runward 0.13.3 → 0.14.1

package/README.md

@@ -6,7 +6,7 @@
 
 **After the spec, the hard part starts. Runward ships it and runs it.**
 
-*Run-grade engineering for agentic systems — from business need to a system that holds in production.*
+*The floor that keeps an agentic system alive. Run-grade engineering, from business need to production.*
 
 Your agent builds fast. Runward frames what it builds — six gated phases your agent executes and one human signs off — so what ships actually holds.
 

package/dist/cli.js

@@ -13,7 +13,8 @@ import { doctorCommand } from "./commands/doctor.js";
 import { updateCommand } from "./commands/update.js";
 import { characterizeCommand } from "./commands/characterize.js";
 import { complianceCommand } from "./commands/compliance.js";
-// Exit codes: 0 = success · 1 = gaps/warnings · 2 = missing prerequisite
+import { TOOL_IDS } from "./lib/tools.js";
+// Exit codes: 0 = success · 1 = gaps/warnings · 2 = missing prerequisite or CLI misuse (typo, unknown flag)
 process.on("uncaughtException", (err) => {
     if (err.name === "ExitPromptError")
         process.exit(130); // Ctrl+C in a prompt
@@ -52,7 +53,7 @@ program
     .command("init")
     .description("scaffold the mission structure (interactive wizard, or --yes)")
     .option("-p, --path <path>", "project directory (default: prompt, or . with --yes)")
-    .option("-t, --tools <list>", "comma-separated tool profiles: claude,cursor,copilot,gemini,windsurf")
+    .option("-t, --tools <list>", `comma-separated tool profiles: ${TOOL_IDS.join(",")}`)
     .option("--force", "overwrite existing files")
     .option("--example", "scaffold a filled reference mission (request-triage) — the whole chain is green out of the box")
     .action(initCommand);
@@ -91,4 +92,27 @@ program
     .argument("[regime]", "iso-42001 | nist-ai-rmf | eu-ai-act")
     .option("-p, --path <path>", "project directory")
     .action(complianceCommand);
-program.parseAsync();
+// exitOverride lets us map Commander's own errors onto runward's exit-code contract:
+// a parse error (unknown command/option, missing/excess argument) is operator misuse → 2,
+// so CI can tell a typo from a legitimate gate failure (exit 1). Help/version exit 0.
+// Applied to the root AND every subcommand — it does not propagate on its own.
+const MISUSE = new Set([
+    "commander.unknownCommand", "commander.unknownOption", "commander.invalidArgument",
+    "commander.missingArgument", "commander.excessArguments",
+    "commander.missingMandatoryOptionValue", "commander.optionMissingArgument",
+]);
+const onCommanderExit = (err) => {
+    const code = err?.code ?? "";
+    if (code === "commander.helpDisplayed" || code === "commander.version" || code === "commander.help")
+        process.exit(0);
+    process.exit(MISUSE.has(code) ? 2 : (err?.exitCode ?? 1)); // Commander already wrote the message
+};
+program.exitOverride(onCommanderExit);
+program.commands.forEach((cmd) => cmd.exitOverride(onCommanderExit));
+program.parseAsync().catch((err) => {
+    // An error escaping an async action — Commander's own exits are handled above.
+    console.error("\n  " + c.error("✗") + " " + (err?.message ?? String(err)));
+    if (process.env.VERBOSE && err?.stack)
+        console.error(err.stack);
+    process.exit(1);
+});

package/dist/commands/check.js

@@ -68,7 +68,10 @@ export async function checkCommand(opts) {
             for (const d of driftReport(mission, deliverable))
                 drift.push(`${label} · ${d.rule} — ${d.problem}`);
             const { expected, violations } = conformance(mission, phase, deliverable);
-            if (expected.length === 0)
+            // Non-vacuity (ADR-0002): when no rules are currently mapped to a phase, conformance()
+            // still raises a `(mapping)` violation if the mapping was stripped below its pinned
+            // floor. Only skip when there is genuinely nothing to report — never discard that signal.
+            if (expected.length === 0 && violations.length === 0)
                 continue;
             checked++;
             if (violations.length === 0) {

package/dist/commands/status.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { analyze, findMissionRoot } from "../lib/mission.js";
+import { analyze, findMissionRoot, isRealAdr } from "../lib/mission.js";
 import { c, createHeader, section } from "../lib/styles.js";
 import { VERSION, WORKFLOWS } from "../lib/paths.js";
 /** Mission snapshot: phase progress, decision journal, activity, workflows —
@@ -44,7 +44,7 @@ export async function statusCommand(opts) {
     console.log(section("Decision journal"));
     const adrDir = join(mission, "adr");
     const adrs = existsSync(adrDir)
-        ? readdirSync(adrDir).filter((f) => /^ADR-\d+/.test(f) && !f.includes("0000")).sort()
+        ? readdirSync(adrDir).filter(isRealAdr).sort()
         : [];
     if (adrs.length === 0) {
         console.log(c.darkGray("  no ADR yet — every structural decision must be locked"));

package/dist/lib/conformance.js

@@ -59,7 +59,9 @@ export function parseManifest(content) {
         const cols = line.split("|").slice(1, -1).map((c) => c.replace(/`/g, "").trim());
         if (cols.length < 3)
             continue;
-        const [rule, status, evidence] = cols;
+        // Evidence may itself contain a pipe (a TS union `a | b`, a table hint) — rejoin the
+        // tail so it is not truncated, which would wrongly fail an n/a row on a trivial reason.
+        const rule = cols[0], status = cols[1], evidence = cols.slice(2).join(" | ");
         if (/^rule$/i.test(rule) || /^:?-+:?$/.test(rule))
             continue; // header / separator
         rows.push({ rule, status: status.toLowerCase(), evidence });
@@ -71,7 +73,12 @@ function adrExists(missionDir, evidence) {
     if (!id)
         return false;
     const dir = join(missionDir, "adr");
-    return existsSync(dir) && readdirSync(dir).some((f) => f.toUpperCase().startsWith(id));
+    // Anchor on a digit boundary so a `deviated` row citing ADR-1 is not satisfied by
+    // ADR-10 / ADR-12 when filenames are unpadded.
+    return existsSync(dir) && readdirSync(dir).some((f) => {
+        const u = f.toUpperCase();
+        return u.startsWith(id) && !/[0-9]/.test(u.charAt(id.length));
+    });
 }
 /**
  * The reconstruction lifecycle (ADR-0013/0014). A retroactively reconstructed decision is a

package/dist/lib/mission.js

@@ -54,13 +54,19 @@ export function findMissionRoot(cwd) {
 // which distinguishes it from cross-references like [ADR-0001] or [framing.md].
 // A closing bracket followed by "(" is a markdown link ([floor note](floor.md)) — never a placeholder.
 const PLACEHOLDER = /\[[^\]\n]*\s[^\]\n]{1,80}\](?!\()/g;
+/** A real ADR file: ADR-<n>-*.md, excluding the scaffolded template. Single source of
+ *  truth so the mission, status, and conformance paths agree (they used to diverge:
+ *  a `!f.includes("0000")` filter wrongly dropped e.g. ADR-0021-…-10000-ms.md). */
+export function isRealAdr(f) {
+    return /^ADR-\d+/.test(f) && f.endsWith(".md") && f !== "ADR-0000-template.md";
+}
 export function artifactState(missionDir, a) {
     const path = join(missionDir, a.relPath);
     if (!existsSync(path))
         return "missing";
     // Special case: ADR directory — count real ADRs beyond the template.
     if (a.relPath === "adr") {
-        const adrs = readdirSync(path).filter((f) => /^ADR-\d+/.test(f) && !f.includes("0000"));
+        const adrs = readdirSync(path).filter(isRealAdr);
         return adrs.length > 0 ? "filled" : "untouched";
     }
     // Special case: contracts directory — filled as soon as one .md is not the raw port-contract template.
@@ -77,9 +83,22 @@ export function artifactState(missionDir, a) {
         const template = readFileSync(join(TEMPLATES, "mission", a.templateKey), "utf8");
         if (content.trim() === template.trim())
             return "untouched";
+        if ((content.match(PLACEHOLDER) || []).length >= 3)
+            return "in-progress";
+        // Divergence guard: a deliverable is "filled" only when it departs meaningfully from
+        // the scaffold. Templates with few placeholders (decision-matrix, execution-topology)
+        // cannot lean on the placeholder floor, so a one-byte interior edit would otherwise
+        // pass. Require several lines of genuinely new content beyond the template. Calibrated
+        // against the reference mission (its lightest fill adds 5 lines / 215 words).
+        const lines = (s) => s.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+        const templateLines = new Set(lines(template));
+        const added = lines(content).filter((l) => !templateLines.has(l));
+        const addedWords = added.reduce((n, l) => n + l.split(/\s+/).filter(Boolean).length, 0);
+        if (added.length < 3 || addedWords < 20)
+            return "in-progress";
+        return "filled";
     }
-    const placeholders = (content.match(PLACEHOLDER) || []).length;
-    if (placeholders >= 3)
+    if ((content.match(PLACEHOLDER) || []).length >= 3)
         return "in-progress";
     return "filled";
 }
@@ -90,7 +109,7 @@ export function analyze(missionDir) {
     });
     const adrDir = join(missionDir, "adr");
     const adrCount = existsSync(adrDir)
-        ? readdirSync(adrDir).filter((f) => /^ADR-\d+/.test(f) && !f.includes("0000")).length
+        ? readdirSync(adrDir).filter(isRealAdr).length
         : 0;
     const firstIncomplete = phases.find((p) => !p.complete);
     return { phases, adrCount, currentPhase: firstIncomplete ? firstIncomplete.spec.label : "all gates passed" };

package/dist/lib/tools.js

@@ -46,11 +46,16 @@ const skillBody = (s) => [
     "This skill helps you *apply* the rules; it does not enforce them. `runward check --strict` is the sole authority and verifies the manifest deterministically. A rule surfaced here but not accounted for still fails the gate.",
     "",
 ].join("\n");
+/** A YAML-safe double-quoted scalar. The description embeds the `when` trigger, which carries
+ *  colons (and apostrophes) — left bare, a spec-conformant YAML parser (PyYAML safe_load,
+ *  js-yaml) rejects the frontmatter, even though today's lenient line-based harness readers
+ *  tolerate it. Double quotes take colons and apostrophes without escaping. */
+const yamlStr = (v) => `"${v.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 /** SKILL.md open-format: name + description (the relevance trigger) + body. */
 const skillMd = (s) => [
     "---",
     `name: runward-${s.phase}`,
-    `description: Runward ${s.label} craft rules. Use when ${s.when}.`,
+    `description: ${yamlStr(`Runward ${s.label} craft rules. Use when ${s.when}.`)}`,
     "---",
     "",
     skillBody(s),
@@ -110,7 +115,7 @@ export const TOOL_PROFILES = [
         label: "Continue.dev (.continue/rules/runward-*)",
         files: (root) => PHASE_SKILLS.map((s) => ({
             path: join(root, ".continue", "rules", `runward-${s.phase}.md`),
-            content: ["---", `name: Runward ${s.label} craft`, `description: Use when ${s.when}.`, "alwaysApply: false", "---", "", skillBody(s)].join("\n"),
+            content: ["---", `name: ${yamlStr(`Runward ${s.label} craft`)}`, `description: ${yamlStr(`Use when ${s.when}.`)}`, "alwaysApply: false", "---", "", skillBody(s)].join("\n"),
         })),
     },
     {

package/examples/request-triage/runward/compliance/eu-ai-act-readiness.md

@@ -0,0 +1,89 @@
+# EU AI Act — Annex IV technical documentation — assessment-readiness draft
+
+> **Draft, incomplete — not a conformity assessment.** Assembled by `runward compliance eu-ai-act` on 2026-07-13,
+> deterministically from ratified engineering artifacts (no model call). High-risk obligations bind from
+> **2 August 2026** (Annex III). This populates Annex IV Point 2 (design & validation) and the design-rationale
+> history; it does **not** satisfy art. 12 runtime logging, and it is not a signed declaration of conformity.
+> Verify against the Official Journal text before filing.
+
+## Annex IV coverage map
+
+| Annex IV point | runward supplies | Required from the provider |
+|---|---|---|
+| 1. General description | UI, HW/SW/firmware notes | intended purpose, provider, versioning, distribution |
+| 2. Elements & development | **architecture, validation procedures + metrics, cybersecurity (manifest + rubric + threat model); design choices, alternatives, assumptions, pre-determined changes = the ADR journal** | third-party sourcing/licensing, sign-off on test logs |
+| 3. Monitoring & control | accuracy characterization, input-data specs, oversight tooling | fundamental-rights / discrimination risk sourcing |
+| 4. Performance metrics | metric-choice justification (rubric) | — |
+| 5. Risk management (art. 9) | technical inputs (threat model, testing) | **risk acceptance / RMS governance** |
+| 6. Lifecycle changes | engineering change record (ADR journal) | release/change-management governance |
+| 7. Harmonised standards | technical notes | **standards selection** (compliance strategy) |
+| 8. Declaration of conformity | — | **signed legal act (art. 47)** |
+| 9. Post-market monitoring | telemetry/logging backbone | **post-market monitoring plan (art. 72)** |
+
+## Point 2 — design decisions (ADR journal, near-verbatim to the Annex IV requirement)
+
+| ADR | Status |
+|---|---|
+| ADR-0001: single orchestrator, sequential triage (`ADR-0001-single-orchestrator.md`) | accepted |
+| ADR-0002: deterministic guard on model-extracted fields (`ADR-0002-deterministic-guard-on-extracted-fields.md`) | accepted |
+
+## Agentic-risk coverage (OWASP ASI → Point 2 cybersecurity / Point 5 risk)
+
+| ASI | Risk | Rules addressing it |
+|---|---|---|
+| ASI01 | Agent Goal Hijack | `frontier-deterministic-boundary`, `hexa-move-deterministic-out`, `security-prompt-injection` |
+| ASI02 | Tool Misuse & Exploitation | `checklist-pre-production-security`, `hexa-move-deterministic-out`, `resilience-fail-open`, `security-code-execution-sandbox`, `security-tool-change-reapproval`, `tools-registry-pattern`, `tools-scope-atomicity` |
+| ASI03 | Identity & Privilege Abuse | `checklist-pre-production-security`, `config-secrets-boundary`, `tools-registry-pattern` |
+| ASI04 | Agentic Supply Chain Vulnerabilities | `contracts-governance`, `resilience-multi-provider-fallback`, `security-mcp-server-pinning`, `security-tool-change-reapproval` |
+| ASI05 | Unexpected Code Execution | `security-code-execution-sandbox` |
+| ASI06 | Memory & Context Poisoning | `checklist-pre-production-security`, `data-memory-provenance`, `patterns-memory-router-tiered`, `security-prompt-injection`, `state-event-sourcing` |
+| ASI07 | Insecure Inter-Agent Communication | `contracts-governance` |
+| ASI08 | Cascading Failures | `async-job-guardrails`, `checklist-pre-production-resilience`, `eval-loop`, `resilience-fail-open`, `resilience-multi-provider-fallback`, `resilience-retry-backoff`, `scaling-distributed-rate-limiting` |
+| ASI09 | Human-Agent Trust Exploitation | `security-human-agent-trust` |
+| ASI10 | Rogue Agents | `config-secrets-boundary`, `scaling-distributed-rate-limiting`, `security-mcp-server-pinning` |
+
+## Control-implementation status (feeds Point 2 validation)
+
+| Rule | Status | Evidence | Phase |
+|---|---|---|---|
+| `contracts-governance` | applied | §3 TriageRecord v1.0 — versioned, additive, tolerant reader, fail-closed; contracts/ | Architect |
+| `hexa-architecture` | applied | §2 pure triage domain, four ports; code/src/core/ | Architect |
+| `hexa-adapter-pattern` | applied | §3 every dependency behind a port; code/src/adapters/ | Architect |
+| `hexa-typescript-native` | n/a | language deliberately left open at this note (§5); locked at floor kickoff (ADR-0003 pending) | Architect |
+| `process-adr-and-journal` | applied | adr/ADR-0001, adr/ADR-0002 — dated decisions with reevaluation triggers | Architect |
+| `security-mcp-server-pinning` | n/a | the floor consumes no MCP or external tool server; tools are in-process and deterministic | Architect |
+| `topology-port-placement-mapped` | applied | §2 map — all four ports placed; the two non-in-app placements (ModelPort → managed vendor runtime under an approved deployment, RoutingPort → existing ticketing infra) are recorded in architecture.md §2 and the legacy-integration note | Topology |
+| `topology-sovereignty-by-data-class` | applied | §2 map — a data class and a sovereignty level per port; request text is bound to the approved model deployment (residency), the TriageRecord is kept internal | Topology |
+| `topology-trace-export-decision` | n/a | the floor exports no execution traces to a third party; observability is in-app structured logs per governance/observability-schema.md | Topology |
+| `topology-usage-registry-present` | applied | §3 usage registry — the single prod deployment with its risk class, data classes, action scopes and owner | Topology |
+| `frontier-deterministic-boundary` | applied | code/src/core/domain/guard.ts — every action-bearing field recomputed/verified (ADR-0002), fail-closed | Floor |
+| `hexa-move-deterministic-out` | applied | code/src/core/domain/guard.ts + keyword classifier — classification and validation are deterministic | Floor |
+| `config-secrets-boundary` | n/a | the illustrative floor runs the deterministic keyword classifier; no provider secret is read in this example code | Floor |
+| `provider-llm-auto-detection` | n/a | only the deterministic keyword adapter ships here; no real provider to auto-detect | Floor |
+| `security-prompt-injection` | applied | threat-model §3 + ADR-0002 — model-proposed values never act; request text is data, not instruction | Floor |
+| `hexa-architecture` | applied | code/src/core/ pure domain behind four ports | Floor |
+| `hexa-adapter-pattern` | applied | code/src/adapters/ — mailbox/web, keyword-model, routing, log behind ports | Floor |
+| `provider-no-crash-missing-env` | applied | code/src/adapters/keyword-model.adapter.ts — deterministic fallback runs with no key | Floor |
+| `state-event-sourcing` | applied | code/src/adapters/in-memory-triage-log.adapter.ts — append-only, keyed by request ID | Floor |
+| `tools-scope-atomicity` | applied | architecture §2 middleware chain + approval on RoutingPort for compliance records | Floor |
+| `eval-loop` | applied | evaluation-rubric.md — abstention scenarios, guard-escalation rate watched off the hot path | Govern |
+| `security-prompt-injection` | applied | §3 guardrails — untrusted request text is data; deterministic guard before RoutingPort (ADR-0002) | Govern |
+| `config-secrets-boundary` | n/a | the illustrative floor reads no provider secret (deterministic keyword classifier) | Govern |
+| `resilience-fail-open` | applied | §3 — sensitive routing fails closed; the guard rejects on doubt (ADR-0002) | Govern |
+| `resilience-multi-provider-fallback` | n/a | single deterministic classifier; no second provider in this floor | Govern |
+| `resilience-retry-backoff` | n/a | in-memory adapters; no external call to retry in the shipped floor | Govern |
+| `async-job-guardrails` | n/a | synchronous request triage; no background jobs at the floor | Govern |
+| `security-mcp-server-pinning` | n/a | no MCP or external tool server consumed at the floor | Govern |
+| `security-tool-change-reapproval` | n/a | tools are in-process and deterministic; no signed external tool to re-approve | Govern |
+| `data-memory-provenance` | n/a | no persistent memory; each request is triaged independently (named deferral) | Govern |
+| `security-code-execution-sandbox` | n/a | the floor runs no model-generated or tool-invoked code; the classifier is deterministic in-process code and RoutingPort calls a typed ticketing API, not code | Govern |
+| `security-human-agent-trust` | applied | §3 — each TriageRecord field carries a provenance marker (computed / verified / model-proposed); RoutingPort approval on a compliance-flagged record shows provenance before the human decides (ADR-0002) | Govern |
+
+## Required from the provider (runward cannot produce this)
+
+- **Point 1** general description (intended purpose, provider, versioning) · **Point 5** RMS governance & risk acceptance (art. 9).
+- **Point 7** harmonised-standards selection · **Point 8** the signed **EU declaration of conformity** (art. 47) · **Point 9** the **post-market monitoring plan** (art. 72).
+- **Art. 12 runtime event logs** — produced by the running system, not by runward.
+
+_Engineering framing, not legal advice; Annex IV wording moves — confirm against the Official Journal (Reg. (EU) 2024/1689) before filing._
+

package/examples/request-triage/runward/compliance/oscal-component-definition.json

@@ -0,0 +1,209 @@
+{
+  "component-definition": {
+    "uuid": "748fac1c-a21c-5282-8140-b77323a0e7da",
+    "metadata": {
+      "title": "runward — agentic-security control evidence (request-triage)",
+      "last-modified": "2026-07-13T00:00:00Z",
+      "version": "2026-07-13",
+      "oscal-version": "1.1.2",
+      "remarks": "Assessment-readiness DRAFT, assembled deterministically by runward from ratified engineering artifacts (rule to OWASP ASI mapping, conformance manifest, ADR journal). Supporting evidence only — NOT a compliance claim, NOT a certification, NOT a conformity assessment. Applicability, risk acceptance and management sign-off are the operator's."
+    },
+    "components": [
+      {
+        "uuid": "78f7623e-fce0-5c98-a040-96a5f5a97e1f",
+        "type": "software",
+        "title": "request-triage",
+        "description": "The agentic system governed by this runward mission.",
+        "control-implementations": [
+          {
+            "uuid": "f8f94d50-a2a4-575a-a0cb-d993e50693ca",
+            "source": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",
+            "description": "OWASP Top 10 for Agentic Applications (ASI01–ASI10) coverage, derived from the mission's craft-rule mapping and conformance manifest.",
+            "implemented-requirements": [
+              {
+                "uuid": "10e10f8e-4f67-5a34-94df-7efaa113769f",
+                "control-id": "asi-01",
+                "description": "ASI01 Agent Goal Hijack. Addressed by rules: frontier-deterministic-boundary, hexa-move-deterministic-out, security-prompt-injection.",
+                "props": [
+                  {
+                    "name": "implementation-status",
+                    "value": "implemented"
+                  }
+                ],
+                "links": [
+                  {
+                    "href": "./iso-42001-readiness.md",
+                    "rel": "reference",
+                    "text": "runward assessment-readiness draft"
+                  }
+                ]
+              },
+              {
+                "uuid": "bb043f31-d856-50d7-8e07-6f7ab9b517e4",
+                "control-id": "asi-02",
+                "description": "ASI02 Tool Misuse & Exploitation. Addressed by rules: checklist-pre-production-security, hexa-move-deterministic-out, resilience-fail-open, security-code-execution-sandbox, security-tool-change-reapproval, tools-registry-pattern, tools-scope-atomicity.",
+                "props": [
+                  {
+                    "name": "implementation-status",
+                    "value": "partial"
+                  }
+                ],
+                "links": [
+                  {
+                    "href": "./iso-42001-readiness.md",
+                    "rel": "reference",
+                    "text": "runward assessment-readiness draft"
+                  }
+                ]
+              },
+              {
+                "uuid": "bfb244c6-c14d-54d8-b2a7-9efc5fa9b8aa",
+                "control-id": "asi-03",
+                "description": "ASI03 Identity & Privilege Abuse. Addressed by rules: checklist-pre-production-security, config-secrets-boundary, tools-registry-pattern.",
+                "props": [
+                  {
+                    "name": "implementation-status",
+                    "value": "partial"
+                  }
+                ],
+                "links": [
+                  {
+                    "href": "./iso-42001-readiness.md",
+                    "rel": "reference",
+                    "text": "runward assessment-readiness draft"
+                  }
+                ]
+              },
+              {
+                "uuid": "ba1a82be-4b49-5b9f-a017-2d9a1c7ba34a",
+                "control-id": "asi-04",
+                "description": "ASI04 Agentic Supply Chain Vulnerabilities. Addressed by rules: contracts-governance, resilience-multi-provider-fallback, security-mcp-server-pinning, security-tool-change-reapproval.",
+                "props": [
+                  {
+                    "name": "implementation-status",
+                    "value": "partial"
+                  }
+                ],
+                "links": [
+                  {
+                    "href": "./iso-42001-readiness.md",
+                    "rel": "reference",
+                    "text": "runward assessment-readiness draft"
+                  }
+                ]
+              },
+              {
+                "uuid": "c3876a6c-d8fe-51ca-b1f6-cff5da50c134",
+                "control-id": "asi-05",
+                "description": "ASI05 Unexpected Code Execution. Addressed by rules: security-code-execution-sandbox.",
+                "props": [
+                  {
+                    "name": "implementation-status",
+                    "value": "partial"
+                  }
+                ],
+                "links": [
+                  {
+                    "href": "./iso-42001-readiness.md",
+                    "rel": "reference",
+                    "text": "runward assessment-readiness draft"
+                  }
+                ]
+              },
+              {
+                "uuid": "02c247e9-35be-5009-bc90-406e39c97f01",
+                "control-id": "asi-06",
+                "description": "ASI06 Memory & Context Poisoning. Addressed by rules: checklist-pre-production-security, data-memory-provenance, patterns-memory-router-tiered, security-prompt-injection, state-event-sourcing.",
+                "props": [
+                  {
+                    "name": "implementation-status",
+                    "value": "partial"
+                  }
+                ],
+                "links": [
+                  {
+                    "href": "./iso-42001-readiness.md",
+                    "rel": "reference",
+                    "text": "runward assessment-readiness draft"
+                  }
+                ]
+              },
+              {
+                "uuid": "d1714857-8222-50ed-8fe4-4c106d904621",
+                "control-id": "asi-07",
+                "description": "ASI07 Insecure Inter-Agent Communication. Addressed by rules: contracts-governance.",
+                "props": [
+                  {
+                    "name": "implementation-status",
+                    "value": "implemented"
+                  }
+                ],
+                "links": [
+                  {
+                    "href": "./iso-42001-readiness.md",
+                    "rel": "reference",
+                    "text": "runward assessment-readiness draft"
+                  }
+                ]
+              },
+              {
+                "uuid": "eb4325d7-8950-5078-b536-30a62da4006b",
+                "control-id": "asi-08",
+                "description": "ASI08 Cascading Failures. Addressed by rules: async-job-guardrails, checklist-pre-production-resilience, eval-loop, resilience-fail-open, resilience-multi-provider-fallback, resilience-retry-backoff, scaling-distributed-rate-limiting.",
+                "props": [
+                  {
+                    "name": "implementation-status",
+                    "value": "partial"
+                  }
+                ],
+                "links": [
+                  {
+                    "href": "./iso-42001-readiness.md",
+                    "rel": "reference",
+                    "text": "runward assessment-readiness draft"
+                  }
+                ]
+              },
+              {
+                "uuid": "56e6885a-fd37-599f-b5dc-5cfd4c6cf582",
+                "control-id": "asi-09",
+                "description": "ASI09 Human-Agent Trust Exploitation. Addressed by rules: security-human-agent-trust.",
+                "props": [
+                  {
+                    "name": "implementation-status",
+                    "value": "implemented"
+                  }
+                ],
+                "links": [
+                  {
+                    "href": "./iso-42001-readiness.md",
+                    "rel": "reference",
+                    "text": "runward assessment-readiness draft"
+                  }
+                ]
+              },
+              {
+                "uuid": "7a1bdaf4-ea39-5b53-b2a6-2b90660c38be",
+                "control-id": "asi-10",
+                "description": "ASI10 Rogue Agents. Addressed by rules: config-secrets-boundary, scaling-distributed-rate-limiting, security-mcp-server-pinning.",
+                "props": [
+                  {
+                    "name": "implementation-status",
+                    "value": "partial"
+                  }
+                ],
+                "links": [
+                  {
+                    "href": "./iso-42001-readiness.md",
+                    "rel": "reference",
+                    "text": "runward assessment-readiness draft"
+                  }
+                ]
+              }
+            ]
+          }
+        ]
+      }
+    ]
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runward",
-  "version": "0.13.3",
+  "version": "0.14.1",
   "description": "After the spec: ship and run. A delivery framework for agentic systems — floor first, evolution on evidence, governance from day zero, handover with proof.",
   "keywords": [
     "agentic",
@@ -49,6 +49,7 @@
     "@types/node": "^22.0.0",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
+    "js-yaml": "^5.2.1",
     "typescript": "^5.5.0"
   }
 }

package/templates/workflows/architect.md

@@ -8,12 +8,14 @@ Use this workflow once framing is decided and structure must follow: "how do we
 
 - The framing note: floor/target split, success criterion, hard constraints, presumed boundaries.
 - The `mission/architecture.md`, `mission/port-contract.md`, and `mission/adr/ADR-0000-template.md` templates.
+- The `mission/decision-matrix.md` template (the structuring defaults and the trigger that switches each).
 - The `mission/shared-bricks.md` and `mission/execution-topology.md` templates (the infrastructure vision).
 
 ## Outputs
 
 - A light architecture note.
 - The port list with contracts and the integration protocol.
+- The decision matrix adopted for the mission: each structuring choice with its sober default and the objective trigger that switches it (`mission/decision-matrix.md`).
 - The execution-topology note: each port placed behind its location family, with data class and sovereignty.
 - One ADR per structuring decision, including each non-in-app placement.
 
@@ -41,6 +43,7 @@ Use this workflow once framing is decided and structure must follow: "how do we
 ## Definition of Done
 
 - Architecture note produced, boundaries first, stack open.
+- Decision matrix adopted for the mission: every structuring choice carries a sober default and an objective trigger; the positions taken so far are recorded (`mission/decision-matrix.md`).
 - Every port named with contract and initial version; integration protocol stated.
 - Execution-topology note produced: every port placed behind a location family, with its data class(es) and sovereignty; non-in-app placements carry an ADR; the usage registry is seeded.
 - One ADR per structuring choice, locked before the note mentions it.

package/templates/workflows/frame.md

@@ -13,6 +13,7 @@ Use this workflow at the start of any agentic-system mission, or whenever the pe
 ## Outputs
 
 - A framing note (use the `mission/framing.md` template).
+- A steering contract (use the `mission/mission-contract.md` template): what is delivered, on what condition it is accepted, and along which roadmap — filled with the sponsor, tying the success criterion to the deliverables and the milestones.
 - The floor/target split with named deferrals.
 - Presumed architecture boundaries — ports and integration protocol, stack left open.
 
@@ -55,6 +56,7 @@ Lock any truly structuring decision through `decision-loop` before committing it
 ## Definition of Done
 
 - Framing note produced: problem, value, observable success criterion, hard constraints — one page.
+- Steering contract filled with the sponsor: the success criterion tied to the deliverables and to what closes each engagement (`mission/mission-contract.md`).
 - Floor perimeter listed, every deferral named with its trigger.
 - Presumed boundaries stated; language and topology explicitly left open.
 - Note reviewed via `review` before circulation.