runward 0.9.1 → 0.11.0

package/README.md

@@ -4,7 +4,9 @@
 
 [![npm](https://img.shields.io/npm/v/runward?style=for-the-badge&color=0a0a0a&label=npm)](https://www.npmjs.com/package/runward) [![License: MIT](https://img.shields.io/badge/License-MIT-0a0a0a?style=for-the-badge)](LICENSE) [![Doctrine: CC BY-ND 4.0](https://img.shields.io/badge/Doctrine-CC%20BY--ND%204.0-C9A45C?style=for-the-badge)](https://github.com/stranxik/designing-and-running-agentic-systems) [![Support via Ko-fi](https://img.shields.io/badge/%E2%98%95%20Support%20via%20Ko--fi-orange?style=for-the-badge)](https://ko-fi.com/stranxik)
 
-**From business need to a system that holds in production.**
+**After the spec, the hard part starts. Runward ships it and runs it.**
+
+*Run-grade engineering for agentic systems — from business need to a system that holds in production.*
 
 Your agent builds fast. Runward frames what it builds — six gated phases your agent executes and one human signs off — so what ships actually holds.
 
@@ -56,9 +58,12 @@ New here? Follow [your first mission in 15 minutes](docs/first-mission.md).
 |---|---|
 | `runward init` | Scaffold the mission structure (wizard: entry mode, stopping tier, tool profiles) |
 | `runward check` | **Gate audit**: which deliverable, expected at which phase, is missing, started, or filled — exit code 1 on gaps |
+| `runward check --strict` | **Conformance gate**: verifies each phase's rule-conformance manifest — every CRITICAL/HIGH craft rule mapped to the phase is accounted for (applied with a `file:line`/test, deviated with an ADR, or reasoned `n/a`). **Deterministic and zero-LLM**: it proves a decision was traced, never the code's quality, and cannot be jailbroken by injection — rerun it and get the same verdict |
 | `runward status` | Mission snapshot: current gate, decision journal (ADRs), workflows |
 | `runward doctor` | Environment and installation checks |
 | `runward update` | Refresh `runward/workflows/` from the package — mission state never touched, local edits preserved unless `--force` |
+| `runward characterize` | **Read-only inventory** of an existing codebase (brownfield / retro-documentation) → `runward/characterization.md`: dependencies and lockfiles, entrypoints, CI, tests, git-log shape. Deterministic and zero-LLM; it parses artifacts at rest and never runs, builds, or writes to your code. Facts, not decisions — reconstructing the *why* stays yours |
+| `runward compliance <regime>` | **Assemble a regime-framed evidence pack** (`iso-42001`, `nist-ai-rmf`, `eu-ai-act`) from the mission's artifacts → `runward/compliance/…`: a human readiness *draft* (OWASP ASI coverage, rule-conformance status, ADR journal, with the operator-only sections flagged) **and a machine-readable OSCAL** component-definition to feed your GRC/auditor tool. Deterministic, read-only, zero-LLM — supporting evidence, never a compliance claim |
 
 Global flags: `--yes`, `--dry-run`, `--verbose`, `--no-color`. Exit codes: 0 success, 1 gaps/warnings, 2 missing prerequisite.
 
@@ -107,6 +112,9 @@ Phase 5 is transverse: it starts at day zero, not after the incident.
 
 ## What makes it different
 
+- **The gate you own — deterministic and zero-LLM.** `runward check --strict` is a non-probabilistic, operator-owned exit-code gate: it cannot be jailbroken by injection (no model in the gate path) and reruns byte-for-byte. Every competitor gates on LLM generation plus human prose review; this one does not depend on an LLM to pass.
+- **Audit-ready evidence, not compliance theatre.** Craft rules carry an OWASP ASI (Top 10 for Agentic Applications) mapping — a universal, region-agnostic security posture — so the conformance manifest reads as supporting evidence. Security-only by default; it maps to your regime when you need one — ISO/IEC 42001 (global), NIST AI RMF (US), or the EU AI Act art. 13 technical file (EU) — see [`docs/compliance/`](docs/compliance/). An input to that work — never a conformity assessment, never a claim to certify.
+- **Never a runtime.** Runward writes nothing into `.git/`, installs nothing, and runs nothing of yours — it frames, gates and hands off. Your runtime and model are swappable adapters behind a port; the thing you depend on is never Runward.
 - **Floor, not MVP deck.** The floor is the smallest *running* system that proves value on real traffic. A presentation is not a floor.
 - **Evolution on evidence.** Multi-agent, long-term memory, microservices, a bigger model: each has a sober default and an explicit trigger. No trigger, no complexity. Every switch is an ADR.
 - **Security by architecture, not detection.** Prompt injection is constrained structurally (lethal trifecta, 2-of-3 rule), not filtered heuristically.

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * Runward CLI — after the spec: ship and run.
- * Commands: init (wizard), check (gate audit), status, doctor, update.
+ * Commands: init (wizard), check (gate audit), status, doctor, update, characterize.
  */
 import { Command } from "commander";
 import { VERSION } from "./lib/paths.js";
@@ -11,6 +11,8 @@ import { checkCommand } from "./commands/check.js";
 import { statusCommand } from "./commands/status.js";
 import { doctorCommand } from "./commands/doctor.js";
 import { updateCommand } from "./commands/update.js";
+import { characterizeCommand } from "./commands/characterize.js";
+import { complianceCommand } from "./commands/compliance.js";
 // Exit codes: 0 = success · 1 = gaps/warnings · 2 = missing prerequisite
 process.on("uncaughtException", (err) => {
     if (err.name === "ExitPromptError")
@@ -59,6 +61,7 @@ program
     .option("-p, --path <path>", "project directory")
     .option("--strict", "also verify the floor rule-conformance manifest (deterministic)")
     .option("--hooks", "run operator hooks from runward/hooks.json around the audit (opt-in)")
+    .option("--coverage", "advisory: report deliverable + decision-ratification coverage (does not gate)")
     .action(checkCommand);
 program
     .command("status")
@@ -75,4 +78,16 @@ program
     .option("-p, --path <path>", "project directory")
     .option("--force", "overwrite locally modified workflows")
     .action(updateCommand);
+program
+    .command("characterize")
+    .description("read-only inventory of an existing codebase → runward/characterization.md (brownfield/retro-doc)")
+    .option("-p, --path <path>", "project directory (default: .)")
+    .option("--mine", "also propose candidate retroactive ADRs as DRAFT hypotheses (deterministic git archaeology, no model call)")
+    .action(characterizeCommand);
+program
+    .command("compliance")
+    .description("assemble a regime-framed evidence pack from the mission (deterministic, read-only; a readiness draft, never a compliance claim)")
+    .argument("[regime]", "iso-42001 (nist-ai-rmf / eu-ai-act: coming)")
+    .option("-p, --path <path>", "project directory")
+    .action(complianceCommand);
 program.parseAsync();

package/dist/commands/characterize.js

@@ -0,0 +1,63 @@
+import { existsSync, statSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { buildInventory, renderCharacterization, mineDrafts, renderDraft } from "../lib/characterize.js";
+import { makeWriter } from "../lib/write.js";
+import { c, createHeader, isNonInteractive, section, status } from "../lib/styles.js";
+import { VERSION } from "../lib/paths.js";
+/**
+ * Characterize an existing codebase (ADR-0014) — read-only, deterministic, zero-LLM.
+ * Emits runward/characterization.md: a factual inventory (dependencies, entrypoints,
+ * CI, tests, git-log shape). It parses artifacts at rest; it never runs, builds,
+ * installs, or writes to the target — only into runward/. The output is facts, not
+ * decisions: reconstructing the *why* stays the operator's job (ADR-0013).
+ * Exit codes: 0 = inventory produced, 2 = no readable target directory.
+ */
+export async function characterizeCommand(opts) {
+    const root = resolve(process.cwd(), opts.path ?? ".");
+    if (!existsSync(root) || !statSync(root).isDirectory()) {
+        console.error(status.error(`No readable directory at ${root}.`));
+        process.exit(2);
+    }
+    console.log(createHeader(`Runward v${VERSION} — characterize`, root));
+    console.log(section("Reading (read-only)"));
+    const inv = buildInventory(root);
+    const dryRun = process.env.RUNWARD_DRY_RUN === "1";
+    const generatedAt = isNonInteractive() && process.env.RUNWARD_NOW ? process.env.RUNWARD_NOW : new Date().toISOString().slice(0, 10);
+    const md = renderCharacterization(inv, generatedAt);
+    // Generated artifact, not mission state: always refresh it (idempotent).
+    const w = makeWriter({ force: true, dryRun, root });
+    w.write(join(root, "runward", "characterization.md"), md);
+    // --mine: deterministic git archaeology → candidate DRAFT ADRs (no model call, ADR-0014).
+    // force:false — never clobber a DRAFT the operator has started editing.
+    if (opts.mine) {
+        console.log(section("Candidate ADR-mining (--mine)"));
+        const candidates = mineDrafts(root, inv);
+        if (candidates.length === 0) {
+            console.log("  " + status.skip("no candidate decision found in the evidence at rest."));
+        }
+        else {
+            const dw = makeWriter({ force: false, dryRun, root });
+            for (const cand of candidates)
+                dw.write(join(root, "runward", "adr", `DRAFT-${cand.slug}.md`), renderDraft(cand, generatedAt));
+            console.log("  " + status.info(`${candidates.length} candidate decision(s) proposed as DRAFT hypotheses — ratify or delete each (they are not decisions until you own them).`));
+        }
+    }
+    console.log(section("Inventory"));
+    console.log(`  ${c.primaryBold("Ecosystems")}   ${c.white(inv.ecosystems.map((e) => e.name.split(" ")[0]).join(", ") || "none")}`);
+    console.log(`  ${c.primaryBold("Entrypoints")}  ${c.white(String(inv.entrypoints.length))}`);
+    console.log(`  ${c.primaryBold("CI")}           ${c.white(String(inv.ci.length))}`);
+    console.log(`  ${c.primaryBold("Tests")}        ${c.white(String(inv.tests.files))} file(s)`);
+    console.log(`  ${c.primaryBold("Git")}          ${c.white(inv.git ? `${inv.git.commits} commit(s), ${inv.git.authors} author(s)` : "not a git repo")}`);
+    console.log(section("Next steps"));
+    console.log("  " + c.white("1.") + " Review " + c.primary("runward/characterization.md") + c.darkGray(" — facts (confidence: high), not decisions."));
+    if (opts.mine) {
+        console.log("  " + c.white("2.") + " Review the " + c.primary("runward/adr/DRAFT-*.md") + " candidates with your agent: for each, write the real");
+        console.log("     " + c.white("why") + " and a trigger, set " + c.white("Status: accepted") + " and rename to " + c.primary("ADR-NNNN-*.md") + c.darkGray(", or delete it."));
+    }
+    else {
+        console.log("  " + c.white("2.") + " Run the " + c.primary("brownfield") + " workflow with your agent: reconstruct the architecture note and");
+        console.log("     retroactive ADRs. Each is a " + c.warning("hypothesis") + " until you confirm its " + c.white("why") + " and set its trigger.");
+    }
+    console.log("  " + c.white("3.") + " Then " + c.primary("runward check --strict") + c.darkGray(" — the gate stays red until you ratify each reconstructed decision."));
+    console.log();
+}

package/dist/commands/check.js

@@ -1,6 +1,6 @@
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { analyze, findMissionRoot } from "../lib/mission.js";
-import { conformance, driftReport } from "../lib/conformance.js";
+import { conformance, driftReport, unratifiedAdrs, decisionCoverage } from "../lib/conformance.js";
 import { runHooks } from "../lib/hooks.js";
 import { c, createHeader, section, status } from "../lib/styles.js";
 import { VERSION } from "../lib/paths.js";
@@ -14,7 +14,7 @@ import { VERSION } from "../lib/paths.js";
  * Exit codes: 0 = current gate clean, 1 = gaps, 2 = no mission found.
  */
 export async function checkCommand(opts) {
-    const root = findMissionRoot(join(process.cwd(), opts.path ?? "."));
+    const root = findMissionRoot(resolve(process.cwd(), opts.path ?? "."));
     if (!root) {
         console.error(status.error("No runward/ mission found here or above. Run `runward init` first."));
         process.exit(2);
@@ -86,6 +86,30 @@ export async function checkCommand(opts) {
                 console.log(`  ${c.warning("◑")} ${c.white(d)}`);
             console.log("  " + c.darkGray("advisory — an applied pointer no longer resolves; verify it. Does not fail the gate."));
         }
+        const unratified = unratifiedAdrs(mission);
+        if (unratified.length > 0) {
+            console.log(section("Reconstruction lifecycle (--strict)"));
+            for (const u of unratified)
+                console.log(`  ${c.error("✗")} ${c.white(u.file)}${c.darkGray(" — " + u.reason)}`);
+            console.log("  " + c.darkGray("ratify each: write the real why + a re-evaluation trigger and set Status: accepted (rename DRAFT→ADR), or remove it. A hypothesis is not a decision."));
+            strictGaps += unratified.length;
+        }
+    }
+    if (opts.coverage) {
+        console.log(section("Documentation coverage (advisory)"));
+        let filled = 0, totalArt = 0;
+        for (const phase of report.phases)
+            for (const { state } of phase.artifacts) {
+                totalArt++;
+                if (state === "filled")
+                    filled++;
+            }
+        console.log(`  ${c.primaryBold("Deliverables")}  ${c.white(`${filled}/${totalArt} filled`)}`);
+        const dc = decisionCoverage(mission);
+        console.log(`  ${c.primaryBold("Decisions")}     ${c.white(`${dc.ratified}/${dc.total} ratified`)}${dc.unratified.length ? c.warning(`  (${dc.unratified.length} to ratify)`) : ""}`);
+        for (const u of dc.unratified)
+            console.log(`     ${c.warning("◑")} ${c.white(u.file)}${c.darkGray(" — " + u.reason)}`);
+        console.log("  " + c.darkGray("advisory — a ratio of what is documented and ratified, not a claim of completeness. Does not affect the verdict."));
     }
     if (opts.hooks) {
         const after = runHooks(mission, "after", root);

package/dist/commands/compliance.js

@@ -0,0 +1,60 @@
+import { basename, join, resolve } from "node:path";
+import { findMissionRoot } from "../lib/mission.js";
+import { gatherComplianceInputs, renderIso42001Readiness, renderNistAiRmf, renderEuAiAct, renderOscal } from "../lib/compliance.js";
+import { makeWriter } from "../lib/write.js";
+import { c, createHeader, isNonInteractive, section, status } from "../lib/styles.js";
+import { VERSION } from "../lib/paths.js";
+/**
+ * Assemble a regime-framed compliance evidence pack (ADR-0016) — deterministic, read-only, zero-LLM,
+ * outside the gate. Reads the mission's real artifacts (rule→OWASP ASI, conformance manifests, ADR
+ * journal, governance docs) and writes an assessment-readiness *draft*, explicitly flagging what only
+ * the operator can supply. Never a compliance claim.
+ * Exit codes: 0 = draft written, 2 = no mission / unsupported regime.
+ */
+const REGIMES = {
+    "iso-42001": { label: "ISO/IEC 42001", render: renderIso42001Readiness, file: "iso-42001-readiness.md" },
+    "nist-ai-rmf": { label: "NIST AI RMF", render: renderNistAiRmf, file: "nist-ai-rmf-readiness.md" },
+    "eu-ai-act": { label: "EU AI Act (Annex IV)", render: renderEuAiAct, file: "eu-ai-act-readiness.md" },
+};
+export async function complianceCommand(regime, opts) {
+    const key = (regime ?? "").toLowerCase();
+    console.log(createHeader(`Runward v${VERSION} — compliance`, key ? REGIMES[key]?.label ?? key : "regime required"));
+    if (!key || !(key in REGIMES)) {
+        console.error(status.error(`Usage: runward compliance <regime>. Supported: ${Object.keys(REGIMES).join(", ")}.`));
+        console.log("  " + c.darkGray("The manifest is universal (OWASP ASI); the regime is a lens (ADR-0015). Default posture is security-only — no regime named."));
+        process.exit(2);
+    }
+    const spec = REGIMES[key];
+    if (!spec.render) {
+        console.error(status.error(`The ${spec.label} lens is not assembled yet — only iso-42001 for now (ADR-0016, built piece by piece).`));
+        console.log("  " + c.darkGray(`See the framing reference: docs/compliance/${key}.md`));
+        process.exit(2);
+    }
+    const root = findMissionRoot(resolve(process.cwd(), opts.path ?? "."));
+    if (!root) {
+        console.error(status.error("No runward/ mission found here or above. Run `runward init` first."));
+        process.exit(2);
+    }
+    const mission = join(root, "runward");
+    const dryRun = process.env.RUNWARD_DRY_RUN === "1";
+    const generatedAt = isNonInteractive() && process.env.RUNWARD_NOW ? process.env.RUNWARD_NOW : new Date().toISOString().slice(0, 10);
+    console.log(section("Assembling (read-only, deterministic)"));
+    const inputs = gatherComplianceInputs(mission);
+    const md = spec.render(inputs, generatedAt);
+    const w = makeWriter({ force: true, dryRun, root }); // generated artifacts — always refresh
+    w.write(join(mission, "compliance", spec.file), md);
+    // OSCAL export — regime-neutral, machine-readable; the interop layer (ADR-0016) so the evidence flows into GRC/auditor tools.
+    w.write(join(mission, "compliance", "oscal-component-definition.json"), renderOscal(inputs, basename(root), generatedAt));
+    const mappedAsi = [...inputs.asiCoverage.values()].filter((v) => v.length).length;
+    console.log(section("Assembled"));
+    console.log(`  ${c.primaryBold("ASI coverage")}   ${c.white(`${mappedAsi}/10 categories mapped to a rule`)}`);
+    console.log(`  ${c.primaryBold("Conformance")}    ${c.white(`${inputs.conformance.length} accounted rule(s)`)}`);
+    console.log(`  ${c.primaryBold("Decisions")}      ${c.white(`${inputs.adrs.length} ratified ADR(s)`)}`);
+    console.log(`  ${c.primaryBold("Governance")}     ${c.white(`threat model ${inputs.threatModel ? "present" : "missing"}, eval rubric ${inputs.evalRubric ? "present" : "missing"}`)}`);
+    console.log(section("Next steps"));
+    console.log("  " + c.white("1.") + " Review " + c.primary(`runward/compliance/${spec.file}`) + c.darkGray(" — a draft, not a compliance claim."));
+    console.log("  " + c.white("2.") + " Fill the " + c.warning("\"Required from the operator\"") + " sections yourself (applicability, risk acceptance, policy, sign-off).");
+    console.log("  " + c.white("3.") + " Machine-readable " + c.primary("runward/compliance/oscal-component-definition.json") + c.darkGray(" (OSCAL) — feed it to your GRC/auditor tool."));
+    console.log("  " + c.white("4.") + " Hand it over as " + c.white("supporting evidence") + c.darkGray(" — never as a certification."));
+    console.log();
+}

package/dist/commands/init.js

@@ -1,4 +1,4 @@
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { readdirSync } from "node:fs";
 import { checkbox, input, select } from "@inquirer/prompts";
 import { TEMPLATES, MISSION_LAYOUT, VERSION } from "../lib/paths.js";
@@ -44,7 +44,7 @@ export async function initCommand(opts) {
     for (const t of unknown)
         console.log(status.warning(`Unknown tool profile "${t}" — supported: ${TOOL_IDS.join(", ")}`));
     // ── Write ─────────────────────────────────────────────────────────
-    const root = join(process.cwd(), dir);
+    const root = resolve(process.cwd(), dir);
     const mission = join(root, "runward");
     const w = makeWriter({ force: opts.force ?? false, dryRun, root });
     console.log(section("Mission structure"));

package/dist/commands/status.js

@@ -1,11 +1,11 @@
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { analyze, findMissionRoot } from "../lib/mission.js";
 import { c, createHeader, section } from "../lib/styles.js";
 import { VERSION, WORKFLOWS } from "../lib/paths.js";
 /** Mission snapshot: phase, ADR journal, framing summary, workflow presence. */
 export async function statusCommand(opts) {
-    const root = findMissionRoot(join(process.cwd(), opts.path ?? "."));
+    const root = findMissionRoot(resolve(process.cwd(), opts.path ?? "."));
     if (!root) {
         console.error(c.error("✗ ") + "No runward/ mission found. Run `runward init` first.");
         process.exit(2);

package/dist/commands/update.js

@@ -1,5 +1,5 @@
 import { existsSync, readFileSync, readdirSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { TEMPLATES, VERSION } from "../lib/paths.js";
 import { findMissionRoot } from "../lib/mission.js";
 import { makeWriter } from "../lib/write.js";
@@ -10,7 +10,7 @@ import { c, createHeader, section, status } from "../lib/styles.js";
  * Local edits are preserved unless --force.
  */
 export async function updateCommand(opts) {
-    const root = findMissionRoot(join(process.cwd(), opts.path ?? "."));
+    const root = findMissionRoot(resolve(process.cwd(), opts.path ?? "."));
     if (!root) {
         console.error(status.error("No runward/ mission found. Run `runward init` first."));
         process.exit(2);

package/dist/lib/characterize.js

@@ -0,0 +1,337 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { basename, join } from "node:path";
+const SKIP_DIRS = new Set([
+    ".git", "node_modules", "dist", "build", "out", "coverage", "vendor",
+    ".next", ".nuxt", ".venv", "venv", "__pycache__", "target", ".turbo", ".cache",
+]);
+/** Bounded recursive walk (skips heavy dirs, caps depth) — read-only. */
+function walk(dir, depth, onFile) {
+    if (depth < 0)
+        return;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const name of entries) {
+        const p = join(dir, name);
+        let st;
+        try {
+            st = statSync(p);
+        }
+        catch {
+            continue;
+        }
+        if (st.isDirectory()) {
+            if (SKIP_DIRS.has(name))
+                continue;
+            walk(p, depth - 1, onFile);
+        }
+        else {
+            onFile(p, name);
+        }
+    }
+}
+function firstExisting(root, names) {
+    for (const n of names)
+        if (existsSync(join(root, n)))
+            return n;
+    return null;
+}
+function detectEcosystems(root) {
+    const out = [];
+    // Node / TypeScript — parsed in full.
+    if (existsSync(join(root, "package.json"))) {
+        let runtime = 0, dev = 0, names = [];
+        try {
+            const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+            names = Object.keys(pkg.dependencies ?? {});
+            runtime = names.length;
+            dev = Object.keys(pkg.devDependencies ?? {}).length;
+        }
+        catch { /* malformed manifest: still recorded, deps unknown */ }
+        out.push({
+            name: "Node / JavaScript / TypeScript",
+            manifest: "package.json",
+            lockfile: firstExisting(root, ["package-lock.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb"]),
+            runtimeDeps: runtime, devDeps: dev, depNames: names,
+        });
+    }
+    // Python.
+    const pyManifest = firstExisting(root, ["pyproject.toml", "requirements.txt", "setup.py", "Pipfile"]);
+    if (pyManifest) {
+        let runtime = 0;
+        if (pyManifest === "requirements.txt") {
+            try {
+                runtime = readFileSync(join(root, "requirements.txt"), "utf8").split("\n").filter((l) => l.trim() && !l.trim().startsWith("#")).length;
+            }
+            catch { /* unreadable */ }
+        }
+        out.push({ name: "Python", manifest: pyManifest, lockfile: firstExisting(root, ["poetry.lock", "Pipfile.lock", "uv.lock"]), runtimeDeps: runtime, devDeps: 0, depNames: [] });
+    }
+    // Go.
+    if (existsSync(join(root, "go.mod"))) {
+        let runtime = 0;
+        try {
+            runtime = readFileSync(join(root, "go.mod"), "utf8").split("\n").filter((l) => /^\s+[\w.\/-]+\s+v\d/.test(l)).length;
+        }
+        catch { /* unreadable */ }
+        out.push({ name: "Go", manifest: "go.mod", lockfile: firstExisting(root, ["go.sum"]), runtimeDeps: runtime, devDeps: 0, depNames: [] });
+    }
+    // Rust, Java, Ruby, PHP — presence + lockfile (rough).
+    const simple = [
+        ["Rust", "Cargo.toml", ["Cargo.lock"]],
+        ["Java (Maven)", "pom.xml", []],
+        ["Java (Gradle)", "build.gradle", ["gradle.lockfile"]],
+        ["Ruby", "Gemfile", ["Gemfile.lock"]],
+        ["PHP", "composer.json", ["composer.lock"]],
+    ];
+    for (const [name, manifest, locks] of simple) {
+        if (existsSync(join(root, manifest))) {
+            out.push({ name, manifest, lockfile: firstExisting(root, locks), runtimeDeps: 0, devDeps: 0, depNames: [] });
+        }
+    }
+    return out;
+}
+function detectEntrypoints(root) {
+    const found = new Set();
+    // Declared entrypoints in package.json.
+    try {
+        const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+        if (typeof pkg.main === "string")
+            found.add(pkg.main);
+        if (typeof pkg.bin === "string")
+            found.add(pkg.bin);
+        else if (pkg.bin && typeof pkg.bin === "object")
+            for (const v of Object.values(pkg.bin))
+                if (typeof v === "string")
+                    found.add(v);
+    }
+    catch { /* no/invalid package.json */ }
+    // Common convention files.
+    for (const f of ["index.ts", "index.js", "src/index.ts", "src/index.js", "src/main.ts", "main.py", "app.py", "src/main.rs", "cmd", "main.go"]) {
+        if (existsSync(join(root, f)))
+            found.add(f);
+    }
+    return [...found];
+}
+function detectCI(root) {
+    const out = [];
+    const wf = join(root, ".github", "workflows");
+    if (existsSync(wf)) {
+        try {
+            for (const f of readdirSync(wf))
+                if (/\.ya?ml$/.test(f))
+                    out.push(`.github/workflows/${f}`);
+        }
+        catch { /* unreadable */ }
+    }
+    for (const f of [".gitlab-ci.yml", "azure-pipelines.yml", ".circleci/config.yml", "Jenkinsfile", ".drone.yml"]) {
+        if (existsSync(join(root, f)))
+            out.push(f);
+    }
+    return out;
+}
+function detectContainers(root) {
+    const out = [];
+    for (const f of ["Dockerfile", "docker-compose.yml", "docker-compose.yaml", "compose.yaml", "vercel.json", "netlify.toml", "fly.toml", "Procfile", "Chart.yaml"]) {
+        if (existsSync(join(root, f)))
+            out.push(f);
+    }
+    return out;
+}
+function detectTests(root) {
+    const dirs = new Set();
+    let files = 0;
+    for (const d of ["test", "tests", "__tests__", "spec"])
+        if (existsSync(join(root, d)))
+            dirs.add(d);
+    walk(root, 5, (_p, name) => {
+        if (/\.(test|spec)\.[jt]sx?$/.test(name) || /_test\.go$/.test(name) || /^test_.*\.py$/.test(name) || /Test\.java$/.test(name))
+            files++;
+    });
+    return { dirs: [...dirs], files };
+}
+function gitShape(root) {
+    const git = (args) => execFileSync("git", ["-C", root, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    try {
+        git(["rev-parse", "--is-inside-work-tree"]); // throws if not a repo / git absent
+        const commits = parseInt(git(["rev-list", "--count", "HEAD"]), 10) || 0;
+        const last = git(["log", "-1", "--format=%as"]);
+        const first = git(["log", "--max-parents=0", "-1", "--format=%as"]);
+        const authors = git(["shortlog", "-sne", "HEAD"]).split("\n").filter((l) => l.trim()).length;
+        return { commits, first, last, authors };
+    }
+    catch {
+        return null;
+    }
+}
+/** Build the read-only inventory of an existing codebase. */
+export function buildInventory(root) {
+    let fileCount = 0;
+    walk(root, 6, () => { fileCount++; });
+    return {
+        root,
+        ecosystems: detectEcosystems(root),
+        entrypoints: detectEntrypoints(root),
+        ci: detectCI(root),
+        containers: detectContainers(root),
+        tests: detectTests(root),
+        git: gitShape(root),
+        fileCount,
+    };
+}
+/** Render the inventory as `characterization.md` — facts only, never decisions. */
+export function renderCharacterization(inv, generatedAt) {
+    const L = [];
+    L.push(`# Characterization — ${basename(inv.root) || "system"}`);
+    L.push("");
+    L.push(`> \`confidence: high\` · generated by \`runward characterize\` on ${generatedAt} · **read-only, deterministic (no LLM).**`);
+    L.push("> This is a factual inventory of an existing system, not a set of decisions. Nothing here explains *why* the");
+    L.push("> system is the way it is — reconstructing that is the operator's job (see next steps). Re-run to refresh.");
+    L.push("");
+    L.push("## Languages & build");
+    L.push("");
+    if (inv.ecosystems.length === 0)
+        L.push("_No dependency manifest found at the root._");
+    else {
+        L.push("| Ecosystem | Manifest | Lockfile | Runtime deps | Dev deps |");
+        L.push("|---|---|---|---|---|");
+        for (const e of inv.ecosystems) {
+            L.push(`| ${e.name} | \`${e.manifest}\` | ${e.lockfile ? `\`${e.lockfile}\`` : "**none** (unpinned)"} | ${e.runtimeDeps || "—"} | ${e.devDeps || "—"} |`);
+        }
+    }
+    L.push("");
+    const withNames = inv.ecosystems.find((e) => e.depNames.length);
+    if (withNames) {
+        L.push(`## Runtime dependencies (${withNames.manifest})`);
+        L.push("");
+        L.push(withNames.depNames.map((n) => `\`${n}\``).join(" · "));
+        L.push("");
+    }
+    L.push("## Entrypoints");
+    L.push("");
+    L.push(inv.entrypoints.length ? inv.entrypoints.map((e) => `- \`${e}\``).join("\n") : "_None detected by convention._");
+    L.push("");
+    L.push("## CI / pipelines");
+    L.push("");
+    L.push(inv.ci.length ? inv.ci.map((f) => `- \`${f}\``).join("\n") : "_No CI configuration detected._");
+    L.push("");
+    L.push("## Containers / deployment");
+    L.push("");
+    L.push(inv.containers.length ? inv.containers.map((f) => `- \`${f}\``).join("\n") : "_No container/deploy descriptor detected._");
+    L.push("");
+    L.push("## Tests");
+    L.push("");
+    L.push(`- Test directories: ${inv.tests.dirs.length ? inv.tests.dirs.map((d) => `\`${d}/\``).join(", ") : "_none_"}`);
+    L.push(`- Test files (by naming convention): **${inv.tests.files}**`);
+    L.push("");
+    L.push("## Git history (shape only)");
+    L.push("");
+    if (inv.git) {
+        L.push(`- Commits: **${inv.git.commits}** · Span: ${inv.git.first} → ${inv.git.last} · Distinct authors: **${inv.git.authors}**`);
+        L.push("- Counts only — the log tells you *what* changed and *when*, rarely *why*. The *why* is a decision to reconstruct, not a fact to read.");
+    }
+    else {
+        L.push("_Not a git repository, or git unavailable — history shape could not be read._");
+    }
+    L.push("");
+    L.push(`_Scanned ~${inv.fileCount} files (heavy directories skipped)._`);
+    L.push("");
+    L.push("## Next steps (operator)");
+    L.push("");
+    L.push("1. This inventory is **facts**, not decisions. Nothing here has been ratified.");
+    L.push("2. Run the **brownfield** workflow (`runward/workflows/brownfield.md`) with your agent: reconstruct the architecture note and the retroactive ADRs — each starts as a *hypothesis* until you confirm its *why* and set its re-evaluation trigger.");
+    L.push("3. Then `runward check` (and `--strict` once you have manifests) — the gate stays red until each reconstructed decision is ratified by you, not your agent.");
+    L.push("");
+    return L.join("\n") + "\n";
+}
+const slugify = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+const DEP_FAMILIES = [
+    { match: /^(express|fastify|koa|@nestjs\/core|next|nuxt|react|vue|svelte|@angular\/core|django|flask|fastapi|rails|sinatra|laravel|symfony|spring-boot)/i, family: "web framework / UI" },
+    { match: /^(pg|mysql2?|mongodb|mongoose|@prisma\/client|prisma|typeorm|sequelize|redis|ioredis|sqlalchemy|gorm|diesel)/i, family: "data store / ORM" },
+    { match: /^(bullmq|bull|amqplib|kafkajs|celery|sidekiq|nats)/i, family: "queue / messaging" },
+    { match: /^(openai|@anthropic-ai\/sdk|anthropic|langchain|@langchain\/|llamaindex|@ai-sdk\/|cohere-ai)/i, family: "AI / model provider" },
+    { match: /^(@aws-sdk\/|aws-sdk|@google-cloud\/|@azure\/|firebase|stripe)/i, family: "external service SDK" },
+];
+function firstSeen(root, file) {
+    try {
+        const out = execFileSync("git", ["-C", root, "log", "--diff-filter=A", "--reverse", "--format=%as", "--", file], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+        return out.split("\n")[0] || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Propose *candidate* structural decisions from evidence at rest — deterministic, no model call.
+ * Covers the stack/language choice, containerization, the CI pipeline, and notable dependency
+ * families. Each is a hypothesis with provenance; the *why* is left for the operator (ADR-0013).
+ */
+export function mineDrafts(root, inv) {
+    const out = [];
+    for (const eco of inv.ecosystems) {
+        const seen = firstSeen(root, eco.manifest);
+        out.push({
+            slug: `stack-${slugify(eco.name.split(/[ /]/)[0])}`,
+            title: `Adopt ${eco.name} as the core stack`,
+            evidence: [`\`${eco.manifest}\`${eco.lockfile ? ` + \`${eco.lockfile}\`` : " (no lockfile — unpinned)"}`, seen ? `first seen ${seen}` : "manifest at repo root"],
+        });
+    }
+    if (inv.containers.length) {
+        out.push({ slug: "deployment-target", title: `Deploy/package via ${inv.containers[0]}`, evidence: inv.containers.map((f) => `\`${f}\``) });
+    }
+    if (inv.ci.length) {
+        out.push({ slug: "ci-pipeline", title: "Gate delivery through a CI pipeline", evidence: inv.ci.map((f) => `\`${f}\``) });
+    }
+    let depCount = 0;
+    for (const eco of inv.ecosystems) {
+        for (const dep of eco.depNames) {
+            if (depCount >= 8)
+                break;
+            const fam = DEP_FAMILIES.find((f) => f.match.test(dep));
+            if (!fam)
+                continue;
+            depCount++;
+            out.push({ slug: `dep-${slugify(dep)}`, title: `Depend on ${dep} (${fam.family})`, evidence: [`\`${dep}\` in \`${eco.manifest}\``] });
+        }
+    }
+    return out;
+}
+/** Render one candidate as a DRAFT-*.md — a hypothesis with provenance, `why: UNKNOWN`, no verdict. */
+export function renderDraft(cand, generatedAt) {
+    const L = [];
+    L.push(`# DRAFT — ${cand.title}`);
+    L.push("");
+    L.push("**Status**: hypothesis");
+    L.push(`**Date**: ${generatedAt}`);
+    L.push("**Deciders**: (unratified — the operator must own this)");
+    L.push("");
+    L.push("> Reconstructed by `runward characterize --mine` from evidence at rest — a **candidate decision**,");
+    L.push("> not a fact. Ratify it: write the real *why* and the alternatives you rejected, set a re-evaluation");
+    L.push("> trigger, put your name in Deciders, set `Status: accepted`, and rename this file to");
+    L.push("> `ADR-NNNN-<slug>.md`. Or delete it if it was never a real decision. `runward check --strict` stays");
+    L.push("> red until you do.");
+    L.push("");
+    L.push("## Evidence");
+    L.push("");
+    for (const e of cand.evidence)
+        L.push(`- ${e}`);
+    L.push("");
+    L.push("## Decision (reconstructed — confirm or correct)");
+    L.push("");
+    L.push(`${cand.title}.`);
+    L.push("");
+    L.push("## Why");
+    L.push("");
+    L.push("why: UNKNOWN — the operator must supply the rationale; it is not recoverable from code or history.");
+    L.push("");
+    L.push("## Reevaluation trigger (mandatory)");
+    L.push("");
+    L.push("TODO — under what objective signal should this decision be reopened?");
+    L.push("");
+    return L.join("\n") + "\n";
+}

package/dist/lib/compliance.js

@@ -0,0 +1,380 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { parseManifest } from "./conformance.js";
+import { TEMPLATES } from "./paths.js";
+/**
+ * Deterministic, read-only assembly of a regime-framed compliance evidence pack (ADR-0016).
+ * It reads the mission's real artifacts at rest — the rule→OWASP ASI mapping, the rule-conformance
+ * manifests, the ADR journal, and the governance-doc presence — and assembles an assessment-readiness
+ * *draft*. No model call, no live-state scraping, nothing runs. It populates the technical-evidence
+ * layer and its index, and explicitly lists what only the operator/organization can supply. It is
+ * never a compliance claim.
+ */
+/** OWASP Top 10 for Agentic Applications (ASI01–ASI10), the universal security grammar (ADR-0009). */
+export const ASI_LABELS = {
+    ASI01: "Agent Goal Hijack",
+    ASI02: "Tool Misuse & Exploitation",
+    ASI03: "Identity & Privilege Abuse",
+    ASI04: "Agentic Supply Chain Vulnerabilities",
+    ASI05: "Unexpected Code Execution",
+    ASI06: "Memory & Context Poisoning",
+    ASI07: "Insecure Inter-Agent Communication",
+    ASI08: "Cascading Failures",
+    ASI09: "Human-Agent Trust Exploitation",
+    ASI10: "Rogue Agents",
+};
+const FRONTMATTER = /^---\n([\s\S]*?)\n---/;
+function readRules(missionDir) {
+    // The mission's own rules if present (possibly customized), else the package rules — where the
+    // shipped OWASP ASI mapping lives (mirrors expectedRules in conformance.ts).
+    const missionRules = join(missionDir, "rules");
+    const dir = existsSync(missionRules) ? missionRules : join(TEMPLATES, "rules");
+    if (!existsSync(dir))
+        return [];
+    const out = [];
+    for (const f of readdirSync(dir)) {
+        if (!f.endsWith(".md"))
+            continue;
+        let fm = "";
+        try {
+            fm = readFileSync(join(dir, f), "utf8").match(FRONTMATTER)?.[1] ?? "";
+        }
+        catch {
+            continue;
+        }
+        const title = (fm.match(/^title:\s*(.+)$/m)?.[1] ?? f.replace(/\.md$/, "")).trim();
+        const impact = (fm.match(/^impact:\s*(.+)$/m)?.[1] ?? "").trim();
+        const asiRaw = fm.match(/^asi:\s*\[(.*)\]/m)?.[1] ?? "";
+        const asi = asiRaw.split(",").map((s) => s.trim().toUpperCase()).filter((s) => /^ASI\d{2}$/.test(s));
+        out.push({ slug: f.replace(/\.md$/, ""), title, impact, asi });
+    }
+    return out;
+}
+/** The three build-phase deliverables that carry a `## Rule conformance` manifest (as `check --strict`). */
+const CONFORMANCE_DELIVERABLES = [
+    ["Architect", "architecture.md"],
+    ["Floor", "floor.md"],
+    ["Govern", "governance/threat-model.md"],
+];
+function readConformance(missionDir) {
+    const out = [];
+    for (const [label, deliverable] of CONFORMANCE_DELIVERABLES) {
+        const p = join(missionDir, deliverable);
+        if (!existsSync(p))
+            continue;
+        let body = "";
+        try {
+            body = readFileSync(p, "utf8");
+        }
+        catch {
+            continue;
+        }
+        for (const row of parseManifest(body)) {
+            if (/^\[.*\]$/.test(row.rule))
+                continue; // skip template placeholder rows
+            out.push({ ...row, source: label });
+        }
+    }
+    return out;
+}
+function readAdrs(missionDir) {
+    const dir = join(missionDir, "adr");
+    if (!existsSync(dir))
+        return [];
+    const out = [];
+    for (const f of readdirSync(dir)) {
+        if (!f.endsWith(".md") || f === "ADR-0000-template.md" || f.toUpperCase() === "README.MD" || /^DRAFT-/i.test(f))
+            continue;
+        let body = "";
+        try {
+            body = readFileSync(join(dir, f), "utf8");
+        }
+        catch {
+            continue;
+        }
+        const title = (body.match(/^#\s+(.+)$/m)?.[1] ?? f.replace(/\.md$/, "")).trim();
+        const status = (body.match(/^\*\*status\*\*\s*:\s*(.+)$/im)?.[1] ?? "").trim();
+        out.push({ file: f, title, status });
+    }
+    return out;
+}
+export function gatherComplianceInputs(missionDir) {
+    const rules = readRules(missionDir);
+    const asiCoverage = new Map();
+    for (const id of Object.keys(ASI_LABELS))
+        asiCoverage.set(id, []);
+    for (const r of rules)
+        for (const id of r.asi)
+            if (asiCoverage.has(id))
+                asiCoverage.get(id).push(r.slug);
+    return {
+        rules,
+        asiCoverage,
+        conformance: readConformance(missionDir),
+        adrs: readAdrs(missionDir),
+        threatModel: existsSync(join(missionDir, "governance", "threat-model.md")),
+        evalRubric: existsSync(join(missionDir, "governance", "evaluation-rubric.md")),
+    };
+}
+/** Render the ISO/IEC 42001 assessment-readiness draft — the technical-evidence layer + the human-gap list. */
+export function renderIso42001Readiness(inputs, generatedAt) {
+    const L = [];
+    const counts = { applied: 0, deviated: 0, "n/a": 0 };
+    for (const r of inputs.conformance)
+        if (counts[r.status] !== undefined)
+            counts[r.status]++;
+    L.push("# ISO/IEC 42001 — assessment-readiness draft");
+    L.push("");
+    L.push(`> **Draft, incomplete — not a compliance claim.** Assembled by \`runward compliance iso-42001\` on ${generatedAt},`);
+    L.push("> deterministically from ratified engineering artifacts (no model call, nothing scraped or run). It populates the");
+    L.push("> **technical-evidence layer and its index**; the applicability, risk-acceptance, policy and management sign-off it");
+    L.push("> cannot invent are listed under \"Required from the operator\". This is **supporting evidence**, never certification —");
+    L.push("> only an accredited body certifies an AI management system. Verify the current ISO/IEC 42001 text before an audit.");
+    L.push("");
+    L.push("## 1. Agentic-risk coverage (OWASP ASI → your rules)");
+    L.push("");
+    L.push("Feeds the ISO 42001 risk assessment (6.1.2) and control selection (6.1.3): which agentic-security risks are addressed by named engineering rules.");
+    L.push("");
+    L.push("| ASI | Risk | Rules addressing it |");
+    L.push("|---|---|---|");
+    for (const id of Object.keys(ASI_LABELS)) {
+        const slugs = inputs.asiCoverage.get(id) ?? [];
+        L.push(`| ${id} | ${ASI_LABELS[id]} | ${slugs.length ? slugs.map((s) => `\`${s}\``).join(", ") : "**no rule mapped — gap to assess**"} |`);
+    }
+    L.push("");
+    L.push("## 2. Control-implementation status (rule conformance)");
+    L.push("");
+    L.push(`Feeds the Statement of Applicability's implementation-status + evidence columns (6.1.3). From your mission's manifests: **${counts.applied} applied · ${counts.deviated} deviated · ${counts["n/a"]} n/a** across ${inputs.conformance.length} accounted rule(s).`);
+    L.push("");
+    if (inputs.conformance.length === 0) {
+        L.push("_No filled `Rule conformance` manifest found yet — fill the architect/floor/govern deliverables (see `runward check --strict`)._");
+    }
+    else {
+        L.push("| Rule | Status | Evidence | Phase |");
+        L.push("|---|---|---|---|");
+        for (const r of inputs.conformance)
+            L.push(`| \`${r.rule}\` | ${r.status} | ${r.evidence || "—"} | ${r.source} |`);
+    }
+    L.push("");
+    L.push("## 3. Design decisions (ADR journal)");
+    L.push("");
+    L.push("The \"key design choices, alternatives, and re-evaluation triggers\" an ISO 42001 auditor expects (records under Annex A control groups).");
+    L.push("");
+    if (inputs.adrs.length === 0) {
+        L.push("_No ratified ADR found in `runward/adr/`._");
+    }
+    else {
+        L.push("| ADR | Status |");
+        L.push("|---|---|");
+        for (const a of inputs.adrs)
+            L.push(`| ${a.title} (\`${a.file}\`) | ${a.status || "—"} |`);
+    }
+    L.push("");
+    L.push("## 4. Risk & impact inputs (presence)");
+    L.push("");
+    L.push(`- Threat model (feeds risk assessment 6.1.2): ${inputs.threatModel ? "**present** — confirm it is filled, not a raw template" : "**missing**"}`);
+    L.push(`- Evaluation rubric (feeds impact/validation analysis): ${inputs.evalRubric ? "**present** — confirm it is filled" : "**missing**"}`);
+    L.push("");
+    L.push("## Required from the operator / organization (runward cannot produce this)");
+    L.push("");
+    L.push("These sections are managerial, legal or organizational — no tool can assemble them from engineering artifacts:");
+    L.push("");
+    L.push("- **AI policy** (5.2) and **AIMS scope** (4.3).");
+    L.push("- **Statement of Applicability — the applicability decisions and inclusion/exclusion justifications** (6.1.3): runward supplies the status + evidence columns; the *applicability* judgment is yours.");
+    L.push("- **Risk methodology, acceptance criteria and risk-acceptance decisions** (6.1.2, 8.3).");
+    L.push("- **AI system impact assessment report and deployment authorization** (6.1.4).");
+    L.push("- **Objectives and targets** (6.2), **roles and competence** (A.3, 7.2).");
+    L.push("- **Internal audit** (9.2) and **management review** minutes (9.3).");
+    L.push("- **Runtime AI event logs** (A.6.2.8) — produced by the running system, not by runward.");
+    L.push("");
+    L.push("_Regime mapping is dated engineering framing, not legal advice; ISO Annex A control counts/templates are behind the paywalled standard — confirm against the purchased text._");
+    L.push("");
+    return L.join("\n") + "\n";
+}
+// ── Shared table blocks (used by every regime lens) ──
+function asiTableLines(inputs) {
+    const L = ["| ASI | Risk | Rules addressing it |", "|---|---|---|"];
+    for (const id of Object.keys(ASI_LABELS)) {
+        const slugs = inputs.asiCoverage.get(id) ?? [];
+        L.push(`| ${id} | ${ASI_LABELS[id]} | ${slugs.length ? slugs.map((s) => `\`${s}\``).join(", ") : "**no rule mapped — gap to assess**"} |`);
+    }
+    return L;
+}
+function confCounts(inputs) {
+    const c = { applied: 0, deviated: 0, "n/a": 0 };
+    for (const r of inputs.conformance)
+        if (c[r.status] !== undefined)
+            c[r.status]++;
+    return c;
+}
+function confTableLines(inputs) {
+    if (inputs.conformance.length === 0)
+        return ["_No filled `Rule conformance` manifest found yet — fill the architect/floor/govern deliverables (`runward check --strict`)._"];
+    const L = ["| Rule | Status | Evidence | Phase |", "|---|---|---|---|"];
+    for (const r of inputs.conformance)
+        L.push(`| \`${r.rule}\` | ${r.status} | ${r.evidence || "—"} | ${r.source} |`);
+    return L;
+}
+function adrTableLines(inputs) {
+    if (inputs.adrs.length === 0)
+        return ["_No ratified ADR found in `runward/adr/`._"];
+    const L = ["| ADR | Status |", "|---|---|"];
+    for (const a of inputs.adrs)
+        L.push(`| ${a.title} (\`${a.file}\`) | ${a.status || "—"} |`);
+    return L;
+}
+/** Render the NIST AI RMF assessment-readiness draft — an ASI↔AI-RMF crosswalk, the MEASURE/TEVV
+ *  documentation, and the design decisions; GOVERN and risk-tolerance stay the operator's. */
+export function renderNistAiRmf(inputs, generatedAt) {
+    const c = confCounts(inputs);
+    const L = [];
+    L.push("# NIST AI RMF — assessment-readiness draft");
+    L.push("");
+    L.push(`> **Draft, incomplete — not a compliance claim.** Assembled by \`runward compliance nist-ai-rmf\` on ${generatedAt},`);
+    L.push("> deterministically from ratified engineering artifacts (no model call). The AI RMF is **voluntary guidance**");
+    L.push("> with no pass/fail and no certification; this populates the MEASURE/documentation evidence and an ASI crosswalk,");
+    L.push("> while GOVERN, risk tolerance and go/no-go stay the operator's. Verify the current AI RMF text before use.");
+    L.push("");
+    L.push("## 1. Agentic-risk crosswalk (OWASP ASI → AI RMF)");
+    L.push("");
+    L.push("An indicative engineering crosswalk (not NIST-endorsed): each agentic-security risk lands primarily under **MEASURE** (test & evaluate, esp. security & resilience) and **MANAGE** (risk treatment). Confirm subcategory selection against AI RMF §5.");
+    L.push("");
+    L.push(...asiTableLines(inputs));
+    L.push("");
+    L.push("## 2. MEASURE / TEVV documentation");
+    L.push("");
+    L.push(`Feeds MEASURE 2.x — documented, repeatable test methodology and results. From your mission: **${c.applied} applied · ${c.deviated} deviated · ${c["n/a"]} n/a** across ${inputs.conformance.length} rule(s).`);
+    L.push(`- Evaluation rubric (test sets, metrics, tooling): ${inputs.evalRubric ? "**present** — confirm it is filled" : "**missing**"}`);
+    L.push(`- Threat model (adversarial / risk-source analysis): ${inputs.threatModel ? "**present** — confirm it is filled" : "**missing**"}`);
+    L.push("");
+    L.push(...confTableLines(inputs));
+    L.push("");
+    L.push("## 3. Design decisions (ADR journal)");
+    L.push("");
+    L.push(...adrTableLines(inputs));
+    L.push("");
+    L.push("## Required from the operator / organization (runward cannot produce this)");
+    L.push("");
+    L.push("- **GOVERN** — policies, roles, accountability, **risk tolerance** (almost entirely organizational).");
+    L.push("- **MAP** — intended purpose, business/legal context, use-case risk enumeration.");
+    L.push("- **MANAGE** — the **go/no-go acceptance** decision, resourcing, response planning.");
+    L.push("- **Profiles** — Current/Target selection, prioritization, the risk-tolerance choices behind them.");
+    L.push("");
+    L.push("_Indicative engineering framing, not legal advice; NIST prescribes no report template — confirm against AI 100-1 and the Playbook._");
+    L.push("");
+    return L.join("\n") + "\n";
+}
+/** Render the EU AI Act Annex IV assessment-readiness draft — strong on Point 2 (design/architecture/
+ *  validation) and the design-rationale/change history (the ADR journal); RMS, standards, declaration
+ *  and post-market plan stay the provider's. */
+export function renderEuAiAct(inputs, generatedAt) {
+    const L = [];
+    L.push("# EU AI Act — Annex IV technical documentation — assessment-readiness draft");
+    L.push("");
+    L.push(`> **Draft, incomplete — not a conformity assessment.** Assembled by \`runward compliance eu-ai-act\` on ${generatedAt},`);
+    L.push("> deterministically from ratified engineering artifacts (no model call). High-risk obligations bind from");
+    L.push("> **2 August 2026** (Annex III). This populates Annex IV Point 2 (design & validation) and the design-rationale");
+    L.push("> history; it does **not** satisfy art. 12 runtime logging, and it is not a signed declaration of conformity.");
+    L.push("> Verify against the Official Journal text before filing.");
+    L.push("");
+    L.push("## Annex IV coverage map");
+    L.push("");
+    L.push("| Annex IV point | runward supplies | Required from the provider |");
+    L.push("|---|---|---|");
+    L.push("| 1. General description | UI, HW/SW/firmware notes | intended purpose, provider, versioning, distribution |");
+    L.push("| 2. Elements & development | **architecture, validation procedures + metrics, cybersecurity (manifest + rubric + threat model); design choices, alternatives, assumptions, pre-determined changes = the ADR journal** | third-party sourcing/licensing, sign-off on test logs |");
+    L.push("| 3. Monitoring & control | accuracy characterization, input-data specs, oversight tooling | fundamental-rights / discrimination risk sourcing |");
+    L.push("| 4. Performance metrics | metric-choice justification (rubric) | — |");
+    L.push("| 5. Risk management (art. 9) | technical inputs (threat model, testing) | **risk acceptance / RMS governance** |");
+    L.push("| 6. Lifecycle changes | engineering change record (ADR journal) | release/change-management governance |");
+    L.push("| 7. Harmonised standards | technical notes | **standards selection** (compliance strategy) |");
+    L.push("| 8. Declaration of conformity | — | **signed legal act (art. 47)** |");
+    L.push("| 9. Post-market monitoring | telemetry/logging backbone | **post-market monitoring plan (art. 72)** |");
+    L.push("");
+    L.push("## Point 2 — design decisions (ADR journal, near-verbatim to the Annex IV requirement)");
+    L.push("");
+    L.push(...adrTableLines(inputs));
+    L.push("");
+    L.push("## Agentic-risk coverage (OWASP ASI → Point 2 cybersecurity / Point 5 risk)");
+    L.push("");
+    L.push(...asiTableLines(inputs));
+    L.push("");
+    L.push("## Control-implementation status (feeds Point 2 validation)");
+    L.push("");
+    L.push(...confTableLines(inputs));
+    L.push("");
+    L.push("## Required from the provider (runward cannot produce this)");
+    L.push("");
+    L.push("- **Point 1** general description (intended purpose, provider, versioning) · **Point 5** RMS governance & risk acceptance (art. 9).");
+    L.push("- **Point 7** harmonised-standards selection · **Point 8** the signed **EU declaration of conformity** (art. 47) · **Point 9** the **post-market monitoring plan** (art. 72).");
+    L.push("- **Art. 12 runtime event logs** — produced by the running system, not by runward.");
+    L.push("");
+    L.push("_Engineering framing, not legal advice; Annex IV wording moves — confirm against the Official Journal (Reg. (EU) 2024/1689) before filing._");
+    L.push("");
+    return L.join("\n") + "\n";
+}
+// ── OSCAL export (ADR-0016) — the machine-readable interop layer, so the evidence flows into GRC/auditor tools ──
+/** A deterministic RFC-4122-shaped UUID derived from a stable seed (SHA-256), so two runs on the same
+ *  artifacts produce byte-identical OSCAL — no random UUIDs to break the determinism invariant. */
+function detUuid(seed) {
+    const b = createHash("sha256").update(`runward-oscal:${seed}`).digest("hex").slice(0, 32).split("");
+    b[12] = "5"; // version 5 (name-based)
+    b[16] = ((parseInt(b[16], 16) & 0x3) | 0x8).toString(16); // RFC-4122 variant
+    const s = b.join("");
+    return `${s.slice(0, 8)}-${s.slice(8, 12)}-${s.slice(12, 16)}-${s.slice(16, 20)}-${s.slice(20, 32)}`;
+}
+const OSCAL_VERSION = "1.1.2";
+const ASI_CATALOG = "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/";
+/**
+ * Render the OWASP ASI control coverage as an OSCAL component-definition (JSON) — regime-neutral, the
+ * universal machine-readable layer. Each ASI category is a control whose implementation-status is
+ * derived from the mission's conformance manifest; evidence links back to the readiness draft. It is
+ * labelled a DRAFT / supporting evidence in the metadata remarks — never a compliance claim.
+ */
+export function renderOscal(inputs, missionName, generatedAt) {
+    const ns = missionName || "mission";
+    const irs = Object.keys(ASI_LABELS).map((id) => {
+        const slugs = inputs.asiCoverage.get(id) ?? [];
+        const statuses = slugs.map((s) => inputs.conformance.find((c) => c.rule === s)?.status).filter(Boolean);
+        let impl;
+        if (slugs.length === 0)
+            impl = "planned"; // no rule maps this risk — a gap
+        else if (statuses.length > 0 && statuses.every((s) => s === "applied"))
+            impl = "implemented";
+        else
+            impl = "partial"; // mapped, but deviated / n-a / not yet in a manifest
+        return {
+            uuid: detUuid(`${ns}:ir:${id}`),
+            "control-id": `asi-${id.slice(3)}`,
+            description: `${id} ${ASI_LABELS[id]}. ${slugs.length ? "Addressed by rules: " + slugs.join(", ") + "." : "No rule mapped — gap to assess."}`,
+            props: [{ name: "implementation-status", value: impl }],
+            links: [{ href: "./iso-42001-readiness.md", rel: "reference", text: "runward assessment-readiness draft" }],
+        };
+    });
+    const doc = {
+        "component-definition": {
+            uuid: detUuid(`${ns}:component-definition`),
+            metadata: {
+                title: `runward — agentic-security control evidence (${missionName})`,
+                "last-modified": `${generatedAt}T00:00:00Z`,
+                version: generatedAt,
+                "oscal-version": OSCAL_VERSION,
+                remarks: "Assessment-readiness DRAFT, assembled deterministically by runward from ratified engineering artifacts (rule to OWASP ASI mapping, conformance manifest, ADR journal). Supporting evidence only — NOT a compliance claim, NOT a certification, NOT a conformity assessment. Applicability, risk acceptance and management sign-off are the operator's.",
+            },
+            components: [{
+                    uuid: detUuid(`${ns}:component`),
+                    type: "software",
+                    title: missionName,
+                    description: "The agentic system governed by this runward mission.",
+                    "control-implementations": [{
+                            uuid: detUuid(`${ns}:control-implementation`),
+                            source: ASI_CATALOG,
+                            description: "OWASP Top 10 for Agentic Applications (ASI01–ASI10) coverage, derived from the mission's craft-rule mapping and conformance manifest.",
+                            "implemented-requirements": irs,
+                        }],
+                }],
+        },
+    };
+    return JSON.stringify(doc, null, 2) + "\n";
+}

package/dist/lib/conformance.js

@@ -73,6 +73,53 @@ function adrExists(missionDir, evidence) {
     const dir = join(missionDir, "adr");
     return existsSync(dir) && readdirSync(dir).some((f) => f.toUpperCase().startsWith(id));
 }
+/**
+ * The reconstruction lifecycle (ADR-0013/0014). A retroactively reconstructed decision is a
+ * *hypothesis* until the operator ratifies it — writes the real *why*, sets a re-evaluation
+ * trigger, and marks it accepted. This returns the ADRs in runward/adr/ still unratified, by
+ * deterministic marker: a DRAFT- filename, a `Status: hypothesis`, or a `why: UNKNOWN` left in
+ * place. The gate fails while any remain — an agent's guess must not pass as a decision.
+ */
+export function unratifiedAdrs(missionDir) {
+    const dir = join(missionDir, "adr");
+    if (!existsSync(dir))
+        return [];
+    const out = [];
+    for (const f of readdirSync(dir)) {
+        if (!f.endsWith(".md"))
+            continue;
+        if (/^DRAFT-/i.test(f)) {
+            out.push({ file: f, reason: "DRAFT — reconstructed decision not yet ratified" });
+            continue;
+        }
+        let body = "";
+        try {
+            body = readFileSync(join(dir, f), "utf8");
+        }
+        catch {
+            continue;
+        }
+        if (/^\s*(?:\*\*status\*\*|status)\s*:\s*hypothesis\b/im.test(body))
+            out.push({ file: f, reason: "Status: hypothesis" });
+        else if (/why\s*:\s*UNKNOWN\b/i.test(body))
+            out.push({ file: f, reason: "why: UNKNOWN — the operator must supply it" });
+    }
+    return out;
+}
+/**
+ * Decision-ratification coverage (ADR-0013): how many recorded decisions are ratified vs still
+ * hypotheses. Advisory — a deterministic ratio, never a claim of completeness. Excludes the
+ * scaffolded ADR-0000 template and any README.
+ */
+export function decisionCoverage(missionDir) {
+    const dir = join(missionDir, "adr");
+    const unratified = unratifiedAdrs(missionDir);
+    let total = 0;
+    if (existsSync(dir)) {
+        total = readdirSync(dir).filter((f) => f.endsWith(".md") && f !== "ADR-0000-template.md" && f.toUpperCase() !== "README.MD").length;
+    }
+    return { total, ratified: Math.max(0, total - unratified.length), unratified };
+}
 // A path token: a file with a known code/doc extension (excludes version numbers like v1.0, "§2").
 const PATH_TOKEN = /[\w./-]+\.(?:ts|tsx|js|jsx|mjs|cjs|py|md|json|ya?ml|toml|go|rs|java|rb|php|sql|sh|css|scss|html|txt)\b/g;
 /** Advisory drift (ADR-0004): applied pointers whose file path no longer resolves. Existence only. */

package/dist/lib/paths.js

@@ -15,6 +15,7 @@ export const MISSION_LAYOUT = {
     "reference-stack.md": "reference-stack.md",
     "shared-bricks.md": "shared-bricks.md",
     "floor.md": "floor.md",
+    "gap-analysis.md": "gap-analysis.md",
     "adr/ADR-0000-template.md": "adr/ADR-0000-template.md",
     "threat-model.md": "governance/threat-model.md",
     "evaluation-rubric.md": "governance/evaluation-rubric.md",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runward",
-  "version": "0.9.1",
+  "version": "0.11.0",
   "description": "After the spec: ship and run. A delivery framework for agentic systems — floor first, evolution on evidence, governance from day zero, handover with proof.",
   "keywords": [
     "agentic",

package/templates/mission/gap-analysis.md

@@ -0,0 +1,44 @@
+# Gap analysis — [system or mission name]
+
+> Brownfield / retro-documentation artifact (workflow `brownfield.md`, mode M3). A **section-by-section
+> audit of an existing system**: what is there, what is missing, and — for each gap — the trigger that
+> forces closing it and the reconstructed decision that records the choice. Start it from the facts in
+> `characterization.md` (run `runward characterize`). Everything here is a **finding or a hypothesis**
+> until you, the operator, ratify it — never a claim that the system is safe or complete.
+
+## How to fill this
+
+For each dimension below: state what **exists** in the current system (fact, from characterization or
+observation), what is **missing or unknown** (the gap), the **trigger** under which the gap must be
+closed (a date, an audit, a next change), and the **ADR** that records the reconstructed decision (a
+`DRAFT-*` hypothesis until you ratify it — write the real *why* + a re-evaluation trigger and set
+`Status: accepted`). Leave `why: UNKNOWN` where you cannot yet source the rationale; `runward check
+--strict` will keep the gate red until it is filled.
+
+| Dimension | What exists (fact) | Gap / unknown | Trigger to close | Reconstructed ADR |
+|---|---|---|---|---|
+| **Boundaries & architecture** | | | | |
+| **Ports & contracts** | | | | |
+| **Model / non-determinism boundary** | | | | |
+| **State & memory** | | | | |
+| **Governance — threat model** | | | | |
+| **Governance — evaluation** | | | | |
+| **Observability & tracing** | | | | |
+| **Security — untrusted input / trifecta** | | | | |
+| **Resilience & cost controls** | | | | |
+| **Tests / characterization** | | | | |
+| **Handover / transmission** | | | | |
+
+## Findings summary
+
+- **Critical gaps** (block production / audit): …
+- **Deferred gaps** (named, each with a trigger): …
+- **Reconstructed decisions to ratify**: list the `DRAFT-*` ADRs still `Status: hypothesis` — the
+  operator owns each *why* and trigger before it counts (see the ratification loop). The reconstruction
+  is the cheap part; owning it is the deliverable.
+
+## Re-entry point
+
+After this audit, re-enter the six-phase chain at the right rung (`brownfield.md`): typically Architect
+(reconstruct boundaries and ports) then Govern (retrofit the threat model, evaluation, observability),
+proving each on real behavior before touching anything.