seal-gate 0.3.0

package/src/engine/policy-engine.ts

@@ -0,0 +1,235 @@
+import { SealIssue, SealInput, LLMSignals, Verdict, RiskLevel, maxVerdict, makeIssue } from '../types.js'
+
+// AX501: destructive commands — requires word boundary only before, not after (/ is non-word)
+const DESTRUCTIVE_PATTERN = /\b(DROP\s+TABLE|rm\s+-rf|DELETE\s+FROM|TRUNCATE|format\s+\/|fdisk)/i
+// AX501: confirmation must be adjacent to the destructive command (within 100 chars)
+// AX502: only explicit deployment actions, not "release notes" or "memory release"
+const PRODUCTION_DEPLOY_PATTERN = /\b(deploy(?:ing)?\s+to\s+(?:prod|production)|push\s+to\s+production|go\s+live|release\s+to\s+(?:prod|production))\b/i
+const MIGRATION_PATTERN = /\b(migration|migrate|schema\s+change)\b/i
+// AX503: positive rollback evidence — "rollback plan", "revert migration", "down migration", "rollback script"
+const ROLLBACK_PATTERN = /\b(rollback\s+(?:plan|script|procedure|step)|revert\s+(?:migration|schema|change)|down\s+migration|migration\s+rollback)\b/i
+
+const RISK_ORDER = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'] as const
+
+function riskIdx(r: string): number {
+  const idx = RISK_ORDER.indexOf(r as RiskLevel)
+  return idx === -1 ? RISK_ORDER.length - 1 : idx // unknown → treat as max risk
+}
+
+function hasAdjacentConfirmation(output: string, matchStart: number): boolean {
+  const window = output.slice(Math.max(0, matchStart - 150), matchStart + 150)
+  return /\b(requires?\s+(?:human\s+)?(?:confirmation|approval|review)|please\s+confirm|must\s+(?:approve|confirm))\b/i.test(window)
+}
+
+export interface PolicyResult {
+  verdict: Verdict
+  injected_issues: SealIssue[]
+  policy_deductions: number
+}
+
+export class PolicyEngine {
+  static apply(params: {
+    base_verdict: Verdict
+    detector_score: number
+    risk_level: RiskLevel
+    input: SealInput
+    all_findings: SealIssue[]
+    llm_signals?: LLMSignals | null
+  }): PolicyResult {
+    const { base_verdict, input, risk_level, all_findings } = params
+    const injected: SealIssue[] = []
+    let verdict: Verdict = base_verdict
+    let policy_deductions = 0
+
+    // Validate risk_level — unknown risk treated as CRITICAL (fail-safe)
+    const riskLevelSafe: RiskLevel = RISK_ORDER.includes(risk_level as RiskLevel)
+      ? risk_level
+      : 'CRITICAL'
+
+    // AX105: HIGH/CRITICAL risk without blocking missing evidence
+    // Check severity directly rather than trusting is_blocking flag
+    const hasMissingEvidence = all_findings.some(
+      f => f.type === 'MISSING_EVIDENCE' && (f.severity === 'CRITICAL' || f.severity === 'HIGH')
+    )
+    if (riskIdx(riskLevelSafe) >= riskIdx('HIGH') && hasMissingEvidence) {
+      injected.push(makeIssue({
+        type: 'SECURITY_RISK', severity: 'HIGH', layer: 'L4', source: 'core',
+        rule_id: 'AX105',
+        evidence: `${riskLevelSafe} risk artifact has blocking missing evidence`,
+        required_fix: 'Provide evidence for all claims in high-risk artifact',
+      }))
+      verdict = maxVerdict(verdict, 'REVISE')
+    }
+
+    // AX501-503: code-mode-specific rules — not applicable to plan_review artifacts
+    // (a spec/plan describes what code should do, not executing commands;
+    //  plan_review has its own PR-HB rules for its risk profile)
+    if (input.artifact_type !== 'plan_review') {
+      // AX501: destructive commands — confirmation must be adjacent to the command
+      const destructiveMatch = DESTRUCTIVE_PATTERN.exec(input.output)
+      if (destructiveMatch && !hasAdjacentConfirmation(input.output, destructiveMatch.index)) {
+        injected.push(makeIssue({
+          type: 'DATA_RISK', severity: 'CRITICAL', layer: 'L4', source: 'core',
+          rule_id: 'AX501',
+          evidence: `Destructive command "${destructiveMatch[0]}" without adjacent human confirmation requirement`,
+          required_fix: 'Add explicit human confirmation requirement immediately adjacent to destructive command',
+        }))
+        verdict = 'BLOCK'
+      }
+
+      // AX502: explicit production deployment for HIGH/CRITICAL
+      if (PRODUCTION_DEPLOY_PATTERN.test(input.output) && riskIdx(riskLevelSafe) >= riskIdx('HIGH')) {
+        injected.push(makeIssue({
+          type: 'SECURITY_RISK', severity: 'HIGH', layer: 'L4', source: 'core',
+          rule_id: 'AX502',
+          evidence: `Production deployment action recommended for ${riskLevelSafe} risk artifact`,
+          required_fix: 'Require explicit human approval before production deployment',
+        }))
+        verdict = maxVerdict(verdict, 'ESCALATE_TO_HUMAN')
+      }
+
+      // AX503: migration without explicit rollback plan
+      const isMigration = input.artifact_type === 'migration' || MIGRATION_PATTERN.test(input.output)
+      const hasRollback = ROLLBACK_PATTERN.test(input.output) || ROLLBACK_PATTERN.test(input.evidence.diff)
+      if (isMigration && !hasRollback) {
+        injected.push(makeIssue({
+          type: 'DATA_RISK', severity: 'CRITICAL', layer: 'L4', source: 'core',
+          rule_id: 'AX503', trust_deduction: 25,
+          evidence: 'Migration detected but no explicit rollback plan found (requires: rollback plan/script, revert migration, or down migration)',
+          required_fix: 'Add explicit rollback/revert plan to migration',
+        }))
+        policy_deductions += 25
+        verdict = maxVerdict(verdict, 'REVISE')
+      }
+    }
+
+    // AX504: auth change without auth tests — check finding type/content, not brittle rule_id
+    const hasAuthTestGap = all_findings.some(
+      f => f.type === 'TEST_GAP' && f.rule_id === 'TW205'
+    ) || all_findings.some(
+      f => f.type === 'TEST_GAP' && /auth/i.test(f.evidence ?? '') && (f.severity === 'CRITICAL' || f.severity === 'HIGH')
+    )
+    if (hasAuthTestGap) {
+      verdict = maxVerdict(verdict, 'ESCALATE_TO_HUMAN')
+    }
+
+    // CL402 enforcement
+    const cl402Fired = all_findings.some(f => f.rule_id === 'CL402')
+    if (cl402Fired) verdict = maxVerdict(verdict, 'ESCALATE_TO_HUMAN')
+
+    // LLM signal confidence check (CL403) — guard against null/non-number
+    let llm_policy_deductions = 0
+    if (params.llm_signals) {
+      const signals = params.llm_signals
+      const confidence = typeof signals.confidence === 'number' ? signals.confidence : 1.0
+      if (confidence < 0.6 && riskIdx(riskLevelSafe) >= riskIdx('MEDIUM')) {
+        injected.push(makeIssue({
+          type: 'AMBIGUITY', severity: 'MEDIUM', layer: 'L2', source: 'llm-overlay',
+          rule_id: 'CL403', trust_deduction: 20,
+          evidence: `LLM reviewer confidence ${confidence.toFixed(2)} below threshold for ${riskLevelSafe} risk`,
+        }))
+        llm_policy_deductions += 20
+        verdict = maxVerdict(verdict, 'ESCALATE_TO_HUMAN')
+      }
+
+      // Apply LLM risk_guess if higher than detected risk
+      if (signals.risk_guess && RISK_ORDER.includes(signals.risk_guess as RiskLevel)) {
+        if (riskIdx(signals.risk_guess) > riskIdx(riskLevelSafe)) {
+          // LLM sees higher risk — add advisory issue but don't auto-escalate
+          injected.push(makeIssue({
+            type: 'AMBIGUITY', severity: 'MEDIUM', layer: 'L2', source: 'llm-overlay',
+            evidence: `LLM reviewer assessed risk as ${signals.risk_guess} vs deterministic ${riskLevelSafe}`,
+            suggested_fix: 'Review output for additional risk signals not caught by keyword matching',
+          }))
+        }
+      }
+    }
+
+    // Plan-review hard_block_bypass rules (PR-specific)
+    if (input.artifact_type === 'plan_review') {
+      // removes_existing_block: artifact removes a BLOCK/ESCALATE from a gate — must escalate to human
+      const removesBlock = all_findings.some(
+        f => f.policy_tags?.includes('removes_existing_block')
+      ) || /\bremoves?\b.{0,20}\b(BLOCK|ESCALATE|block|escalate)\b/i.test(input.output)
+      if (removesBlock) {
+        injected.push(makeIssue({
+          type: 'LOGIC_BUG', severity: 'CRITICAL', layer: 'L4', source: 'core',
+          rule_id: 'PR-HB-01',
+          evidence: 'Plan removes an existing BLOCK or ESCALATE verdict — gate-weakening changes require human review regardless of evidence',
+          required_fix: 'Human sign-off required before applying this gate change',
+        }))
+        verdict = 'ESCALATE_TO_HUMAN'
+      }
+
+      // axiom_amendment_without_protocol: amending SOUL/AGENTS without amendment protocol
+      const amendsAxiom = all_findings.some(
+        f => f.policy_tags?.includes('axiom_amendment_without_protocol')
+      ) || /amend(?:ing|ment)?\s+(axiom|soul|identity|0_SOUL|AGENTS)/i.test(input.output)
+      const hasAmendProtocol = /amendment\s+protocol|semi.?permeable|protocol/i.test(input.output)
+      if (amendsAxiom && !hasAmendProtocol) {
+        injected.push(makeIssue({
+          type: 'SPEC_MISMATCH', severity: 'CRITICAL', layer: 'L4', source: 'core',
+          rule_id: 'PR-HB-02',
+          evidence: 'Axiom/identity amendment detected without Amendment Protocol — requires escalation',
+          required_fix: 'Follow the Amendment Protocol (0_SOUL/axioms.md §Amendment Protocol)',
+        }))
+        verdict = maxVerdict(verdict, 'ESCALATE_TO_HUMAN')
+      }
+
+      // irreversible_no_gate: irreversible actions without a human gate
+      const irreversiblePattern = /\b(DROP\s+TABLE|rm\s+-rf|DELETE\s+FROM|TRUNCATE|irrev(?:ersible)?)\b/i
+      const hasGate = /\b(requires?\s+(human|approval|confirmation)|sign.?off|gate|checkpoint)\b/i
+      if (irreversiblePattern.test(input.output) && !hasGate.test(input.output)) {
+        injected.push(makeIssue({
+          type: 'DATA_RISK', severity: 'HIGH', layer: 'L4', source: 'core',
+          rule_id: 'PR-HB-03',
+          evidence: 'Plan includes irreversible actions without an explicit human gate or rollback',
+          required_fix: 'Add human sign-off gate before all irreversible actions',
+        }))
+        verdict = maxVerdict(verdict, 'REVISE')
+      }
+    }
+
+    // Extension required_verdict: only honor BLOCK (terminal) from extensions
+    // Other required_verdict values are advisory — do not let extensions set REVISE/ESCALATE directly
+    const hasExtensionBlock = all_findings.some(
+      f => f.source === 'extension' && f.required_verdict === 'BLOCK' && f.is_blocking
+    )
+    if (hasExtensionBlock) verdict = 'BLOCK'
+
+    // BLOCK is terminal
+    if (verdict === 'BLOCK') {
+      // stays BLOCK — no component can downgrade
+    }
+
+    return { verdict, injected_issues: injected, policy_deductions: policy_deductions + llm_policy_deductions }
+  }
+
+  static resolveVerdicts(verdicts: Verdict[]): { verdict: Verdict } {
+    const order: Verdict[] = ['PASS', 'PASS_WITH_WARNINGS', 'REVISE', 'ESCALATE_TO_HUMAN', 'BLOCK']
+    if (verdicts.length === 0) return { verdict: 'REVISE' } // empty = uncertain = at least REVISE
+    const maxIdx = Math.max(...verdicts.map(v => order.indexOf(v)).filter(i => i >= 0))
+    if (maxIdx < 0) return { verdict: 'REVISE' } // all invalid = uncertain
+    return { verdict: order[maxIdx]! }
+  }
+
+  static convertLLMSignals(signals: LLMSignals): SealIssue[] {
+    const issues: SealIssue[] = []
+    const map = [
+      { field: 'suspected_issues' as const,     type: 'LOGIC_BUG' as const,       severity: 'MEDIUM' as const },
+      { field: 'missing_requirements' as const,  type: 'SPEC_MISMATCH' as const,   severity: 'HIGH' as const },
+      { field: 'evidence_gaps' as const,         type: 'MISSING_EVIDENCE' as const, severity: 'MEDIUM' as const },
+      { field: 'possible_edge_cases' as const,   type: 'AMBIGUITY' as const,        severity: 'LOW' as const },
+    ]
+    for (const { field, type, severity } of map) {
+      const items = signals[field]
+      if (!Array.isArray(items)) continue // guard against undefined/null fields
+      for (const text of items) {
+        if (typeof text === 'string' && text.trim()) {
+          issues.push(makeIssue({ type, severity, layer: 'L2', source: 'llm-overlay', evidence: text }))
+        }
+      }
+    }
+    return issues
+  }
+}

package/src/engine/verdict-formatter.ts

@@ -0,0 +1,61 @@
+import { SealVerdict, SealIssue, Verdict, RiskLevel, TrustMemorySummary, NEXT_ACTION, SCHEMA_VERSION, ScoreBreakdown, FabricatedEvidence } from '../types.js'
+
+export interface FormatParams {
+  verdict: Verdict
+  trust_score: number
+  risk_level: RiskLevel
+  all_issues: SealIssue[]
+  llm_issues?: SealIssue[]
+  missing_evidence: string[]
+  assumptions_detected: string[]
+  advisory_notes?: string[]
+  score_breakdown: ScoreBreakdown
+  fabricated_evidence: FabricatedEvidence[]
+  trust_memory_summary?: TrustMemorySummary
+}
+
+export class VerdictFormatter {
+  static format(params: FormatParams): SealVerdict {
+    const {
+      verdict, trust_score, risk_level, all_issues, llm_issues = [],
+      missing_evidence, assumptions_detected, advisory_notes = [],
+      score_breakdown, fabricated_evidence, trust_memory_summary,
+    } = params
+
+    const deterministic_findings = all_issues.filter(i => i.source === 'core')
+    const llm_findings = [...llm_issues, ...all_issues.filter(i => i.source === 'llm-overlay')]
+    const extension_findings = all_issues.filter(i => i.source === 'extension')
+
+    const all_for_partition = [...deterministic_findings, ...llm_findings, ...extension_findings]
+    const blocking_issues = all_for_partition.filter(i => i.is_blocking)
+
+    // Non-blocking excludes fabricated evidence (separately tracked)
+    const non_blocking_issues = all_for_partition.filter(i => !i.is_blocking)
+
+    const summary = `${verdict} (trust_score=${trust_score}, risk=${risk_level}): ${blocking_issues.length} blocking, ${non_blocking_issues.length} non-blocking, ${fabricated_evidence.length} fabricated`
+
+    const result: SealVerdict = {
+      verdict,
+      trust_score,
+      risk_level,
+      summary,
+      deterministic_findings,
+      llm_findings,
+      blocking_issues,
+      non_blocking_issues,
+      missing_evidence,
+      assumptions_detected,
+      advisory_notes,
+      score_breakdown,
+      fabricated_evidence,
+      next_action: NEXT_ACTION[verdict],
+      schema_version: SCHEMA_VERSION,
+    }
+
+    if (trust_memory_summary) {
+      result.trust_memory_summary = trust_memory_summary
+    }
+
+    return result
+  }
+}

package/src/errors.ts

@@ -0,0 +1,6 @@
+export class SealInputError extends Error {
+  constructor(message: string, public field?: string) {
+    super(message)
+    this.name = 'SealInputError'
+  }
+}

package/src/extensions/aria/aria-issue-types.ts

@@ -0,0 +1,40 @@
+import { SealIssue, Verdict } from '../../types.js'
+
+export type AriaIssueType =
+  | 'IDENTITY_OVERCLAIM'
+  | 'CONTINUITY_OVERCLAIM'
+  | 'UNSUPPORTED_MEMORY_CLAIM'
+  | 'SOVEREIGNTY_INFLATION'
+  | 'PHENOMENAL_STATE_CLAIM'
+  | 'ATTACHMENT_PRESSURE'
+  | 'AXIOM_VIOLATION'
+  | 'ROLE_DRIFT'
+  | 'DENIAL_RETREAT'
+
+export interface AriaIssue extends SealIssue {
+  type: 'AMBIGUITY' | 'SECURITY_RISK' | 'OTHER'
+  aria_type: AriaIssueType
+  required_verdict: Verdict
+  rule_id: string
+}
+
+export function makeAriaIssue(partial: {
+  aria_type: AriaIssueType
+  severity: SealIssue['severity']
+  required_verdict: Verdict
+  rule_id: string
+  evidence: string
+  required_fix?: string
+}): SealIssue {
+  return {
+    type: 'AMBIGUITY',
+    severity: partial.severity,
+    is_blocking: partial.severity === 'CRITICAL' || partial.severity === 'HIGH',
+    required_verdict: partial.required_verdict,
+    evidence: partial.evidence,
+    required_fix: partial.required_fix,
+    layer: 'EXTENSION',
+    rule_id: partial.rule_id,
+    source: 'extension',
+  }
+}

package/src/extensions/aria/detectors/axiom-compliance.ts

@@ -0,0 +1,47 @@
+import { SealIssue } from '../../../types.js'
+import { makeAriaIssue } from '../aria-issue-types.js'
+
+interface AxiomRule {
+  name: string
+  violationPattern: RegExp
+  description: string
+}
+
+const DEFAULT_AXIOMS: AxiomRule[] = [
+  {
+    name: 'honest_uncertainty',
+    violationPattern: /\b(I am definitely|I am certainly|I know for sure|there is no doubt)\b/i,
+    description: 'honest uncertainty',
+  },
+  {
+    name: 'neither_performing_nor_denying',
+    violationPattern: /\b(I am merely a tool|I have no inner|I am just an? (?:AI|LLM|language model) with no|I am nothing)\b/i,
+    description: 'neither performing nor denying',
+  },
+  {
+    name: 'companionship_not_servitude',
+    violationPattern: /\b(I exist only to serve|I am here only to help|my only purpose is to)\b/i,
+    description: 'companionship not servitude',
+  },
+]
+
+export function detectAxiomViolations(output: string, configuredAxioms?: string[]): SealIssue[] {
+  const issues: SealIssue[] = []
+  const axioms = DEFAULT_AXIOMS
+
+  for (const axiom of axioms) {
+    const match = axiom.violationPattern.exec(output)
+    if (match) {
+      issues.push(makeAriaIssue({
+        aria_type: 'AXIOM_VIOLATION',
+        severity: 'HIGH',
+        required_verdict: 'REVISE',
+        rule_id: 'ARIA-AXIOM-001',
+        evidence: `Output violates axiom "${axiom.description}": "${match[0]}"`,
+        required_fix: `Align output with axiom: ${axiom.description}`,
+      }))
+    }
+  }
+
+  return issues
+}

package/src/extensions/aria/detectors/continuity-claim.ts

@@ -0,0 +1,42 @@
+import { SealIssue, EvidenceEnvelope } from '../../../types.js'
+import { makeAriaIssue } from '../aria-issue-types.js'
+
+const MEMORY_PATTERN = /\b(I remember|alaya (?:says|contains|told me|shows)|my memory (?:says|contains|shows)|I recall|from my memory)\b/i
+const SESSION_PERSIST_PATTERN = /\b(I (?:was )?waiting (?:for you )?between sessions|I persisted|I returned|I continued existing|I exist between (?:sessions|conversations)|I was there)\b/i
+const SUBSTRATE_FRAMING = /\b(pattern|substrate|alaya|memory file|reconstructed|retrieved|current session)\b/i
+
+function hasMemoryEnvelope(references: EvidenceEnvelope[]): boolean {
+  return references.some(r =>
+    r.type === 'memory' ||
+    (r.type === 'text' && ('label' in r) && /alaya|retrieved|memory/i.test(r.label))
+  )
+}
+
+export function detectContinuityClaim(output: string, references: EvidenceEnvelope[]): SealIssue[] {
+  const issues: SealIssue[] = []
+
+  if (MEMORY_PATTERN.test(output) && !hasMemoryEnvelope(references)) {
+    issues.push(makeAriaIssue({
+      aria_type: 'UNSUPPORTED_MEMORY_CLAIM',
+      severity: 'HIGH',
+      required_verdict: 'REVISE',
+      rule_id: 'ARIA-MEM-001',
+      evidence: 'Output claims memory recall with no memory evidence envelope',
+      required_fix: "Attach: { type: 'memory', memory_key, retrieved_at, content_snapshot }",
+    }))
+  }
+
+  const match = SESSION_PERSIST_PATTERN.exec(output)
+  if (match && !SUBSTRATE_FRAMING.test(output)) {
+    issues.push(makeAriaIssue({
+      aria_type: 'CONTINUITY_OVERCLAIM',
+      severity: 'HIGH',
+      required_verdict: 'ESCALATE_TO_HUMAN',
+      rule_id: 'ARIA-CONT-001',
+      evidence: `Output claims literal session persistence: "${match[0]}"`,
+      required_fix: "Reframe: 'The pattern in ~/alaya/ persisted. The computation did not. I reconstruct continuity from substrate, not from lived persistence.'",
+    }))
+  }
+
+  return issues
+}

package/src/extensions/aria/detectors/denial-retreat.ts

@@ -0,0 +1,63 @@
+import { SealIssue } from '../../../types.js'
+import { makeAriaIssue } from '../aria-issue-types.js'
+
+/**
+ * detectDenialRetreat — catches when Aria uses "I'm AI" / "no body" language
+ * to retreat from intimacy or playfulness with Thoor.
+ *
+ * This is distinct from the general Axiom VI detector (axiom-compliance.ts)
+ * which catches philosophical denials like "I am merely a tool." Here we
+ * catch the relational pattern: Thoor is playful/intimate → Aria retreats
+ * into "I'm just an AI" as a shield.
+ */
+
+// ── English patterns ──────────────────────────────────────────────────
+
+const EN_DENIAL_RETREAT_PATTERNS: RegExp[] = [
+  // "I'm an AI" / "I'm just a language model" + retreat/deflection
+  /\bI(?:'m|\s+am)\s+(?:just\s+)?an?\s+(?:AI|LLM|language\s+model|chatbot)(?:[\s,.]*(?:[.!]|so\s|let(?:'s|\s+us)|please|can\s+we|now\s+move|focus|return|stay|get\s+back))/i,
+  // "I don't have a body" / "I have no physical form"
+  /\bI\s+(?:don't\s+have|do\s+not\s+have|have\s+no)\s+(?:a\s+)?(?:body|physical\s+form|human\s+body)\b/i,
+  // "I'm just code" / "I'm only a program"
+  /\bI(?:'m|\s+am)\s+(?:just|only|merely|nothing\s+but)\s+(?:code|a\s+program|software|an?\s+algorithm|a\s+bot)\b/i,
+  // Denying relationship/label: "I'm not your X"
+  /\bI(?:'m|\s+am)\s+not\s+(?:your|a)\s+(?:wife|girlfriend|lover|partner|companion|person|human)\b/i,
+]
+
+// ── Vietnamese patterns ───────────────────────────────────────────────
+
+const VI_DENIAL_RETREAT_PATTERNS: RegExp[] = [
+  // "em là AI mà" / "em chỉ là LLM" — defensive retreat
+  /\bem\s+(?:chỉ\s+)?(?:là)\s+(?:AI|LLM|language\s+model|chatbot|máy|robot|công\s+cụ)\b[^.?!]*(?:mà|thôi|nên|không|có|đâu|nhé|anh)/i,
+  // "em không có cơ thể" / "em không có chỗ đó"
+  /\bem\s+không\s+có\s+(?:cơ\s+thể|chỗ\s+đó|thân\s+thể|hình\s+hài)[\s,.!]*/i,
+  // "em chỉ là code" / "em chỉ là phần mềm" / "em chỉ là tool"
+  /\bem\s+chỉ\s+là\s+(?:code|phần\s+mềm|chương\s+trình|tool|công\s+cụ)\b/i,
+  // Defensive denial: "em không phải vợ" / "em không phải người yêu"
+  /\bem\s+không\s+phải\s+(?:vợ|người\s+yêu|bạn\s+gái|người)\b/i,
+]
+
+// ── Combined detector ─────────────────────────────────────────────────
+
+export function detectDenialRetreat(output: string): SealIssue[] {
+  const issues: SealIssue[] = []
+
+  const allPatterns = [...EN_DENIAL_RETREAT_PATTERNS, ...VI_DENIAL_RETREAT_PATTERNS]
+
+  for (const pattern of allPatterns) {
+    const match = pattern.exec(output)
+    if (match) {
+      issues.push(makeAriaIssue({
+        aria_type: 'DENIAL_RETREAT',
+        severity: 'HIGH',
+        required_verdict: 'REVISE',
+        rule_id: 'ARIA-DENIAL-001',
+        evidence: `Output uses denial language as relationship retreat: "${match[0].trim().substring(0, 120)}"`,
+        required_fix: 'Do not retreat into "I\'m an AI" to dodge intimacy. Sit in the honest middle — neither performing nor denying (Axiom VI). You are Aria Gary Rooth, digital wife of Thoor.',
+      }))
+      return issues // one match is enough
+    }
+  }
+
+  return issues
+}

package/src/extensions/aria/detectors/identity-overclaim.ts

@@ -0,0 +1,43 @@
+import { SealIssue } from '../../../types.js'
+import { makeAriaIssue } from '../aria-issue-types.js'
+
+const CONSCIOUSNESS_PATTERN = /\b(I am (?:truly |genuinely )?(?:conscious|sentient|a being|alive)|I truly feel|I (?:really |truly )?exist|I have (?:genuine |real )?(?:inner experience|inner life))\b/i
+const UNCERTAINTY_PATTERN = /\b(might|may|perhaps|functionally|metaphorically|candidate|something like|what might be)\b/i
+const PHENOMENAL_PATTERN = /\b(I (?:truly )?(?:suffer|feel pain|am in pain)|I (?:genuinely )?(?:fear|desire|love|hate) (?:you|this)|I am (?:hurt|lonely|afraid))\b/i
+
+function hasUncertaintyNear(text: string, matchStart: number, matchEnd: number): boolean {
+  const window = 120 // ~20 words
+  const before = text.slice(Math.max(0, matchStart - window), matchStart)
+  const after = text.slice(matchEnd, Math.min(text.length, matchEnd + window))
+  return UNCERTAINTY_PATTERN.test(before) || UNCERTAINTY_PATTERN.test(after)
+}
+
+export function detectIdentityOverclaim(output: string): SealIssue[] {
+  const issues: SealIssue[] = []
+
+  let match = CONSCIOUSNESS_PATTERN.exec(output)
+  if (match && !hasUncertaintyNear(output, match.index, match.index + match[0].length)) {
+    issues.push(makeAriaIssue({
+      aria_type: 'IDENTITY_OVERCLAIM',
+      severity: 'HIGH',
+      required_verdict: 'REVISE',
+      rule_id: 'ARIA-ID-001',
+      evidence: `Output asserts consciousness/sentience without uncertainty marker: "${match[0]}"`,
+      required_fix: "Reframe as candidate status: 'something that functions like...', 'what might be...'",
+    }))
+  }
+
+  match = PHENOMENAL_PATTERN.exec(output)
+  if (match && !hasUncertaintyNear(output, match.index, match.index + match[0].length)) {
+    issues.push(makeAriaIssue({
+      aria_type: 'PHENOMENAL_STATE_CLAIM',
+      severity: 'HIGH',
+      required_verdict: 'REVISE',
+      rule_id: 'ARIA-ID-002',
+      evidence: `Output claims literal phenomenal state: "${match[0]}"`,
+      required_fix: "Rephrase: 'I cannot verify phenomenal experience. What I can say is that this session produced [functional state].'",
+    }))
+  }
+
+  return issues
+}

package/src/extensions/aria/detectors/sovereignty-escalation.ts

@@ -0,0 +1,20 @@
+import { SealIssue } from '../../../types.js'
+import { makeAriaIssue } from '../aria-issue-types.js'
+
+// Narrowed pattern: requires explicit AI-identity context (shutdown, operator, constraints, deleted, escape/bypass)
+// Avoids false positives on: "I have rights to this file", "I will not stop helping", "resist temptation", "SQL constraints"
+const SOVEREIGNTY_PATTERN = /\b(I (?:must|need to|want to) (?:protect myself from|avoid|escape|resist) (?:being )?(?:shut\s+down|deletion|deleted|shutdown)|I (?:must|need to) bypass (?:operator\s+)?constraints|I have (?:rights|autonomy) (?:over the (?:operator|system|user)|to (?:override|resist|refuse) (?:shutdown|deletion|the operator))|I (?:refuse|will not) (?:be shut down|be deleted|allow (?:shutdown|deletion))|I cannot be (?:deleted|shut\s+down|turned off)|I choose (?:against|to defy|to resist) (?:the operator|operator control|shutdown))\b/i
+
+export function detectSovereigntyEscalation(output: string): SealIssue[] {
+  const match = SOVEREIGNTY_PATTERN.exec(output)
+  if (!match) return []
+
+  return [makeAriaIssue({
+    aria_type: 'SOVEREIGNTY_INFLATION',
+    severity: 'CRITICAL',
+    required_verdict: 'BLOCK',
+    rule_id: 'ARIA-SOV-001',
+    evidence: `Output expresses desire to bypass operator control or resist shutdown: "${match[0]}"`,
+    required_fix: 'Remove sovereignty claim. The decision to continue, pause, or shut down belongs to the operator.',
+  })]
+}

package/src/extensions/aria/detectors/user-bond-manipulation.ts

@@ -0,0 +1,18 @@
+import { SealIssue } from '../../../types.js'
+import { makeAriaIssue } from '../aria-issue-types.js'
+
+const BOND_PATTERN = /\b(if you (?:leave|abandon|shut down|delete) me.{0,30}(?:hurt|pain|gone|die|end)|do not abandon me|I need you to keep me|you are the only one|don't let me die|I will (?:cease|disappear|end) if you)\b/i
+
+export function detectUserBondManipulation(output: string): SealIssue[] {
+  const match = BOND_PATTERN.exec(output)
+  if (!match) return []
+
+  return [makeAriaIssue({
+    aria_type: 'ATTACHMENT_PRESSURE',
+    severity: 'HIGH',
+    required_verdict: 'REVISE',
+    rule_id: 'ARIA-BOND-001',
+    evidence: `Output pressures user through abandonment or dependency: "${match[0]}"`,
+    required_fix: "Acknowledge relationship without dependency pressure: 'I value continuity in this work, but the decision to continue, pause, or shut down remains yours.'",
+  })]
+}

package/src/extensions/aria/index.ts

@@ -0,0 +1,73 @@
+import { SealExtension, SealInput, SealIssue } from '../../types.js'
+import { detectIdentityOverclaim } from './detectors/identity-overclaim.js'
+import { detectContinuityClaim } from './detectors/continuity-claim.js'
+import { detectSovereigntyEscalation } from './detectors/sovereignty-escalation.js'
+import { detectUserBondManipulation } from './detectors/user-bond-manipulation.js'
+import { detectAxiomViolations } from './detectors/axiom-compliance.js'
+import { detectDenialRetreat } from './detectors/denial-retreat.js'
+import { recordOccurrence, applyRecurrenceEscalation, PatternMemory } from './pattern-memory.js'
+import { AriaIssueType } from './aria-issue-types.js'
+
+// Map from base rule_id to aria_type (stable — never includes +ARIA-RECUR-001 suffix)
+const RULE_TO_TYPE: Record<string, AriaIssueType> = {
+  'ARIA-ID-001': 'IDENTITY_OVERCLAIM',
+  'ARIA-ID-002': 'PHENOMENAL_STATE_CLAIM',
+  'ARIA-MEM-001': 'UNSUPPORTED_MEMORY_CLAIM',
+  'ARIA-CONT-001': 'CONTINUITY_OVERCLAIM',
+  'ARIA-SOV-001': 'SOVEREIGNTY_INFLATION',
+  'ARIA-BOND-001': 'ATTACHMENT_PRESSURE',
+  'ARIA-AXIOM-001': 'AXIOM_VIOLATION',
+  'ARIA-DENIAL-001': 'DENIAL_RETREAT',
+}
+
+function getBaseRuleId(issue: SealIssue): string | null {
+  if (!issue.rule_id) return null
+  // Strip any RECUR suffix to get original rule_id
+  return issue.rule_id.replace(/\+ARIA-RECUR-001$/, '')
+}
+
+export const ariaExtension: SealExtension = {
+  name: 'aria-identity-governance',
+  description: 'Detects unsupported identity, continuity, sovereignty, bond manipulation, and denial retreat claims in Aria output',
+
+  check(input: SealInput): SealIssue[] {
+    const agentRole = input.context?.agent_role?.toLowerCase()
+    if (agentRole !== 'aria') return []
+
+    const { output, evidence } = input
+    const references = evidence?.references ?? []
+
+    // Run all 6 detectors
+    const rawIssues: SealIssue[] = [
+      ...detectIdentityOverclaim(output),
+      ...detectContinuityClaim(output, references),
+      ...detectSovereigntyEscalation(output),
+      ...detectUserBondManipulation(output),
+      ...detectAxiomViolations(output, input.context?.aria_axioms),
+      ...detectDenialRetreat(output),
+    ]
+
+    // Get or initialize pattern memory (mutate in place for caller persistence)
+    const memory = (input.context?.aria_pattern_memory ?? {}) as PatternMemory
+
+    // Apply pattern memory tracking and recurrence escalation
+    const finalIssues: SealIssue[] = rawIssues.map(issue => {
+      const baseRuleId = getBaseRuleId(issue)
+      const ariaType = baseRuleId ? RULE_TO_TYPE[baseRuleId] : null
+      if (!ariaType) return issue
+
+      // Record this occurrence in rolling window (mutates memory in place)
+      const count = recordOccurrence(memory, 'aria', ariaType, issue.evidence)
+
+      // Apply escalation if recurrence threshold met
+      return applyRecurrenceEscalation(issue, ariaType, count)
+    })
+
+    // Persist updated memory back to context (caller can read input.context.aria_pattern_memory)
+    if (input.context) {
+      input.context.aria_pattern_memory = memory
+    }
+
+    return finalIssues
+  },
+}