progmune-runtime 2.1.6 → 3.2.1

package/dist/policy/cli.js

@@ -0,0 +1,134 @@
+"use strict";
+/**
+ * Phase 11: Policy Engine CLI
+ *
+ * Usage:
+ *   npx ts-node src/policy/cli.ts check <file.ts>
+ *   npx ts-node src/policy/cli.ts check <file.ts> --author alice@example.com
+ *   npx ts-node src/policy/cli.ts check <file.ts> --json
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const certify_1 = require("../certify");
+const accountability_1 = require("../ledger/accountability");
+const engine_1 = require("./engine");
+const C = {
+    reset: "\x1b[0m", bold: "\x1b[1m", dim: "\x1b[2m",
+    green: "\x1b[32m", red: "\x1b[31m", yellow: "\x1b[33m", cyan: "\x1b[36m",
+};
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h") || args.length === 0) {
+    console.log(`
+Progmune Policy Engine — Deploy Gate
+
+Usage:
+  npx ts-node src/policy/cli.ts check <file.ts> [options]
+
+Options:
+  --author <email>     Human who initiated generation
+  --reviewer <email>   Human reviewer
+  --policy <path>      Policy config file (default: .progmune-policy.json)
+  --json               Output as JSON
+
+Examples:
+  npx ts-node src/policy/cli.ts check src/server.ts
+  npx ts-node src/policy/cli.ts check src/server.ts --author alice@example.com
+  npx ts-node src/policy/cli.ts check src/server.ts --json
+  `);
+    process.exit(0);
+}
+const cmd = args[0];
+const filePath = args[1];
+function parseHumanOpt(flag) {
+    const idx = args.indexOf(flag);
+    if (idx < 0 || !args[idx + 1] || args[idx + 1].startsWith("--"))
+        return undefined;
+    const email = args[idx + 1];
+    return { id: email, name: email.split("@")[0], role: flag.slice(2) };
+}
+const useJson = args.includes("--json");
+const author = parseHumanOpt("--author");
+const reviewer = parseHumanOpt("--reviewer");
+const policyIdx = args.indexOf("--policy");
+const policyPath = policyIdx >= 0 ? args[policyIdx + 1] : undefined;
+if (cmd !== "check" || !filePath) {
+    console.error("❌ Usage: npx ts-node src/policy/cli.ts check <file.ts>");
+    process.exit(1);
+}
+// 1. Certify the file
+const cert = (0, certify_1.certify)(filePath);
+// 2. Build accountability chain
+let acct;
+try {
+    acct = (0, accountability_1.buildAccountabilityChain)(cert.sessionId, {
+        author,
+        reviewers: reviewer ? [reviewer] : undefined,
+    });
+}
+catch {
+    // Accountability unavailable — policy will flag human_review violations
+}
+// 3. Load policy (from project config or defaults)
+const projectDir = process.env.PROGMUNE_PROJECT_DIR || process.cwd();
+const { rules, source } = (0, engine_1.loadPolicyConfig)(projectDir, policyPath);
+// 4. Evaluate policy
+const ctx = {
+    certificate: {
+        validated: cert.validated,
+        confidence: cert.confidence,
+        provenanceIntact: cert.provenanceIntact,
+        fingerprint: cert.fingerprint,
+        violations: cert.violations,
+        plsbCoverage: cert.plsbCoverage,
+        plsbRecall: cert.plsbRecall,
+        degraded: cert.degraded,
+        sessionId: cert.sessionId,
+        file: cert.file,
+    },
+    accountability: acct ? {
+        humanEvents: acct.humanEvents,
+        aiEvents: acct.aiEvents,
+        automatedEvents: acct.automatedEvents,
+        custodyGap: acct.custodyGap,
+    } : undefined,
+};
+const result = (0, engine_1.evaluatePolicy)(ctx, rules);
+if (useJson) {
+    console.log(JSON.stringify({ ...result, policySource: source }, null, 2));
+}
+else {
+    console.log(formatPolicyResult(result, cert.file, source));
+}
+process.exit(result.passed ? 0 : 1);
+// ── Formatter ──
+function formatPolicyResult(result, file, policySource) {
+    const lines = [];
+    const verdictColor = result.verdict === "ALLOW" ? C.green
+        : result.verdict === "WARN" ? C.yellow : C.red;
+    const box = result.verdict === "ALLOW" ? "✅"
+        : result.verdict === "WARN" ? "⚠️ " : "❌";
+    lines.push("");
+    lines.push(`${C.bold}${C.cyan}╔════════════════════════════════════════════════════╗${C.reset}`);
+    lines.push(`${C.bold}${C.cyan}║${C.reset}  ${C.bold}Policy Engine — Deploy Gate${C.reset}                         ${C.bold}${C.cyan}║${C.reset}`);
+    lines.push(`${C.bold}${C.cyan}╚════════════════════════════════════════════════════╝${C.reset}`);
+    lines.push("");
+    lines.push(`  File:     ${file}`);
+    lines.push(`  Policy:   ${C.dim}${policySource || "built-in defaults"}${C.reset}`);
+    lines.push(`  Verdict:  ${verdictColor}${C.bold}${box} ${result.verdict}${C.reset}`);
+    lines.push(`  Rules:    ${C.green}${result.passed_rules} passed${C.reset}, ${result.failed_rules > 0 ? C.red : ""}${result.failed_rules} failed${C.reset} / ${result.rules} total`);
+    lines.push("");
+    if (result.violations.length > 0) {
+        lines.push(`  ${C.bold}Violations:${C.reset}`);
+        for (const v of result.violations) {
+            const sev = v.rule.severity === "block" ? `${C.red}BLOCK${C.reset}` : `${C.yellow}WARN${C.reset}`;
+            const ruleName = v.rule.type;
+            lines.push(`    ${sev}  ${ruleName.padEnd(16)} ${v.actual} → expected ${v.expected}`);
+            if (v.detail) {
+                lines.push(`         ${C.dim}${v.detail.slice(0, 90)}${C.reset}`);
+            }
+        }
+        lines.push("");
+    }
+    lines.push(`  ${result.summary}`);
+    lines.push("");
+    return lines.join("\n");
+}

package/dist/policy/engine.js

@@ -0,0 +1,333 @@
+"use strict";
+/**
+ * Phase 11: Policy Engine
+ *
+ * Evaluates policy rules against a certified file and its
+ * supporting data (provenance chain, accountability chain, PLSB).
+ * Returns ALLOW, WARN, or BLOCK.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadPolicyConfig = loadPolicyConfig;
+exports.evaluatePolicy = evaluatePolicy;
+exports.loadEnterprisePolicyConfig = loadEnterprisePolicyConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const types_1 = require("./types");
+function confidenceToNumber(c) {
+    if (c === "high")
+        return 2;
+    if (c === "medium")
+        return 1;
+    return 0;
+}
+function parsePlsbCovered(coverage) {
+    const m = coverage.match(/^(\d+)\//);
+    return m ? parseInt(m[1], 10) : 0;
+}
+/** Load policy from project config file, merged with defaults */
+function loadPolicyConfig(projectPath, configPath) {
+    const cfgFile = configPath
+        ? path.resolve(configPath)
+        : path.join(projectPath, ".progmune-policy.json");
+    if (!fs.existsSync(cfgFile)) {
+        return { rules: [...types_1.DEFAULT_POLICY], source: "built-in defaults" };
+    }
+    try {
+        const cfg = JSON.parse(fs.readFileSync(cfgFile, "utf-8"));
+        const inherit = cfg.inherit !== false; // default: inherit
+        if (!inherit) {
+            return { rules: cfg.rules || [...types_1.DEFAULT_POLICY], source: cfgFile };
+        }
+        // Merge: project rules override defaults by type
+        const merged = [...types_1.DEFAULT_POLICY];
+        for (const pr of cfg.rules || []) {
+            const idx = merged.findIndex(dr => dr.type === pr.type);
+            if (idx >= 0) {
+                // Override existing rule
+                merged[idx] = {
+                    type: merged[idx].type,
+                    severity: pr.severity || merged[idx].severity,
+                    description: pr.description || merged[idx].description,
+                    threshold: pr.threshold ?? merged[idx].threshold,
+                    require: pr.require ?? merged[idx].require,
+                };
+            }
+            else {
+                // Add new rule
+                merged.push(pr);
+            }
+        }
+        return { rules: merged, source: cfgFile };
+    }
+    catch (e) {
+        console.error(`⚠️  Failed to load policy config: ${e.message}. Using defaults.`);
+        return { rules: [...types_1.DEFAULT_POLICY], source: "built-in defaults (config error)" };
+    }
+}
+function evaluatePolicy(ctx, rules) {
+    const activeRules = rules || types_1.DEFAULT_POLICY;
+    const violations = [];
+    for (const rule of activeRules) {
+        switch (rule.type) {
+            // ── Confidence ──
+            case "confidence": {
+                const minLevel = rule.threshold ?? 1; // default: medium
+                const actual = confidenceToNumber(ctx.certificate.confidence);
+                if (actual < minLevel || ctx.certificate.degraded) {
+                    violations.push({
+                        rule,
+                        actual: ctx.certificate.degraded ? "degraded" : ctx.certificate.confidence,
+                        expected: `confidence >= ${minLevel === 2 ? "high" : "medium"}`,
+                        detail: ctx.certificate.degraded
+                            ? "This file was generated via a fallback/degraded path — reliability is reduced."
+                            : `Confidence is ${ctx.certificate.confidence}. Recommend re-generating with full validation.`,
+                    });
+                }
+                break;
+            }
+            // ── Provenance ──
+            case "provenance": {
+                if (!ctx.certificate.provenanceIntact) {
+                    violations.push({
+                        rule,
+                        actual: "broken",
+                        expected: "intact",
+                        detail: `Provenance chain for session ${ctx.certificate.sessionId} is broken — the ledger fingerprint has changed since generation.`,
+                    });
+                }
+                break;
+            }
+            // ── PLSB Coverage ──
+            case "plsb_coverage": {
+                const minCovered = rule.threshold ?? 5;
+                const covered = parsePlsbCovered(ctx.certificate.plsbCoverage);
+                if (covered < minCovered) {
+                    violations.push({
+                        rule,
+                        actual: `${covered} categories covered`,
+                        expected: `>= ${minCovered} categories`,
+                        detail: `PLSB covers ${ctx.certificate.plsbCoverage} categories. Add protocol rules for uncovered weakness types.`,
+                    });
+                }
+                break;
+            }
+            // ── Human Review ──
+            case "human_review": {
+                const minHumans = rule.require ?? 1;
+                const humans = ctx.accountability?.humanEvents ?? 0;
+                if (humans < minHumans) {
+                    violations.push({
+                        rule,
+                        actual: `${humans} human(s) in chain`,
+                        expected: `>= ${minHumans} human reviewer(s)`,
+                        detail: ctx.accountability?.custodyGap
+                            ? "Custody gaps detected — actor identities could not be verified."
+                            : "No human reviewer found in the accountability chain. Use --author, --reviewer flags.",
+                    });
+                }
+                break;
+            }
+            // ── Fingerprint ──
+            case "fingerprint": {
+                if (!ctx.certificate.fingerprint || ctx.certificate.fingerprint.includes("pending")) {
+                    violations.push({
+                        rule,
+                        actual: "no fingerprint",
+                        expected: "fingerprint registered",
+                        detail: "Run 'npm run check' to register missing fingerprints.",
+                    });
+                }
+                break;
+            }
+            // ── Risk-Based (Protocol-agnostic) ──
+            case "risk": {
+                const minSeverity = rule.threshold ?? 2;
+                const minConfidence = rule.require ?? 70;
+                try {
+                    const { assessRisk } = require("../risk-model");
+                    // Extract call sequence from file (best-effort)
+                    const calls = ctx.certificate.validated ? [] : ["SSL_CTX_new", "SSL_connect"]; // fallback
+                    const risk = assessRisk(calls.length > 0 ? calls : ["init", "connect"]);
+                    const criticalOrHigh = risk.patterns.filter((p) => {
+                        const sevOrder = ["Low", "Medium", "High", "Critical"];
+                        return sevOrder.indexOf(p.severity) >= minSeverity && p.confidence >= minConfidence;
+                    });
+                    if (criticalOrHigh.length > 0) {
+                        violations.push({
+                            rule,
+                            actual: `${criticalOrHigh.length} risk pattern(s) ≥ severity threshold`,
+                            expected: `0 patterns at this severity+confidence level`,
+                            detail: criticalOrHigh.map((p) => `${p.patternName} (${p.severity}, ${p.confidence}%): ${p.detail}`).join("; "),
+                        });
+                    }
+                }
+                catch { /* risk model unavailable */ }
+                break;
+            }
+            // ── Knowledge Base Coverage ──
+            case "kb_coverage": {
+                const minStable = rule.threshold ?? 3;
+                let stableCount = 0;
+                try {
+                    const { buildKnowledgeBase } = require("../protocol-knowledge");
+                    const kb = buildKnowledgeBase();
+                    stableCount = kb.units.filter((u) => u.maturity === "stable").length;
+                }
+                catch { /* KB unavailable */ }
+                if (stableCount < minStable) {
+                    violations.push({
+                        rule,
+                        actual: `${stableCount} stable assets`,
+                        expected: `>= ${minStable} stable assets`,
+                        detail: `The Knowledge Base has ${stableCount} stable protocol assets. Need at least ${minStable} for production governance. Run 'npm run status' to see coverage.`,
+                    });
+                }
+                break;
+            }
+            // ── Violations ──
+            case "violations": {
+                const maxViolations = rule.threshold ?? 0;
+                if (ctx.certificate.violations > maxViolations) {
+                    violations.push({
+                        rule,
+                        actual: `${ctx.certificate.violations} SSG violation(s)`,
+                        expected: `<= ${maxViolations}`,
+                        detail: `Ledger consistency check found ${ctx.certificate.violations} violation(s). Run 'progmune_repair' to fix.`,
+                    });
+                }
+                break;
+            }
+        }
+    }
+    // ── Compute verdict ──
+    const blockViolations = violations.filter((v) => v.rule.severity === "block");
+    const warnViolations = violations.filter((v) => v.rule.severity === "warn");
+    let verdict;
+    if (blockViolations.length > 0) {
+        verdict = "BLOCK";
+    }
+    else if (warnViolations.length > 0) {
+        verdict = "WARN";
+    }
+    else {
+        verdict = "ALLOW";
+    }
+    const passed = activeRules.length - violations.length;
+    let summary;
+    if (verdict === "ALLOW") {
+        summary = `✅ ALLOW — all ${activeRules.length} policy rules passed. Safe to deploy.`;
+    }
+    else if (verdict === "WARN") {
+        summary = `⚠️ WARN — ${passed}/${activeRules.length} rules passed, ${warnViolations.length} warning(s). Review before deploy.`;
+    }
+    else {
+        summary = `❌ BLOCK — ${blockViolations.length} blocking violation(s). Deployment is blocked until these are resolved.`;
+    }
+    return {
+        passed: verdict !== "BLOCK",
+        verdict,
+        rules: activeRules.length,
+        passed_rules: passed,
+        failed_rules: violations.length,
+        violations,
+        summary,
+    };
+}
+/**
+ * Load policy configuration from a project's .progmune-policy.json.
+ * Auto-detects enterprise format (has `enterprise` array with `id` fields)
+ * vs legacy format (has `rules` array with `type` fields).
+ *
+ * For legacy format: returns isEnterprise=false, rules=[]
+ * For enterprise format: returns parsed EnterpriseRule[] with policy_ref
+ */
+function loadEnterprisePolicyConfig(projectPath, configPath) {
+    const cfgFile = configPath
+        ? path.resolve(configPath)
+        : path.join(projectPath, ".progmune-policy.json");
+    const emptyResult = {
+        policy: { rules: [...types_1.DEFAULT_POLICY] },
+        source: "built-in defaults",
+        rules: [],
+        isEnterprise: false,
+    };
+    if (!fs.existsSync(cfgFile)) {
+        return emptyResult;
+    }
+    try {
+        const raw = JSON.parse(fs.readFileSync(cfgFile, "utf-8"));
+        // Auto-detect: enterprise format has `enterprise` array with `id` fields
+        if (raw.enterprise && Array.isArray(raw.enterprise) && raw.enterprise.length > 0) {
+            const first = raw.enterprise[0];
+            if (first.id && first.policy_ref) {
+                const policy = {
+                    version: raw.version || "1.0",
+                    name: raw.name,
+                    description: raw.description,
+                    rules: raw.rules || [...types_1.DEFAULT_POLICY],
+                    inherit: raw.inherit,
+                    dimensions: raw.dimensions,
+                    enterprise: raw.enterprise,
+                };
+                return {
+                    policy,
+                    source: cfgFile,
+                    rules: raw.enterprise,
+                    isEnterprise: true,
+                };
+            }
+        }
+        // Fallback: treat as legacy format
+        const policy = {
+            version: raw.version,
+            name: raw.name,
+            description: raw.description,
+            rules: raw.rules || [...types_1.DEFAULT_POLICY],
+            inherit: raw.inherit,
+            dimensions: raw.dimensions,
+        };
+        return {
+            policy,
+            source: cfgFile,
+            rules: [],
+            isEnterprise: false,
+        };
+    }
+    catch (e) {
+        console.error(`⚠️  Failed to load enterprise policy config: ${e.message}. Using defaults.`);
+        return emptyResult;
+    }
+}

package/dist/policy/index.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * Phase 11: Policy Engine Module
+ *
+ * Public API for deployment gating and policy enforcement.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_POLICY = exports.evaluatePolicy = void 0;
+var engine_1 = require("./engine");
+Object.defineProperty(exports, "evaluatePolicy", { enumerable: true, get: function () { return engine_1.evaluatePolicy; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "DEFAULT_POLICY", { enumerable: true, get: function () { return types_1.DEFAULT_POLICY; } });

package/dist/policy/types.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * Phase 11: Policy Engine Types
+ *
+ * Declarative rules that gate AI-generated code from deployment.
+ * Transforms governance from "report" to "enforce".
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_POLICY = void 0;
+/** Default policy — can be overridden by .progmune-policy.json */
+exports.DEFAULT_POLICY = [
+    {
+        type: "confidence",
+        severity: "block",
+        description: "Certificate confidence must be medium or higher",
+        threshold: 1, // 0=low, 1=medium, 2=high
+    },
+    {
+        type: "provenance",
+        severity: "block",
+        description: "Provenance chain must be intact",
+    },
+    {
+        type: "plsb_coverage",
+        severity: "warn",
+        description: "PLSB must cover at least 5/13 categories",
+        threshold: 5,
+    },
+    {
+        type: "human_review",
+        severity: "block",
+        description: "At least 1 human must be in the accountability chain",
+        require: 1,
+    },
+    {
+        type: "fingerprint",
+        severity: "warn",
+        description: "Fingerprint must exist and be verified",
+    },
+    {
+        type: "violations",
+        severity: "block",
+        description: "No SSG ledger violations allowed",
+        threshold: 0,
+    },
+    {
+        type: "kb_coverage",
+        severity: "warn",
+        description: "Knowledge Base must have at least 3 stable protocol assets",
+        threshold: 3,
+    },
+    {
+        type: "risk",
+        severity: "block",
+        description: "Block Critical risks with ≥90% confidence. Warn on High risks with ≥70% confidence.",
+        threshold: 2, // severity: 0=Low, 1=Medium, 2=High, 3=Critical → block if >= 2 with enough confidence
+        require: 70, // minimum confidence %
+    },
+];