futura-scion 0.2.5 → 0.2.7

package/README.md

@@ -531,11 +531,14 @@ signature. Read-only plans need no ceremony.
 
 Gate verifier BUNDLES per stack ship in `recipes/` as pure data (YAML —
 description, required tools, verifier commands): **node** (node --check +
-npm test), **python** (py_compile + pytest), **docker** (image build),
-**terraform** (fmt -check + init + validate — deliberately read-only;
-plan/apply belong in senior-review-approved workflow steps, never a gate),
-**xcode** (xcodebuild, tuned by `SCION_XCODE_*` env), **gradle** (wrapper
-build + test). Enable with one line:
+npm test), **python** (py_compile + pytest), **go** (gofmt discipline +
+go vet + go test), **rust** (cargo check + clippy discipline + cargo test),
+**dotnet** (dotnet build + test), **jvm** (wrapper-aware Maven/Gradle test),
+**docker** (image build), **terraform** (fmt -check + init + validate —
+deliberately read-only; plan/apply belong in senior-review-approved workflow
+steps, never a gate), **xcode** (xcodebuild, tuned by `SCION_XCODE_*` env),
+**gradle** (wrapper build + test). POSIX-pipeline verifiers declare
+`shell: bash` and run under Git Bash on Windows. Enable with one line:
 
 ```yaml
 gate:
@@ -589,6 +592,40 @@ with the violation evidence attached — the human chooses refactor, move,
 or amend the declaration, via the same `scion review` loop as every other
 escalation.
 
+#### Hub rules — shape, not just edges (`architecture.hubs`)
+
+Edges police direction; HUBS police concentration, checked against the
+schematic's measured fan-in/fan-out (`scion map` design data — curator
+models derive the same numbers from edges, so no map build is required):
+
+```yaml
+architecture:
+  hubs:
+    max_fan_in: 100        # no file imported by more than N (change magnets)
+    max_fan_out: 20        # no file importing more than N (God modules)
+    max_layer_fan_in: 300  # no layer funneling more inbound edges than N
+    ignore: [vendor, gen]  # path prefixes exempt from hub accounting
+```
+
+Hub violations are analyzer-shaped **warnings** (`arch-hub-fan-in`,
+`arch-hub-fan-out`, `arch-hub-layer-fan-in`) carrying the measured number,
+the declared ceiling, and the file — a design smell escalates to the human
+arch lane, never machine-patched. All thresholds are opt-in (empty = not
+checked); malformed or typo'd keys fail loud. Live on FS's own source at
+diagnostic thresholds: `kernel/trail.js` flagged at 173 inbound edges
+(change magnet), `daemon.js` at 22 imports (God module).
+
+#### Map-first THINK (`schematic.enabled`)
+
+Every ladder decision attaches the schematic digest — layers, entries,
+hubs, exported surface — as context for all downstream rungs (generator
+prompts, analyzer reasoning, research queries). Served from a warm cache
+(`schematic.digest_ttl_ms`, default 30000) so latency-bounded scans are
+never starved: one refresh per TTL window, amortized across every worker
+and daemon scan. `taskId` and `mapContext` are ambient keys — stripped
+before signature hashing, so identical problems replay identically across
+task ids and map refreshes.
+
 ### Command over tools — the research rung (`scion tools`)
 
 FS's rungs answer from what it knows. The RESEARCH rung gives it hands:
@@ -777,6 +814,50 @@ With `learn: { auto: true }` in config, `scion serve` runs a cycle every
 `learn.interval_ms` (default 6h) in-process — the harness improves itself
 while it works. Zero-LLM by construction.
 
+### Codebase schematics — single-pass understanding, incremental forever (`scion map`)
+
+FS converts a complex codebase into a complete machine-navigable map — every
+symbol (signature, kind, line, exported/async), file import edges AND
+symbol-level call edges, entry points (bin scripts, HTTP route
+registrations, handlers), the exported surface, per-layer fan-in/fan-out,
+and deterministic pattern observations (factories, handlers, repositories).
+Persisted in the brain with per-file content hashes.
+
+The token contract: `mapFor()` re-parses ONLY files whose hash changed and
+reuses persisted fragments for everything else — 89 files with 1 changed
+costs 1 re-parse. Queries answer from the map with zero file reads:
+impact (transitive blast radius of a symbol), who-imports/who-calls,
+surface, entries.
+
+```bash
+scion map src                     # build-or-refresh + the one-screen digest
+scion map src --impact=runTask    # what breaks if this symbol changes
+scion map src --who=enqueue       # importers + callers, from the map
+scion map src --entries           # every door into the system
+```
+
+`digest()` renders the briefing a worker reads INSTEAD of source files;
+subsequent passes re-read only what changed. First pass = understanding;
+every pass after = surgical.
+
+### The MoE retention discipline — ephemeral fuel, durable lessons
+
+FS's memory mirrors a Mixture-of-Experts model's discipline: activate what
+the current task needs, retain only what compounds.
+
+- **Task working-set** (`scion working-set <taskId>`): gathered research
+  lives in an EPHEMERAL per-task brief — 64 KiB budget enforced by
+  oldest-first eviction, 1-hour TTL, swept at task end. Fuel, not furniture.
+- **Earned research rung**: when every cheaper ladder rung abstains, the
+  worker researches the web (deterministic organ) into its working set and
+  escalates INFORMED — the reviewer sees findings and sources. Opt out
+  with `research: false`.
+- **Lesson distiller**: exactly ONE durable lesson per gate verdict
+  (success / failure with the failing command / escalation), dedup-
+  reinforced. Lessons start at confidence 82 — just under the memory
+  rung's action threshold — so only REPETITION makes them actionable.
+  One occurrence is an observation; repetition is knowledge.
+
 ### FS Desktop — the standalone UI (chat / agent / plan / architect)
 
 FS ships a real UI in two forms, both zero-build:

package/bin/scion.js

@@ -656,6 +656,28 @@ switch (cmd || '') {
     else console.log(JSON.stringify(loop.cycle(), null, 2));
     break;
   }
+  case 'working-set': {
+    // Task working-set introspection (the ephemeral brief):
+    //   scion working-set <taskId>   what a task gathered + its budget posture
+    //   scion working-set --sweep    janitor: expire all past-TTL sets now
+    const tb = await import('../src/mind/task-brief.js');
+    if (arg === '--sweep') {
+      console.log(JSON.stringify(tb.briefSweep(), null, 2));
+      break;
+    }
+    if (!arg) {
+      console.error('usage: scion working-set <taskId> | scion working-set --sweep');
+      process.exitCode = 2;
+      break;
+    }
+    const stats = tb.briefStats(arg);
+    const brief = tb.briefRead(arg, { limit: 12 });
+    console.log(`task ${arg}: ${stats.items} item(s), ${stats.bytes} bytes`);
+    for (const i of brief.items) {
+      console.log(`  · [${i.source ?? 'no source'}] ${i.text.replace(/\s+/g, ' ').slice(0, 150)}`);
+    }
+    break;
+  }
   case 'evolve': {
     // The nightly harness-evolution pass (A4): mine weaknesses → propose
     // harness edits → gate them (SICA utility) → apply the accepted. Bounded
@@ -769,6 +791,43 @@ switch (cmd || '') {
     if (arch.violations.length > 0) process.exitCode = 1; // CI-friendly
     break;
   }
+  case 'map': {
+    // THE CODEBASE SCHEMATICS (single-pass understanding, incremental after):
+    //   scion map [dir]              build-or-refresh + digest (one-screen briefing)
+    //   scion map <dir> --impact X   transitive blast radius of symbol X
+    //   scion map <dir> --who X      who imports/calls X
+    //   scion map <dir> --entries    every entry point
+    // All queries answer from the persisted map — zero file re-reads beyond
+    // the changed files' hashes.
+    const sch = await import('../src/mind/schematic.js');
+    const target = arg || 'src';
+    const r = sch.mapFor(target);
+    const m = r.model;
+    const rel = (p) => String(p).split('\\').join('/').replace(/^src\//, '');
+    if (restArgs.includes('--entries')) {
+      for (const e of m.entries) console.log(`${e.kind.padEnd(8)} ${rel(e.file)}${e.symbol ? '#' + e.symbol : ''}  (${e.detail})`);
+      break;
+    }
+    const impactOf = restArgs.find((a) => a.startsWith('--impact='))?.split('=')[1];
+    if (impactOf) {
+      const im = sch.impact(m, impactOf);
+      console.log(`impact of ${impactOf} (defined in ${rel(m.symbols.find((s) => s.name === impactOf)?.file ?? '?')}):`);
+      console.log(`  direct (${im.direct.length}): ${im.direct.map(rel).join(', ')}`);
+      console.log(`  transitive (${im.transitive.length}): ${im.transitive.map(rel).join(', ')}`);
+      break;
+    }
+    const whoOf = restArgs.find((a) => a.startsWith('--who='))?.split('=')[1];
+    if (whoOf) {
+      const uniq = (a) => [...new Set(a)];
+      console.log(`importers: ${uniq(sch.queries.whoImports(m, sch.queries.fileFor(m, whoOf) ?? whoOf)).map(rel).join(', ') || '(none)'}`);
+      console.log(`callers:   ${uniq(sch.queries.callersOf(m, whoOf)).map(rel).join(', ') || '(none)'}`);
+      break;
+    }
+    console.log(sch.digest(m));
+    console.log(`
+refresh: ${r.reused} reused, ${r.changed.length} changed, ${r.added.length} added, ${r.removed.length} removed`);
+    break;
+  }
   case 'curate': {
     // Build + persist the codebase model (cortex curator lineage).
     //   scion curate <dir>            build + persist + summary
@@ -818,9 +877,11 @@ switch (cmd || '') {
         const m = f.match(/^--([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
         if (m) params[m[1]] = m[2];
       }
+      const swarm = flags.includes('--swarm');
       const manifest = planFullstack(resolve(target), {
         name: params.name,
         ...(params.port !== undefined ? { port: Number(params.port) } : {}),
+        ...(swarm ? { swarm: true } : {}),
       });
       if (flags.includes('--dry-run')) {
         console.log(`fullstack plan for ${target}:`);
@@ -837,8 +898,17 @@ switch (cmd || '') {
       }
       const { runWorkflow } = await import('../src/kernel/workflow.js');
       const conc = Number(flags.find((f) => f.startsWith('--concurrency='))?.split('=')[1]) || 3;
-      const r = await runWorkflow(manifest, { concurrency: conc, approval: { reviewer } });
-      console.log(`fullstack ${r.status}: ${r.completed}/${r.total} steps (concurrency ${conc})`);
+      // SWARM mode needs a builder worker: register the construct role and
+      // bind this process's worker so the claim transaction routes to it.
+      const swarmOpts = {};
+      if (swarm) {
+        const roles = await import('../src/kernel/roles.js');
+        roles.registerRole({ id: 'builder', capabilities: ['construct'] });
+        roles.bindWorker('cli-builder', 'builder');
+        swarmOpts.role = 'builder';
+      }
+      const r = await runWorkflow(manifest, { concurrency: conc, approval: { reviewer }, ...swarmOpts });
+      console.log(`fullstack ${r.status}: ${r.completed}/${r.total} steps (concurrency ${conc}${swarm ? ', swarm-routed' : ''})`);
       for (const t of r.tasks ?? []) {
         if (t.status !== 'completed') console.log(`  ${t.status.toUpperCase()}: ${t.manifestId ?? t.id} ${t.error ?? ''}`);
       }

package/config/scion.config.yaml

@@ -11,8 +11,12 @@ ladder:
   min_insight_confidence: 0.55  # reasoner rung admission floor
 
 llm:
-  daily_tokens: 0               # 0 = LLM rung off (zero-LLM doctrine)
+  daily_tokens: 500
 
+  apiKey: null
+  model: "qwen2.5-coder:7b"
+  baseUrl: "http://localhost:11434/v1"
+  provider: "ollama"
 bounds:
   max_turns: 25
   timeout_ms: 300000

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "futura-scion",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "The fused scion of cortex-os-agent + persona: one zero-LLM-dependent agent stack — Mind proposes, Muscle executes, Gate disposes.",
   "type": "module",
   "main": "src/index.js",

package/recipes/dotnet.yaml

@@ -0,0 +1,8 @@
+# gate.verifiers — the REAL Gate oracle for .NET projects (dotnet CLI).
+description: .NET (C# / F#)
+requires: [dotnet]
+verifiers:
+  - cmd: "dotnet build --nologo -v q"
+    timeout_ms: 600000
+  - cmd: "dotnet test --nologo -v q"
+    timeout_ms: 600000

package/recipes/go.yaml

@@ -0,0 +1,13 @@
+# gate.verifiers — the REAL Gate oracle for Go projects (modules).
+# gofmt discipline (any unformatted file fails), go vet, go test — real
+# exit codes, fail-fast. Pipeline runs under bash (Git Bash on Windows).
+description: Go (modules)
+requires: [go]
+verifiers:
+  - cmd: "gofmt -l . | grep -q . && exit 1 || exit 0"
+    timeout_ms: 60000
+    shell: bash
+  - cmd: "go vet ./..."
+    timeout_ms: 300000
+  - cmd: "go test ./..."
+    timeout_ms: 600000

package/recipes/jvm.yaml

@@ -0,0 +1,10 @@
+# gate.verifiers — the REAL Gate oracle for JVM projects (Maven or Gradle,
+# whichever wrapper the project ships). Auto-detects the wrapper, falls
+# back to the global tool. POSIX test syntax runs under bash (Git Bash on
+# Windows).
+description: JVM (Java / Kotlin via Maven or Gradle)
+requires: [java]
+verifiers:
+  - cmd: "if [ -f mvnw ]; then ./mvnw -q test; elif [ -f gradlew ]; then ./gradlew -q test; else mvn -q test 2>/dev/null || gradle -q test; fi"
+    timeout_ms: 600000
+    shell: bash

package/recipes/rust.yaml

@@ -0,0 +1,13 @@
+# gate.verifiers — the REAL Gate oracle for Rust projects (cargo).
+# Clippy is discipline, cargo test is truth. All judged by exit code.
+# The clippy gate is a bash pipeline (Git Bash on Windows).
+description: Rust (cargo)
+requires: [cargo]
+verifiers:
+  - cmd: "cargo check --quiet"
+    timeout_ms: 600000
+  - cmd: "cargo clippy --quiet 2>&1 | grep -E '^(warning|error)' && exit 1 || exit 0"
+    timeout_ms: 600000
+    shell: bash
+  - cmd: "cargo test --quiet"
+    timeout_ms: 600000

package/src/brain/db.js

@@ -256,6 +256,25 @@ export function ensureSchema(db) {
     CREATE INDEX IF NOT EXISTS idx_req_status ON requirements(status);
   `);
 
+  // ── Mind: task working-set (the EPHEMERAL brief) — gathered research
+  // held per-task for the task's duration, swept on completion. The MoE
+  // discipline: activate what THIS task needs, retain only the lessons.
+  // TTL (expires_at) and a size budget are enforced mechanically.
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS task_working_set (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      task_id TEXT NOT NULL,
+      kind TEXT NOT NULL DEFAULT 'finding',
+      text TEXT NOT NULL,
+      source TEXT,
+      bytes INTEGER NOT NULL DEFAULT 0,
+      expires_at TEXT,
+      created_at TEXT NOT NULL DEFAULT (datetime('now'))
+    );
+    CREATE INDEX IF NOT EXISTS idx_tws_task ON task_working_set(task_id);
+    CREATE INDEX IF NOT EXISTS idx_tws_expires ON task_working_set(expires_at);
+  `);
+
   // ── Mind: replay index (Tier-0 learned decisions, now persistent) ──
   db.exec(`
     CREATE TABLE IF NOT EXISTS replay_index (

package/src/config.js

@@ -27,7 +27,8 @@ export const DEFAULTS = Object.freeze({
   forge: { min_support: 3, min_precision: 0.7, max_trigger_terms: 3, max_seeds_per_run: 5 },
   queue: { max_attempts: 3 },
   analyzer: { enabled: true },
-  architecture: { rules: [] },     // declared layer/dependency-direction rules (mind/architecture.js)
+  schematic: { enabled: true, digest_ttl_ms: 30000 },   // map-first THINK: inject the codebase digest into every ladder decide (warm-cache TTL)
+  architecture: { rules: [], hubs: { max_fan_in: null, max_fan_out: null, max_layer_fan_in: null, ignore: [] } },     // declared layer rules (mind/architecture.js); hubs thresholds are the schematic's measured shape (null = not checked)
   daemon: { auto_fix: false, max_fixes_per_scan: 10 },
   muscle: { path_deny: [], path_allow: [] },   // empty deny = shipped defaults
   api: { token: null, port: 5107, host: '127.0.0.1' },
@@ -75,6 +76,19 @@ function dedentBlockLine(line, blockScalar) {
   return line.slice(cut);
 }
 
+/**
+ * YAML clip semantics: a literal/folded block scalar's value ends with a
+ * SINGLE trailing newline. Templates embed whole files in these blocks —
+ * gofmt, py_compile, and most linters require the final newline, and the
+ * old parser silently dropped it (a latent correctness bug the Go recipe's
+ * gofmt oracle caught first). Folded blocks join with spaces as before.
+ */
+function finalizeBlock(blockScalar) {
+  const text = blockScalar.text;
+  if (blockScalar.folded) return text.join(' ');
+  return text.length > 0 ? text.join('\n') + '\n' : '';
+}
+
 /**
  * Minimal YAML-subset parser: nested maps by indentation, scalars, inline
  * arrays, `#` comments. Deliberately NOT full YAML — unsupported syntax
@@ -84,6 +98,10 @@ export function parseYaml(text, source = CONFIG_PATH) {
   const root = {};
   const stack = [{ indent: -1, obj: root }];
   const lines = text.split(/\r?\n/);
+  // A trailing newline is a line TERMINATOR, not a blank line — drop the
+  // phantom final empty element so block scalars don't swallow it as an
+  // extra blank content line (gofmt-grade oracles reject the result).
+  if (lines.length > 0 && lines[lines.length - 1] === '') lines.pop();
   let blockScalar = null; // open "key: >" / "key: |" scalar being collected
 
   for (let i = 0; i < lines.length; i++) {
@@ -103,8 +121,8 @@ export function parseYaml(text, source = CONFIG_PATH) {
         && line.match(/^\s*/)[0].length > (blockScalar.indent ?? 0);
       const isListItem = /^\s*-\s/.test(line);
       if (!isContinuation || isListItem) {
-        const { parent, key, folded, text } = blockScalar;
-        parent[key] = folded ? text.join(' ') : text.join('\n');
+        const { parent, key } = blockScalar;
+        parent[key] = finalizeBlock(blockScalar);
         blockScalar = null;
       }
     }
@@ -207,11 +225,10 @@ export function parseYaml(text, source = CONFIG_PATH) {
     } else {
       parent[key] = parseScalar(rest);
     }
-  }
-  // Close a block scalar still open at EOF.
+  }  // Close a block scalar still open at EOF.
   if (blockScalar !== null) {
-    const { parent, key, folded, text } = blockScalar;
-    parent[key] = folded ? text.join(' ') : text.join('\n');
+    const { parent, key } = blockScalar;
+    parent[key] = finalizeBlock(blockScalar);
   }
   return root;
 }

package/src/gate/recipes.js

@@ -129,8 +129,14 @@ export function probeRecipes(names = null) {
     if (toolCache.has(tool)) return toolCache.get(tool);
     let ok = false;
     try {
+      // Go prints its version to STDOUT via `go version` (`go --version` is
+      // a usage error); everything else speaks `--version`. Probe both.
       const r = spawnSync(`${tool} --version`, { shell: true, windowsHide: true, timeout: 10000 });
       ok = r.status === 0 || (r.error === undefined && typeof r.stdout === 'string' && r.stdout.length > 0);
+      if (!ok && tool === 'go') {
+        const g = spawnSync('go version', { shell: true, windowsHide: true, timeout: 10000 });
+        ok = g.status === 0;
+      }
     } catch { ok = false; }
     toolCache.set(tool, ok);
     return ok;

package/src/gate/verifier.js

@@ -29,6 +29,7 @@
 'use strict';
 
 import { spawn } from 'node:child_process';
+import { accessSync, constants } from 'node:fs';
 import { resolve, isAbsolute } from 'node:path';
 import { load as loadConfig } from '../config.js';
 import { redact, assertCommandAllowed } from '../kernel/safety.js';
@@ -59,6 +60,31 @@ export function parseCommand(cmd) {
   return argv;
 }
 
+/**
+ * Locate a bash executable for portable POSIX recipes (shell:'bash').
+ * Order: SCION_BASH env override, then the well-known Git Bash paths on
+ * Windows, then PATH. Cached — a probe per command would be waste.
+ */
+let _bashPath = undefined;
+function resolveBash() {
+  if (_bashPath !== undefined) return _bashPath;
+  const candidates = [
+    process.env.SCION_BASH,
+    'C:/Program Files/Git/bin/bash.exe',
+    'C:/Program Files (x86)/Git/bin/bash.exe',
+  ].filter(Boolean);
+  if (process.platform !== 'win32') candidates.unshift('/bin/bash', '/usr/bin/bash');
+  for (const c of candidates) {
+    try {
+      accessSync(c, constants.X_OK);
+      _bashPath = c;
+      return c;
+    } catch { /* try next */ }
+  }
+  _bashPath = null;
+  return null;
+}
+
 /**
  * Run one command and capture its outcome.
  * @param {object} spec — { cmd, shell?, timeout_ms?, cwd?, env? }
@@ -74,6 +100,14 @@ export function runCommand(spec) {
     const cfg = loadConfig();
     const timeoutMs = spec.timeout_ms ?? cfg.gate?.timeout_ms ?? 120000;
     const useShell = spec.shell === true;
+    // shell:'bash' — portable POSIX recipes (gofmt/clippy pipelines, [ -f ]
+    // tests). Windows resolves Git Bash; POSIX shells already speak this.
+    const useBash = spec.shell === 'bash';
+    const bash = useBash ? resolveBash() : null;
+    if (useBash && !bash) {
+      resolvePromise({ cmd: spec.cmd, exit_code: -1, verified: false, error: 'verifier: shell "bash" requested but no bash found (install Git Bash or set SCION_BASH)' });
+      return;
+    }
     const cwd = spec.cwd ? resolve(spec.cwd) : process.cwd();
 
     let argv;
@@ -85,10 +119,12 @@ export function runCommand(spec) {
       return;
     }
 
-    const file = useShell ? (process.platform === 'win32' ? process.env.ComSpec || 'cmd.exe' : '/bin/sh') : argv[0];
-    const args = useShell
-      ? (process.platform === 'win32' ? ['/d', '/s', '/c', spec.cmd] : ['-c', spec.cmd])
-      : argv.slice(1);
+    const file = useBash ? bash : useShell ? (process.platform === 'win32' ? process.env.ComSpec || 'cmd.exe' : '/bin/sh') : argv[0];
+    const args = useBash
+      ? ['-c', spec.cmd]
+      : useShell
+        ? (process.platform === 'win32' ? ['/d', '/s', '/c', spec.cmd] : ['-c', spec.cmd])
+        : argv.slice(1);
 
     let child;
     try {

package/src/kernel/policy.js

@@ -12,6 +12,7 @@
 const DEFAULT_RULES = [
   { re: /^(os|shell|exec|rm|del)\b/i, action: 'deny', reason: 'os-level tools require the curated-command path' },
   { re: /^(read|list|glob|analyze|reason|search)\b/i, action: 'allow' },
+  { re: /^construct\b/i, action: 'gate', reason: 'construction is a mutation: the transactional applier writes and the Gate verifies' },
   { re: /^(write|edit|fix|apply)\b/i, action: 'gate', reason: 'mutations pass through the evidence gate' },
 ];
 

package/src/kernel/roles.js

@@ -100,6 +100,9 @@ export function liveWorkers() {
  * - An UNBOUND worker (no role) may claim only capability-less tasks —
  *   legacy behavior survives only where it is safe.
  * - Otherwise: every required capability must be in the role's set.
+ * - The role capability '*' is the GENERALIST wildcard: it satisfies any
+ *   requirement (the swarm's default binding; explicit is better than
+ *   implicit unrestrictedness — a generalist role is a declared contract).
  * Pure predicate — the queue's claim transaction calls this.
  */
 export function canClaim(workerId, taskCapabilities) {
@@ -107,6 +110,7 @@ export function canClaim(workerId, taskCapabilities) {
   if (required.length === 0) return true; // open task
   const role = roleOf(workerId);
   if (!role) return false;
+  if (role.capabilities.includes('*')) return true; // generalist wildcard
   return required.every((c) => role.capabilities.includes(c));
 }