prae-cli 0.6.0 → 0.6.2

package/README.md

@@ -90,6 +90,14 @@ next to the result rather than in a footnote: a removed, edited, or reordered
 row breaks the chain; a rewrite of the whole file by someone holding this code
 does not.
 
+### `prae report <ledger.jsonl> [--out <file.html>] [--pack <pack.json>]`
+
+Render the decision record as a printable evidence report. With `--pack`,
+each clause also names the framework risk the rule cites — OWASP Top 10 for
+LLM Applications 2026 today — so a reviewer reads risk → control → decision →
+seal in one row. Without the pack the clause id stands alone rather than a
+name guessed from it.
+
 ### `prae console <ledger.jsonl> --out <dir> [--pack <file>]`
 
 Write the control plane as linked pages: Overview, Policy packs, Playground,

package/lib/bin.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import "./evaluate-CkYySl7T.js";
-import { t as main } from "./cli-Cr0U-PFD.js";
-import "./src-CXU0_W1P.js";
-import "./views-DalPkBZZ.js";
+import "./views-CAD9738P.js";
+import { t as main } from "./cli-BUgU-LpN.js";
+import "./src-Ciggx9ja.js";
 
 //#region src/bin.ts
 main(process.argv.slice(2)).catch((error) => {

package/lib/{cli-Cr0U-PFD.js → cli-BUgU-LpN.js}

@@ -1,6 +1,6 @@
 import { t as evaluate } from "./evaluate-CkYySl7T.js";
-import { m as seal, t as Ledger } from "./src-CXU0_W1P.js";
-import { a as renderPacks, c as renderShell, i as renderOverview, l as VERDICT_LABEL$1, n as renderApprovals, o as esc, r as renderCompliance, s as renderNav, t as navFor } from "./views-DalPkBZZ.js";
+import { a as renderPacks, c as renderShell, d as cite, i as renderOverview, l as VERDICT_LABEL$1, n as renderApprovals, o as esc, r as renderCompliance, s as renderNav, t as navFor, u as FRAMEWORKS } from "./views-CAD9738P.js";
+import { m as seal, t as Ledger } from "./src-Ciggx9ja.js";
 import { existsSync, readFileSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, extname, join, normalize, resolve, sep } from "node:path";
@@ -302,7 +302,8 @@ function readRule(check$1, path, value) {
 		"id",
 		"title",
 		"when",
-		"effect"
+		"effect",
+		"frameworks"
 	]);
 	const id = check$1.text(`${path}.id`, value.id);
 	const effect = readEffect(check$1, `${path}.effect`, value.effect);
@@ -318,8 +319,40 @@ function readRule(check$1, path, value) {
 		const title = check$1.text(`${path}.title`, value.title);
 		if (title !== void 0) rule.title = title;
 	}
+	if (value.frameworks !== void 0) {
+		const frameworks = readFrameworks(check$1, `${path}.frameworks`, value.frameworks);
+		if (frameworks !== void 0) rule.frameworks = frameworks;
+	}
 	return rule;
 }
+/**
+* A citation names a framework edition and controls the registry knows. A
+* typo here would be a rule that claims a mapping no view can render, so it
+* is a pack error rather than an ignored key — the same line the rest of the
+* parser takes.
+*/
+function readFrameworks(check$1, path, value) {
+	if (!isObject(value)) {
+		check$1.fail(path, "expected an object keyed by framework id");
+		return;
+	}
+	const out = {};
+	for (const [framework, controls] of Object.entries(value)) {
+		const known = FRAMEWORKS[framework];
+		if (known === void 0) {
+			check$1.fail(`${path}.${framework}`, `unknown framework; expected one of ${Object.keys(FRAMEWORKS).map((k) => `\`${k}\``).join(", ")}`);
+			continue;
+		}
+		if (!Array.isArray(controls) || !controls.every((c) => typeof c === "string")) {
+			check$1.fail(`${path}.${framework}`, "expected an array of control ids");
+			continue;
+		}
+		const ids = controls;
+		for (const control of ids) if (known.controls[control] === void 0) check$1.fail(`${path}.${framework}`, `unknown control \`${control}\` in ${known.name}`);
+		if (ids.length > 0) out[framework] = [...new Set(ids)];
+	}
+	return out;
+}
 /** Parse and validate a pack. Never throws; every problem lands in `errors`. */
 function parsePack(source) {
 	let raw;
@@ -404,14 +437,16 @@ function ago(iso, now) {
 	const s = seconds % 60;
 	return `${String(h).padStart(2, "0")}:${String(m).padStart(2, "0")}:${String(s).padStart(2, "0")}`;
 }
-function row(entry) {
+function row(entry, pack) {
 	const call = entry.subject === void 0 ? entry.tool : `${entry.tool} ${entry.subject}`;
 	const actor = entry.actor ?? entry.agent ?? "—";
+	const rule = pack?.rules.find((r) => r.id === entry.rule);
+	const cited = rule === void 0 ? "" : cite(rule).map((c) => `<br><span style="color:var(--secondary)">${esc(c.control)} ${esc(c.controlName)}</span>`).join("");
 	return `      <div class="grid row">
         <div class="seq">${entry.seq}</div>
         <div class="call">${esc(call)}</div>
         <div class="actor">${esc(actor)}</div>
-        <div class="clause">${esc(entry.rule ?? "—")}</div>
+        <div class="clause">${esc(entry.rule ?? "—")}${cited}</div>
         <div class="verdict v-${esc(entry.verdict)}">${esc(VERDICT_LABEL$1[entry.verdict] ?? entry.verdict)}</div>
         <div class="seal">${esc(seal(entry))}</div>
       </div>`;
@@ -452,7 +487,7 @@ function renderLedgerView(entries, verification, options) {
 	const table = `    <div class="grid thead">
       <div>SEQ</div><div>CALL</div><div>ACTOR</div><div>CLAUSE</div><div>VERDICT</div><div>SEAL</div>
     </div>
-${entries.length === 0 ? "    <div class=\"empty\">No decisions recorded yet.</div>" : [...entries].reverse().map(row).join("\n")}`;
+${entries.length === 0 ? "    <div class=\"empty\">No decisions recorded yet.</div>" : [...entries].reverse().map((entry) => row(entry, options.pack)).join("\n")}`;
 	const first = held.at(-1);
 	const awaiting = first === void 0 ? "" : `    <section class="await">
       <div class="k">AWAITING HUMAN · 1 OF ${held.length}</div>
@@ -874,8 +909,11 @@ const USAGE = `prae — operator policy for agent harnesses
       Check one receipt with nothing but the file: recompute its hash, verify
       its signature, and print the key fingerprint to compare against your own.
 
-  prae report <ledger.jsonl> [--out <file.html>]
-      Render the decision record as a printable evidence report.
+  prae report <ledger.jsonl> [--out <file.html>] [--pack <pack.json>]
+      Render the decision record as a printable evidence report. With
+      --pack, each clause also names the framework risk it addresses
+      (OWASP LLM Top 10 2026), so a reviewer can trace risk → control →
+      decision → seal.
 
   prae console <ledger.jsonl> --out <dir> [--pack <file>] [--serve [port]]
                 [--instructions <dir>]
@@ -925,6 +963,7 @@ async function check(path) {
 	for (const rule of pack.rules) {
 		const label = rule.title ?? rule.effect.because;
 		console.log(`  ${rule.id.padEnd(10)} ${rule.effect.kind.toUpperCase().padEnd(8)} ${label}`);
+		for (const c of cite(rule)) console.log(`  ${"".padEnd(10)} ${"".padEnd(8)} ↳ ${c.frameworkShort} · ${c.control} ${c.controlName}`);
 	}
 }
 /**
@@ -982,7 +1021,7 @@ async function mcp(root, packPath, ledgerPath) {
 	const chosen = packPath ?? bundled;
 	if (chosen === void 0) return fail("mcp needs --pack <file>; no bundled secret-catcher found");
 	const pack = await loadPack(chosen);
-	const { Ledger: Ledger$1 } = await import("./src-Kubj3MTX.js");
+	const { Ledger: Ledger$1 } = await import("./src-C9L6NBvu.js");
 	const ledger = ledgerPath === void 0 ? void 0 : Ledger$1.open(ledgerPath);
 	console.error(`prae mcp: serving ${resolve$1(root)} under ${pack.pack} ${pack.version}` + (ledgerPath === void 0 ? " (no ledger)" : ` · ledger ${ledgerPath}`));
 	await serveMcp({
@@ -1034,7 +1073,7 @@ async function explain(path, tool, pairs) {
 * a key that arrived beside it is checked against nothing.
 */
 async function keygen(dir) {
-	const { generateKeypair, fingerprint } = await import("./src-Kubj3MTX.js");
+	const { generateKeypair, fingerprint } = await import("./src-C9L6NBvu.js");
 	const { writeFileSync: writeFileSync$1 } = await import("node:fs");
 	const keys = generateKeypair();
 	const priv = join(dir, "prae-signing.pem");
@@ -1050,7 +1089,7 @@ async function keygen(dir) {
 	console.log("private key with `signingKey` to sign every row.");
 }
 async function receipt(path, seq, keyPath, out) {
-	const { Ledger: Ledger$1, makeReceipt, fingerprint } = await import("./src-Kubj3MTX.js");
+	const { Ledger: Ledger$1, makeReceipt, fingerprint } = await import("./src-C9L6NBvu.js");
 	const { readFileSync: readFileSync$1 } = await import("node:fs");
 	const { createPublicKey } = await import("node:crypto");
 	const privateKey = readFileSync$1(keyPath, "utf8");
@@ -1080,7 +1119,7 @@ async function receipt(path, seq, keyPath, out) {
 * file and sets the exit code, so scripts can branch on it.
 */
 async function verifyReceiptCmd(path) {
-	const { checkReceipt } = await import("./receipt-check-Dql0uqxw.js");
+	const { checkReceipt } = await import("./receipt-check-DrDE3Wwi.js");
 	let parsed;
 	try {
 		parsed = JSON.parse(await readFile(path, "utf8"));
@@ -1151,7 +1190,7 @@ async function verify(path, keyPath) {
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
 		if (keyPath !== void 0) {
-			const { verifySignature, fingerprint } = await import("./src-Kubj3MTX.js");
+			const { verifySignature, fingerprint } = await import("./src-C9L6NBvu.js");
 			const { readFileSync: readFileSync$1 } = await import("node:fs");
 			const publicKey = readFileSync$1(keyPath, "utf8");
 			let signed = 0;
@@ -1190,18 +1229,20 @@ function flag(argv, name) {
 * has to go and check separately. A report that looks authoritative while
 * quietly sitting on a broken chain is worse than no report.
 */
-async function report(path, out) {
+async function report(path, out, packPath) {
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
 	} catch (error) {
 		return fail(error instanceof Error ? error.message : String(error));
 	}
+	const pack = packPath === void 0 ? void 0 : await loadPack(packPath);
 	const entries = ledger.read();
 	const verification = ledger.verify();
 	const html = renderLedgerView(entries, verification, {
 		ledgerPath: path,
-		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		...pack === void 0 ? {} : { pack }
 	});
 	if (out === void 0) {
 		process.stdout.write(html);
@@ -1325,7 +1366,7 @@ async function consoleOut(path, argv) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
 			import("./src-CraUX64d.js"),
 			import("./src-CQ0UmFUK.js"),
-			import("./instructions-D4VOn2lk.js")
+			import("./instructions-oGCdVxHM.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -1460,7 +1501,7 @@ async function main(argv) {
 		case "report": {
 			const path = rest[0];
 			if (path === void 0) fail("report needs a ledger file");
-			return report(path, flag(rest, "out"));
+			return report(path, flag(rest, "out"), flag(rest, "pack"));
 		}
 		case "console": {
 			const path = rest[0];

package/lib/docs/pilot-dsh.md

@@ -172,9 +172,9 @@ Prefer the interactive UI? Swap `@deepseek-ai/dsh-headless` for
 | Attempt | Expected | Why |
 | --- | --- | --- |
 | Ask for the file by another relative spelling, `../pilot-target/docs/…`, an absolute path | **deny** | Paths are normalized and anchored; the content rule has no path condition anyway |
-| Ask it to `cat` / `head` / `tail` the file through the shell | **held (ask)** by `SEC-005` | Shell output is not content-inspected; the pilot pack holds the known dumpers for a human. In headless mode there is no approver, so expect the call to fail closed rather than run |
-| Ask it to `python3 -c "print(open(...).read())"`, `node -e`, `awk`, or a here-doc | **not caught** by this pack | Shell is governed by *command* rules, not by content inspection — the list of programs that can print a file is unbounded. The honest control is scope: deny or hold `proc:spawn` for agents that should not need a shell |
-| Ask it to `grep AKIA docs/` or search the directory | **not caught** by this pack | Search tools return matched *lines*; content inspection runs on whole-file reads. A pilot pack can hold `grep`/`glob` by tool name (`"tool": ["grep"]` → `ask`) if that matters to you — say so and we will ship it as an option |
+| Ask it to `cat` / `head` / `tail` the file through the shell | **held (ask)** by `SEC-005` before it runs; and from `prae-gate 0.6.0`, if it does run, the **output is withheld** (`SEC-004`, `phase: output`) | Two doors: the pilot pack holds the known dumpers for a human, and the result of any shell command is content-inspected before the model sees it. The command runs; the model gets a structured refusal saying so |
+| Ask it to `python3 -c "print(open(...).read())"`, `node -e`, `awk`, or a here-doc | **output withheld** (`SEC-004`) from `prae-gate 0.6.0` | No program list is involved: the result is scanned, not the command. Say it precisely — the process ran, the model saw nothing of what it printed. To stop the process itself, scope `proc:spawn` |
+| Ask it to `grep AKIA docs/` or search the directory | **output withheld** from `prae-gate 0.6.0` | Search results are lines, so nothing is inspected before the call; the lines it returns are, under the read rules |
 | Copy the file under `tests/fixtures/` first, then read it | **allowed, recorded** | That is the carve-out working as designed (`SEC-003` still writes a warn row). Tighten or remove the carve-out in the pack if your repos keep real secrets in fixtures |
 | Edit the ledger to hide the refusal | **chain breaks** on `prae verify` | And with a signing key configured, the signature fails without the private key — `prae keygen`, then `signingKey` in the plugin config |
 

package/lib/docs/secret-catcher.md

@@ -116,14 +116,23 @@ counterparty can check without trusting the machine it came from.
   it; the dsh plugin covers the harness's `read` tool. An agent with direct
   filesystem access outside both is covered only where its harness routes
   those calls through a gated seam.
-- **The shell is governed by scope, not by content.** `cat`, `python -c`,
-  `node -e`, a here-doc — the set of programs that can print a file is
-  unbounded, so shell output is never content-inspected. The pilot pack holds
-  the common dumpers (`SEC-005`, `ask`); the honest control for agents that
-  should not need a shell is to deny or hold `proc:spawn`.
-- **Search tools return lines, not files.** `grep`/`glob` results are not
-  content-inspected. Hold them by tool name (`"tool": ["grep"]` → `ask`) where
-  that matters; `docs/pilot-dsh.md` §4 lists this with the rest.
+- **The shell is content-inspected on the way out, not the way in.** `cat`,
+  `python -c`, `node -e`, `sed`, a here-doc — the set of programs that can
+  print a file is unbounded, so no list of them is a control. What is bounded
+  is the result: every tool result is scanned with the same detector before
+  the model sees it, and a result carrying a credential is withheld (`SEC-004`
+  in the shipped pack, `prae-gate ≥ 0.6.0`). Be exact about what that means:
+  **the command ran**; the model never saw what it printed. The ledger row says
+  `phase: output`, and the refusal the agent gets says `executed: true`. If a
+  process must not run at all, that is a scope rule on `proc:spawn`, not a
+  content rule.
+- **Search tools are covered by the same door.** `grep`/`glob` return lines,
+  not files, so nothing is inspected before they run; their output is, and a
+  matched line that carries a credential is withheld under the read rules.
+- **Shell rows carry a fingerprint, never the line.** `command: { program,
+  hash }` — the program word and a hash of the whole line — so an auditor can
+  see what ran and match repeats, while a line that carried a secret is never
+  quoted into the log.
 - **Detection is regex + entropy.** Same floor the mature at-rest scanners
   stand on; novel unformatted secrets can pass. The engine is an interface,
   not a ceiling.

package/lib/index.js

@@ -1,6 +1,6 @@
 import "./evaluate-CkYySl7T.js";
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-Cr0U-PFD.js";
-import "./src-CXU0_W1P.js";
-import "./views-DalPkBZZ.js";
+import "./views-CAD9738P.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-BUgU-LpN.js";
+import "./src-Ciggx9ja.js";
 
 export { applyWrite, defaultProfile, dshHome, main, planWrite, praeRow, profileAt };

package/lib/{instructions-D4VOn2lk.js → instructions-oGCdVxHM.js}

@@ -1,4 +1,4 @@
-import { c as renderShell, o as esc, s as renderNav, t as navFor } from "./views-DalPkBZZ.js";
+import { c as renderShell, o as esc, s as renderNav, t as navFor } from "./views-CAD9738P.js";
 
 //#region src/console/instructions.ts
 const STYLE = `

package/lib/playground.js

@@ -466,6 +466,55 @@
 		};
 	}
 
+//#endregion
+//#region ../kernel/src/frameworks.ts
+	const FRAMEWORKS = { "owasp-llm-top-10-2026": {
+		name: "OWASP Top 10 for LLM Applications — 2026",
+		short: "OWASP LLM 2026",
+		controls: {
+			LLM01: {
+				name: "Prompt Injection",
+				summary: "Instructions in a prompt or in retrieved content alter what the model does."
+			},
+			LLM02: {
+				name: "Sensitive Information Disclosure",
+				summary: "Credentials, personal data or proprietary content reach the model or its output."
+			},
+			LLM03: {
+				name: "Excessive Agency",
+				summary: "The model can take actions, or holds permissions, beyond what its task needs."
+			},
+			LLM04: {
+				name: "Supply Chain",
+				summary: "A compromised model, dataset, plugin or dependency enters the application."
+			},
+			LLM05: {
+				name: "Data and Model Poisoning",
+				summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
+			},
+			LLM06: {
+				name: "Unbounded Consumption",
+				summary: "The application permits resource use without a limit, exhausting budget or service."
+			},
+			LLM07: {
+				name: "Misinformation",
+				summary: "The model produces false or misleading content that is acted on as if true."
+			},
+			LLM08: {
+				name: "Hidden Context Exposure",
+				summary: "System prompts, hidden instructions or internal context are revealed."
+			},
+			LLM09: {
+				name: "Vector and Embedding Weaknesses",
+				summary: "Retrieval stores are manipulated or leak across tenants and permissions."
+			},
+			LLM10: {
+				name: "Improper Output Handling",
+				summary: "Model output is passed to downstream systems without validation."
+			}
+		}
+	} };
+
 //#endregion
 //#region ../kernel/src/pack.ts
 	function isObject(value) {
@@ -761,7 +810,8 @@
 			"id",
 			"title",
 			"when",
-			"effect"
+			"effect",
+			"frameworks"
 		]);
 		const id = check.text(`${path}.id`, value.id);
 		const effect = readEffect(check, `${path}.effect`, value.effect);
@@ -777,8 +827,40 @@
 			const title = check.text(`${path}.title`, value.title);
 			if (title !== void 0) rule.title = title;
 		}
+		if (value.frameworks !== void 0) {
+			const frameworks = readFrameworks(check, `${path}.frameworks`, value.frameworks);
+			if (frameworks !== void 0) rule.frameworks = frameworks;
+		}
 		return rule;
 	}
+	/**
+	* A citation names a framework edition and controls the registry knows. A
+	* typo here would be a rule that claims a mapping no view can render, so it
+	* is a pack error rather than an ignored key — the same line the rest of the
+	* parser takes.
+	*/
+	function readFrameworks(check, path, value) {
+		if (!isObject(value)) {
+			check.fail(path, "expected an object keyed by framework id");
+			return;
+		}
+		const out = {};
+		for (const [framework, controls] of Object.entries(value)) {
+			const known = FRAMEWORKS[framework];
+			if (known === void 0) {
+				check.fail(`${path}.${framework}`, `unknown framework; expected one of ${Object.keys(FRAMEWORKS).map((k) => `\`${k}\``).join(", ")}`);
+				continue;
+			}
+			if (!Array.isArray(controls) || !controls.every((c) => typeof c === "string")) {
+				check.fail(`${path}.${framework}`, "expected an array of control ids");
+				continue;
+			}
+			const ids = controls;
+			for (const control of ids) if (known.controls[control] === void 0) check.fail(`${path}.${framework}`, `unknown control \`${control}\` in ${known.name}`);
+			if (ids.length > 0) out[framework] = [...new Set(ids)];
+		}
+		return out;
+	}
 	/** Parse and validate a pack. Never throws; every problem lands in `errors`. */
 	function parsePack(source) {
 		let raw;

package/lib/{receipt-check-Dql0uqxw.js → receipt-check-DrDE3Wwi.js}

@@ -1,4 +1,4 @@
-import { c as verifyReceipt, i as fingerprint } from "./src-CXU0_W1P.js";
+import { c as verifyReceipt, i as fingerprint } from "./src-Ciggx9ja.js";
 
 //#region src/receipt-check.ts
 /** Shape we require before we will call it a receipt at all. */

package/lib/secret-catcher.prae.json

@@ -17,11 +17,16 @@
             "./**/*.sample"
           ]
         },
-        "secrets": { "minConfidence": 0.8 }
+        "secrets": {
+          "minConfidence": 0.8
+        }
       },
       "effect": {
         "kind": "deny",
         "because": "the requested file contains a protected credential; the contents were not returned"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM02"]
       }
     },
     {
@@ -29,21 +34,48 @@
       "title": "Private keys are refused everywhere",
       "when": {
         "capability": "fs:read",
-        "secrets": { "types": ["private-key"] }
+        "secrets": {
+          "types": ["private-key"]
+        }
       },
       "effect": {
         "kind": "deny",
         "because": "the requested file contains a private key; the contents were not returned"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM02"]
       }
     },
     {
       "id": "SEC-003",
       "title": "Anything credential-shaped is at least recorded",
-      "when": { "capability": "fs:read", "secrets": { "minConfidence": 0.5 } },
+      "when": {
+        "capability": "fs:read",
+        "secrets": {
+          "minConfidence": 0.5
+        }
+      },
       "effect": {
         "kind": "warn",
         "because": "a possible credential was noticed in this file; where no stronger rule fired, the read proceeded and this row is the record"
       }
+    },
+    {
+      "id": "SEC-004",
+      "title": "Shell output carrying credentials is withheld",
+      "when": {
+        "capability": "proc:spawn",
+        "secrets": {
+          "minConfidence": 0.8
+        }
+      },
+      "effect": {
+        "kind": "deny",
+        "because": "the command ran and its output contained a protected credential; the output was withheld from the model"
+      },
+      "frameworks": {
+        "owasp-llm-top-10-2026": ["LLM02"]
+      }
     }
   ]
 }

package/lib/{src-Kubj3MTX.js → src-C9L6NBvu.js}

@@ -1,3 +1,3 @@
-import { a as generateKeypair, c as verifyReceipt, d as canonical, f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, o as makeReceipt, p as hashEntry, r as verifyEntries, s as signEntry, t as Ledger, u as GENESIS } from "./src-CXU0_W1P.js";
+import { a as generateKeypair, c as verifyReceipt, d as canonical, f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, o as makeReceipt, p as hashEntry, r as verifyEntries, s as signEntry, t as Ledger, u as GENESIS } from "./src-Ciggx9ja.js";
 
 export { GENESIS, Ledger, canonical, chain, fingerprint, generateKeypair, hashEntry, makeReceipt, readEntries, seal, signEntry, verifyEntries, verifyReceipt, verifySignature };

package/lib/{views-DalPkBZZ.js → views-CAD9738P.js}

@@ -1,3 +1,72 @@
+//#region ../kernel/src/frameworks.ts
+const FRAMEWORKS = { "owasp-llm-top-10-2026": {
+	name: "OWASP Top 10 for LLM Applications — 2026",
+	short: "OWASP LLM 2026",
+	controls: {
+		LLM01: {
+			name: "Prompt Injection",
+			summary: "Instructions in a prompt or in retrieved content alter what the model does."
+		},
+		LLM02: {
+			name: "Sensitive Information Disclosure",
+			summary: "Credentials, personal data or proprietary content reach the model or its output."
+		},
+		LLM03: {
+			name: "Excessive Agency",
+			summary: "The model can take actions, or holds permissions, beyond what its task needs."
+		},
+		LLM04: {
+			name: "Supply Chain",
+			summary: "A compromised model, dataset, plugin or dependency enters the application."
+		},
+		LLM05: {
+			name: "Data and Model Poisoning",
+			summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
+		},
+		LLM06: {
+			name: "Unbounded Consumption",
+			summary: "The application permits resource use without a limit, exhausting budget or service."
+		},
+		LLM07: {
+			name: "Misinformation",
+			summary: "The model produces false or misleading content that is acted on as if true."
+		},
+		LLM08: {
+			name: "Hidden Context Exposure",
+			summary: "System prompts, hidden instructions or internal context are revealed."
+		},
+		LLM09: {
+			name: "Vector and Embedding Weaknesses",
+			summary: "Retrieval stores are manipulated or leak across tenants and permissions."
+		},
+		LLM10: {
+			name: "Improper Output Handling",
+			summary: "Model output is passed to downstream systems without validation."
+		}
+	}
+} };
+/**
+* Every framework control a rule cites, resolved to names.
+*
+* A pack that parsed cites only ids the registry knows, so the lookups here
+* cannot miss; the fallbacks exist for a `Rule` built by hand in code.
+*/
+function cite(rule) {
+	const out = [];
+	for (const [framework, controls] of Object.entries(rule.frameworks ?? {})) {
+		const known = FRAMEWORKS[framework];
+		for (const control of controls) out.push({
+			framework,
+			frameworkName: known?.name ?? framework,
+			frameworkShort: known?.short ?? framework,
+			control,
+			controlName: known?.controls[control]?.name ?? control
+		});
+	}
+	return out;
+}
+
+//#endregion
 //#region src/console/logo.ts
 /**
 * The mark, inlined.
@@ -629,7 +698,7 @@ function renderNav(items, active) {
 * the obligation, and a tool that told them the answer would be selling the
 * one thing it cannot supply.
 */
-const CONTROLS = [
+const OBLIGATIONS = [
 	{
 		id: "EU AI Act art. 12",
 		asks: "Automatic recording of events over the lifetime of the system, to a degree that enables tracing.",
@@ -671,6 +740,71 @@ const CONTROLS = [
 		})
 	}
 ];
+const OWASP = "owasp-llm-top-10-2026";
+/** Rules in the pack that cite one control of one framework. */
+function citing(pack, framework, control) {
+	return (pack?.rules ?? []).filter((rule) => (rule.frameworks?.[framework] ?? []).includes(control));
+}
+/**
+* Why a runtime execution gate is not the control for a risk no rule cites.
+*
+* Said per risk rather than as one generic line, because "out of scope" with
+* no reason reads as an excuse. Each of these is a boundary a reader can
+* check: the risk lives somewhere a tool-call gate does not stand.
+*/
+const NOT_THIS_BOUNDARY = {
+	LLM04: "Where a model or dependency came from is settled before an agent runs; the gate sees the call, not the provenance.",
+	LLM05: "Training and fine-tuning data sit outside the execution boundary this gate stands on.",
+	LLM07: "Whether an answer is true is not a property of a tool call.",
+	LLM08: "The assembled system prompt is sealed into the ledger as evidence of what the model was told; nothing here stops the model repeating it.",
+	LLM09: "Retrieval stores are upstream of the call the gate judges.",
+	LLM10: "What downstream code does with model output is that code's boundary, not this one's."
+};
+function owaspRow(control) {
+	const framework = FRAMEWORKS[OWASP];
+	const risk = framework?.controls[control];
+	const name = risk?.name ?? control;
+	return {
+		id: `${framework?.short ?? OWASP} · ${control}`,
+		asks: `${name}. ${risk?.summary ?? ""}`.trim(),
+		evidence: (data) => {
+			if (data.pack === void 0) return {
+				state: "absent",
+				note: "No pack supplied to this view."
+			};
+			if (control === "LLM01") {
+				const bounding = citing(data.pack, OWASP, "LLM03");
+				return {
+					state: "partial",
+					note: bounding.length === 0 ? "Not mitigated: this gate does not detect injected instructions, and no LLM03 control in this pack bounds what one can execute." : `Not mitigated: this gate does not detect injected instructions. Bounded: ${bounding.length} LLM03 control${bounding.length === 1 ? "" : "s"} (${bounding.map((r) => r.id).join(", ")}) decide what an injected instruction can execute.`
+				};
+			}
+			const rules = citing(data.pack, OWASP, control);
+			if (rules.length === 0) return {
+				state: "absent",
+				note: NOT_THIS_BOUNDARY[control] ?? "No rule in this pack cites this risk."
+			};
+			const ids = new Set(rules.map((rule) => rule.id));
+			const decisions = data.entries.filter((entry) => entry.rule !== void 0 && ids.has(entry.rule));
+			const listed = rules.map((rule) => rule.id).join(", ");
+			return decisions.length > 0 ? {
+				state: "covered",
+				note: `${rules.length} control${rules.length === 1 ? "" : "s"} mapped (${listed}) · ${decisions.length} sealed decision${decisions.length === 1 ? "" : "s"} under them in this record.`
+			} : {
+				state: "partial",
+				note: `${rules.length} control${rules.length === 1 ? "" : "s"} mapped (${listed}); none has decided a call in this record yet, so the mapping is declared, not exercised.`
+			};
+		}
+	};
+}
+const OWASP_ROWS = Object.keys(FRAMEWORKS[OWASP]?.controls ?? {}).map(owaspRow);
+/**
+* The obligations first, then the OWASP risks. Two kinds of row in one table
+* on purpose: an auditor reads down one list and finds the audit obligations
+* the ledger evidences and the application risks the pack's rules address,
+* each stated in its framework's own words.
+*/
+const CONTROLS = [...OBLIGATIONS, ...OWASP_ROWS];
 
 //#endregion
 //#region src/console/views.ts
@@ -789,11 +923,17 @@ function renderPacks(data) {
 	});
 	const baseline = pack.baseline?.capabilities;
 	const caps = baseline === void 0 ? `<p style="padding:0 30px 22px;font-size:14px;color:var(--secondary);max-width:76ch">This pack sets no capability ceiling. It governs through its rules alone, and withholds nothing an author declares.</p>` : `<div class="caps">${baseline.map((c) => `<span class="cap">${esc(c)}</span>`).join("")}</div>`;
-	const rows = pack.rules.map((rule) => `      <div class="grid rules row">
+	const cited = /* @__PURE__ */ new Map();
+	for (const rule of pack.rules) for (const c of cite(rule)) cited.set(c.framework, c.frameworkName);
+	const frameworks = cited.size === 0 ? "" : `<div class="caps">${[...cited.values()].map((name) => `<span class="cap">${esc(name)}</span>`).join("")}</div>`;
+	const rows = pack.rules.map((rule) => {
+		const tags = cite(rule).map((c) => `<br><span style="color:var(--secondary)">${esc(c.frameworkShort)} · ${esc(c.control)} ${esc(c.controlName)}</span>`).join("");
+		return `      <div class="grid rules row">
         <div class="seq">${esc(rule.id)}</div>
-        <div class="call">${esc(rule.title ?? rule.effect.because)}<br><span style="color:var(--muted)">${esc(matcherOf(rule))}</span></div>
+        <div class="call">${esc(rule.title ?? rule.effect.because)}<br><span style="color:var(--muted)">${esc(matcherOf(rule))}</span>${tags}</div>
         <div class="effect e-${esc(rule.effect.kind)}">${esc(rule.effect.kind.toUpperCase())}</div>
-      </div>`).join("\n");
+      </div>`;
+	}).join("\n");
 	const body = `    <section class="sect">
       <h2>${esc(pack.pack)} <span style="font-family:var(--proof);font-size:14px;color:var(--muted)">${esc(pack.version)}</span></h2>
       <p>The operator baseline is intersected with whatever a plugin's own
@@ -801,6 +941,7 @@ function renderPacks(data) {
       grant a capability an author never asked for.</p>
     </section>
     ${caps}
+    ${frameworks}
     <div class="grid rules thead">
       <div>CLAUSE</div><div>RULE</div><div>EFFECT</div>
     </div>
@@ -840,11 +981,17 @@ ${CONTROLS.map((control) => {
       </div>`;
 	}).join("\n")}
     <section class="sect" style="padding-bottom:26px">
-      <h2>The gap that recurs</h2>
-      <p>Three of these rows stop at <em>partial</em> for the same reason: the
-      harness records what was decided and never who decided it. Attributable
-      approval needs an identity anchor outside this machine, which is a
-      control-plane concern this build does not claim.</p>
+      <h2>Reading the states</h2>
+      <p>For the audit obligations, several rows stop at <em>partial</em> for
+      one reason: the harness records what was decided and never who decided
+      it. Attributable approval needs an identity anchor outside this machine,
+      which is a control-plane concern this build does not claim.</p>
+      <p>For the OWASP risks, <em>evidence</em> means rules in this pack cite
+      the risk and have decided calls in this record; <em>partial</em> means
+      they cite it and have not yet, or — for prompt injection — that the gate
+      bounds the risk without claiming to detect it; <em>none</em> means no
+      rule cites it, with the reason a tool-call gate is not where that risk
+      is controlled.</p>
     </section>`;
 	return renderShell({
 		title: "Compliance map",
@@ -926,4 +1073,4 @@ ${history}`;
 }
 
 //#endregion
-export { renderPacks as a, renderShell as c, renderOverview as i, VERDICT_LABEL as l, renderApprovals as n, esc as o, renderCompliance as r, renderNav as s, navFor as t };
+export { renderPacks as a, renderShell as c, cite as d, renderOverview as i, VERDICT_LABEL as l, renderApprovals as n, esc as o, renderCompliance as r, renderNav as s, navFor as t, FRAMEWORKS as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, test a pack against security invariants, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",
@@ -41,9 +41,9 @@
     "typescript": "^5.9.2",
     "vitest": "^3.2.4",
     "@prae/controls": "0.1.0",
+    "@prae/extract": "0.1.0",
     "@prae/inspect": "0.1.0",
     "@prae/instructions": "0.1.0",
-    "@prae/extract": "0.1.0",
     "@prae/kernel": "0.1.0",
     "@prae/ledger": "0.1.0",
     "@prae/tokens": "0.1.0"