runward 0.14.1 → 0.15.0

package/templates/workflows/floor.md

@@ -21,7 +21,7 @@ Use this workflow once the architecture is fixed and building must start: "what
 
 **Start from the reference floor, not a blank page.** The starting point is the reference floor (`floor-ts/` in the Runward repository): a clonable hexagonal scaffold that already carries the pure domain, the ports, the adapters, and the middleware chain, with a principle-to-code table mapping each principle to where it lives in the code. Clone it, implement the project's concrete adapters behind the ports fixed in `architect`, and leave intact the structure that keeps the domain testable without the model. Do not reinvent the skeleton; populate it.
 
-**Confront the floor's craft rules at the point of building.** Before writing each piece, open the CRITICAL/HIGH rules mapped to the floor phase — `runward/rules/`, frontmatter `phases: [floor]`: the deterministic frontier guard, the model port and its keyless fallback, provider auto-detection, secrets boundary, prompt-injection defense, the hexagonal architecture and adapter pattern, the event-sourced journal, tool-scope atomicity. Do not work from their names — read them. Account for each in the `Rule conformance` manifest of the floor note: `applied` with a `file:line` or test, `deviated` with an ADR, or `n/a` with a reason. `runward check --strict` verifies that manifest is complete and well-formed (it checks that a decision was traced, never the quality of the code — you judge that at the gate).
+**Confront the floor's craft rules at the point of building.** Before writing each piece, open the CRITICAL/HIGH rules mapped to the floor phase — `runward/rules/`, frontmatter `phases: [floor]`: the deterministic frontier guard, the model port and its keyless fallback, provider auto-detection, secrets boundary, prompt-injection defense, the hexagonal architecture and adapter pattern, the event-sourced journal, tool-scope atomicity. Do not work from their names — read them. Account for each in the `Rule conformance` manifest of the floor note: `applied` with a `file:line` or test, `deviated` with an ADR, or `n/a` with a reason. Prefer **typed pointers** — `file:PATH[:LINE][#SYMBOL]`, `test:PATH[::NAME]`, `adr:NNNN`, several per cell separated by `;` — the gate verifies them deterministically: resolution, non-empty content, symbol/test-name presence, and the rule's `signature:` when it declares one (ADR-0019/0020). `runward check --strict` verifies that manifest is complete and well-formed (it checks that a decision was traced and points at something real, never the quality of the code — you judge that at the gate).
 
 **Build exactly these six pieces, and nothing more.**
 

package/templates/workflows/verify.md

@@ -17,12 +17,12 @@ It is **advisory**. It produces findings, never a verdict that gates. `runward c
 
 **Return a finding per row**: `confirmed` (the code applies the rule), `cited-not-applied` (the row claims applied but the code does not carry the rule), or `uncertain` (needs a human look). Deduplicate overlapping findings; group them by severity.
 
-**Hand the findings to the operator.** They are input to the operator's gate decision, not a gate of their own. A `cited-not-applied` finding is a prompt to fix the code (or downgrade the row to `deviated`/`n/a`) and re-run `check --strict` — never a silent override of the deterministic gate.
+**Write the findings, then hand them to the operator.** Record the pass in `runward/governance/verify-findings.md`: a dated header (date, model used, manifests reviewed) and one line per `applied` row — `rule · finding · pointer · one-line reason`. A green `check --strict` surfaces this artifact's presence and freshness (stale once a gated manifest changes); it never reads a verdict out of it. The findings are input to the operator's gate decision, not a gate of their own. A `cited-not-applied` finding is a prompt to fix the code (or downgrade the row to `deviated`/`n/a`) and re-run `check --strict` — never a silent override of the deterministic gate.
 
 ## Definition of Done
 
 - Every `applied` row reviewed, with a confirmed / cited-not-applied / uncertain finding.
-- Findings handed to the operator; no exit code produced, no gate blocked.
+- Findings written to `runward/governance/verify-findings.md` (dated) and handed to the operator; no exit code produced, no gate blocked.
 - Any `cited-not-applied` finding routed back to the code and re-checked deterministically.
 
 ## Anti-patterns

package/examples/request-triage/runward/compliance/eu-ai-act-readiness.md

@@ -1,89 +0,0 @@
-# EU AI Act — Annex IV technical documentation — assessment-readiness draft
-
-> **Draft, incomplete — not a conformity assessment.** Assembled by `runward compliance eu-ai-act` on 2026-07-13,
-> deterministically from ratified engineering artifacts (no model call). High-risk obligations bind from
-> **2 August 2026** (Annex III). This populates Annex IV Point 2 (design & validation) and the design-rationale
-> history; it does **not** satisfy art. 12 runtime logging, and it is not a signed declaration of conformity.
-> Verify against the Official Journal text before filing.
-
-## Annex IV coverage map
-
-| Annex IV point | runward supplies | Required from the provider |
-|---|---|---|
-| 1. General description | UI, HW/SW/firmware notes | intended purpose, provider, versioning, distribution |
-| 2. Elements & development | **architecture, validation procedures + metrics, cybersecurity (manifest + rubric + threat model); design choices, alternatives, assumptions, pre-determined changes = the ADR journal** | third-party sourcing/licensing, sign-off on test logs |
-| 3. Monitoring & control | accuracy characterization, input-data specs, oversight tooling | fundamental-rights / discrimination risk sourcing |
-| 4. Performance metrics | metric-choice justification (rubric) | — |
-| 5. Risk management (art. 9) | technical inputs (threat model, testing) | **risk acceptance / RMS governance** |
-| 6. Lifecycle changes | engineering change record (ADR journal) | release/change-management governance |
-| 7. Harmonised standards | technical notes | **standards selection** (compliance strategy) |
-| 8. Declaration of conformity | — | **signed legal act (art. 47)** |
-| 9. Post-market monitoring | telemetry/logging backbone | **post-market monitoring plan (art. 72)** |
-
-## Point 2 — design decisions (ADR journal, near-verbatim to the Annex IV requirement)
-
-| ADR | Status |
-|---|---|
-| ADR-0001: single orchestrator, sequential triage (`ADR-0001-single-orchestrator.md`) | accepted |
-| ADR-0002: deterministic guard on model-extracted fields (`ADR-0002-deterministic-guard-on-extracted-fields.md`) | accepted |
-
-## Agentic-risk coverage (OWASP ASI → Point 2 cybersecurity / Point 5 risk)
-
-| ASI | Risk | Rules addressing it |
-|---|---|---|
-| ASI01 | Agent Goal Hijack | `frontier-deterministic-boundary`, `hexa-move-deterministic-out`, `security-prompt-injection` |
-| ASI02 | Tool Misuse & Exploitation | `checklist-pre-production-security`, `hexa-move-deterministic-out`, `resilience-fail-open`, `security-code-execution-sandbox`, `security-tool-change-reapproval`, `tools-registry-pattern`, `tools-scope-atomicity` |
-| ASI03 | Identity & Privilege Abuse | `checklist-pre-production-security`, `config-secrets-boundary`, `tools-registry-pattern` |
-| ASI04 | Agentic Supply Chain Vulnerabilities | `contracts-governance`, `resilience-multi-provider-fallback`, `security-mcp-server-pinning`, `security-tool-change-reapproval` |
-| ASI05 | Unexpected Code Execution | `security-code-execution-sandbox` |
-| ASI06 | Memory & Context Poisoning | `checklist-pre-production-security`, `data-memory-provenance`, `patterns-memory-router-tiered`, `security-prompt-injection`, `state-event-sourcing` |
-| ASI07 | Insecure Inter-Agent Communication | `contracts-governance` |
-| ASI08 | Cascading Failures | `async-job-guardrails`, `checklist-pre-production-resilience`, `eval-loop`, `resilience-fail-open`, `resilience-multi-provider-fallback`, `resilience-retry-backoff`, `scaling-distributed-rate-limiting` |
-| ASI09 | Human-Agent Trust Exploitation | `security-human-agent-trust` |
-| ASI10 | Rogue Agents | `config-secrets-boundary`, `scaling-distributed-rate-limiting`, `security-mcp-server-pinning` |
-
-## Control-implementation status (feeds Point 2 validation)
-
-| Rule | Status | Evidence | Phase |
-|---|---|---|---|
-| `contracts-governance` | applied | §3 TriageRecord v1.0 — versioned, additive, tolerant reader, fail-closed; contracts/ | Architect |
-| `hexa-architecture` | applied | §2 pure triage domain, four ports; code/src/core/ | Architect |
-| `hexa-adapter-pattern` | applied | §3 every dependency behind a port; code/src/adapters/ | Architect |
-| `hexa-typescript-native` | n/a | language deliberately left open at this note (§5); locked at floor kickoff (ADR-0003 pending) | Architect |
-| `process-adr-and-journal` | applied | adr/ADR-0001, adr/ADR-0002 — dated decisions with reevaluation triggers | Architect |
-| `security-mcp-server-pinning` | n/a | the floor consumes no MCP or external tool server; tools are in-process and deterministic | Architect |
-| `topology-port-placement-mapped` | applied | §2 map — all four ports placed; the two non-in-app placements (ModelPort → managed vendor runtime under an approved deployment, RoutingPort → existing ticketing infra) are recorded in architecture.md §2 and the legacy-integration note | Topology |
-| `topology-sovereignty-by-data-class` | applied | §2 map — a data class and a sovereignty level per port; request text is bound to the approved model deployment (residency), the TriageRecord is kept internal | Topology |
-| `topology-trace-export-decision` | n/a | the floor exports no execution traces to a third party; observability is in-app structured logs per governance/observability-schema.md | Topology |
-| `topology-usage-registry-present` | applied | §3 usage registry — the single prod deployment with its risk class, data classes, action scopes and owner | Topology |
-| `frontier-deterministic-boundary` | applied | code/src/core/domain/guard.ts — every action-bearing field recomputed/verified (ADR-0002), fail-closed | Floor |
-| `hexa-move-deterministic-out` | applied | code/src/core/domain/guard.ts + keyword classifier — classification and validation are deterministic | Floor |
-| `config-secrets-boundary` | n/a | the illustrative floor runs the deterministic keyword classifier; no provider secret is read in this example code | Floor |
-| `provider-llm-auto-detection` | n/a | only the deterministic keyword adapter ships here; no real provider to auto-detect | Floor |
-| `security-prompt-injection` | applied | threat-model §3 + ADR-0002 — model-proposed values never act; request text is data, not instruction | Floor |
-| `hexa-architecture` | applied | code/src/core/ pure domain behind four ports | Floor |
-| `hexa-adapter-pattern` | applied | code/src/adapters/ — mailbox/web, keyword-model, routing, log behind ports | Floor |
-| `provider-no-crash-missing-env` | applied | code/src/adapters/keyword-model.adapter.ts — deterministic fallback runs with no key | Floor |
-| `state-event-sourcing` | applied | code/src/adapters/in-memory-triage-log.adapter.ts — append-only, keyed by request ID | Floor |
-| `tools-scope-atomicity` | applied | architecture §2 middleware chain + approval on RoutingPort for compliance records | Floor |
-| `eval-loop` | applied | evaluation-rubric.md — abstention scenarios, guard-escalation rate watched off the hot path | Govern |
-| `security-prompt-injection` | applied | §3 guardrails — untrusted request text is data; deterministic guard before RoutingPort (ADR-0002) | Govern |
-| `config-secrets-boundary` | n/a | the illustrative floor reads no provider secret (deterministic keyword classifier) | Govern |
-| `resilience-fail-open` | applied | §3 — sensitive routing fails closed; the guard rejects on doubt (ADR-0002) | Govern |
-| `resilience-multi-provider-fallback` | n/a | single deterministic classifier; no second provider in this floor | Govern |
-| `resilience-retry-backoff` | n/a | in-memory adapters; no external call to retry in the shipped floor | Govern |
-| `async-job-guardrails` | n/a | synchronous request triage; no background jobs at the floor | Govern |
-| `security-mcp-server-pinning` | n/a | no MCP or external tool server consumed at the floor | Govern |
-| `security-tool-change-reapproval` | n/a | tools are in-process and deterministic; no signed external tool to re-approve | Govern |
-| `data-memory-provenance` | n/a | no persistent memory; each request is triaged independently (named deferral) | Govern |
-| `security-code-execution-sandbox` | n/a | the floor runs no model-generated or tool-invoked code; the classifier is deterministic in-process code and RoutingPort calls a typed ticketing API, not code | Govern |
-| `security-human-agent-trust` | applied | §3 — each TriageRecord field carries a provenance marker (computed / verified / model-proposed); RoutingPort approval on a compliance-flagged record shows provenance before the human decides (ADR-0002) | Govern |
-
-## Required from the provider (runward cannot produce this)
-
-- **Point 1** general description (intended purpose, provider, versioning) · **Point 5** RMS governance & risk acceptance (art. 9).
-- **Point 7** harmonised-standards selection · **Point 8** the signed **EU declaration of conformity** (art. 47) · **Point 9** the **post-market monitoring plan** (art. 72).
-- **Art. 12 runtime event logs** — produced by the running system, not by runward.
-
-_Engineering framing, not legal advice; Annex IV wording moves — confirm against the Official Journal (Reg. (EU) 2024/1689) before filing._
-

package/examples/request-triage/runward/compliance/oscal-component-definition.json

@@ -1,209 +0,0 @@
-{
-  "component-definition": {
-    "uuid": "748fac1c-a21c-5282-8140-b77323a0e7da",
-    "metadata": {
-      "title": "runward — agentic-security control evidence (request-triage)",
-      "last-modified": "2026-07-13T00:00:00Z",
-      "version": "2026-07-13",
-      "oscal-version": "1.1.2",
-      "remarks": "Assessment-readiness DRAFT, assembled deterministically by runward from ratified engineering artifacts (rule to OWASP ASI mapping, conformance manifest, ADR journal). Supporting evidence only — NOT a compliance claim, NOT a certification, NOT a conformity assessment. Applicability, risk acceptance and management sign-off are the operator's."
-    },
-    "components": [
-      {
-        "uuid": "78f7623e-fce0-5c98-a040-96a5f5a97e1f",
-        "type": "software",
-        "title": "request-triage",
-        "description": "The agentic system governed by this runward mission.",
-        "control-implementations": [
-          {
-            "uuid": "f8f94d50-a2a4-575a-a0cb-d993e50693ca",
-            "source": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",
-            "description": "OWASP Top 10 for Agentic Applications (ASI01–ASI10) coverage, derived from the mission's craft-rule mapping and conformance manifest.",
-            "implemented-requirements": [
-              {
-                "uuid": "10e10f8e-4f67-5a34-94df-7efaa113769f",
-                "control-id": "asi-01",
-                "description": "ASI01 Agent Goal Hijack. Addressed by rules: frontier-deterministic-boundary, hexa-move-deterministic-out, security-prompt-injection.",
-                "props": [
-                  {
-                    "name": "implementation-status",
-                    "value": "implemented"
-                  }
-                ],
-                "links": [
-                  {
-                    "href": "./iso-42001-readiness.md",
-                    "rel": "reference",
-                    "text": "runward assessment-readiness draft"
-                  }
-                ]
-              },
-              {
-                "uuid": "bb043f31-d856-50d7-8e07-6f7ab9b517e4",
-                "control-id": "asi-02",
-                "description": "ASI02 Tool Misuse & Exploitation. Addressed by rules: checklist-pre-production-security, hexa-move-deterministic-out, resilience-fail-open, security-code-execution-sandbox, security-tool-change-reapproval, tools-registry-pattern, tools-scope-atomicity.",
-                "props": [
-                  {
-                    "name": "implementation-status",
-                    "value": "partial"
-                  }
-                ],
-                "links": [
-                  {
-                    "href": "./iso-42001-readiness.md",
-                    "rel": "reference",
-                    "text": "runward assessment-readiness draft"
-                  }
-                ]
-              },
-              {
-                "uuid": "bfb244c6-c14d-54d8-b2a7-9efc5fa9b8aa",
-                "control-id": "asi-03",
-                "description": "ASI03 Identity & Privilege Abuse. Addressed by rules: checklist-pre-production-security, config-secrets-boundary, tools-registry-pattern.",
-                "props": [
-                  {
-                    "name": "implementation-status",
-                    "value": "partial"
-                  }
-                ],
-                "links": [
-                  {
-                    "href": "./iso-42001-readiness.md",
-                    "rel": "reference",
-                    "text": "runward assessment-readiness draft"
-                  }
-                ]
-              },
-              {
-                "uuid": "ba1a82be-4b49-5b9f-a017-2d9a1c7ba34a",
-                "control-id": "asi-04",
-                "description": "ASI04 Agentic Supply Chain Vulnerabilities. Addressed by rules: contracts-governance, resilience-multi-provider-fallback, security-mcp-server-pinning, security-tool-change-reapproval.",
-                "props": [
-                  {
-                    "name": "implementation-status",
-                    "value": "partial"
-                  }
-                ],
-                "links": [
-                  {
-                    "href": "./iso-42001-readiness.md",
-                    "rel": "reference",
-                    "text": "runward assessment-readiness draft"
-                  }
-                ]
-              },
-              {
-                "uuid": "c3876a6c-d8fe-51ca-b1f6-cff5da50c134",
-                "control-id": "asi-05",
-                "description": "ASI05 Unexpected Code Execution. Addressed by rules: security-code-execution-sandbox.",
-                "props": [
-                  {
-                    "name": "implementation-status",
-                    "value": "partial"
-                  }
-                ],
-                "links": [
-                  {
-                    "href": "./iso-42001-readiness.md",
-                    "rel": "reference",
-                    "text": "runward assessment-readiness draft"
-                  }
-                ]
-              },
-              {
-                "uuid": "02c247e9-35be-5009-bc90-406e39c97f01",
-                "control-id": "asi-06",
-                "description": "ASI06 Memory & Context Poisoning. Addressed by rules: checklist-pre-production-security, data-memory-provenance, patterns-memory-router-tiered, security-prompt-injection, state-event-sourcing.",
-                "props": [
-                  {
-                    "name": "implementation-status",
-                    "value": "partial"
-                  }
-                ],
-                "links": [
-                  {
-                    "href": "./iso-42001-readiness.md",
-                    "rel": "reference",
-                    "text": "runward assessment-readiness draft"
-                  }
-                ]
-              },
-              {
-                "uuid": "d1714857-8222-50ed-8fe4-4c106d904621",
-                "control-id": "asi-07",
-                "description": "ASI07 Insecure Inter-Agent Communication. Addressed by rules: contracts-governance.",
-                "props": [
-                  {
-                    "name": "implementation-status",
-                    "value": "implemented"
-                  }
-                ],
-                "links": [
-                  {
-                    "href": "./iso-42001-readiness.md",
-                    "rel": "reference",
-                    "text": "runward assessment-readiness draft"
-                  }
-                ]
-              },
-              {
-                "uuid": "eb4325d7-8950-5078-b536-30a62da4006b",
-                "control-id": "asi-08",
-                "description": "ASI08 Cascading Failures. Addressed by rules: async-job-guardrails, checklist-pre-production-resilience, eval-loop, resilience-fail-open, resilience-multi-provider-fallback, resilience-retry-backoff, scaling-distributed-rate-limiting.",
-                "props": [
-                  {
-                    "name": "implementation-status",
-                    "value": "partial"
-                  }
-                ],
-                "links": [
-                  {
-                    "href": "./iso-42001-readiness.md",
-                    "rel": "reference",
-                    "text": "runward assessment-readiness draft"
-                  }
-                ]
-              },
-              {
-                "uuid": "56e6885a-fd37-599f-b5dc-5cfd4c6cf582",
-                "control-id": "asi-09",
-                "description": "ASI09 Human-Agent Trust Exploitation. Addressed by rules: security-human-agent-trust.",
-                "props": [
-                  {
-                    "name": "implementation-status",
-                    "value": "implemented"
-                  }
-                ],
-                "links": [
-                  {
-                    "href": "./iso-42001-readiness.md",
-                    "rel": "reference",
-                    "text": "runward assessment-readiness draft"
-                  }
-                ]
-              },
-              {
-                "uuid": "7a1bdaf4-ea39-5b53-b2a6-2b90660c38be",
-                "control-id": "asi-10",
-                "description": "ASI10 Rogue Agents. Addressed by rules: config-secrets-boundary, scaling-distributed-rate-limiting, security-mcp-server-pinning.",
-                "props": [
-                  {
-                    "name": "implementation-status",
-                    "value": "partial"
-                  }
-                ],
-                "links": [
-                  {
-                    "href": "./iso-42001-readiness.md",
-                    "rel": "reference",
-                    "text": "runward assessment-readiness draft"
-                  }
-                ]
-              }
-            ]
-          }
-        ]
-      }
-    ]
-  }
-}