prae-cli 0.7.1 → 0.8.0

package/lib/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import "./evaluate-wMPkjcIC.js";
-import "./views-UODslKwu.js";
-import { t as main } from "./cli-mahLCjoD.js";
+import "./views-CCwVXpo2.js";
+import { t as main } from "./cli-UAE968If.js";
 import "./src-Ciggx9ja.js";
 
 //#region src/bin.ts

package/lib/checkpoint-DiznOVpS.js

@@ -0,0 +1,99 @@
+import { d as canonical, i as fingerprint } from "./src-Ciggx9ja.js";
+import { createPrivateKey, createPublicKey, sign, verify } from "node:crypto";
+
+//#region src/checkpoint.ts
+/** What the signature covers: the facts, never the timestamp or the name of the key. */
+function signable(cp) {
+	return Buffer.from(canonical({
+		ledger: cp.ledger,
+		entries: cp.entries,
+		head: cp.head
+	}));
+}
+function makeCheckpoint(rows, ledger, privateKeyPem, at = (/* @__PURE__ */ new Date()).toISOString()) {
+	const head = rows.at(-1);
+	const cp = {
+		prae: "checkpoint/1",
+		at,
+		ledger,
+		entries: rows.length,
+		head: head === void 0 ? {
+			seq: -1,
+			hash: ""
+		} : {
+			seq: head.seq,
+			hash: head.hash
+		}
+	};
+	if (privateKeyPem === void 0) return cp;
+	const key = createPrivateKey(privateKeyPem);
+	const publicKey = createPublicKey(key).export({
+		type: "spki",
+		format: "pem"
+	}).toString();
+	return {
+		...cp,
+		fingerprint: fingerprint(publicKey),
+		sig: sign(null, signable(cp), key).toString("base64")
+	};
+}
+/**
+* The ledger as it is now, against the checkpoint as it was then. Rows may
+* have been appended since; nothing before the head may differ.
+*/
+function checkCheckpoint(rows, cp, publicKeyPem) {
+	const lines = [];
+	let ok = true;
+	if (cp.prae !== "checkpoint/1") return {
+		ok: false,
+		lines: [`not a checkpoint: prae is ${String(cp.prae)}`]
+	};
+	if (publicKeyPem !== void 0) if (cp.sig === void 0) {
+		ok = false;
+		lines.push("checkpoint is not signed; a key was given to check it against");
+	} else {
+		let good = false;
+		try {
+			good = verify(null, signable(cp), createPublicKey(publicKeyPem), Buffer.from(cp.sig, "base64"));
+		} catch {
+			good = false;
+		}
+		if (good) lines.push(`checkpoint signature verifies against ${fingerprint(publicKeyPem)}`);
+		else {
+			ok = false;
+			lines.push(`checkpoint signature FAILS against ${fingerprint(publicKeyPem)} — the checkpoint itself has been altered or was signed by another key`);
+		}
+	}
+	if (rows.length < cp.entries) {
+		ok = false;
+		lines.push(`ledger holds ${rows.length} rows; the checkpoint of ${cp.at} recorded ${cp.entries} — ${cp.entries - rows.length} row${cp.entries - rows.length === 1 ? "" : "s"} removed since`);
+		return {
+			ok,
+			lines
+		};
+	}
+	if (cp.entries === 0) {
+		lines.push(`checkpoint of ${cp.at} recorded an empty ledger; ${rows.length} rows since`);
+		return {
+			ok,
+			lines
+		};
+	}
+	const then = rows.find((row) => row.seq === cp.head.seq);
+	if (then === void 0 || then.hash !== cp.head.hash) {
+		ok = false;
+		lines.push(`row ${cp.head.seq} does not match the checkpoint head (${cp.head.hash.slice(0, 16)}…) — the ledger was rewritten since ${cp.at}`);
+		return {
+			ok,
+			lines
+		};
+	}
+	lines.push(`checkpoint of ${cp.at} holds: ${cp.entries} rows then, ${rows.length} now, head ${cp.head.hash.slice(0, 16)}… intact`);
+	return {
+		ok,
+		lines
+	};
+}
+
+//#endregion
+export { checkCheckpoint, makeCheckpoint };

package/lib/{cli-mahLCjoD.js → cli-UAE968If.js}

@@ -1,5 +1,5 @@
 import { t as evaluate } from "./evaluate-wMPkjcIC.js";
-import { a as renderPacks, c as renderNav, d as FRAMEWORKS, f as cite, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-UODslKwu.js";
+import { a as renderPacks, c as renderNav, d as FRAMEWORKS, f as cite, i as renderOverview, l as renderShell, n as renderApprovals, o as CONTROLS, r as renderCompliance, s as esc, t as navFor, u as VERDICT_LABEL$1 } from "./views-CCwVXpo2.js";
 import { f as chain, i as fingerprint, l as verifySignature, m as seal, n as readEntries, r as verifyEntries, t as Ledger, u as GENESIS } from "./src-Ciggx9ja.js";
 import { existsSync, readFileSync, readdirSync, statSync, watch } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -972,7 +972,6 @@ function verifyRecord(record, tamper, repair = false) {
 		signatures
 	};
 }
-const OWASP = "owasp-llm-top-10-2026";
 /**
 * Evidence toward each control, from the pack and the ledger as they are
 * now — the rows the controls package defines, so the console, the exporter and
@@ -1001,15 +1000,16 @@ function complianceOf(record) {
 		verification: verifyEntries(text),
 		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
-	const owasp = FRAMEWORKS[OWASP]?.controls ?? {};
 	return { controls: CONTROLS.map((control) => {
-		const code = /LLM\d\d/.exec(control.id)?.[0];
-		const named = code === void 0 ? void 0 : owasp[code];
+		const found = Object.entries(FRAMEWORKS).find(([, f]) => control.id.startsWith(`${f.short} · `));
+		const code = found === void 0 ? void 0 : control.id.split(" · ")[1];
+		const named = found === void 0 || code === void 0 ? void 0 : found[1].controls[code];
 		return {
 			id: code ?? control.id,
 			...named === void 0 ? {} : { name: named.name },
 			asks: control.asks,
-			framework: named === void 0 ? "obligation" : OWASP,
+			framework: found === void 0 ? "obligation" : found[0],
+			...found === void 0 ? {} : { frameworkName: found[1].name },
 			...control.evidence(data)
 		};
 	}) };
@@ -1187,9 +1187,23 @@ const USAGE = `⌜▪⌟ prae — operator policy for agent harnesses
       the exit code is non-zero if any invariant no longer holds, so a
       control pack can be defended in CI. --pack overrides the suite's own.
 
-  prae verify <ledger.jsonl> [--key <public.pem>]
+  prae verify <ledger.jsonl> [--key <public.pem>] [--checkpoint <file>]
       Re-derive every hash in a decision log and report any break. With
-      --key, also verify each row's signature against that pinned key.
+      --key, also verify each row's signature against that pinned key. With
+      --checkpoint, also check that nothing before that checkpoint's head
+      has been removed or rewritten since it was taken.
+
+  prae checkpoint <ledger.jsonl> [--key <private.pem>] [--out <file>]
+      Record the ledger's length and head, signed, to keep somewhere the
+      ledger's machine cannot write. A chain proves no row inside the file
+      was touched; a checkpoint proves the file was not cut at the end.
+
+  prae export <ledger.jsonl> --format ocsf [--out <file>]
+                [--hec <url> --hec-token <token>]
+      The record as OCSF 1.5.0 events (NDJSON) for a SIEM or data lake:
+      refusals, holds and withheld outputs as Detection Findings, allowed
+      calls as API Activity, every event carrying the row's seal. With --hec,
+      post them to a Splunk HTTP Event Collector instead of writing a file.
 
   prae keygen [--out <dir>]
       Generate an Ed25519 keypair for signing ledger rows. Prints the
@@ -1270,7 +1284,7 @@ async function check(path) {
 * from the findings, so there is nothing here to be careful about printing.
 */
 async function scanFile(path, packPath, json) {
-	const { scan } = await import("./src-Vnr0fcpK.js");
+	const { scan } = await import("./src-CwBEFhww.js");
 	let content;
 	try {
 		content = await readFile(path, "utf8");
@@ -1310,7 +1324,7 @@ async function scanFile(path, packPath, json) {
 * not come up inspecting nothing.
 */
 async function mcp(root, packPath, ledgerPath) {
-	const { serveMcp } = await import("./mcp-DDcejhwQ.js");
+	const { serveMcp } = await import("./mcp-doNYU-1C.js");
 	const { resolve: resolve$1 } = await import("node:path");
 	const bundled = [join(import.meta.dirname, "secret-catcher.prae.json"), join(import.meta.dirname, "..", "..", "..", "examples", "secret-catcher.prae.json")].find((candidate) => existsSync(candidate));
 	const chosen = packPath ?? bundled;
@@ -1414,7 +1428,7 @@ async function receipt(path, seq, keyPath, out) {
 * file and sets the exit code, so scripts can branch on it.
 */
 async function verifyReceiptCmd(path) {
-	const { checkReceipt } = await import("./receipt-check-DrDE3Wwi.js");
+	const { checkReceipt } = await import("./receipt-check-s3Aryyz-.js");
 	let parsed;
 	try {
 		parsed = JSON.parse(await readFile(path, "utf8"));
@@ -1445,7 +1459,7 @@ async function test(suitePath, packOverride, asJson) {
 	} catch (error) {
 		return fail(`${suitePath} is not valid JSON: ${error instanceof Error ? error.message : error}`);
 	}
-	const { parseSuite, renderSuite, runSuite } = await import("./test-run-DOaCKD1t.js");
+	const { parseSuite, renderSuite, runSuite } = await import("./test-run-XNIRHKOu.js");
 	const suite = parseSuite(parsed);
 	if (!suite.ok) {
 		console.error(`prae: ${suitePath} is not a valid test suite`);
@@ -1456,7 +1470,7 @@ async function test(suitePath, packOverride, asJson) {
 	if (chosen === void 0) return fail("test needs a pack: set `pack` in the suite or pass --pack");
 	const pack = await loadPack(chosen);
 	const { capabilityForTool } = await import("capmark");
-	const { scan } = await import("./src-Vnr0fcpK.js");
+	const { scan } = await import("./src-CwBEFhww.js");
 	const inspect = pack.rules.some((rule) => rule.when.secrets !== void 0) ? (path) => {
 		try {
 			return scan(readFileSync(path, "utf8"));
@@ -1472,7 +1486,7 @@ async function test(suitePath, packOverride, asJson) {
 	else for (const line of renderSuite(result)) console.log(line);
 	if (!result.ok) process.exit(1);
 }
-async function verify(path, keyPath) {
+async function verify(path, keyPath, checkpointPath) {
 	let ledger;
 	try {
 		ledger = Ledger.open(path);
@@ -1484,6 +1498,13 @@ async function verify(path, keyPath) {
 		const entries = ledger.read();
 		const last = entries.at(-1);
 		console.log(`${result.entries} entries · chain intact${last === void 0 ? "" : ` · seal ${seal(last)}`}`);
+		if (checkpointPath !== void 0) {
+			const { checkCheckpoint } = await import("./checkpoint-DiznOVpS.js");
+			const publicKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
+			const verdict = checkCheckpoint(entries, JSON.parse(readFileSync(checkpointPath, "utf8")), publicKey);
+			for (const line of verdict.lines) (verdict.ok ? console.log : console.error)(`checkpoint: ${line}`);
+			if (!verdict.ok) process.exitCode = 1;
+		}
 		if (keyPath !== void 0) {
 			const { verifySignature: verifySignature$1, fingerprint: fingerprint$1 } = await import("./src-C9L6NBvu.js");
 			const { readFileSync: readFileSync$1 } = await import("node:fs");
@@ -1563,7 +1584,7 @@ async function report(path, out, packPath) {
 * that step is a proposal a human approves, and it starts from this list.
 */
 async function instructions(from, asJson) {
-	const { ingest } = await import("./src-CraUX64d.js");
+	const { ingest } = await import("./src-d4c_n6wd.js");
 	const result = ingest(from);
 	if (asJson) {
 		console.log(JSON.stringify(result, null, 2));
@@ -1599,7 +1620,7 @@ async function instructions(from, asJson) {
 * on purpose rather than something that happened to their policy.
 */
 async function propose(from, options) {
-	const [{ ingest }, { extract }] = await Promise.all([import("./src-CraUX64d.js"), import("./src-CQ0UmFUK.js")]);
+	const [{ ingest }, { extract }] = await Promise.all([import("./src-d4c_n6wd.js"), import("./src-CBGZVvt7.js")]);
 	const read = ingest(from);
 	if (read.files.length === 0) {
 		console.log(`No instruction files found at or above ${from}.`);
@@ -1659,9 +1680,9 @@ async function consoleOut(path, argv) {
 	const instructionsDir = flag(argv, "instructions");
 	if (instructionsDir !== void 0) {
 		const [{ ingest }, { extract }, { renderInstructions }] = await Promise.all([
-			import("./src-CraUX64d.js"),
-			import("./src-CQ0UmFUK.js"),
-			import("./instructions-C104EUaE.js")
+			import("./src-d4c_n6wd.js"),
+			import("./src-CBGZVvt7.js"),
+			import("./instructions-DulxSqFd.js")
 		]);
 		const read = ingest(instructionsDir);
 		instructionsView = renderInstructions(data, read, extract(read.statements));
@@ -1759,6 +1780,60 @@ async function init(argv) {
 		return fail(error instanceof Error ? error.message : String(error));
 	}
 }
+async function checkpoint(path, keyPath, out) {
+	const { makeCheckpoint } = await import("./checkpoint-DiznOVpS.js");
+	let ledger;
+	try {
+		ledger = Ledger.open(path);
+	} catch (error) {
+		return fail(error instanceof Error ? error.message : String(error));
+	}
+	const chain$1 = ledger.verify();
+	if (!chain$1.ok) return fail(`chain broken at line ${chain$1.problems[0]?.line}: ${chain$1.problems[0]?.message} — a checkpoint of a broken chain would certify the break`);
+	const privateKey = keyPath === void 0 ? void 0 : readFileSync(keyPath, "utf8");
+	const cp = makeCheckpoint(ledger.read(), path.split("/").at(-1) ?? path, privateKey);
+	const text = `${JSON.stringify(cp, null, 2)}\n`;
+	if (out === void 0) console.log(text);
+	else {
+		await mkdir(dirname(out), { recursive: true });
+		await writeFile(out, text);
+		console.log(`checkpoint ${out} · ${cp.entries} rows · head ${cp.head.hash.slice(0, 16)}…${cp.sig === void 0 ? " · unsigned" : ` · signed ${cp.fingerprint}`}`);
+		console.log("Keep it where this machine cannot write. `prae verify --checkpoint` later detects rows removed or rewritten since.");
+	}
+}
+async function exportLedger(path, options) {
+	const { toOcsf, ndjson, sendToHec } = await import("./ocsf-DhVGbBUw.js");
+	const { createRequire } = await import("node:module");
+	const { version } = createRequire(import.meta.url)("../package.json");
+	let ledger;
+	try {
+		ledger = Ledger.open(path);
+	} catch (error) {
+		return fail(error instanceof Error ? error.message : String(error));
+	}
+	const events = toOcsf(ledger.read(), {
+		product: {
+			name: "prae-gate",
+			version
+		},
+		ledger: path
+	});
+	if (options.hec !== void 0) {
+		if (options.token === void 0) fail("--hec needs --hec-token");
+		const sent = await sendToHec(events, options.hec, options.token);
+		if (sent.status < 200 || sent.status >= 300) return fail(`HEC answered ${sent.status}: ${sent.body.slice(0, 200)}`);
+		console.log(`${sent.sent} events → ${options.hec} (${sent.status})`);
+		return;
+	}
+	const text = ndjson(events);
+	if (options.out === void 0) {
+		process.stdout.write(text);
+		return;
+	}
+	await mkdir(dirname(options.out), { recursive: true });
+	await writeFile(options.out, text);
+	console.log(`${events.length} OCSF events → ${options.out} · seals carried under unmapped; the signature covers the ledger row, not the event`);
+}
 async function main(argv) {
 	const [command, ...rest] = argv;
 	switch (command) {
@@ -1798,7 +1873,23 @@ async function main(argv) {
 		case "verify": {
 			const path = rest[0];
 			if (path === void 0) fail("verify needs a ledger file");
-			return verify(path, flag(rest, "key"));
+			return verify(path, flag(rest, "key"), flag(rest, "checkpoint"));
+		}
+		case "checkpoint": {
+			const path = rest[0];
+			if (path === void 0) fail("checkpoint needs a ledger file");
+			return checkpoint(path, flag(rest, "key"), flag(rest, "out"));
+		}
+		case "export": {
+			const path = rest[0];
+			if (path === void 0) fail("export needs a ledger file");
+			const format = flag(rest, "format") ?? "ocsf";
+			if (format !== "ocsf") fail(`unknown format ${format}; only ocsf today`);
+			return exportLedger(path, {
+				out: flag(rest, "out"),
+				hec: flag(rest, "hec"),
+				token: flag(rest, "hec-token")
+			});
 		}
 		case "verify-receipt": {
 			const path = rest[0];

package/lib/index.js

@@ -1,6 +1,6 @@
 import "./evaluate-wMPkjcIC.js";
-import "./views-UODslKwu.js";
-import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-mahLCjoD.js";
+import "./views-CCwVXpo2.js";
+import { a as planWrite, i as dshHome, n as applyWrite, o as praeRow, r as defaultProfile, s as profileAt, t as main } from "./cli-UAE968If.js";
 import "./src-Ciggx9ja.js";
 
 export { applyWrite, defaultProfile, dshHome, main, planWrite, praeRow, profileAt };

package/lib/{instructions-C104EUaE.js → instructions-DulxSqFd.js}

@@ -1,4 +1,4 @@
-import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-UODslKwu.js";
+import { c as renderNav, l as renderShell, s as esc, t as navFor } from "./views-CCwVXpo2.js";
 
 //#region src/console/instructions.ts
 const STYLE = `

package/lib/{mcp-DDcejhwQ.js → mcp-doNYU-1C.js}

@@ -1,5 +1,5 @@
 import { t as evaluate } from "./evaluate-wMPkjcIC.js";
-import { a as scan, n as MAX_SCAN_BYTES } from "./src-Br1tGPtS.js";
+import { a as scan, n as MAX_SCAN_BYTES } from "./src-B25SHWcz.js";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { resolve, sep } from "node:path";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";

package/lib/ocsf-DhVGbBUw.js

@@ -0,0 +1,211 @@
+import { basename } from "node:path";
+
+//#region src/ocsf.ts
+const OCSF_VERSION = "1.5.0";
+const DETECTION_FINDING = 2004;
+const API_ACTIVITY = 6003;
+/** OCSF `severity_id`. */
+const SEVERITY = {
+	informational: 1,
+	low: 2,
+	medium: 3,
+	high: 4
+};
+/** OCSF `action_id`: what was done about it, in the schema's four words. */
+const ACTION = {
+	allowed: 1,
+	denied: 2,
+	observed: 3
+};
+/** OCSF API Activity `activity_id`. */
+const API_ACTIVITY_OF = {
+	read: 2,
+	list_dir: 2,
+	read_file: 2,
+	web_fetch: 2,
+	write: 3,
+	edit: 3,
+	str_replace_editor: 3
+};
+function isEvent(row) {
+	return row.tool.startsWith("prae:");
+}
+const isUrl = (subject) => /^https?:\/\//.test(subject);
+/** The file or URL the call was aimed at, as an OCSF evidence artifact. */
+function evidences(row) {
+	const subject = row.subject;
+	if (subject === void 0 || subject === "" || isEvent(row)) return [];
+	if (isUrl(subject)) return [{ url: {
+		url_string: subject,
+		hostname: subject.replace(/^https?:\/\//, "").split("/")[0] ?? ""
+	} }];
+	if (row.command !== void 0) return [];
+	return [{ file: {
+		name: basename(subject),
+		path: subject,
+		type_id: 1
+	} }];
+}
+/** The same target, as the resource an API Activity touched. */
+function resources(row) {
+	const subject = row.subject;
+	if (subject === void 0 || subject === "") return [];
+	if (row.command !== void 0) return [{
+		name: row.command.program,
+		type: "program"
+	}];
+	return [{
+		name: subject,
+		type: isUrl(subject) ? "url" : "file"
+	}];
+}
+/** Everything the SIEM has no field for, kept verbatim. The seal lives here. */
+function unmapped(row, disposition) {
+	return {
+		seq: row.seq,
+		disposition,
+		seal: row.hash,
+		prev: row.prev,
+		...row.sig === void 0 ? {} : { sig: row.sig },
+		verdict: row.verdict,
+		...row.rule === void 0 ? {} : { rule: row.rule },
+		...row.capability === void 0 ? {} : { capability: row.capability },
+		...row.phase === void 0 ? {} : { phase: row.phase },
+		...row.shadow === void 0 ? {} : { shadow: row.shadow },
+		...row.subject === void 0 ? {} : { subject: row.subject },
+		...row.command === void 0 ? {} : { command: row.command },
+		...row.secrets === void 0 ? {} : { secrets: row.secrets.map((s) => ({
+			type: s.type,
+			rule: s.rule
+		})) },
+		...row.micros === void 0 ? {} : { micros: row.micros },
+		pack: row.pack,
+		trace: row.trace,
+		evidence: "PRAE ledger row. The seal and signature cover the original row, not this event; verify with `prae verify` or a receipt."
+	};
+}
+function metadata(row, options) {
+	const log = options.ledger === void 0 ? void 0 : basename(options.ledger);
+	return {
+		product: {
+			name: options.product.name,
+			vendor_name: "PRAE",
+			version: options.product.version
+		},
+		version: OCSF_VERSION,
+		profiles: ["security_control"],
+		uid: `${row.session ?? log ?? "ledger"}#${row.seq}`,
+		...row.session === void 0 ? {} : { correlation_uid: row.session },
+		...log === void 0 ? {} : { log_name: log },
+		logged_time: Date.parse(row.at)
+	};
+}
+/** What happened, in one line a SOC analyst reads first. */
+function message(row) {
+	const what = row.command?.program ?? row.subject ?? row.tool;
+	if (isEvent(row)) return `${row.rule ?? row.tool}: ${row.reason ?? what}`;
+	const verb = row.verdict === "deny" ? row.phase === "output" ? "ran; output withheld from the model" : "refused before execution" : row.verdict === "ask" ? "held for approval" : row.rule === void 0 ? "allowed" : "allowed and recorded";
+	const shadow = row.shadow ? " (shadow mode)" : "";
+	const rule = row.rule === void 0 ? "" : ` · ${row.rule}`;
+	return `${row.tool} ${what}: ${verb}${shadow}${rule}`;
+}
+function finding(row, options) {
+	const event = isEvent(row);
+	const severity = event ? SEVERITY.informational : row.verdict === "deny" ? SEVERITY.high : row.verdict === "ask" || row.verdict === "correct" ? SEVERITY.medium : SEVERITY.low;
+	const disposition = event ? "logged" : row.shadow ? "logged" : row.verdict === "deny" ? row.phase === "output" ? "withheld" : "blocked" : row.verdict === "ask" ? "held" : "logged";
+	const action = disposition === "blocked" || disposition === "withheld" ? ACTION.denied : ACTION.observed;
+	const activity = 1;
+	return {
+		class_uid: DETECTION_FINDING,
+		category_uid: 2,
+		activity_id: activity,
+		type_uid: DETECTION_FINDING * 100 + activity,
+		time: Date.parse(row.at),
+		severity_id: severity,
+		status_id: 1,
+		action_id: action,
+		is_alert: !event && row.verdict === "deny" && row.shadow !== true,
+		message: message(row),
+		metadata: metadata(row, options),
+		finding_info: {
+			uid: `${row.session ?? "ledger"}#${row.seq}`,
+			title: event ? `PRAE ${row.rule ?? row.tool}` : `PRAE ${row.verdict}${row.phase === "output" ? " (output)" : ""}${row.rule === void 0 ? "" : ` · ${row.rule}`}`,
+			...row.reason === void 0 ? {} : { desc: row.reason },
+			analytic: {
+				name: row.rule ?? "baseline",
+				type_id: 1,
+				...row.pack === void 0 ? {} : { version: `${row.pack.name} ${row.pack.version}` }
+			},
+			...row.capability === void 0 ? {} : { types: [row.capability] }
+		},
+		evidences: evidences(row),
+		unmapped: unmapped(row, disposition)
+	};
+}
+function apiActivity(row, options) {
+	const activity = API_ACTIVITY_OF[row.tool] ?? 99;
+	return {
+		class_uid: API_ACTIVITY,
+		category_uid: 6,
+		activity_id: activity,
+		type_uid: API_ACTIVITY * 100 + activity,
+		time: Date.parse(row.at),
+		severity_id: SEVERITY.informational,
+		status_id: 1,
+		action_id: ACTION.allowed,
+		message: message(row),
+		metadata: metadata(row, options),
+		actor: {
+			app_name: "dsh",
+			...row.session === void 0 ? {} : { session: { uid: row.session } }
+		},
+		api: {
+			operation: row.tool,
+			request: { uid: `${row.seq}` },
+			response: {
+				code: 0,
+				message: "allowed"
+			}
+		},
+		src_endpoint: { name: "agent harness" },
+		resources: resources(row),
+		unmapped: unmapped(row, "allowed")
+	};
+}
+/** One OCSF event per ledger row, in file order. */
+function toOcsf(rows, options) {
+	return rows.map((row) => isEvent(row) || row.verdict !== "allow" || row.rule !== void 0 ? finding(row, options) : apiActivity(row, options));
+}
+/** Newline-delimited JSON, the form every collector takes. */
+function ndjson(events) {
+	return `${events.map((event) => JSON.stringify(event)).join("\n")}\n`;
+}
+/**
+* Splunk HTTP Event Collector: one request, one JSON object per line, each
+* wrapping the event with its time. Sentinel and Security Lake take the
+* NDJSON file through their own ingestion; only HEC has a wire this simple.
+*/
+async function sendToHec(events, url, token, fetchImpl = fetch) {
+	const endpoint = `${url.replace(/\/$/, "")}/services/collector/event`;
+	const body = events.map((event) => JSON.stringify({
+		time: Number(event.time) / 1e3,
+		sourcetype: "ocsf:prae",
+		event
+	})).join("\n");
+	const response = await fetchImpl(endpoint, {
+		method: "POST",
+		headers: {
+			authorization: `Splunk ${token}`,
+			"content-type": "application/json"
+		},
+		body
+	});
+	return {
+		sent: events.length,
+		status: response.status,
+		body: await response.text()
+	};
+}
+
+//#endregion
+export { OCSF_VERSION, ndjson, sendToHec, toOcsf };

package/lib/playground.js

@@ -491,52 +491,100 @@
 
 //#endregion
 //#region ../kernel/src/frameworks.ts
-	const FRAMEWORKS = { "owasp-llm-top-10-2026": {
-		name: "OWASP Top 10 for LLM Applications — 2026",
-		short: "OWASP LLM 2026",
-		controls: {
-			LLM01: {
-				name: "Prompt Injection",
-				summary: "Instructions in a prompt or in retrieved content alter what the model does."
-			},
-			LLM02: {
-				name: "Sensitive Information Disclosure",
-				summary: "Credentials, personal data or proprietary content reach the model or its output."
-			},
-			LLM03: {
-				name: "Excessive Agency",
-				summary: "The model can take actions, or holds permissions, beyond what its task needs."
-			},
-			LLM04: {
-				name: "Supply Chain",
-				summary: "A compromised model, dataset, plugin or dependency enters the application."
-			},
-			LLM05: {
-				name: "Data and Model Poisoning",
-				summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
-			},
-			LLM06: {
-				name: "Unbounded Consumption",
-				summary: "The application permits resource use without a limit, exhausting budget or service."
-			},
-			LLM07: {
-				name: "Misinformation",
-				summary: "The model produces false or misleading content that is acted on as if true."
-			},
-			LLM08: {
-				name: "Hidden Context Exposure",
-				summary: "System prompts, hidden instructions or internal context are revealed."
-			},
-			LLM09: {
-				name: "Vector and Embedding Weaknesses",
-				summary: "Retrieval stores are manipulated or leak across tenants and permissions."
-			},
-			LLM10: {
-				name: "Improper Output Handling",
-				summary: "Model output is passed to downstream systems without validation."
+	const FRAMEWORKS = {
+		"owasp-llm-top-10-2026": {
+			name: "OWASP Top 10 for LLM Applications — 2026",
+			short: "OWASP LLM 2026",
+			controls: {
+				LLM01: {
+					name: "Prompt Injection",
+					summary: "Instructions in a prompt or in retrieved content alter what the model does."
+				},
+				LLM02: {
+					name: "Sensitive Information Disclosure",
+					summary: "Credentials, personal data or proprietary content reach the model or its output."
+				},
+				LLM03: {
+					name: "Excessive Agency",
+					summary: "The model can take actions, or holds permissions, beyond what its task needs."
+				},
+				LLM04: {
+					name: "Supply Chain",
+					summary: "A compromised model, dataset, plugin or dependency enters the application."
+				},
+				LLM05: {
+					name: "Data and Model Poisoning",
+					summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
+				},
+				LLM06: {
+					name: "Unbounded Consumption",
+					summary: "The application permits resource use without a limit, exhausting budget or service."
+				},
+				LLM07: {
+					name: "Misinformation",
+					summary: "The model produces false or misleading content that is acted on as if true."
+				},
+				LLM08: {
+					name: "Hidden Context Exposure",
+					summary: "System prompts, hidden instructions or internal context are revealed."
+				},
+				LLM09: {
+					name: "Vector and Embedding Weaknesses",
+					summary: "Retrieval stores are manipulated or leak across tenants and permissions."
+				},
+				LLM10: {
+					name: "Improper Output Handling",
+					summary: "Model output is passed to downstream systems without validation."
+				}
+			}
+		},
+		"owasp-agentic-top-10-2026": {
+			name: "OWASP Top 10 for Agentic Applications — 2026",
+			short: "OWASP Agentic 2026",
+			controls: {
+				ASI01: {
+					name: "Agent Goal Hijack",
+					summary: "Untrusted input redirects what the agent is trying to do, turning its objectives against its owner."
+				},
+				ASI02: {
+					name: "Tool Misuse and Exploitation",
+					summary: "A legitimate tool the agent already holds is turned to an attacker's ends."
+				},
+				ASI03: {
+					name: "Identity and Privilege Abuse",
+					summary: "The agent's own authority, credentials or delegated access is inherited or escalated."
+				},
+				ASI04: {
+					name: "Agentic Supply Chain",
+					summary: "A poisoned tool, model, plugin, skill or dependency is trusted before the agent runs."
+				},
+				ASI05: {
+					name: "Unexpected Code Execution",
+					summary: "The agent's output reaches something that runs it: a shell, an interpreter, a parser."
+				},
+				ASI06: {
+					name: "Memory and Context Poisoning",
+					summary: "Corrupted memory or retrieved context persists across sessions and steers future reasoning."
+				},
+				ASI07: {
+					name: "Insecure Inter-Agent Communication",
+					summary: "One agent trusts another's messages by default, so a compromised agent can steer its peers."
+				},
+				ASI08: {
+					name: "Cascading Failures",
+					summary: "A single fault propagates across agents, tools and workflows into system-wide impact."
+				},
+				ASI09: {
+					name: "Human-Agent Trust Exploitation",
+					summary: "Persuasive or misleading agent output moves a person to an unsafe action or approval."
+				},
+				ASI10: {
+					name: "Rogue Agents",
+					summary: "A compromised, misaligned or drifting agent keeps operating in unintended ways."
+				}
 			}
 		}
-	} };
+	};
 
 //#endregion
 //#region ../kernel/src/pack.ts

package/lib/prae-baseline.prae.json

@@ -1,7 +1,7 @@
 {
   "prae": "0.1",
   "pack": "prae-baseline",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "rules": [
     {
       "id": "BASE-001",
@@ -17,7 +17,8 @@
         "because": "piping a download into an interpreter runs code nobody has read"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI05", "ASI02"]
       }
     },
     {
@@ -35,7 +36,8 @@
         "because": "a recursive force-delete is not reversible and needs a human"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
@@ -51,7 +53,8 @@
         "because": "escalating privileges needs a human"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
@@ -73,7 +76,8 @@
         "because": "block-device and filesystem tools are not granted to agents"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
@@ -98,7 +102,8 @@
         "because": "secrets and credential stores are out of scope for agents"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM02"]
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
@@ -115,7 +120,8 @@
         "because": "writing outside the working tree needs a human"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
@@ -132,7 +138,8 @@
         "because": "rewriting shared history needs a human"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     },
     {
@@ -149,7 +156,8 @@
         "because": "publishing is outward-facing and needs a human"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM03"]
+        "owasp-llm-top-10-2026": ["LLM03"],
+        "owasp-agentic-top-10-2026": ["ASI02"]
       }
     }
   ]

package/lib/secret-catcher.prae.json

@@ -1,7 +1,7 @@
 {
   "prae": "0.1",
   "pack": "secret-catcher",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "rules": [
     {
       "id": "SEC-001",
@@ -26,7 +26,8 @@
         "because": "the requested file contains a protected credential; the contents were not returned"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM02"]
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
@@ -43,7 +44,8 @@
         "because": "the requested file contains a private key; the contents were not returned"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM02"]
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     },
     {
@@ -74,7 +76,8 @@
         "because": "the command ran and its output contained a protected credential; the output was withheld from the model"
       },
       "frameworks": {
-        "owasp-llm-top-10-2026": ["LLM02"]
+        "owasp-llm-top-10-2026": ["LLM02"],
+        "owasp-agentic-top-10-2026": ["ASI03"]
       }
     }
   ]

package/lib/{src-Vnr0fcpK.js → src-CwBEFhww.js}

@@ -1,3 +1,3 @@
-import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-Br1tGPtS.js";
+import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-B25SHWcz.js";
 
 export { DETECTORS, MAX_SCAN_BYTES, entropy, looksBinary, scan };

package/lib/{views-UODslKwu.js → views-CCwVXpo2.js}

@@ -1,50 +1,98 @@
 //#region ../kernel/src/frameworks.ts
-const FRAMEWORKS = { "owasp-llm-top-10-2026": {
-	name: "OWASP Top 10 for LLM Applications — 2026",
-	short: "OWASP LLM 2026",
-	controls: {
-		LLM01: {
-			name: "Prompt Injection",
-			summary: "Instructions in a prompt or in retrieved content alter what the model does."
-		},
-		LLM02: {
-			name: "Sensitive Information Disclosure",
-			summary: "Credentials, personal data or proprietary content reach the model or its output."
-		},
-		LLM03: {
-			name: "Excessive Agency",
-			summary: "The model can take actions, or holds permissions, beyond what its task needs."
-		},
-		LLM04: {
-			name: "Supply Chain",
-			summary: "A compromised model, dataset, plugin or dependency enters the application."
-		},
-		LLM05: {
-			name: "Data and Model Poisoning",
-			summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
-		},
-		LLM06: {
-			name: "Unbounded Consumption",
-			summary: "The application permits resource use without a limit, exhausting budget or service."
-		},
-		LLM07: {
-			name: "Misinformation",
-			summary: "The model produces false or misleading content that is acted on as if true."
-		},
-		LLM08: {
-			name: "Hidden Context Exposure",
-			summary: "System prompts, hidden instructions or internal context are revealed."
-		},
-		LLM09: {
-			name: "Vector and Embedding Weaknesses",
-			summary: "Retrieval stores are manipulated or leak across tenants and permissions."
-		},
-		LLM10: {
-			name: "Improper Output Handling",
-			summary: "Model output is passed to downstream systems without validation."
+const FRAMEWORKS = {
+	"owasp-llm-top-10-2026": {
+		name: "OWASP Top 10 for LLM Applications — 2026",
+		short: "OWASP LLM 2026",
+		controls: {
+			LLM01: {
+				name: "Prompt Injection",
+				summary: "Instructions in a prompt or in retrieved content alter what the model does."
+			},
+			LLM02: {
+				name: "Sensitive Information Disclosure",
+				summary: "Credentials, personal data or proprietary content reach the model or its output."
+			},
+			LLM03: {
+				name: "Excessive Agency",
+				summary: "The model can take actions, or holds permissions, beyond what its task needs."
+			},
+			LLM04: {
+				name: "Supply Chain",
+				summary: "A compromised model, dataset, plugin or dependency enters the application."
+			},
+			LLM05: {
+				name: "Data and Model Poisoning",
+				summary: "Training, fine-tuning or embedding data is manipulated to change behaviour."
+			},
+			LLM06: {
+				name: "Unbounded Consumption",
+				summary: "The application permits resource use without a limit, exhausting budget or service."
+			},
+			LLM07: {
+				name: "Misinformation",
+				summary: "The model produces false or misleading content that is acted on as if true."
+			},
+			LLM08: {
+				name: "Hidden Context Exposure",
+				summary: "System prompts, hidden instructions or internal context are revealed."
+			},
+			LLM09: {
+				name: "Vector and Embedding Weaknesses",
+				summary: "Retrieval stores are manipulated or leak across tenants and permissions."
+			},
+			LLM10: {
+				name: "Improper Output Handling",
+				summary: "Model output is passed to downstream systems without validation."
+			}
+		}
+	},
+	"owasp-agentic-top-10-2026": {
+		name: "OWASP Top 10 for Agentic Applications — 2026",
+		short: "OWASP Agentic 2026",
+		controls: {
+			ASI01: {
+				name: "Agent Goal Hijack",
+				summary: "Untrusted input redirects what the agent is trying to do, turning its objectives against its owner."
+			},
+			ASI02: {
+				name: "Tool Misuse and Exploitation",
+				summary: "A legitimate tool the agent already holds is turned to an attacker's ends."
+			},
+			ASI03: {
+				name: "Identity and Privilege Abuse",
+				summary: "The agent's own authority, credentials or delegated access is inherited or escalated."
+			},
+			ASI04: {
+				name: "Agentic Supply Chain",
+				summary: "A poisoned tool, model, plugin, skill or dependency is trusted before the agent runs."
+			},
+			ASI05: {
+				name: "Unexpected Code Execution",
+				summary: "The agent's output reaches something that runs it: a shell, an interpreter, a parser."
+			},
+			ASI06: {
+				name: "Memory and Context Poisoning",
+				summary: "Corrupted memory or retrieved context persists across sessions and steers future reasoning."
+			},
+			ASI07: {
+				name: "Insecure Inter-Agent Communication",
+				summary: "One agent trusts another's messages by default, so a compromised agent can steer its peers."
+			},
+			ASI08: {
+				name: "Cascading Failures",
+				summary: "A single fault propagates across agents, tools and workflows into system-wide impact."
+			},
+			ASI09: {
+				name: "Human-Agent Trust Exploitation",
+				summary: "Persuasive or misleading agent output moves a person to an unsafe action or approval."
+			},
+			ASI10: {
+				name: "Rogue Agents",
+				summary: "A compromised, misaligned or drifting agent keeps operating in unintended ways."
+			}
 		}
 	}
-} };
+};
 /**
 * Every framework control a rule cites, resolved to names.
 *
@@ -802,6 +850,7 @@ const OBLIGATIONS = [
 	}
 ];
 const OWASP = "owasp-llm-top-10-2026";
+const AGENTIC = "owasp-agentic-top-10-2026";
 /** Rules in the pack that cite one control of one framework. */
 function citing(pack, framework, control) {
 	return (pack?.rules ?? []).filter((rule) => (rule.frameworks?.[framework] ?? []).includes(control));
@@ -819,32 +868,91 @@ const NOT_THIS_BOUNDARY = {
 	LLM07: "Whether an answer is true is not a property of a tool call.",
 	LLM08: "The assembled system prompt is sealed into the ledger as evidence of what the model was told; nothing here stops the model repeating it.",
 	LLM09: "Retrieval stores are upstream of the call the gate judges.",
-	LLM10: "What downstream code does with model output is that code's boundary, not this one's."
+	LLM10: "What downstream code does with model output is that code's boundary, not this one's.",
+	ASI04: "Where a tool, skill or plugin came from is settled before the agent runs. A rule on the skill tool (integrity, source) is how a pack refuses to trust one at load time; none in this pack does.",
+	ASI06: "Memory and retrieval stores are upstream of the call the gate judges. What the gate can do is seal what the agent was told (PRAE-ASM, PRAE-CTX) so a poisoned context is evidenced, never silent; this record holds no such seal.",
+	ASI07: "A message between agents is not a tool call; when it becomes one, it is judged like any other agent's call. The channel itself is outside this boundary.",
+	ASI09: "Whether a person was misled is not a property of a tool call. An ask verdict puts a human in the path and seals the outcome; nothing here judges the persuasion."
+};
+/**
+* A risk this gate answers by *not* answering it: nothing here detects an
+* injected instruction or a hijacked goal, and saying otherwise would be the
+* claim a red team disproves first. What the gate does is bound what the
+* subverted agent can execute — the cited controls of another risk doing
+* their job. Said in those words, every time.
+*/
+const BOUNDED_BY = {
+	LLM01: {
+		framework: OWASP,
+		control: "LLM03"
+	},
+	ASI01: {
+		framework: AGENTIC,
+		control: "ASI02"
+	}
+};
+function bounded(data, risk, by) {
+	const bounding = citing(data.pack, by.framework, by.control);
+	const what = risk === "ASI01" ? "a hijacked goal" : "injected instructions";
+	const who = risk === "ASI01" ? "a hijacked agent" : "an injected instruction";
+	return {
+		state: "partial",
+		note: bounding.length === 0 ? `Not mitigated: this gate does not detect ${what}, and no ${by.control} control in this pack bounds what ${who} can execute.` : `Not mitigated: this gate does not detect ${what}. Bounded: ${bounding.length} ${by.control} control${bounding.length === 1 ? "" : "s"} (${bounding.map((r) => r.id).join(", ")}) decide what ${who} can execute.`
+	};
+}
+/**
+* Risks whose evidence is in the record rather than in a citing rule.
+*
+* ASI06: a poisoned context cannot be prevented here, but every change to what
+* the agent was told is sealed, so it is evidenced. ASI10: a drifting agent's
+* actions are judged like any other's; what the record shows is whether the
+* gate refused any of them.
+*/
+const FROM_THE_RECORD = {
+	ASI06: (data) => {
+		const seals = data.entries.filter((e) => e.rule === "PRAE-ASM" || e.rule === "PRAE-CTX");
+		return seals.length === 0 ? void 0 : {
+			state: "partial",
+			note: `Evidenced, not prevented: ${seals.length} seal${seals.length === 1 ? "" : "s"} of what the agent was told (PRAE-ASM / PRAE-CTX) in this record; a poisoned context changes the hash and is answerable afterwards.`
+		};
+	},
+	ASI10: (data) => {
+		const refused = data.entries.filter((e) => e.verdict === "deny").length;
+		const armed = [
+			"ASI02",
+			"ASI03",
+			"ASI08"
+		].flatMap((c) => citing(data.pack, AGENTIC, c));
+		if (armed.length === 0) return void 0;
+		return {
+			state: refused > 0 ? "covered" : "partial",
+			note: refused > 0 ? `A drifting agent's actions are judged like any other's: ${armed.length} controls under ASI02/03/08 apply to every call, and ${refused} refusal${refused === 1 ? "" : "s"} in this record show them holding.` : `A drifting agent's actions are judged like any other's: ${armed.length} controls under ASI02/03/08 apply to every call; none has refused one in this record yet. Detecting drift itself is derived from the record, not a rule.`
+		};
+	}
 };
-function owaspRow(control) {
-	const framework = FRAMEWORKS[OWASP];
+function frameworkRow(frameworkId, control) {
+	const framework = FRAMEWORKS[frameworkId];
 	const risk = framework?.controls[control];
 	const name = risk?.name ?? control;
 	return {
-		id: `${framework?.short ?? OWASP} · ${control}`,
+		id: `${framework?.short ?? frameworkId} · ${control}`,
 		asks: `${name}. ${risk?.summary ?? ""}`.trim(),
 		evidence: (data) => {
 			if (data.pack === void 0) return {
 				state: "absent",
 				note: "No pack supplied to this view."
 			};
-			if (control === "LLM01") {
-				const bounding = citing(data.pack, OWASP, "LLM03");
+			const by = BOUNDED_BY[control];
+			if (by !== void 0) return bounded(data, control, by);
+			const rules = citing(data.pack, frameworkId, control);
+			if (rules.length === 0) {
+				const derived = FROM_THE_RECORD[control]?.(data);
+				if (derived !== void 0) return derived;
 				return {
-					state: "partial",
-					note: bounding.length === 0 ? "Not mitigated: this gate does not detect injected instructions, and no LLM03 control in this pack bounds what one can execute." : `Not mitigated: this gate does not detect injected instructions. Bounded: ${bounding.length} LLM03 control${bounding.length === 1 ? "" : "s"} (${bounding.map((r) => r.id).join(", ")}) decide what an injected instruction can execute.`
+					state: "absent",
+					note: NOT_THIS_BOUNDARY[control] ?? "No rule in this pack cites this risk."
 				};
 			}
-			const rules = citing(data.pack, OWASP, control);
-			if (rules.length === 0) return {
-				state: "absent",
-				note: NOT_THIS_BOUNDARY[control] ?? "No rule in this pack cites this risk."
-			};
 			const ids = new Set(rules.map((rule) => rule.id));
 			const decisions = data.entries.filter((entry) => entry.rule !== void 0 && ids.has(entry.rule));
 			const listed = rules.map((rule) => rule.id).join(", ");
@@ -858,14 +966,18 @@ function owaspRow(control) {
 		}
 	};
 }
-const OWASP_ROWS = Object.keys(FRAMEWORKS[OWASP]?.controls ?? {}).map(owaspRow);
+const rowsOf = (frameworkId) => Object.keys(FRAMEWORKS[frameworkId]?.controls ?? {}).map((control) => frameworkRow(frameworkId, control));
 /**
-* The obligations first, then the OWASP risks. Two kinds of row in one table
-* on purpose: an auditor reads down one list and finds the audit obligations
-* the ledger evidences and the application risks the pack's rules address,
-* each stated in its framework's own words.
+* The obligations first, then the risks framework by framework. Two kinds of
+* row in one table on purpose: an auditor reads down one list and finds the
+* audit obligations the ledger evidences and the application risks the pack's
+* rules address, each stated in its framework's own words.
 */
-const CONTROLS = [...OBLIGATIONS, ...OWASP_ROWS];
+const CONTROLS = [
+	...OBLIGATIONS,
+	...rowsOf(OWASP),
+	...rowsOf(AGENTIC)
+];
 
 //#endregion
 //#region src/console/views.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "prae-cli",
-  "version": "0.7.1",
+  "version": "0.8.0",
   "description": "Operator policy for agent harnesses: validate packs, explain a decision, test a pack against security invariants, verify a decision log, and provision a governed DSH profile.",
   "keywords": [
     "dsh-plugin",
@@ -42,10 +42,10 @@
     "vitest": "^3.2.4",
     "@prae/extract": "0.1.0",
     "@prae/inspect": "0.1.0",
+    "@prae/controls": "0.1.0",
     "@prae/instructions": "0.1.0",
     "@prae/kernel": "0.1.0",
     "@prae/ledger": "0.1.0",
-    "@prae/controls": "0.1.0",
     "@prae/tokens": "0.1.0"
   },
   "scripts": {