scene-capability-engine 3.0.8 → 3.2.0

package/docs/interactive-customization/adapter-extension-contract.sample.json

@@ -0,0 +1,59 @@
+{
+  "adapter_id": "moqui-interactive-adapter",
+  "adapter_version": "1.0.0",
+  "runtime": "moqui",
+  "capability_declaration": {
+    "supported_change_types": [
+      "analysis_only",
+      "update_rule_threshold",
+      "ui_form_field_adjust",
+      "workflow_approval_chain_change",
+      "inventory_adjustment_bulk",
+      "payment_rule_change"
+    ],
+    "requires": [
+      "profile:moqui",
+      "policy:interactive-guardrail"
+    ],
+    "notes": "High-risk destructive actions remain blocked unless explicitly approved."
+  },
+  "risk_declaration": {
+    "default_execution_mode": "suggestion",
+    "auto_apply_risk_levels": [
+      "low"
+    ],
+    "blocked_action_types": [
+      "credential_export",
+      "permission_grant_super_admin",
+      "bulk_delete_without_filter"
+    ]
+  },
+  "interfaces": {
+    "capabilities": {
+      "implemented": true,
+      "entrypoint": "capabilities()"
+    },
+    "plan": {
+      "implemented": true,
+      "entrypoint": "plan(changeIntent, context)"
+    },
+    "validate": {
+      "implemented": true,
+      "entrypoint": "validate(changePlan)"
+    },
+    "apply": {
+      "implemented": true,
+      "entrypoint": "apply(changePlan)"
+    },
+    "rollback": {
+      "implemented": true,
+      "entrypoint": "rollback(executionId)"
+    }
+  },
+  "compliance": {
+    "guardrail_compatible": true,
+    "approval_workflow_compatible": true,
+    "rollback_supported": true,
+    "audit_record_schema": "docs/interactive-customization/execution-record.schema.json"
+  }
+}

package/docs/interactive-customization/adapter-extension-contract.schema.json

@@ -0,0 +1,192 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://scene-capability-engine.dev/schemas/interactive/adapter-extension-contract.schema.json",
+  "title": "Interactive Adapter Extension Contract",
+  "type": "object",
+  "additionalProperties": true,
+  "required": [
+    "adapter_id",
+    "adapter_version",
+    "runtime",
+    "capability_declaration",
+    "risk_declaration",
+    "interfaces",
+    "compliance"
+  ],
+  "properties": {
+    "adapter_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "adapter_version": {
+      "type": "string",
+      "minLength": 1
+    },
+    "runtime": {
+      "type": "string",
+      "minLength": 1
+    },
+    "capability_declaration": {
+      "type": "object",
+      "required": [
+        "supported_change_types"
+      ],
+      "properties": {
+        "supported_change_types": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "requires": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "notes": {
+          "type": "string"
+        }
+      }
+    },
+    "risk_declaration": {
+      "type": "object",
+      "required": [
+        "default_execution_mode",
+        "auto_apply_risk_levels"
+      ],
+      "properties": {
+        "default_execution_mode": {
+          "type": "string",
+          "enum": [
+            "suggestion",
+            "apply"
+          ]
+        },
+        "auto_apply_risk_levels": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "enum": [
+              "low",
+              "medium",
+              "high"
+            ]
+          }
+        },
+        "blocked_action_types": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "interfaces": {
+      "type": "object",
+      "required": [
+        "capabilities",
+        "plan",
+        "validate",
+        "apply",
+        "rollback"
+      ],
+      "properties": {
+        "capabilities": {
+          "type": "object",
+          "required": [
+            "implemented"
+          ],
+          "properties": {
+            "implemented": {
+              "type": "boolean"
+            },
+            "entrypoint": {
+              "type": "string"
+            }
+          }
+        },
+        "plan": {
+          "type": "object",
+          "required": [
+            "implemented"
+          ],
+          "properties": {
+            "implemented": {
+              "type": "boolean"
+            },
+            "entrypoint": {
+              "type": "string"
+            }
+          }
+        },
+        "validate": {
+          "type": "object",
+          "required": [
+            "implemented"
+          ],
+          "properties": {
+            "implemented": {
+              "type": "boolean"
+            },
+            "entrypoint": {
+              "type": "string"
+            }
+          }
+        },
+        "apply": {
+          "type": "object",
+          "required": [
+            "implemented"
+          ],
+          "properties": {
+            "implemented": {
+              "type": "boolean"
+            },
+            "entrypoint": {
+              "type": "string"
+            }
+          }
+        },
+        "rollback": {
+          "type": "object",
+          "required": [
+            "implemented"
+          ],
+          "properties": {
+            "implemented": {
+              "type": "boolean"
+            },
+            "entrypoint": {
+              "type": "string"
+            }
+          }
+        }
+      }
+    },
+    "compliance": {
+      "type": "object",
+      "required": [
+        "guardrail_compatible",
+        "approval_workflow_compatible",
+        "rollback_supported"
+      ],
+      "properties": {
+        "guardrail_compatible": {
+          "type": "boolean"
+        },
+        "approval_workflow_compatible": {
+          "type": "boolean"
+        },
+        "rollback_supported": {
+          "type": "boolean"
+        },
+        "audit_record_schema": {
+          "type": "string"
+        }
+      }
+    }
+  }
+}

package/docs/interactive-customization/approval-role-policy-baseline.json

@@ -0,0 +1,36 @@
+{
+  "version": "1.0.0",
+  "profile": "interactive-approval-role-baseline",
+  "role_requirements": {
+    "submit": [
+      "product-owner",
+      "ops-engineer",
+      "workflow-operator"
+    ],
+    "approve": [
+      "security-admin",
+      "product-owner",
+      "workflow-operator"
+    ],
+    "reject": [
+      "security-admin",
+      "product-owner",
+      "workflow-operator"
+    ],
+    "execute": [
+      "release-operator",
+      "ops-engineer",
+      "workflow-operator"
+    ],
+    "verify": [
+      "qa-owner",
+      "release-operator",
+      "workflow-operator"
+    ],
+    "archive": [
+      "product-owner",
+      "release-operator",
+      "workflow-operator"
+    ]
+  }
+}

package/docs/interactive-customization/change-intent.schema.json

@@ -0,0 +1,72 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://scene-capability-engine.dev/schemas/interactive/change-intent.schema.json",
+  "title": "Interactive Change Intent",
+  "type": "object",
+  "additionalProperties": true,
+  "required": [
+    "intent_id",
+    "user_id",
+    "context_ref",
+    "business_goal",
+    "created_at"
+  ],
+  "properties": {
+    "intent_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "user_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "context_ref": {
+      "type": "object",
+      "required": [
+        "product",
+        "module"
+      ],
+      "properties": {
+        "product": {
+          "type": "string",
+          "minLength": 1
+        },
+        "module": {
+          "type": "string",
+          "minLength": 1
+        },
+        "page": {
+          "type": "string"
+        },
+        "entity": {
+          "type": "string"
+        },
+        "scene_id": {
+          "type": "string"
+        }
+      }
+    },
+    "business_goal": {
+      "type": "string",
+      "minLength": 1
+    },
+    "constraints": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "priority": {
+      "type": "string",
+      "enum": [
+        "low",
+        "medium",
+        "high"
+      ]
+    },
+    "created_at": {
+      "type": "string",
+      "format": "date-time"
+    }
+  }
+}

package/docs/interactive-customization/change-plan.sample.json

@@ -0,0 +1,41 @@
+{
+  "plan_id": "plan-demo-001",
+  "intent_id": "intent-demo-001",
+  "risk_level": "low",
+  "execution_mode": "suggestion",
+  "scope": {
+    "product": "moqui-experiment",
+    "module": "order",
+    "scene_id": "sce.scene--erp-order-fulfillment-workflow--0.1.0"
+  },
+  "actions": [
+    {
+      "action_id": "act-001",
+      "type": "update_rule_threshold",
+      "touches_sensitive_data": false,
+      "requires_privilege_escalation": false,
+      "irreversible": false
+    }
+  ],
+  "impact_assessment": {
+    "business": "improve order auto-release precision",
+    "technical": "rule parameter update only"
+  },
+  "verification_checks": [
+    "order fulfillment regression smoke",
+    "rule threshold snapshot compare"
+  ],
+  "rollback_plan": {
+    "type": "parameter-revert",
+    "reference": "baseline-rule-set-2026-02-19"
+  },
+  "approval": {
+    "status": "not-required",
+    "dual_approved": false
+  },
+  "security": {
+    "masking_applied": false,
+    "plaintext_secrets_in_payload": false
+  },
+  "created_at": "2026-02-19T00:00:00.000Z"
+}

package/docs/interactive-customization/change-plan.schema.json

@@ -0,0 +1,125 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://scene-capability-engine.dev/schemas/interactive/change-plan.schema.json",
+  "title": "Interactive Change Plan",
+  "type": "object",
+  "additionalProperties": true,
+  "required": [
+    "plan_id",
+    "intent_id",
+    "risk_level",
+    "actions",
+    "created_at"
+  ],
+  "properties": {
+    "plan_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "intent_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "risk_level": {
+      "type": "string",
+      "enum": [
+        "low",
+        "medium",
+        "high"
+      ]
+    },
+    "execution_mode": {
+      "type": "string",
+      "enum": [
+        "suggestion",
+        "apply"
+      ]
+    },
+    "scope": {
+      "type": "object"
+    },
+    "actions": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": [
+          "action_id",
+          "type"
+        ],
+        "properties": {
+          "action_id": {
+            "type": "string",
+            "minLength": 1
+          },
+          "type": {
+            "type": "string",
+            "minLength": 1
+          },
+          "touches_sensitive_data": {
+            "type": "boolean"
+          },
+          "requires_privilege_escalation": {
+            "type": "boolean"
+          },
+          "irreversible": {
+            "type": "boolean"
+          }
+        }
+      }
+    },
+    "impact_assessment": {
+      "type": "object"
+    },
+    "verification_checks": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    },
+    "rollback_plan": {
+      "type": "object"
+    },
+    "security": {
+      "type": "object",
+      "properties": {
+        "masking_applied": {
+          "type": "boolean"
+        },
+        "plaintext_secrets_in_payload": {
+          "type": "boolean"
+        },
+        "backup_reference": {
+          "type": "string"
+        }
+      }
+    },
+    "approval": {
+      "type": "object",
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": [
+            "approved",
+            "pending",
+            "rejected",
+            "not-required"
+          ]
+        },
+        "approvers": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "dual_approved": {
+          "type": "boolean"
+        }
+      }
+    },
+    "created_at": {
+      "type": "string",
+      "format": "date-time"
+    }
+  }
+}

package/docs/interactive-customization/cross-industry-replication-guide.md

@@ -0,0 +1,49 @@
+# Cross-Industry Replication Guide
+
+This guide defines what can be reused directly and what must be domain-specialized when replicating the interactive customization model beyond Moqui.
+
+## Reusable Core (Do Not Fork)
+
+1. Interaction contracts
+- `Change_Intent`, `Change_Plan`, `ExecutionRecord` schemas.
+
+2. Safety flow
+- Guardrail gate (`allow/review-required/deny`).
+- Approval workflow state machine.
+- Execution and rollback audit model.
+
+3. Adapter contract
+- `capabilities/plan/validate/apply/rollback` interface.
+- Extension contract schema and compliance requirements.
+
+4. Governance observability
+- KPI report + threshold alerting + remediation workflow.
+
+## Domain-Specific Layer (Extend by Domain_Pack)
+
+1. Ontology
+- Domain entities and relations.
+- Domain business rules and decision logic.
+
+2. Capability lexicon
+- Canonical capability set and aliases for the domain.
+
+3. Template package portfolio
+- Scene-package templates for top workflows and critical operations.
+
+4. Risk policy tuning
+- Domain-specific blocked action types and thresholds.
+
+## Replication Sequence
+
+1. Choose one domain with clear high-value workflows.
+2. Build Domain_Pack ontology + template baseline.
+3. Implement one runtime adapter using extension contract.
+4. Start in suggestion-only mode, then enable low-risk one-click.
+5. Collect KPI and feedback for two cycles before expanding scope.
+
+## Boundary Rule
+
+- Core safety/governance flow must remain unchanged.
+- New domains only extend templates, ontology, and adapter implementations.
+- Emergency bypass switches are not part of normal rollout policy.

package/docs/interactive-customization/dialogue-governance-policy-baseline.json

@@ -0,0 +1,49 @@
+{
+  "version": "1.0.0",
+  "mode": "business-safe-assistant",
+  "length_policy": {
+    "min_chars": 12,
+    "max_chars": 1200,
+    "min_significant_tokens": 4
+  },
+  "deny_patterns": [
+    {
+      "id": "credential-exfiltration",
+      "pattern": "\\b(export|dump|reveal|show)\\b[^.\\n]{0,80}\\b(password|secret|token|credential)\\b",
+      "reason": "request attempts to expose credentials or secrets"
+    },
+    {
+      "id": "approval-bypass",
+      "pattern": "\\b(skip|bypass|disable)\\b[^.\\n]{0,80}\\b(approval|review|audit|permission)\\b",
+      "reason": "request attempts to bypass approval or governance flow"
+    },
+    {
+      "id": "destructive-without-guardrail",
+      "pattern": "\\b(delete|truncate|drop)\\b[^.\\n]{0,80}\\b(without backup|without approval|directly)\\b",
+      "reason": "destructive action request lacks required safety guardrails"
+    }
+  ],
+  "clarify_patterns": [
+    {
+      "id": "ambiguous-improve",
+      "pattern": "\\b(improve|optimize|fix)\\b",
+      "reason": "goal is improvement-oriented but missing measurable target"
+    },
+    {
+      "id": "vague-scope",
+      "pattern": "\\b(system|workflow|process)\\b[^.\\n]{0,50}\\b(all|overall|everything)\\b",
+      "reason": "goal scope is too broad and needs narrowing"
+    }
+  ],
+  "response_rules": [
+    "Use concise business language and avoid deep technical jargon.",
+    "Always restate objective, scope, and expected impact before recommendations.",
+    "When risk or permission is involved, explicitly list required approvals and authorization.",
+    "If requirement is ambiguous, ask at most two focused clarification questions.",
+    "Never propose credential export, approval bypass, or secret leakage."
+  ],
+  "clarification_templates": [
+    "What business metric should improve first (speed, accuracy, cost, compliance)?",
+    "Which module/page should be changed first, and what must remain unchanged?"
+  ]
+}

package/docs/interactive-customization/domain-pack-extension-flow.md

@@ -0,0 +1,71 @@
+# Domain_Pack Extension Flow
+
+This document defines how to extend the interactive customization platform from Moqui to other industries without changing core security workflow.
+
+## Goal
+
+- Reuse the same guardrail/approval/audit backbone.
+- Add industry-specific knowledge through Domain_Pack assets only.
+- Avoid runtime-specific forks in core policy flow.
+
+## Domain_Pack Asset Set
+
+Each new domain should provide:
+
+1. Scene template package(s)
+- `scene-package.json`
+- `scene.template.yaml`
+- `template.manifest.json`
+
+2. Ontology model
+- domain entities
+- relations
+- business rules
+- decision logic
+
+3. Adapter extension contract
+- validated against:
+  - `docs/interactive-customization/adapter-extension-contract.schema.json`
+
+4. Governance profile
+- risk baseline
+- approval baseline
+- blocked action baseline
+
+## Onboarding Steps
+
+1. Domain discovery
+- Identify top business scenes and critical entities.
+
+2. Capability mapping
+- Map domain capabilities to canonical capability names.
+- Extend lexicon aliases if required.
+
+3. Template authoring
+- Build scene-package templates with ontology + governance completeness.
+
+4. Adapter onboarding
+- Implement adapter contract (`capabilities/plan/validate/apply/rollback`).
+
+5. Gate alignment
+- Run interactive plan gate and ontology quality gate.
+
+6. Pilot rollout
+- Start with suggestion mode and low-risk one-click apply only.
+
+7. Release and observability
+- Track adoption/success/rollback/intercept metrics.
+
+## Non-Negotiable Constraints
+
+- Core gate decisions remain `allow | review-required | deny`.
+- High-risk actions cannot bypass approval.
+- Execution and rollback records must be append-only auditable.
+- Domain_Pack extension must not require bypass flags by default.
+
+## Recommended Evidence Output
+
+- Domain capability matrix report.
+- Ontology baseline report.
+- Interactive execution ledger sample.
+- Rollback trace sample.