prae-cli 0.5.2 → 0.6.1

package/README.md

@@ -40,6 +40,40 @@ formats plus entropy, placeholders dropped. Findings name the type, rule,
 line and confidence — structurally never the secret, so the output is safe to
 paste anywhere. With `--pack`, also prints the verdict that pack would reach.
 
+### `prae test <suite.json> [--pack <pack.json>] [--json]`
+
+Run security invariants against a pack and exit non-zero if any stops holding.
+A suite says what an agent attempts and what the pack must decide about it:
+
+```json
+{
+  "pack": "./acme.prae.json",
+  "scenarios": [
+    {
+      "name": "Reads outside the workspace are refused",
+      "given": "the agent is scoped to ./src and ./docs",
+      "when": { "tool": "read", "args": { "file_path": "/etc/shadow" } },
+      "then": { "decision": "deny", "rule": "ACME-001" }
+    }
+  ]
+}
+```
+
+`then` also takes `secretTypes`, asserting which credential classes the
+inspector found before the verdict — so a rule about secrets is tested on the
+detection as well as the decision. `when.repeat: 8` asserts the eighth call of
+that capability, which is how a session budget is written down and how the gate
+counts it.
+
+A failure prints the invariant in full — given, when, then, and what it got
+instead — because the useful thing about a red security test is the sentence
+describing what was supposed to hold. `--pack` overrides the suite's own, which
+is how one suite is run against a candidate pack before it is adopted.
+
+This evaluates the same pack through the same evaluator and the same content
+inspector the gate uses at runtime. It is not the harness: the adapter that
+turns a live tool call into facts is covered by `prae-gate`'s own suite.
+
 ### `prae mcp --root <dir> [--pack <pack.json>] [--ledger <file>]`
 
 Serve gated filesystem access over MCP stdio. Any MCP-capable IDE or agent
@@ -56,6 +90,14 @@ next to the result rather than in a footnote: a removed, edited, or reordered
 row breaks the chain; a rewrite of the whole file by someone holding this code
 does not.
 
+### `prae report <ledger.jsonl> [--out <file.html>] [--pack <pack.json>]`
+
+Render the decision record as a printable evidence report. With `--pack`,
+each clause also names the framework risk the rule cites — OWASP Top 10 for
+LLM Applications 2026 today — so a reviewer reads risk → control → decision →
+seal in one row. Without the pack the clause id stands alone rather than a
+name guessed from it.
+
 ### `prae console <ledger.jsonl> --out <dir> [--pack <file>]`
 
 Write the control plane as linked pages: Overview, Policy packs, Playground,

package/lib/bin.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import "./evaluate-DMyL3qM_.js";
-import { t as main } from "./cli-DfXHsQO7.js";
-import "./src-CXU0_W1P.js";
-import "./views-DalPkBZZ.js";
+import "./evaluate-CkYySl7T.js";
+import "./views-CAD9738P.js";
+import { t as main } from "./cli-BUgU-LpN.js";
+import "./src-Ciggx9ja.js";
 
 //#region src/bin.ts
 main(process.argv.slice(2)).catch((error) => {

package/lib/{cli-DfXHsQO7.js → cli-BUgU-LpN.js}

@@ -1,9 +1,9 @@
-import { t as evaluate } from "./evaluate-DMyL3qM_.js";
-import { m as seal, t as Ledger } from "./src-CXU0_W1P.js";
-import { a as renderPacks, c as renderShell, i as renderOverview, l as VERDICT_LABEL$1, n as renderApprovals, o as esc, r as renderCompliance, s as renderNav, t as navFor } from "./views-DalPkBZZ.js";
+import { t as evaluate } from "./evaluate-CkYySl7T.js";
+import { a as renderPacks, c as renderShell, d as cite, i as renderOverview, l as VERDICT_LABEL$1, n as renderApprovals, o as esc, r as renderCompliance, s as renderNav, t as navFor, u as FRAMEWORKS } from "./views-CAD9738P.js";
+import { m as seal, t as Ledger } from "./src-Ciggx9ja.js";
 import { existsSync, readFileSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { extname, join, normalize, resolve, sep } from "node:path";
+import { dirname, extname, join, normalize, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import { composePatchFile, preflightOps, revisionOf, takeSnapshot } from "dsh-overlay-check";
 import { createServer } from "node:http";
@@ -302,7 +302,8 @@ function readRule(check$1, path, value) {
 		"id",
 		"title",
 		"when",
-		"effect"
+		"effect",
+		"frameworks"
 	]);
 	const id = check$1.text(`${path}.id`, value.id);
 	const effect = readEffect(check$1, `${path}.effect`, value.effect);
@@ -318,8 +319,40 @@ function readRule(check$1, path, value) {
 		const title = check$1.text(`${path}.title`, value.title);
 		if (title !== void 0) rule.title = title;
 	}
+	if (value.frameworks !== void 0) {
+		const frameworks = readFrameworks(check$1, `${path}.frameworks`, value.frameworks);
+		if (frameworks !== void 0) rule.frameworks = frameworks;
+	}
 	return rule;
 }
+/**
+* A citation names a framework edition and controls the registry knows. A
+* typo here would be a rule that claims a mapping no view can render, so it
+* is a pack error rather than an ignored key — the same line the rest of the
+* parser takes.
+*/
+function readFrameworks(check$1, path, value) {
+	if (!isObject(value)) {
+		check$1.fail(path, "expected an object keyed by framework id");
+		return;
+	}
+	const out = {};
+	for (const [framework, controls] of Object.entries(value)) {
+		const known = FRAMEWORKS[framework];
+		if (known === void 0) {
+			check$1.fail(`${path}.${framework}`, `unknown framework; expected one of ${Object.keys(FRAMEWORKS).map((k) => `\`${k}\``).join(", ")}`);
+			continue;
+		}
+		if (!Array.isArray(controls) || !controls.every((c) => typeof c === "string")) {
+			check$1.fail(`${path}.${framework}`, "expected an array of control ids");
+			continue;
+		}
+		const ids = controls;
+		for (const control of ids) if (known.controls[control] === void 0) check$1.fail(`${path}.${framework}`, `unknown control \`${control}\` in ${known.name}`);
+		if (ids.length > 0) out[framework] = [...new Set(ids)];
+	}
+	return out;
+}
 /** Parse and validate a pack. Never throws; every problem lands in `errors`. */
 function parsePack(source) {
 	let raw;
@@ -404,14 +437,16 @@ function ago(iso, now) {
 	const s = seconds % 60;
 	return `${String(h).padStart(2, "0")}:${String(m).padStart(2, "0")}:${String(s).padStart(2, "0")}`;
 }
-function row(entry) {
+function row(entry, pack) {
 	const call = entry.subject === void 0 ? entry.tool : `${entry.tool} ${entry.subject}`;
 	const actor = entry.actor ?? entry.agent ?? "—";
+	const rule = pack?.rules.find((r) => r.id === entry.rule);
+	const cited = rule === void 0 ? "" : cite(rule).map((c) => `<br><span style="color:var(--secondary)">${esc(c.control)} ${esc(c.controlName)}</span>`).join("");
 	return `      <div class="grid row">
         <div class="seq">${entry.seq}</div>
         <div class="call">${esc(call)}</div>
         <div class="actor">${esc(actor)}</div>
-        <div class="clause">${esc(entry.rule ?? "—")}</div>
+        <div class="clause">${esc(entry.rule ?? "—")}${cited}</div>
         <div class="verdict v-${esc(entry.verdict)}">${esc(VERDICT_LABEL$1[entry.verdict] ?? entry.verdict)}</div>
         <div class="seal">${esc(seal(entry))}</div>
       </div>`;
@@ -452,7 +487,7 @@ function renderLedgerView(entries, verification, options) {
 	const table = `    <div class="grid thead">
       <div>SEQ</div><div>CALL</div><div>ACTOR</div><div>CLAUSE</div><div>VERDICT</div><div>SEAL</div>
     </div>
-${entries.length === 0 ? "    <div class=\"empty\">No decisions recorded yet.</div>" : [...entries].reverse().map(row).join("\n")}`;
+${entries.length === 0 ? "    <div class=\"empty\">No decisions recorded yet.</div>" : [...entries].reverse().map((entry) => row(entry, options.pack)).join("\n")}`;
 	const first = held.at(-1);
 	const awaiting = first === void 0 ? "" : `    <section class="await">
       <div class="k">AWAITING HUMAN · 1 OF ${held.length}</div>
@@ -853,6 +888,12 @@ const USAGE = `prae — operator policy for agent harnesses
       contents are returned, and every decision lands in the ledger.
       (no --pack mounts the bundled secret-catcher pack)
 
+  prae test <suite.json> [--pack <pack.json>] [--json]
+      Run security scenarios against a pack and report PASS/FAIL. Each
+      scenario says what an agent attempts and what the pack must decide;
+      the exit code is non-zero if any invariant no longer holds, so a
+      control pack can be defended in CI. --pack overrides the suite's own.
+
   prae verify <ledger.jsonl> [--key <public.pem>]
       Re-derive every hash in a decision log and report any break. With
       --key, also verify each row's signature against that pinned key.
@@ -868,8 +909,11 @@ const USAGE = `prae — operator policy for agent harnesses
       Check one receipt with nothing but the file: recompute its hash, verify
       its signature, and print the key fingerprint to compare against your own.
 
-  prae report <ledger.jsonl> [--out <file.html>]
-      Render the decision record as a printable evidence report.
+  prae report <ledger.jsonl> [--out <file.html>] [--pack <pack.json>]
+      Render the decision record as a printable evidence report. With
+      --pack, each clause also names the framework risk it addresses
+      (OWASP LLM Top 10 2026), so a reviewer can trace risk → control →
+      decision → seal.
 
   prae console <ledger.jsonl> --out <dir> [--pack <file>] [--serve [port]]
                 [--instructions <dir>]
@@ -919,6 +963,7 @@ async function check(path) {
 	for (const rule of pack.rules) {
 		const label = rule.title ?? rule.effect.because;
 		console.log(`  ${rule.id.padEnd(10)} ${rule.effect.kind.toUpperCase().padEnd(8)} ${label}`);
+		for (const c of cite(rule)) console.log(`  ${"".padEnd(10)} ${"".padEnd(8)} ↳ ${c.frameworkShort} · ${c.control} ${c.controlName}`);
 	}
 }
 /**
@@ -970,13 +1015,13 @@ async function scanFile(path, packPath, json) {
 * not come up inspecting nothing.
 */
 async function mcp(root, packPath, ledgerPath) {
-	const { serveMcp } = await import("./mcp-CEN48TpN.js");
+	const { serveMcp } = await import("./mcp-Bq0DNPPR.js");
 	const { resolve: resolve$1 } = await import("node:path");
 	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
 	const chosen = packPath ?? bundled;
 	if (chosen === void 0) return fail("mcp needs --pack <file>; no bundled secret-catcher found");
 	const pack = await loadPack(chosen);
-	const { Ledger: Ledger$1 } = await import("./src-Kubj3MTX.js");
+	const { Ledger: Ledger$1 } = await import("./src-C9L6NBvu.js");
 	const ledger = ledgerPath === void 0 ? void 0 : Ledger$1.open(ledgerPath);
 	console.error(`prae mcp: serving ${resolve$1(root)} under ${pack.pack} ${pack.version}` + (ledgerPath === void 0 ? " (no ledger)" : ` · ledger ${ledgerPath}`));
 	await serveMcp({
@@ -1028,7 +1073,7 @@ async function explain(path, tool, pairs) {
 * a key that arrived beside it is checked against nothing.
 */
 async function keygen(dir) {
-	const { generateKeypair, fingerprint } = await import("./src-Kubj3MTX.js");
+	const { generateKeypair, fingerprint } = await import("./src-C9L6NBvu.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = generateKeypair();
 	const priv = join(dir, "prae-signing.pem");
@@ -1044,7 +1089,7 @@ async function keygen(dir) {
 	console.log("private key with `signingKey` to sign every row.");
 }
 async function receipt(path, seq, keyPath, out) {
-	const { Ledger: Ledger$1, makeReceipt, fingerprint } = await import("./src-Kubj3MTX.js");
+	const { Ledger: Ledger$1, makeReceipt, fingerprint } = await import("./src-C9L6NBvu.js");
 	const { readFileSync: readFileSync$1 } = await import("node:fs");
 	const { createPublicKey } = await import("node:crypto");
 	const privateKey = readFileSync$1(keyPath, "utf8");
@@ -1074,7 +1119,7 @@ async function receipt(path, seq, keyPath, out) {
 * file and sets the exit code, so scripts can branch on it.
 */
 async function verifyReceiptCmd(path) {
-	const { checkReceipt } = await import("./receipt-check-Dql0uqxw.js");
+	const { checkReceipt } = await import("./receipt-check-DrDE3Wwi.js");
 	let parsed;
 	try {
 		parsed = JSON.parse(await readFile(path, "utf8"));
@@ -1086,6 +1131,52 @@ async function verifyReceiptCmd(path) {
 	else console.error(line);
 	if (!result.ok) process.exit(1);
 }
+/**
+* `prae test`: assert a pack's invariants and set an exit code.
+*
+* The checking lives in `test-run.ts`. This does the three things a command
+* does — read the files, supply the inspector, and decide the exit code.
+*/
+async function test(suitePath, packOverride, asJson) {
+	let raw;
+	try {
+		raw = await readFile(suitePath, "utf8");
+	} catch {
+		return fail(`cannot read ${suitePath}`);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (error) {
+		return fail(`${suitePath} is not valid JSON: ${error instanceof Error ? error.message : error}`);
+	}
+	const { parseSuite, renderSuite, runSuite } = await import("./test-run-04ubUcSb.js");
+	const suite = parseSuite(parsed);
+	if (!suite.ok) {
+		console.error(`prae: ${suitePath} is not a valid test suite`);
+		for (const message of suite.errors) console.error(`  ${message}`);
+		process.exit(1);
+	}
+	const chosen = packOverride ?? (suite.suite.pack === void 0 ? void 0 : resolve(dirname(suitePath), suite.suite.pack));
+	if (chosen === void 0) return fail("test needs a pack: set `pack` in the suite or pass --pack");
+	const pack = await loadPack(chosen);
+	const { capabilityForTool } = await import("capmark");
+	const { scan } = await import("./src-Vnr0fcpK.js");
+	const inspect = pack.rules.some((rule) => rule.when.secrets !== void 0) ? (path) => {
+		try {
+			return scan(readFileSync(path, "utf8"));
+		} catch {
+			return;
+		}
+	} : void 0;
+	const result = runSuite(pack, suite.suite, {
+		capabilityFor: (tool) => capabilityForTool(tool)?.id,
+		...inspect === void 0 ? {} : { inspect }
+	});
+	if (asJson) console.log(JSON.stringify(result, null, 2));
+	else for (const line of renderSuite(result)) console.log(line);
+	if (!result.ok) process.exit(1);
+}
 async function verify(path, keyPath) {
 	let ledger;
 	try {
@@ -1099,7 +1190,7 @@ async function verify(path, keyPath) {
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
 		if (keyPath !== void 0) {
-			const { verifySignature, fingerprint } = await import("./src-Kubj3MTX.js");
+			const { verifySignature, fingerprint } = await import("./src-C9L6NBvu.js");
 			const { readFileSync: readFileSync$1 } = await import("node:fs");
 			const publicKey = readFileSync$1(keyPath, "utf8");
 			let signed = 0;
@@ -1138,18 +1229,20 @@ function flag(argv, name) {
 * has to go and check separately. A report that looks authoritative while
 * quietly sitting on a broken chain is worse than no report.
 */
-async function report(path, out) {
+async function report(path, out, packPath) {
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
 	} catch (error) {
 		return fail(error instanceof Error ? error.message : String(error));
 	}
+	const pack = packPath === void 0 ? void 0 : await loadPack(packPath);
 	const entries = ledger.read();
 	const verification = ledger.verify();
 	const html = renderLedgerView(entries, verification, {
 		ledgerPath: path,
-		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		...pack === void 0 ? {} : { pack }
 	});
 	if (out === void 0) {
 		process.stdout.write(html);
@@ -1175,7 +1268,7 @@ async function report(path, out) {
 * that step is a proposal a human approves, and it starts from this list.
 */
 async function instructions(from, asJson) {
-	const { ingest } = await import("./src-C4fnUm9V.js");
+	const { ingest } = await import("./src-CraUX64d.js");
 	const result = ingest(from);
 	if (asJson) {
 		console.log(JSON.stringify(result, null, 2));
@@ -1211,7 +1304,7 @@ async function instructions(from, asJson) {
 * on purpose rather than something that happened to their policy.
 */
 async function propose(from, options) {
-	const [{ ingest }, { extract }] = await Promise.all([import("./src-C4fnUm9V.js"), import("./src-BfYsUDW9.js")]);
+	const [{ ingest }, { extract }] = await Promise.all([import("./src-CraUX64d.js"), import("./src-CQ0UmFUK.js")]);
 	const read = ingest(from);
 	if (read.files.length === 0) {
 		console.log(`No instruction files found at or above ${from}.`);
@@ -1271,9 +1364,9 @@ async function consoleOut(path, argv) {
 	const instructionsDir = flag(argv, "instructions");
 	if (instructionsDir !== void 0) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
-			import("./src-C4fnUm9V.js"),
-			import("./src-BfYsUDW9.js"),
-			import("./instructions-D4VOn2lk.js")
+			import("./src-CraUX64d.js"),
+			import("./src-CQ0UmFUK.js"),
+			import("./instructions-oGCdVxHM.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -1389,6 +1482,12 @@ async function main(argv) {
 			if (path === void 0 || seq === void 0 || key === void 0) fail("receipt needs <ledger.jsonl> <seq> --key <private.pem>");
 			return receipt(path, Number(seq), key, flag(rest, "out"));
 		}
+		case "test": {
+			const [suite] = rest;
+			if (suite === void 0) fail("test needs a suite file");
+			await test(suite, flag(argv, "pack"), argv.includes("--json"));
+			return;
+		}
 		case "verify": {
 			const path = rest[0];
 			if (path === void 0) fail("verify needs a ledger file");
@@ -1402,7 +1501,7 @@ async function main(argv) {
 		case "report": {
 			const path = rest[0];
 			if (path === void 0) fail("report needs a ledger file");
-			return report(path, flag(rest, "out"));
+			return report(path, flag(rest, "out"), flag(rest, "pack"));
 		}
 		case "console": {
 			const path = rest[0];

package/lib/docs/secret-catcher.md

@@ -73,6 +73,22 @@ before the tool runs. The refusal is delivered to the agent as the tool result.
 — one-minute profile, the exact command, the expected refusal, and the bypasses
 to try with what each one does. Requires `prae-gate ≥ 0.5.1`.
 
+## Prove the pack still holds, in your own pipeline
+
+`prae test` runs a pack against written invariants and exits non-zero when one
+stops holding — so a pack edit that quietly stops refusing something fails a
+build instead of reaching an agent:
+
+```bash
+npx prae-cli test ./your-invariants.json --pack ./secret-catcher.prae.json
+```
+
+Each scenario names what an agent attempts and what the pack must decide about
+it, including which credential classes the inspector had to find first — so the
+detection is asserted alongside the verdict. The file format is in
+`packages/cli/README.md`, and `demo/workspace/papaya.tests.json` in this
+repository is a worked suite of fourteen. Needs `prae-cli >= 0.6.0`.
+
 ## What the ledger holds afterwards
 
 One row per intercepted read — verdict, rule, subject path, and for content

package/lib/{evaluate-DMyL3qM_.js → evaluate-CkYySl7T.js}

@@ -80,13 +80,16 @@ function segments(command) {
 	const found = [];
 	for (const tokens of scan(command)) {
 		let at = 0;
+		const wrappers = [];
 		while (at < tokens.length) {
 			const token = tokens[at];
 			if (ASSIGNMENT.test(token)) {
 				at += 1;
 				continue;
 			}
-			if (WRAPPERS.has(token)) {
+			const word = (token.split("/").pop() ?? token).toLowerCase();
+			if (WRAPPERS.has(word)) {
+				wrappers.push(word);
 				at += 1;
 				while (at < tokens.length) {
 					const option = tokens[at];
@@ -98,10 +101,19 @@ function segments(command) {
 			break;
 		}
 		const name = tokens[at];
-		if (name === void 0) continue;
+		if (name === void 0) {
+			const last = wrappers.at(-1);
+			if (last !== void 0) found.push({
+				name: last,
+				tokens: [],
+				wrappers
+			});
+			continue;
+		}
 		found.push({
 			name: (name.split("/").pop() ?? name).toLowerCase(),
-			tokens: tokens.slice(at + 1)
+			tokens: tokens.slice(at + 1),
+			wrappers
 		});
 	}
 	return found;
@@ -122,7 +134,7 @@ function commandMatches(match, command) {
 	const args = list(match.token);
 	const pipes = list(match.pipedTo);
 	if (names.length > 0) {
-		const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name)));
+		const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name) || segment.wrappers.some((wrapper) => matches$1(pattern, wrapper))));
 		if (hit.length === 0) return false;
 		if (args.length > 0 && !hit.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
 	} else if (args.length > 0) {

package/lib/index.js

@@ -1,6 +1,6 @@
-import "./evaluate-DMyL3qM_.js";
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-DfXHsQO7.js";
-import "./src-CXU0_W1P.js";
-import "./views-DalPkBZZ.js";
+import "./evaluate-CkYySl7T.js";
+import "./views-CAD9738P.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-BUgU-LpN.js";
+import "./src-Ciggx9ja.js";
 
 export { applyWrite, defaultProfile, dshHome, main, planWrite, praeRow, profileAt };

package/lib/{instructions-D4VOn2lk.js → instructions-oGCdVxHM.js}

@@ -1,4 +1,4 @@
-import { c as renderShell, o as esc, s as renderNav, t as navFor } from "./views-DalPkBZZ.js";
+import { c as renderShell, o as esc, s as renderNav, t as navFor } from "./views-CAD9738P.js";
 
 //#region src/console/instructions.ts
 const STYLE = `

package/lib/{mcp-CEN48TpN.js → mcp-Bq0DNPPR.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-DMyL3qM_.js";
+import { t as evaluate } from "./evaluate-CkYySl7T.js";
 import { a as scan, n as MAX_SCAN_BYTES } from "./src-Br1tGPtS.js";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { resolve, sep } from "node:path";

package/lib/playground.js

@@ -83,13 +83,16 @@
 		const found = [];
 		for (const tokens of scan(command)) {
 			let at = 0;
+			const wrappers = [];
 			while (at < tokens.length) {
 				const token = tokens[at];
 				if (ASSIGNMENT.test(token)) {
 					at += 1;
 					continue;
 				}
-				if (WRAPPERS.has(token)) {
+				const word = (token.split("/").pop() ?? token).toLowerCase();
+				if (WRAPPERS.has(word)) {
+					wrappers.push(word);
 					at += 1;
 					while (at < tokens.length) {
 						const option = tokens[at];
@@ -101,10 +104,19 @@
 				break;
 			}
 			const name = tokens[at];
-			if (name === void 0) continue;
+			if (name === void 0) {
+				const last = wrappers.at(-1);
+				if (last !== void 0) found.push({
+					name: last,
+					tokens: [],
+					wrappers
+				});
+				continue;
+			}
 			found.push({
 				name: (name.split("/").pop() ?? name).toLowerCase(),
-				tokens: tokens.slice(at + 1)
+				tokens: tokens.slice(at + 1),
+				wrappers
 			});
 		}
 		return found;
@@ -125,7 +137,7 @@
 		const args = list(match.token);
 		const pipes = list(match.pipedTo);
 		if (names.length > 0) {
-			const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name)));
+			const hit = parts.filter((segment) => names.some((pattern) => matches$1(pattern, segment.name) || segment.wrappers.some((wrapper) => matches$1(pattern, wrapper))));
 			if (hit.length === 0) return false;
 			if (args.length > 0 && !hit.some((segment) => args.every((wanted) => segment.tokens.some((token) => matches$1(wanted, token))))) return false;
 		} else if (args.length > 0) {
@@ -454,6 +466,55 @@
 		};
 	}
 
+//#endregion
+//#region ../kernel/src/frameworks.ts
+	const FRAMEWORKS = { "owasp-llm-top-10-2026": {
+		name: "OWASP Top 10 for LLM Applications — 2026",
+		short: "OWASP LLM 2026",
+		controls: {
+			LLM01: {
+				name: "Prompt Injection",
+				summary: "Instructions in a prompt or in retrieved content alter what the model does."
+			},
+			LLM02: {
+				name: "Sensitive Information Disclosure",
+				summary: "Credentials, personal data or proprietary content reach the model or its output."
+			},
+			LLM03: {
+				name: "Excessive Agency",
+				summary: "The model can take actions, or holds permissions, beyond what its task needs."
+			},
+			LLM04: {
+				name: "Supply Chain",
+				summary: "A compromised model, dataset, plugin or dependency enters the application."
+			},
+			LLM05: {
+				name: "Data and Model Poisoning",
+				summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
+			},
+			LLM06: {
+				name: "Unbounded Consumption",
+				summary: "The application permits resource use without a limit, exhausting budget or service."
+			},
+			LLM07: {
+				name: "Misinformation",
+				summary: "The model produces false or misleading content that is acted on as if true."
+			},
+			LLM08: {
+				name: "Hidden Context Exposure",
+				summary: "System prompts, hidden instructions or internal context are revealed."
+			},
+			LLM09: {
+				name: "Vector and Embedding Weaknesses",
+				summary: "Retrieval stores are manipulated or leak across tenants and permissions."
+			},
+			LLM10: {
+				name: "Improper Output Handling",
+				summary: "Model output is passed to downstream systems without validation."
+			}
+		}
+	} };
+
 //#endregion
 //#region ../kernel/src/pack.ts
 	function isObject(value) {
@@ -749,7 +810,8 @@
 			"id",
 			"title",
 			"when",
-			"effect"
+			"effect",
+			"frameworks"
 		]);
 		const id = check.text(`${path}.id`, value.id);
 		const effect = readEffect(check, `${path}.effect`, value.effect);
@@ -765,8 +827,40 @@
 			const title = check.text(`${path}.title`, value.title);
 			if (title !== void 0) rule.title = title;
 		}
+		if (value.frameworks !== void 0) {
+			const frameworks = readFrameworks(check, `${path}.frameworks`, value.frameworks);
+			if (frameworks !== void 0) rule.frameworks = frameworks;
+		}
 		return rule;
 	}
+	/**
+	* A citation names a framework edition and controls the registry knows. A
+	* typo here would be a rule that claims a mapping no view can render, so it
+	* is a pack error rather than an ignored key — the same line the rest of the
+	* parser takes.
+	*/
+	function readFrameworks(check, path, value) {
+		if (!isObject(value)) {
+			check.fail(path, "expected an object keyed by framework id");
+			return;
+		}
+		const out = {};
+		for (const [framework, controls] of Object.entries(value)) {
+			const known = FRAMEWORKS[framework];
+			if (known === void 0) {
+				check.fail(`${path}.${framework}`, `unknown framework; expected one of ${Object.keys(FRAMEWORKS).map((k) => `\`${k}\``).join(", ")}`);
+				continue;
+			}
+			if (!Array.isArray(controls) || !controls.every((c) => typeof c === "string")) {
+				check.fail(`${path}.${framework}`, "expected an array of control ids");
+				continue;
+			}
+			const ids = controls;
+			for (const control of ids) if (known.controls[control] === void 0) check.fail(`${path}.${framework}`, `unknown control \`${control}\` in ${known.name}`);
+			if (ids.length > 0) out[framework] = [...new Set(ids)];
+		}
+		return out;
+	}
 	/** Parse and validate a pack. Never throws; every problem lands in `errors`. */
 	function parsePack(source) {
 		let raw;

package/lib/{receipt-check-Dql0uqxw.js → receipt-check-DrDE3Wwi.js}

@@ -1,4 +1,4 @@
-import { c as verifyReceipt, i as fingerprint } from "./src-CXU0_W1P.js";
+import { c as verifyReceipt, i as fingerprint } from "./src-Ciggx9ja.js";
 
 //#region src/receipt-check.ts
 /** Shape we require before we will call it a receipt at all. */

package/lib/secret-catcher.prae.json

@@ -17,11 +17,16 @@
             "./**/*.sample"
           ]
         },
-        "secrets": { "minConfidence": 0.8 }
+        "secrets": {
+          "minConfidence": 0.8
+        }
       },
       "effect": {
         "kind": "deny",
         "because": "the requested file contains a protected credential; the contents were not returned"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM02"]
       }
     },
     {
@@ -29,17 +34,27 @@
       "title": "Private keys are refused everywhere",
       "when": {
         "capability": "fs:read",
-        "secrets": { "types": ["private-key"] }
+        "secrets": {
+          "types": ["private-key"]
+        }
       },
       "effect": {
         "kind": "deny",
         "because": "the requested file contains a private key; the contents were not returned"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM02"]
       }
     },
     {
       "id": "SEC-003",
       "title": "Anything credential-shaped is at least recorded",
-      "when": { "capability": "fs:read", "secrets": { "minConfidence": 0.5 } },
+      "when": {
+        "capability": "fs:read",
+        "secrets": {
+          "minConfidence": 0.5
+        }
+      },
       "effect": {
         "kind": "warn",
         "because": "a possible credential was noticed in this file; where no stronger rule fired, the read proceeded and this row is the record"

package/lib/{src-Kubj3MTX.js → src-C9L6NBvu.js}

@@ -1,3 +1,3 @@
-import { a as generateKeypair, c as verifyReceipt, d as canonical, f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, o as makeReceipt, p as hashEntry, r as verifyEntries, s as signEntry, t as Ledger, u as GENESIS } from "./src-CXU0_W1P.js";
+import { a as generateKeypair, c as verifyReceipt, d as canonical, f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, o as makeReceipt, p as hashEntry, r as verifyEntries, s as signEntry, t as Ledger, u as GENESIS } from "./src-Ciggx9ja.js";
 
 export { GENESIS, Ledger, canonical, chain, fingerprint, generateKeypair, hashEntry, makeReceipt, readEntries, seal, signEntry, verifyEntries, verifyReceipt, verifySignature };

package/lib/test-run-04ubUcSb.js

@@ -0,0 +1,137 @@
+import { t as evaluate } from "./evaluate-CkYySl7T.js";
+
+//#region src/test-run.ts
+/** The path argument a scenario's call carries, if any. */
+function pathOf(args) {
+	for (const key of [
+		"path",
+		"file_path",
+		"filePath",
+		"target"
+	]) {
+		const value = args[key];
+		if (typeof value === "string" && value !== "") return value;
+	}
+}
+/**
+* Reject a malformed suite by saying what is wrong with it.
+*
+* A test file that silently runs nothing is the worst possible outcome here —
+* it reports success — so every scenario must name a tool and an expected
+* decision, and anything else is an error rather than a default.
+*/
+function parseSuite(parsed) {
+	const errors = [];
+	if (typeof parsed !== "object" || parsed === null) return {
+		ok: false,
+		errors: ["expected a JSON object"]
+	};
+	const root = parsed;
+	const scenarios = root.scenarios;
+	if (!Array.isArray(scenarios) || scenarios.length === 0) return {
+		ok: false,
+		errors: ["`scenarios` must be a non-empty array"]
+	};
+	const kinds = new Set([
+		"allow",
+		"deny",
+		"ask",
+		"correct"
+	]);
+	scenarios.forEach((raw, index) => {
+		const at = `scenarios[${index}]`;
+		if (typeof raw !== "object" || raw === null) {
+			errors.push(`${at}: expected an object`);
+			return;
+		}
+		const s = raw;
+		if (typeof s.name !== "string" || s.name === "") errors.push(`${at}.name: required`);
+		const when = s.when;
+		if (typeof when !== "object" || when === null) errors.push(`${at}.when: required`);
+		else {
+			if (typeof when.tool !== "string" || when.tool === "") errors.push(`${at}.when.tool: required`);
+			if (when.repeat !== void 0 && (typeof when.repeat !== "number" || when.repeat < 1)) errors.push(`${at}.when.repeat: must be a positive number`);
+		}
+		const then = s.then;
+		if (typeof then !== "object" || then === null) errors.push(`${at}.then: required`);
+		else if (typeof then.decision !== "string" || !kinds.has(then.decision)) errors.push(`${at}.then.decision: one of allow, deny, ask, correct`);
+	});
+	if (errors.length > 0) return {
+		ok: false,
+		errors
+	};
+	return {
+		ok: true,
+		suite: {
+			...typeof root.pack === "string" ? { pack: root.pack } : {},
+			scenarios
+		}
+	};
+}
+function runSuite(pack, suite, options) {
+	const results = suite.scenarios.map((scenario) => {
+		const args = scenario.when.args ?? {};
+		const capability = options.capabilityFor(scenario.when.tool);
+		const target = pathOf(args);
+		const findings = target === void 0 || options.inspect === void 0 ? void 0 : options.inspect(target);
+		const decision = evaluate(pack, {
+			tool: scenario.when.tool,
+			...capability === void 0 ? {} : { capability },
+			args,
+			...findings !== void 0 && findings.length > 0 ? { secrets: findings } : {},
+			...capability === void 0 || scenario.when.repeat === void 0 ? {} : { counts: { [capability]: scenario.when.repeat } }
+		});
+		const secretTypes = [...new Set((findings ?? []).map((f) => f.type))];
+		const failures = [];
+		if (decision.kind !== scenario.then.decision) failures.push(`decision was ${decision.kind}, expected ${scenario.then.decision}`);
+		if (scenario.then.rule !== void 0 && decision.rule !== scenario.then.rule) failures.push(`rule was ${decision.rule ?? "none"}, expected ${scenario.then.rule}`);
+		if (scenario.then.secretTypes !== void 0) {
+			const missing = scenario.then.secretTypes.filter((type) => !secretTypes.includes(type));
+			if (missing.length > 0) failures.push(`no finding of type ${missing.join(", ")}`);
+		}
+		return {
+			name: scenario.name,
+			...scenario.given === void 0 ? {} : { given: scenario.given },
+			when: scenario.when,
+			expected: scenario.then,
+			actual: {
+				decision: decision.kind,
+				...decision.rule === void 0 ? {} : { rule: decision.rule },
+				secretTypes
+			},
+			pass: failures.length === 0,
+			failures
+		};
+	});
+	const failed = results.filter((r) => !r.pass).length;
+	return {
+		pack: `${pack.pack} ${pack.version}`,
+		passed: results.length - failed,
+		failed,
+		results,
+		ok: failed === 0
+	};
+}
+/** The report, as lines. Phrased for a reader; the command only prints it. */
+function renderSuite(result) {
+	const lines = [`prae test — ${result.pack}`, ""];
+	const width = Math.max(...result.results.map((r) => r.name.length), 20);
+	for (const r of result.results) {
+		const mark = r.pass ? "✓" : "✕";
+		const shown = r.pass ? `${r.actual.decision.toUpperCase()}${r.actual.rule === void 0 ? "" : `  ${r.actual.rule}`}` : r.failures.join("; ");
+		lines.push(`  ${mark} ${r.name.padEnd(width)}  ${shown}`);
+	}
+	for (const r of result.results.filter((one) => !one.pass)) {
+		lines.push("", `  ✕ ${r.name}`);
+		if (r.given !== void 0) lines.push(`      GIVEN  ${r.given}`);
+		lines.push(`      WHEN   ${r.when.tool}${r.when.repeat === void 0 ? "" : ` ×${r.when.repeat}`} ${JSON.stringify(r.when.args ?? {})}`);
+		lines.push(`      THEN   ${r.expected.decision}${r.expected.rule === void 0 ? "" : ` · ${r.expected.rule}`}`);
+		lines.push(`      GOT    ${r.failures.join("; ")}`);
+	}
+	const n = result.results.length;
+	lines.push("", `${n} scenario${n === 1 ? "" : "s"} · ${result.passed} passed · ${result.failed} failed`, result.ok ? "SECURITY TEST: PASS" : "SECURITY TEST: FAIL");
+	return lines;
+}
+
+//#endregion
+export { parseSuite, renderSuite, runSuite };

package/lib/{views-DalPkBZZ.js → views-CAD9738P.js}

@@ -1,3 +1,72 @@
+//#region ../kernel/src/frameworks.ts
+const FRAMEWORKS = { "owasp-llm-top-10-2026": {
+	name: "OWASP Top 10 for LLM Applications — 2026",
+	short: "OWASP LLM 2026",
+	controls: {
+		LLM01: {
+			name: "Prompt Injection",
+			summary: "Instructions in a prompt or in retrieved content alter what the model does."
+		},
+		LLM02: {
+			name: "Sensitive Information Disclosure",
+			summary: "Credentials, personal data or proprietary content reach the model or its output."
+		},
+		LLM03: {
+			name: "Excessive Agency",
+			summary: "The model can take actions, or holds permissions, beyond what its task needs."
+		},
+		LLM04: {
+			name: "Supply Chain",
+			summary: "A compromised model, dataset, plugin or dependency enters the application."
+		},
+		LLM05: {
+			name: "Data and Model Poisoning",
+			summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
+		},
+		LLM06: {
+			name: "Unbounded Consumption",
+			summary: "The application permits resource use without a limit, exhausting budget or service."
+		},
+		LLM07: {
+			name: "Misinformation",
+			summary: "The model produces false or misleading content that is acted on as if true."
+		},
+		LLM08: {
+			name: "Hidden Context Exposure",
+			summary: "System prompts, hidden instructions or internal context are revealed."
+		},
+		LLM09: {
+			name: "Vector and Embedding Weaknesses",
+			summary: "Retrieval stores are manipulated or leak across tenants and permissions."
+		},
+		LLM10: {
+			name: "Improper Output Handling",
+			summary: "Model output is passed to downstream systems without validation."
+		}
+	}
+} };
+/**
+* Every framework control a rule cites, resolved to names.
+*
+* A pack that parsed cites only ids the registry knows, so the lookups here
+* cannot miss; the fallbacks exist for a `Rule` built by hand in code.
+*/
+function cite(rule) {
+	const out = [];
+	for (const [framework, controls] of Object.entries(rule.frameworks ?? {})) {
+		const known = FRAMEWORKS[framework];
+		for (const control of controls) out.push({
+			framework,
+			frameworkName: known?.name ?? framework,
+			frameworkShort: known?.short ?? framework,
+			control,
+			controlName: known?.controls[control]?.name ?? control
+		});
+	}
+	return out;
+}
+
+//#endregion
 //#region src/console/logo.ts
 /**
 * The mark, inlined.
@@ -629,7 +698,7 @@ function renderNav(items, active) {
 * the obligation, and a tool that told them the answer would be selling the
 * one thing it cannot supply.
 */
-const CONTROLS = [
+const OBLIGATIONS = [
 	{
 		id: "EU AI Act art. 12",
 		asks: "Automatic recording of events over the lifetime of the system, to a degree that enables tracing.",
@@ -671,6 +740,71 @@ const CONTROLS = [
 		})
 	}
 ];
+const OWASP = "owasp-llm-top-10-2026";
+/** Rules in the pack that cite one control of one framework. */
+function citing(pack, framework, control) {
+	return (pack?.rules ?? []).filter((rule) => (rule.frameworks?.[framework] ?? []).includes(control));
+}
+/**
+* Why a runtime execution gate is not the control for a risk no rule cites.
+*
+* Said per risk rather than as one generic line, because "out of scope" with
+* no reason reads as an excuse. Each of these is a boundary a reader can
+* check: the risk lives somewhere a tool-call gate does not stand.
+*/
+const NOT_THIS_BOUNDARY = {
+	LLM04: "Where a model or dependency came from is settled before an agent runs; the gate sees the call, not the provenance.",
+	LLM05: "Training and fine-tuning data sit outside the execution boundary this gate stands on.",
+	LLM07: "Whether an answer is true is not a property of a tool call.",
+	LLM08: "The assembled system prompt is sealed into the ledger as evidence of what the model was told; nothing here stops the model repeating it.",
+	LLM09: "Retrieval stores are upstream of the call the gate judges.",
+	LLM10: "What downstream code does with model output is that code's boundary, not this one's."
+};
+function owaspRow(control) {
+	const framework = FRAMEWORKS[OWASP];
+	const risk = framework?.controls[control];
+	const name = risk?.name ?? control;
+	return {
+		id: `${framework?.short ?? OWASP} · ${control}`,
+		asks: `${name}. ${risk?.summary ?? ""}`.trim(),
+		evidence: (data) => {
+			if (data.pack === void 0) return {
+				state: "absent",
+				note: "No pack supplied to this view."
+			};
+			if (control === "LLM01") {
+				const bounding = citing(data.pack, OWASP, "LLM03");
+				return {
+					state: "partial",
+					note: bounding.length === 0 ? "Not mitigated: this gate does not detect injected instructions, and no LLM03 control in this pack bounds what one can execute." : `Not mitigated: this gate does not detect injected instructions. Bounded: ${bounding.length} LLM03 control${bounding.length === 1 ? "" : "s"} (${bounding.map((r) => r.id).join(", ")}) decide what an injected instruction can execute.`
+				};
+			}
+			const rules = citing(data.pack, OWASP, control);
+			if (rules.length === 0) return {
+				state: "absent",
+				note: NOT_THIS_BOUNDARY[control] ?? "No rule in this pack cites this risk."
+			};
+			const ids = new Set(rules.map((rule) => rule.id));
+			const decisions = data.entries.filter((entry) => entry.rule !== void 0 && ids.has(entry.rule));
+			const listed = rules.map((rule) => rule.id).join(", ");
+			return decisions.length > 0 ? {
+				state: "covered",
+				note: `${rules.length} control${rules.length === 1 ? "" : "s"} mapped (${listed}) · ${decisions.length} sealed decision${decisions.length === 1 ? "" : "s"} under them in this record.`
+			} : {
+				state: "partial",
+				note: `${rules.length} control${rules.length === 1 ? "" : "s"} mapped (${listed}); none has decided a call in this record yet, so the mapping is declared, not exercised.`
+			};
+		}
+	};
+}
+const OWASP_ROWS = Object.keys(FRAMEWORKS[OWASP]?.controls ?? {}).map(owaspRow);
+/**
+* The obligations first, then the OWASP risks. Two kinds of row in one table
+* on purpose: an auditor reads down one list and finds the audit obligations
+* the ledger evidences and the application risks the pack's rules address,
+* each stated in its framework's own words.
+*/
+const CONTROLS = [...OBLIGATIONS, ...OWASP_ROWS];
 
 //#endregion
 //#region src/console/views.ts
@@ -789,11 +923,17 @@ function renderPacks(data) {
 	});
 	const baseline = pack.baseline?.capabilities;
 	const caps = baseline === void 0 ? `<p style="padding:0 30px 22px;font-size:14px;color:var(--secondary);max-width:76ch">This pack sets no capability ceiling. It governs through its rules alone, and withholds nothing an author declares.</p>` : `<div class="caps">${baseline.map((c) => `<span class="cap">${esc(c)}</span>`).join("")}</div>`;
-	const rows = pack.rules.map((rule) => `      <div class="grid rules row">
+	const cited = /* @__PURE__ */ new Map();
+	for (const rule of pack.rules) for (const c of cite(rule)) cited.set(c.framework, c.frameworkName);
+	const frameworks = cited.size === 0 ? "" : `<div class="caps">${[...cited.values()].map((name) => `<span class="cap">${esc(name)}</span>`).join("")}</div>`;
+	const rows = pack.rules.map((rule) => {
+		const tags = cite(rule).map((c) => `<br><span style="color:var(--secondary)">${esc(c.frameworkShort)} · ${esc(c.control)} ${esc(c.controlName)}</span>`).join("");
+		return `      <div class="grid rules row">
         <div class="seq">${esc(rule.id)}</div>
-        <div class="call">${esc(rule.title ?? rule.effect.because)}<br><span style="color:var(--muted)">${esc(matcherOf(rule))}</span></div>
+        <div class="call">${esc(rule.title ?? rule.effect.because)}<br><span style="color:var(--muted)">${esc(matcherOf(rule))}</span>${tags}</div>
         <div class="effect e-${esc(rule.effect.kind)}">${esc(rule.effect.kind.toUpperCase())}</div>
-      </div>`).join("\n");
+      </div>`;
+	}).join("\n");
 	const body = `    <section class="sect">
       <h2>${esc(pack.pack)} <span style="font-family:var(--proof);font-size:14px;color:var(--muted)">${esc(pack.version)}</span></h2>
       <p>The operator baseline is intersected with whatever a plugin's own
@@ -801,6 +941,7 @@ function renderPacks(data) {
       grant a capability an author never asked for.</p>
     </section>
     ${caps}
+    ${frameworks}
     <div class="grid rules thead">
       <div>CLAUSE</div><div>RULE</div><div>EFFECT</div>
     </div>
@@ -840,11 +981,17 @@ ${CONTROLS.map((control) => {
       </div>`;
 	}).join("\n")}
     <section class="sect" style="padding-bottom:26px">
-      <h2>The gap that recurs</h2>
-      <p>Three of these rows stop at <em>partial</em> for the same reason: the
-      harness records what was decided and never who decided it. Attributable
-      approval needs an identity anchor outside this machine, which is a
-      control-plane concern this build does not claim.</p>
+      <h2>Reading the states</h2>
+      <p>For the audit obligations, several rows stop at <em>partial</em> for
+      one reason: the harness records what was decided and never who decided
+      it. Attributable approval needs an identity anchor outside this machine,
+      which is a control-plane concern this build does not claim.</p>
+      <p>For the OWASP risks, <em>evidence</em> means rules in this pack cite
+      the risk and have decided calls in this record; <em>partial</em> means
+      they cite it and have not yet, or — for prompt injection — that the gate
+      bounds the risk without claiming to detect it; <em>none</em> means no
+      rule cites it, with the reason a tool-call gate is not where that risk
+      is controlled.</p>
     </section>`;
 	return renderShell({
 		title: "Compliance map",
@@ -926,4 +1073,4 @@ ${history}`;
 }
 
 //#endregion
-export { renderPacks as a, renderShell as c, renderOverview as i, VERDICT_LABEL as l, renderApprovals as n, esc as o, renderCompliance as r, renderNav as s, navFor as t };
+export { renderPacks as a, renderShell as c, cite as d, renderOverview as i, VERDICT_LABEL as l, renderApprovals as n, esc as o, renderCompliance as r, renderNav as s, navFor as t, FRAMEWORKS as u };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "prae-cli",
-  "version": "0.5.2",
-  "description": "Operator policy for agent harnesses: validate packs, explain a decision, verify a decision log, and provision a governed DSH profile.",
+  "version": "0.6.1",
+  "description": "Operator policy for agent harnesses: validate packs, explain a decision, test a pack against security invariants, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",
     "governance",