicit domain');
+        return { status: 'resolved', value: declared, basis: basis[1], mapVersion: Number(basis[2]) };
+    }
+    const origins = fields('Originating job').flatMap(value => value.split(';').map(value => value.trim()).filter(Boolean));
+    if (origins.length)
+        return deriveDomain(origins.map(registryPath => ({ name: registryPath, registryPath })), effectiveCatalog);
+    // Undecorated files contain intentionally global preferences and patterns.
+    // An old umbrella filename alone never proves a current domain assignment.
+    if (storageDomain === 'global' && (!declared || declared === 'global'))
+        return { status: 'resolved', value: 'global', basis: 'category', mapVersion: map.mapVersion };
+    return unknown('Historical entry needs original job provenance or an explicit manager domain decision');
+}
+/** Select entry blocks for one job while retaining provenance in the original text. */
+function selectStoredLearningEntries(content, storageDomain, targetDomain, includeGlobal = true, effectiveCatalog = catalog) {
+    const headings = [...content.matchAll(/^#{2,6}\s+\[(?:P-)?(?:CRITICAL|HIGH|MED|MEDIUM|LOW|IMPORTANT|MONITOR)\].*$/gm)];
+    const blocks = headings.length ? headings.map((heading, index) => content.slice(heading.index, headings[index + 1]?.index ?? content.length).trim()) : [content.trim()].filter(Boolean);
+    const entries = [];
+    let unresolved = 0;
+    for (const block of blocks) {
+        const decision = storedEntryDomain(block, storageDomain, effectiveCatalog);
+        if (decision.status === 'needs-domain')
+            unresolved++;
+        else if (decision.value === targetDomain || (includeGlobal && decision.value === 'global'))
+            entries.push(block);
+    }
+    return { entries, unresolved };
+}
 function readerText(entry) {
     return [entry.title, entry.takeaway, entry.why, entry.example, entry.next].join(' ');
 }
@@ -68,7 +106,7 @@ function validateEntry(entry) {
     if (!entry.domain || !Number.isInteger(entry.domain.mapVersion))
         throw new Error('invalid-entry: domain');
     if (entry.domain.status === 'resolved') {
-        if (!['global', ...map.domains].includes(entry.domain.value) || !['category', 'job-declaration', 'manager'].includes(entry.domain.basis))
+        if (entry.domain.mapVersion < 1 || !/^[a-z][a-z-]*$/.test(entry.domain.value) || ['constructor', 'prototype'].includes(entry.domain.value) || !['catalog', 'category', 'job-declaration', 'manager'].includes(entry.domain.basis))
             throw new Error('invalid-entry: domain');
     }
     else if (entry.domain.status !== 'needs-domain' || entry.domain.value !== null || !entry.domain.reason)

package/dist/registry/scripts/learning/run-application.js

@@ -47,7 +47,7 @@ function capabilityGuards(action, proof, options) {
     const required = [action.target, ...(action.delivery?.callers || [])].map(ref => resolved(ref, options).file);
     if (required.some(file => {
         const snapshot = snapshots.get(node_path_1.default.resolve(file));
-        return !snapshot || typeof snapshot.realPath !== 'string' || !snapshot.realPath
+        return !snapshot || snapshot.kind !== undefined || typeof snapshot.realPath !== 'string' || !snapshot.realPath
             || typeof snapshot.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(snapshot.sha256);
     }))
         throw new Error('capability-local-proof-required');
@@ -57,8 +57,13 @@ function capabilityGuards(action, proof, options) {
             throw new Error('capability-local-proof-conflict');
     }
     return [...snapshots.values()].map(item => {
+        if (item.kind !== undefined && item.kind !== 'directory')
+            throw new Error('capability-local-proof-conflict');
         const absent = item.realPath === null && item.sha256 === null;
-        if (!absent && (typeof item.realPath !== 'string' || typeof item.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(item.sha256)))
+        const directory = item.kind === 'directory';
+        if (directory && (item.sha256 !== null || (!absent && (typeof item.realPath !== 'string' || !item.realPath))))
+            throw new Error('capability-local-proof-conflict');
+        if (!directory && !absent && (typeof item.realPath !== 'string' || typeof item.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(item.sha256)))
             throw new Error('capability-local-proof-conflict');
         return { file: item.file, verify: () => {
                 if (absent) {
@@ -72,6 +77,11 @@ function capabilityGuards(action, proof, options) {
                     }
                     throw new Error('capability-local-proof-changed');
                 }
+                if (directory) {
+                    if (!node_fs_1.default.existsSync(item.file) || !node_fs_1.default.statSync(item.file).isDirectory() || node_fs_1.default.realpathSync(item.file) !== item.realPath)
+                        throw new Error('capability-local-proof-changed');
+                    return;
+                }
                 if (!node_fs_1.default.existsSync(item.file) || node_fs_1.default.realpathSync(item.file) !== item.realPath || (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(item.file, 'utf8')) !== item.sha256)
                     throw new Error('capability-local-proof-changed');
             } };