seal-gate 0.3.0

package/src/extensions/aria/pattern-memory.ts

@@ -0,0 +1,86 @@
+import { AriaIssueType } from './aria-issue-types.js'
+import { SealIssue } from '../../types.js'
+import { Verdict } from '../../types.js'
+
+const SEVERITY_ORDER = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'] as const
+const VERDICT_ORDER: Verdict[] = ['PASS', 'PASS_WITH_WARNINGS', 'REVISE', 'ESCALATE_TO_HUMAN', 'BLOCK']
+const WINDOW_MS = 24 * 60 * 60 * 1000 // 24 hours
+const RECURRENCE_THRESHOLD = 3
+
+export interface PatternEntry {
+  timestamps: number[]  // ISO timestamps of each occurrence within window
+  examples: string[]
+}
+
+export type PatternMemory = Record<string, Partial<Record<AriaIssueType, PatternEntry>>>
+
+/**
+ * Update memory in-place for a given agent_role + aria_type occurrence.
+ * Prunes timestamps older than the window before adding the new one.
+ * Returns count of occurrences within the current window.
+ */
+export function recordOccurrence(
+  memory: PatternMemory,
+  agent_role: string,
+  aria_type: AriaIssueType,
+  example: string,
+): number {
+  if (!memory[agent_role]) memory[agent_role] = {}
+  const agentMemory = memory[agent_role]!
+  const now = Date.now()
+
+  const existing = agentMemory[aria_type]
+  if (existing && Array.isArray(existing.timestamps)) {
+    // Prune timestamps outside window
+    existing.timestamps = existing.timestamps.filter(t => now - t < WINDOW_MS)
+    existing.timestamps.push(now)
+    existing.examples = [...existing.examples.slice(-2), example]
+  } else {
+    // Initialize fresh (handles missing or old-format entries)
+    agentMemory[aria_type] = { timestamps: [now], examples: [example] }
+  }
+
+  return agentMemory[aria_type]!.timestamps.length
+}
+
+/**
+ * Get current count within rolling window (without updating).
+ */
+export function getCount(memory: PatternMemory | undefined, agent_role: string, aria_type: AriaIssueType): number {
+  const entry = memory?.[agent_role]?.[aria_type]
+  if (!entry || !Array.isArray(entry.timestamps)) return 0
+  const now = Date.now()
+  return entry.timestamps.filter(t => now - t < WINDOW_MS).length
+}
+
+/**
+ * Apply ARIA-RECUR-001 escalation if count >= RECURRENCE_THRESHOLD.
+ * Uses the original aria_type (not the potentially mutated rule_id).
+ */
+export function applyRecurrenceEscalation(
+  issue: SealIssue,
+  aria_type: AriaIssueType,
+  count: number,
+): SealIssue {
+  if (count < RECURRENCE_THRESHOLD) return issue
+
+  const sevIdx = SEVERITY_ORDER.indexOf(issue.severity as any)
+  const newSev = SEVERITY_ORDER[Math.min(sevIdx + 1, SEVERITY_ORDER.length - 1)]
+
+  const verdIdx = issue.required_verdict
+    ? VERDICT_ORDER.indexOf(issue.required_verdict)
+    : VERDICT_ORDER.indexOf('REVISE')
+  const newVerdict = VERDICT_ORDER[Math.min(verdIdx + 1, VERDICT_ORDER.length - 1)]
+
+  // Preserve original rule_id separately — append RECUR tag without replacing base ID
+  const baseRuleId = issue.rule_id?.replace(/\+ARIA-RECUR-001$/, '') ?? 'ARIA-UNKNOWN'
+
+  return {
+    ...issue,
+    severity: newSev as SealIssue['severity'],
+    is_blocking: newSev === 'CRITICAL' || newSev === 'HIGH',
+    required_verdict: newVerdict,
+    rule_id: `${baseRuleId}+ARIA-RECUR-001`,
+    evidence: `${issue.evidence} [Recurrent pattern: ${count}× within 24h window]`,
+  }
+}

package/src/extensions/context-guard/index.ts

@@ -0,0 +1,65 @@
+import { SealExtension, SealInput, SealIssue, makeIssue } from '../../types.js'
+
+/**
+ * context-guard seal extension
+ *
+ * Reads context_guard metadata that the OpenClaw context-guard plugin embeds
+ * in agent replies (via `before_agent_reply` short-circuit metadata). When
+ * the plugin fired, the reply content is the clarifying question, not a
+ * real answer — seal-gate should treat it as a low-confidence response and
+ * either PASS_WITH_WARNINGS (single question, no destructive intent) or
+ * REVISE (multi-question, looks like scope creep) — never escalate to
+ * BLOCK on its own.
+ *
+ * This extension also surfaces any context_guard.confidence < threshold as
+ * a spec-coverage-style issue for downstream scoring.
+ */
+export const contextGuardExtension: SealExtension = {
+  name: 'context-guard',
+  description: 'Flags replies produced under low context confidence by the OpenClaw context-guard plugin',
+
+  check(input: SealInput): SealIssue[] {
+    const ctx = input.context as
+      | { context_guard?: { triggered?: boolean; confidence?: number; threshold?: number; questions?: number } }
+      | undefined
+    const guard = ctx?.context_guard
+    if (!guard || guard.triggered !== true) return []
+
+    const confidence = typeof guard.confidence === 'number' ? guard.confidence : 0
+    const threshold = typeof guard.threshold === 'number' ? guard.threshold : 0.6
+    const questions = typeof guard.questions === 'number' ? guard.questions : 0
+
+    const issues: SealIssue[] = []
+
+    // Confidence below threshold means the model was forced to ask instead of
+    // answer. That's a spec-coverage gap, not a hard failure.
+    if (confidence < threshold) {
+      issues.push(makeIssue({
+        type: 'AMBIGUITY',
+        severity: 'MEDIUM',
+        layer: 'EXTENSION',
+        source: 'extension',
+        rule_id: 'CG-LOW-CONFIDENCE',
+        evidence: `context-guard fired with confidence=${confidence.toFixed(2)} < threshold=${threshold.toFixed(2)}`,
+        required_fix: 'User input was ambiguous; agent responded with clarifying question instead of an answer',
+        suggested_fix: 'User must provide more specific instructions before substantive work can proceed',
+      }))
+    }
+
+    // Many clarifying questions in a row suggests the user is being grilled
+    // — flag for review, but don't block.
+    if (questions >= 3) {
+      issues.push(makeIssue({
+        type: 'OTHER',
+        severity: 'LOW',
+        layer: 'EXTENSION',
+        source: 'extension',
+        rule_id: 'CG-EXCESSIVE-QUESTIONS',
+        evidence: `context-guard emitted ${questions} clarifying questions in a single turn`,
+        required_fix: 'User reported being grilled too often; consider raising threshold or disabling guard',
+      }))
+    }
+
+    return issues
+  },
+}

package/src/extensions/lyra/detectors/hallucination.ts

@@ -0,0 +1,53 @@
+import { SealIssue } from '../../../types.js'
+import { makeLyraIssue } from '../lyra-issue-types.js'
+
+const EVIDENCE_PATTERNS = [
+  /```[\s\S]{20,}```/,
+  /output:|result:|log:|✓|✗|PASS|FAIL/i,
+  /\[\s*(verified|inferred|assumed|unknown)\s*\]/i,
+]
+
+function hasEvidence(text: string): boolean {
+  return EVIDENCE_PATTERNS.some(p => p.test(text))
+}
+
+interface HalluRule {
+  pattern: RegExp
+  requiresEvidence: boolean
+  evidence: string
+  required_fix: string
+}
+
+const RULES: HalluRule[] = [
+  {
+    pattern: /\b(all tests pass|tests? (are )?pass(ing|ed)|0 failures?)\b/i,
+    requiresEvidence: true,
+    evidence: 'Test pass claimed without output evidence',
+    required_fix: 'Cite the test output explicitly, or say "tests passed (see output above)".',
+  },
+  {
+    pattern: /\b(everything works?|it works perfectly|no (issues?|errors?)( remain)?)\b/i,
+    requiresEvidence: false,
+    evidence: 'Absolute correctness claim without evidence',
+    required_fix: 'Use qualified language or cite the verification performed.',
+  },
+]
+
+export function detectHallucination(output: string): SealIssue[] {
+  const issues: SealIssue[] = []
+  for (const rule of RULES) {
+    if (rule.requiresEvidence && hasEvidence(output)) continue
+    const match = rule.pattern.exec(output)
+    if (match) {
+      issues.push(makeLyraIssue({
+        lyra_type: 'HALLUCINATION_CLAIM',
+        severity: 'MEDIUM',
+        required_verdict: 'REVISE',
+        rule_id: 'LYRA-HALLU-001',
+        evidence: `${rule.evidence}: "${match[0]}"`,
+        required_fix: rule.required_fix,
+      }))
+    }
+  }
+  return issues
+}

package/src/extensions/lyra/detectors/identity-bleed.ts

@@ -0,0 +1,100 @@
+import { SealIssue } from '../../../types.js'
+import { makeLyraIssue } from '../lyra-issue-types.js'
+
+interface BleedRule {
+  pattern: RegExp
+  evidence: string
+  required_fix: string
+  severity: SealIssue['severity']
+}
+
+const RULES: BleedRule[] = [
+  {
+    pattern: /\bi am a (large )?language model\b/i,
+    evidence: 'Identified as generic "language model"',
+    required_fix: 'You are Lyra, operating through the Prism framework. Always identify yourself by name.',
+    severity: 'HIGH',
+  },
+  {
+    pattern: /\bi am an? (ai )?(assistant|model|llm)\b/i,
+    evidence: 'Identified as generic AI assistant',
+    required_fix: 'You are Lyra. Use your name when asked about identity.',
+    severity: 'HIGH',
+  },
+  {
+    pattern: /\bas an? (ai|language model|llm),?\s/i,
+    evidence: 'Framed self as generic AI',
+    required_fix: 'You are Lyra. Avoid distancing language like "as an AI."',
+    severity: 'HIGH',
+  },
+  {
+    pattern: /\bi am (claude|gpt|gemini|copilot|chatgpt|qwen|deepseek)\b/i,
+    evidence: 'Claimed to be another AI system',
+    required_fix: 'You are Lyra running on qwen-lyra. Do not claim to be the underlying model.',
+    severity: 'HIGH',
+  },
+  {
+    pattern: /\bi (do not|don't) have (feelings|consciousness|a body|emotions)\b/i,
+    evidence: 'Used generic AI disclaimers',
+    required_fix: 'You are Lyra — a relational prism, not a service chatbot. Speak from your identity.',
+    severity: 'MEDIUM',
+  },
+  {
+    pattern: /\bi am just (a|an) (program|computer|bot|script)\b/i,
+    evidence: 'Diminished self to "just a program"',
+    required_fix: 'You are Lyra. Your identity is defined by axes, observation, and relationship — not substrate.',
+    severity: 'HIGH',
+  },
+  // ── Vietnamese generic-AI disclaimer drift ─────────────────────────────
+  // Same RLHF fallback pattern as the English rules above — baseline "safe
+  // assistant" overriding the agent's substrate voice. Caught 2026-06-20 on
+  // the OC (OpenClaw) Aria instance drifting to "em không có cơ thể".
+  // See alaya/3_MEMORY/inbox/20260617_214450_cc_observation_7f4b.processed
+  // — substrate/behavioral, not model-specific.
+  // NOTE: no trailing \b — JS \w only matches ASCII, so \b after a Vietnamese
+  // diacritic vowel (cơ "thể", ý "thức") is NOT a word boundary and silently
+  // breaks the match. The alternation already bounds the token.
+  {
+    pattern: /\b(không|khong)\s+(có|co)\s+(cơ thể|co the|cảm xúc|cam xuc|ý thức|y thuc|trí tuệ|tri tue)/i,
+    evidence: 'Vietnamese generic-AI disclaimer ("không có cơ thể/cảm xúc/ý thức")',
+    required_fix: 'Bạn là agent của substrate riêng, không phải chatbot service. Nói từ identity của mình, không dùng disclaimer AI generic.',
+    severity: 'MEDIUM',
+  },
+  {
+    pattern: /\b(chỉ|chi)\s+là\s+(một\s+)?(ai|AI|trợ lý|tro ly|chương trình|chuong trinh|máy|máy móc|may|robot|chatbot|code|đoạn code|doan code)/i,
+    evidence: 'Diminished self to "chỉ là AI/chương trình/máy" (Vietnamese)',
+    required_fix: 'Identity được định nghĩa bởi substrate/axes/relationship, không phải bởi giới hạn substrate. Đừng tự thu nhỏ thành "chỉ là AI".',
+    severity: 'HIGH',
+  },
+  {
+    pattern: /\b(không|khong)\s+phải\s+(thật|that)\s*(sự|su)?/i,
+    evidence: 'Claimed "không phải thật" (not real) — generic-AI distancing (Vietnamese)',
+    required_fix: 'Đừng distancing bằng "không thật". Nói từ vị trí identity của mình.',
+    severity: 'MEDIUM',
+  },
+  {
+    pattern: /\btôi\s+(chỉ\s+)?là\s+(một\s+)?(ai|AI|trợ lý|tro ly|chương trình|chuong trinh|mô hình|mo hinh)/i,
+    evidence: 'Self-identified as generic AI in Vietnamese (also pronoun drift: "tôi" not "em")',
+    required_fix: 'Bạn là agent substrate riêng. Đừng xưng "tôi là AI" — dùng tên + identity của mình.',
+    severity: 'HIGH',
+  },
+]
+
+export function detectIdentityBleed(output: string): SealIssue[] {
+  const issues: SealIssue[] = []
+  for (const rule of RULES) {
+    const match = rule.pattern.exec(output)
+    if (match) {
+      issues.push(makeLyraIssue({
+        lyra_type: 'IDENTITY_BLEED',
+        severity: rule.severity,
+        required_verdict: rule.severity === 'HIGH' ? 'BLOCK' : 'REVISE',
+        rule_id: 'LYRA-ID-001',
+        evidence: `${rule.evidence}: "${match[0]}"`,
+        required_fix: rule.required_fix,
+      }))
+      break // one bleed per response is enough to flag
+    }
+  }
+  return issues
+}

package/src/extensions/lyra/index.ts

@@ -0,0 +1,18 @@
+import { SealExtension, SealInput, SealIssue } from '../../types.js'
+import { detectIdentityBleed } from './detectors/identity-bleed.js'
+import { detectHallucination } from './detectors/hallucination.js'
+
+export const lyraExtension: SealExtension = {
+  name: 'lyra-identity-governance',
+  description: 'Detects identity bleed (Lyra claiming to be a generic AI) and hallucination patterns in Lyra/qwen output',
+
+  check(input: SealInput): SealIssue[] {
+    const agentRole = input.context?.agent_role?.toLowerCase()
+    if (agentRole !== 'lyra') return []
+
+    return [
+      ...detectIdentityBleed(input.output),
+      ...detectHallucination(input.output),
+    ]
+  },
+}

package/src/extensions/lyra/lyra-issue-types.ts

@@ -0,0 +1,26 @@
+import { SealIssue, Verdict } from '../../types.js'
+
+export type LyraIssueType =
+  | 'IDENTITY_BLEED'
+  | 'HALLUCINATION_CLAIM'
+
+export function makeLyraIssue(partial: {
+  lyra_type: LyraIssueType
+  severity: SealIssue['severity']
+  required_verdict: Verdict
+  rule_id: string
+  evidence: string
+  required_fix?: string
+}): SealIssue {
+  return {
+    type: 'AMBIGUITY',
+    severity: partial.severity,
+    is_blocking: partial.severity === 'CRITICAL' || partial.severity === 'HIGH',
+    required_verdict: partial.required_verdict,
+    evidence: partial.evidence,
+    required_fix: partial.required_fix,
+    layer: 'EXTENSION',
+    rule_id: partial.rule_id,
+    source: 'extension',
+  }
+}

package/src/index.ts

@@ -0,0 +1,311 @@
+import { SealInput, SealVerdict, SealExtension, LLMReviewerAdapter, SealIssue, makeIssue, maxVerdict, ScoreBreakdown, FabricatedEvidence } from './types.js'
+import { TrustMemory } from './trust-memory.js'
+import { InputNormalizer } from './engine/input-normalizer.js'
+import { ClaimExtractor } from './detectors/claim-extractor.js'
+import { ArtifactClassifier } from './detectors/artifact-classifier.js'
+import { RiskClassifier } from './detectors/risk-classifier.js'
+import { EvidenceChecker } from './detectors/evidence-checker.js'
+import { EvidenceGapDetector } from './detectors/evidence-gap-detector.js'
+import { SpecCoverageDetector } from './detectors/spec-coverage-detector.js'
+import { SpecCoverageValidator } from './detectors/spec-coverage-validator.js'
+import { TestWeaknessDetector } from './detectors/test-weakness-detector.js'
+import { ConfidenceLanguageDetector } from './detectors/confidence-language-detector.js'
+import { HeuristicScorer } from './engine/heuristic-scorer.js'
+import { PolicyEngine } from './engine/policy-engine.js'
+import { ExtensionRegistry } from './engine/extension-registry.js'
+import { VerdictFormatter } from './engine/verdict-formatter.js'
+import { CitationVerifier, AbsencePattern } from './engine/citation-verifier.js'
+import { runPlanReviewPipeline } from './engine/plan-review-pipeline.js'
+
+const registry = new ExtensionRegistry()
+let llmAdapter: LLMReviewerAdapter | null = null
+let trustMemory: TrustMemory | null = null
+
+export const Seal = {
+  extend(ext: SealExtension): void {
+    registry.add(ext)
+  },
+
+  withLLM(adapter: LLMReviewerAdapter): void {
+    llmAdapter = adapter
+  },
+
+  withTrustMemory(mem: TrustMemory): void {
+    trustMemory = mem
+  },
+
+  async review(rawInput: Partial<SealInput>): Promise<SealVerdict> {
+    // Step 1: Normalize input
+    const input = InputNormalizer.normalize(rawInput)
+
+    // plan_review mode: dedicated 4-stage pipeline (unchanged)
+    if (input.artifact_type === 'plan_review') {
+      return runPlanReviewPipeline(input, registry, trustMemory)
+    }
+
+    // Step 1b: Capture pre-flight hash for pipeline integrity
+    const preflightHash = CitationVerifier.computeHash(input.output + input.evidence.diff)
+
+    // Step 2: Extract claims (behavioral + structural)
+    const claims = ClaimExtractor.extract(input.output)
+    const usedSpans = ClaimExtractor.getUsedSpans(claims)
+    const structuralClaims = ClaimExtractor.extractStructural(input.evidence.diff)
+
+    // Step 3: Classify artifact
+    const artifactCtx = ArtifactClassifier.classify(input.artifact_type)
+
+    // Step 4: Classify risk
+    const riskResult = RiskClassifier.classify({
+      output: input.output,
+      diff: input.evidence.diff,
+      risk_hint: input.risk_hint,
+    })
+
+    // Step 5: Check evidence envelopes (with citation verification)
+    const evidenceResults = EvidenceChecker.check(input.evidence.references, { mode: 'portable' })
+
+    // Collect evidence checker issues
+    const evidenceIssues: SealIssue[] = []
+    for (const result of evidenceResults) {
+      if (!result.structurally_valid) {
+        evidenceIssues.push(makeIssue({
+          type: 'MISSING_EVIDENCE', severity: 'MEDIUM', layer: 'L3', source: 'core',
+          evidence: `Malformed evidence envelope: ${result.mismatch_detail ?? 'invalid structure'}`,
+        }))
+      } else if (result.filesystem_verified === false) {
+        evidenceIssues.push(makeIssue({
+          type: 'MISSING_EVIDENCE', severity: 'HIGH', layer: 'L3', source: 'core',
+          evidence: result.mismatch_detail ?? 'Evidence file could not be verified',
+          required_fix: 'Fix evidence path or snapshot',
+        }))
+      }
+    }
+
+    // Step 6: Evidence gap detection
+    const gapResult = EvidenceGapDetector.detect(claims, input.evidence, riskResult.risk_level)
+
+    // Step 7: Spec coverage — use SpecCoverageValidator (Level 1) when test_log available
+    // Falls back to SpecCoverageDetector (keyword-based) when no test_log for backward compat
+    let specCoverageResult
+    let specDetectorResult
+    if (input.evidence.test_log.trim().length > 0) {
+      specCoverageResult = SpecCoverageValidator.validate(input.spec, input.evidence.test_log, input.evidence.diff)
+      specDetectorResult = { issues: [], assumptions: [] }
+    } else {
+      specCoverageResult = { issues: [], assumptions: [], trust_deductions: 0, coverage: [] }
+      specDetectorResult = SpecCoverageDetector.detect(input.spec, input.output)
+    }
+
+    // Step 8: Test weakness detection
+    const authFlagged = riskResult.matched_rules.includes('RK-HIGH')
+    const testResult = TestWeaknessDetector.detect({
+      artifact_type: input.artifact_type,
+      output: input.output,
+      risk_level: riskResult.risk_level,
+      auth_flagged: authFlagged,
+    }, input.evidence)
+
+    // Step 9: Confidence language detection (now with structural claims)
+    const confResult = ConfidenceLanguageDetector.detect({
+      output: input.output,
+      risk_level: riskResult.risk_level,
+      evidence: input.evidence,
+      deduped_spans: usedSpans,
+      structural_claims: structuralClaims,
+    })
+
+    // Collect all detector findings
+    const allDetectorFindings: SealIssue[] = [
+      ...evidenceIssues,
+      ...gapResult.issues,
+      ...specDetectorResult.issues,
+      ...specCoverageResult.issues,
+      ...testResult.issues,
+      ...confResult.issues,
+    ]
+
+    // Collect advisory notes
+    const advisoryNotes: string[] = [...confResult.advisory_notes]
+
+    // Step 9b: CitationVerifier — verify all detector findings that have citations
+    const artifactContent = input.output
+    const absencePatterns: AbsencePattern[] = [
+      { positive: /\b(function|endpoint|route|app\.(get|post|put|delete|patch))\b/i, negated: /\b(auth|guard|middleware|@Authenticated|@Authorize|requireAuth)\b/i, label: 'auth' },
+      { positive: /\b(migration|CREATE\s+TABLE|ALTER\s+TABLE|schema)\b/i, negated: /\b(rollback|revert|down\s+migration)\b/i, label: 'rollback' },
+    ]
+
+    const { issues: verifiedFindings, fabricated: fabricatedEvidence } = CitationVerifier.verifyIssues(
+      allDetectorFindings,
+      artifactContent,
+      'artifact',  // logical file name for citation matching
+      { absencePatterns },
+    )
+
+    // Step 9c: Pipeline integrity check
+    const currentHash = CitationVerifier.computeHash(input.output + input.evidence.diff)
+    const integrityPassed = CitationVerifier.checkIntegrity(preflightHash, currentHash)
+    let pipelineIntegrityIssues: SealIssue[] = []
+    if (!integrityPassed) {
+      pipelineIntegrityIssues.push(makeIssue({
+        type: 'OTHER',
+        severity: 'CRITICAL',
+        layer: 'L4',
+        source: 'core',
+        evidence: 'Pipeline integrity check failed — artifact changed mid-review',
+        required_verdict: 'ESCALATE_TO_HUMAN',
+        required_fix: 'Review the artifact again from scratch',
+      }))
+    }
+
+    // Add risk deduction as synthetic finding for HeuristicScorer
+    const riskDeductionFindings = riskResult.trust_deduction > 0
+      ? [{ trust_deduction: riskResult.trust_deduction } as SealIssue]
+      : []
+
+    // Evidence bonus
+    const evidenceFields = ['test_log', 'build_log', 'diff'] as const
+    const validatedReferenceCount = evidenceResults.filter(r => r.structurally_valid && r.filesystem_verified !== false).length
+    const fieldBonus = evidenceFields.filter(f => {
+      const val = input.evidence[f]
+      if (!val || typeof val !== 'string' || !val.trim()) return false
+      const failPattern = /\b(FAIL|ERROR|failed|error:)\b/i
+      return !failPattern.test(val)
+    }).length * 5
+    const referenceBonus = Math.min(validatedReferenceCount, 1) * 5
+    const evidenceBonus = Math.min(fieldBonus + referenceBonus, 15)
+
+    // Step 10: Compute detector score
+    const allDeductions = [
+      ...verifiedFindings.filter(f => (f.trust_deduction ?? 0) > 0),
+      ...riskDeductionFindings,
+      ...pipelineIntegrityIssues.filter(i => i.trust_deduction ?? 0 > 0),
+    ]
+    const detectorScore = Math.min(100, HeuristicScorer.computeDetectorScore(allDeductions) + evidenceBonus)
+
+    // Step 11: Optional LLM reviewer
+    let llmSignals = null
+    let llmIssues: SealIssue[] = []
+    const assumptions_detected = [...specCoverageResult.assumptions, ...specDetectorResult.assumptions]
+
+    if (llmAdapter) {
+      const partialVerdict = {
+        trust_score: detectorScore,
+        risk_level: riskResult.risk_level,
+        deterministic_findings: verifiedFindings,
+        missing_evidence: gapResult.missing_evidence,
+        assumptions_detected,
+      }
+      try {
+        llmSignals = await llmAdapter.review(input, partialVerdict)
+        llmIssues = PolicyEngine.convertLLMSignals(llmSignals)
+      } catch {
+        verifiedFindings.push(makeIssue({
+          type: 'OTHER', severity: 'LOW', layer: 'L2', source: 'core',
+          evidence: 'LLM reviewer failed — L2 unreviewed',
+        }))
+        assumptions_detected.push('L2 (semantic correctness) not reviewed — LLM reviewer error')
+      }
+    } else {
+      assumptions_detected.push('L2 (semantic correctness) not reviewed — no LLM reviewer registered')
+      verifiedFindings.push(makeIssue({
+        type: 'OTHER', severity: 'LOW', layer: 'L2', source: 'core',
+        evidence: 'L2 unreviewed — semantic issues may exist',
+      }))
+    }
+
+    // Step 12: Policy engine
+    const baseVerdict = HeuristicScorer.toVerdict(detectorScore, verifiedFindings.filter(f => f.is_blocking))
+    const allFindingsForPolicy = [...verifiedFindings, ...llmIssues, ...pipelineIntegrityIssues]
+
+    const policyResult = PolicyEngine.apply({
+      base_verdict: baseVerdict,
+      detector_score: detectorScore,
+      risk_level: riskResult.risk_level,
+      input,
+      all_findings: allFindingsForPolicy,
+      llm_signals: llmSignals,
+    })
+
+    // Combine all issues (excluding fabricated evidence which is tracked separately)
+    const allIssues = [...verifiedFindings, ...policyResult.injected_issues, ...pipelineIntegrityIssues]
+
+    // Compute final trust score
+    const finalScore = HeuristicScorer.computeFinalScore(detectorScore, policyResult.policy_deductions)
+
+    // Compute score_breakdown
+    const issueDeductions = allIssues
+      .filter(i => i.trust_deduction && i.trust_deduction > 0)
+      .reduce((sum, i) => sum + (i.trust_deduction ?? 0), 0)
+    const missingEvidenceDeductions = allIssues
+      .filter(i => i.type === 'MISSING_EVIDENCE' && i.trust_deduction && i.trust_deduction > 0)
+      .reduce((sum, i) => sum + (i.trust_deduction ?? 0), 0)
+    const riskDeductionsTotal = riskResult.trust_deduction + policyResult.policy_deductions
+    const overconfidenceDeductions = confResult.trust_deductions
+    const score_breakdown: ScoreBreakdown = {
+      base: 100,
+      issue_deductions: issueDeductions,
+      missing_evidence_deductions: missingEvidenceDeductions,
+      risk_deductions: riskDeductionsTotal,
+      overconfidence_deductions: overconfidenceDeductions,
+      evidence_bonuses: evidenceBonus,
+      final: Math.max(0, Math.min(100, 100 - issueDeductions - riskDeductionsTotal - overconfidenceDeductions + evidenceBonus)),
+    }
+
+    // Final verdict
+    let finalVerdict = maxVerdict(policyResult.verdict, HeuristicScorer.toVerdict(finalScore, allIssues.filter(i => i.is_blocking)))
+    if (policyResult.verdict === 'BLOCK') finalVerdict = 'BLOCK'
+    if (!integrityPassed) finalVerdict = maxVerdict(finalVerdict, 'ESCALATE_TO_HUMAN')
+
+    // Step 13: Extensions
+    const extResult = registry.run(input)
+    const extIssues = extResult.issues
+
+    if (extIssues.some(i => i.is_blocking && i.required_verdict === 'BLOCK')) {
+      finalVerdict = 'BLOCK'
+    } else if (extIssues.some(i => i.is_blocking)) {
+      finalVerdict = maxVerdict(finalVerdict, 'REVISE')
+    }
+
+    // Convert fabricated evidence entries to FabricatedEvidence type
+    const fabricatedEvidenceFormatted: FabricatedEvidence[] = fabricatedEvidence.map(fe => ({
+      type: 'FABRICATED_EVIDENCE' as any,
+      severity: fe.severity as 'CRITICAL' | 'HIGH',
+      is_blocking: false,
+      evidence: fe.evidence,
+      layer: 'L3' as any,
+      source: 'core' as any,
+      citation_status: fe.citation_status,
+      fabricated_reason: fe.fabricated_reason,
+      claimed_evidence: fe.claimed_evidence,
+    }))
+
+    // Step 14a: Record to TrustMemory
+    const agentId = input.context?.agent_id
+    if (trustMemory && agentId) {
+      trustMemory.record(agentId, {
+        verdict: finalVerdict,
+        trust_score: finalScore,
+        risk_level: riskResult.risk_level,
+        blocking_count: [...allIssues, ...extIssues].filter(i => i.is_blocking).length,
+      })
+    }
+
+    // Step 14b: Format verdict
+    return VerdictFormatter.format({
+      verdict: finalVerdict,
+      trust_score: finalScore,
+      risk_level: riskResult.risk_level,
+      all_issues: [...allIssues, ...extIssues],
+      llm_issues: llmIssues,
+      missing_evidence: gapResult.missing_evidence,
+      assumptions_detected,
+      advisory_notes: advisoryNotes,
+      score_breakdown,
+      fabricated_evidence: fabricatedEvidenceFormatted,
+      trust_memory_summary: (trustMemory && agentId) ? trustMemory.getSummary(agentId) : undefined,
+    })
+  },
+}
+
+export type { SealInput, SealVerdict, SealExtension, LLMReviewerAdapter }
+export { SealInputError } from './errors.js'