worldvm 0.0.0-stage → 0.1.0

package/dist/snapshot.js

@@ -0,0 +1,45 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { sqlite } from "./sqlite.js";
+/** Export committed records without opening a host or evaluating them under new rules. */
+export const snapshotDatabase = async (filename, account) => {
+    const store = sqlite(filename, { readOnly: true });
+    try {
+        const state = await store.load();
+        if (!state)
+            throw new Error(`No committed world in ${filename}.`);
+        return {
+            format: "worldvm/world@1",
+            accounts: [account],
+            release: state.release,
+            world: state.records,
+        };
+    }
+    finally {
+        await store.close();
+    }
+};
+/** Reads a snapshot and checks that every world it will be evaluated under declares its accounts. */
+export const readSnapshot = async (input, worlds, code) => {
+    const path = resolve(input);
+    const fail = (message, help) => ({
+        diagnostic: { code, severity: "error", message, at: null, help, fix: null },
+    });
+    let snapshot;
+    try {
+        snapshot = JSON.parse(await readFile(path, "utf8"));
+        if (snapshot.format !== "worldvm/world@1" ||
+            !Array.isArray(snapshot.accounts) ||
+            !snapshot.accounts.length)
+            throw new Error(`Expected format worldvm/world@1 with accounts in ${path}.`);
+    }
+    catch (cause) {
+        return fail(String(cause), "Pass a worldvm/world@1 JSON snapshot: { format, accounts, world }.");
+    }
+    for (const ir of worlds) {
+        const undeclared = snapshot.accounts.filter((n) => !ir.accounts.some((a) => a.name === n));
+        if (undeclared.length)
+            return fail(`Snapshot accounts ${undeclared.join(", ")} are not declared by this world.`, `Declared accounts: ${ir.accounts.map((a) => a.name).join(", ")}.`);
+    }
+    return { snapshot };
+};

package/dist/sqlite.d.ts

@@ -0,0 +1,16 @@
+import type { IR } from "./_internal/reconciler/index.js";
+import type { Store, StoreState } from "./handle/store.js";
+export interface DeployedRelease {
+    readonly release: string;
+    readonly account: string;
+    readonly at: string;
+    readonly ir: IR.WorldIR;
+}
+export interface SQLiteStore extends Store {
+    readonly deployed: () => DeployedRelease | null;
+    readonly deploy: (release: DeployedRelease, state: StoreState) => void;
+}
+/** Durable single-file storage. Pass ":memory:" for a throwaway database. */
+export declare const sqlite: (filename: string, options?: {
+    readonly readOnly?: boolean;
+}) => SQLiteStore;

package/dist/sqlite.js

@@ -0,0 +1,151 @@
+import { createRequire } from "node:module";
+// One account in one SQLite file. Each record stream is stored one row per record, and a
+// commit writes only the rows that changed, inside a single transaction. SQLite's journal
+// makes the commit atomic: a crash leaves the previous state or the new one.
+const FORMAT = "worldvm/sqlite-store@3";
+/** Durable single-file storage. Pass ":memory:" for a throwaway database. */
+export const sqlite = (filename, options = {}) => {
+    // Keep the synchronous store API without loading experimental SQLite for authoring commands.
+    const { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
+    const db = new DatabaseSync(filename, { readOnly: options.readOnly ?? false });
+    try {
+        const existing = db
+            .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'meta'")
+            .get();
+        if (existing) {
+            const format = db.prepare("SELECT value FROM meta WHERE key = 'format'").get()?.["value"];
+            if (format !== undefined && format !== FORMAT)
+                throw new Error(`${filename} uses ${String(format)}; expected ${FORMAT}. Create a new database; no migration is provided.`);
+        }
+        if (!options.readOnly)
+            db.exec(`
+    PRAGMA journal_mode = WAL;
+    PRAGMA synchronous = FULL;
+    CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT NOT NULL) STRICT;
+    CREATE TABLE IF NOT EXISTS records (
+      stream TEXT NOT NULL, idx INTEGER NOT NULL, body TEXT NOT NULL,
+      PRIMARY KEY (stream, idx)
+    ) STRICT, WITHOUT ROWID;
+    CREATE TABLE IF NOT EXISTS releases (
+      seq INTEGER PRIMARY KEY, release TEXT NOT NULL, account TEXT NOT NULL,
+      deployed_at TEXT NOT NULL, ir TEXT NOT NULL
+    ) STRICT;
+    CREATE TABLE IF NOT EXISTS receipts (id TEXT PRIMARY KEY, body TEXT NOT NULL) STRICT;
+  `);
+        const meta = db.prepare("SELECT value FROM meta WHERE key = ?"), setMeta = db.prepare("INSERT INTO meta (key, value) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET value = excluded.value"), put = db.prepare("INSERT INTO records (stream, idx, body) VALUES (?, ?, ?) ON CONFLICT (stream, idx) DO UPDATE SET body = excluded.body"), truncate = db.prepare("DELETE FROM records WHERE stream = ? AND idx >= ?"), putReceipt = db.prepare("INSERT OR IGNORE INTO receipts (id, body) VALUES (?, ?)");
+        // What is on disk, so a commit can write only the difference.
+        let committed = null;
+        let deploying;
+        const store = {
+            deployed: () => {
+                const row = db.prepare("SELECT * FROM releases ORDER BY seq DESC LIMIT 1").get();
+                return row
+                    ? {
+                        release: String(row["release"]),
+                        account: String(row["account"]),
+                        at: String(row["deployed_at"]),
+                        ir: JSON.parse(String(row["ir"])),
+                    }
+                    : null;
+            },
+            deploy: (release, state) => {
+                deploying = release;
+                try {
+                    store.commit(state);
+                }
+                finally {
+                    deploying = undefined;
+                }
+            },
+            load: () => {
+                db.exec("BEGIN");
+                try {
+                    const release = meta.get("release")?.["value"];
+                    if (typeof release !== "string") {
+                        db.exec("COMMIT");
+                        committed = null;
+                        return null;
+                    }
+                    const streams = {};
+                    for (const row of db
+                        .prepare("SELECT stream, body FROM records ORDER BY stream, idx")
+                        .all())
+                        (streams[row["stream"]] ??= []).push(JSON.parse(row["body"]));
+                    const receipts = Object.create(null);
+                    for (const row of db.prepare("SELECT id, body FROM receipts").all())
+                        receipts[row["id"]] = JSON.parse(row["body"]);
+                    const loaded = {
+                        release,
+                        revision: Number(meta.get("revision")?.["value"] ?? 0),
+                        // The kernel requires these streams to exist even when empty.
+                        records: {
+                            facts: [],
+                            evidence: [],
+                            acceptances: [],
+                            signals: [],
+                            dispatches: [],
+                            journal: [],
+                            ...streams,
+                        },
+                        receipts,
+                        proposals: JSON.parse(String(meta.get("proposals")?.["value"] ?? "{}")),
+                    };
+                    db.exec("COMMIT");
+                    committed = loaded;
+                    return committed;
+                }
+                catch (cause) {
+                    db.exec("ROLLBACK");
+                    throw cause;
+                }
+            },
+            commit: (next) => {
+                db.exec("BEGIN IMMEDIATE");
+                try {
+                    if (deploying)
+                        db.prepare("INSERT INTO releases (release, account, deployed_at, ir) VALUES (?, ?, ?, ?)").run(deploying.release, deploying.account, deploying.at, JSON.stringify(deploying.ir));
+                    setMeta.run("format", FORMAT);
+                    setMeta.run("release", next.release);
+                    setMeta.run("revision", String(next.revision));
+                    setMeta.run("proposals", JSON.stringify(next.proposals));
+                    const streams = new Set([
+                        ...Object.keys(next.records),
+                        ...Object.keys(committed?.records ?? {}),
+                    ]);
+                    for (const stream of streams) {
+                        const before = committed?.records[stream] ?? [], after = next.records[stream] ?? [];
+                        if (before === after)
+                            continue;
+                        // The kernel shares unchanged records by reference, so this scan is cheap.
+                        for (let i = 0; i < after.length; i++) {
+                            if (before[i] === after[i])
+                                continue;
+                            const body = JSON.stringify(after[i]);
+                            if (i >= before.length || JSON.stringify(before[i]) !== body)
+                                put.run(stream, i, body);
+                        }
+                        if (after.length < before.length)
+                            truncate.run(stream, after.length);
+                    }
+                    for (const [id, receipt] of Object.entries(next.receipts))
+                        if (committed?.receipts[id] !== receipt)
+                            putReceipt.run(id, JSON.stringify(receipt));
+                    db.exec("COMMIT");
+                }
+                catch (cause) {
+                    db.exec("ROLLBACK");
+                    throw cause;
+                }
+                committed = next;
+            },
+            close: () => db.close(),
+        };
+        return store;
+    }
+    catch (cause) {
+        db.close();
+        if (/locked|busy/i.test(String(cause)))
+            throw new Error("Database is locked. Stop worldvm serve before deploying.");
+        throw cause;
+    }
+};

package/dist/test.d.ts

@@ -0,0 +1,54 @@
+import { type IR, type WorldReconciliation, type CoverageReference } from "./_internal/reconciler/index.js";
+import { type CliDiagnostic, type Project } from "./project.js";
+export interface TestOptions {
+    readonly seed?: number;
+    readonly cases?: number;
+    readonly scenario?: string;
+}
+export interface TestFailure extends CliDiagnostic {
+    readonly at: IR.Span;
+    readonly expected?: unknown;
+    readonly actual?: unknown;
+}
+export interface PropertyTestFailure extends CliDiagnostic {
+    readonly at: IR.Span;
+    readonly seed: number;
+    readonly index: number;
+    readonly binding: string;
+    readonly actual: "false" | "Unknown";
+    readonly counterexample: {
+        readonly source: string;
+        readonly attempts: number;
+        readonly complete: boolean;
+        readonly originalSize: number;
+        readonly shrunkSize: number;
+    };
+}
+export interface TestReport {
+    readonly format: "worldvm/test@1";
+    readonly command: "test";
+    readonly directory: string;
+    readonly ok: boolean;
+    readonly diagnostics: readonly CliDiagnostic[];
+    readonly scenarios: readonly {
+        readonly name: string;
+        readonly passed: boolean;
+        readonly assertions: number;
+        readonly failures: readonly TestFailure[];
+    }[];
+    readonly properties: readonly {
+        readonly name: string;
+        readonly passed: boolean;
+        readonly seed: number;
+        readonly cases: number;
+        readonly checks: number;
+        readonly antecedents: readonly {
+            readonly at: IR.Span;
+            readonly cases: number;
+        }[];
+        readonly failure?: PropertyTestFailure;
+    }[];
+}
+export declare const testDirectory: (directory: string, options?: TestOptions) => Promise<TestReport>;
+/** The CLI commands share execution; coverage observes tests before any shrink replay. */
+export declare const runTests: (project: Project, options?: TestOptions, observe?: (reconciliation: WorldReconciliation, reference: CoverageReference) => void) => TestReport;

package/dist/test.js

@@ -0,0 +1,131 @@
+import { createScenarioRunner, checkProperty, shrinkPropertyFailure, validatePropertyOptions, Unknown, } from "./_internal/reconciler/index.js";
+import { loadProject } from "./project.js";
+const scenarioFailure = (f) => ({
+    code: f.code,
+    at: f.at,
+    message: f.message,
+    severity: "error",
+    help: "Inspect this expectation and its rule/proof, then correct the rule or example.",
+    fix: null,
+    ...(f.expected === undefined ? {} : { expected: f.expected }),
+    ...(f.actual === undefined ? {} : { actual: f.actual instanceof Unknown ? "Unknown" : f.actual }),
+});
+export const testDirectory = async (directory, options = {}) => {
+    validatePropertyOptions({ seed: options.seed ?? 0, cases: options.cases ?? 100 });
+    return runTests(await loadProject(directory), options);
+};
+/** The CLI commands share execution; coverage observes tests before any shrink replay. */
+export const runTests = (project, options = {}, observe) => {
+    const budgets = { seed: options.seed ?? 0, cases: options.cases ?? 100 };
+    validatePropertyOptions(budgets);
+    const diagnostics = [...project.diagnostics];
+    const scenarios = [], properties = [];
+    const report = () => ({
+        format: "worldvm/test@1",
+        command: "test",
+        directory: project.directory,
+        ok: !!project.ir &&
+            !diagnostics.some((d) => d.severity === "error") &&
+            scenarios.every((s) => s.passed) &&
+            properties.every((p) => p.passed),
+        diagnostics,
+        scenarios,
+        properties,
+    });
+    if (!project.ir || diagnostics.some((d) => d.severity === "error"))
+        return report();
+    const ir = project.ir;
+    const run = createScenarioRunner(ir);
+    const selected = (ir.scenarios ?? []).filter((s) => options.scenario === undefined || s.name === options.scenario);
+    if (options.scenario !== undefined && !selected.length) {
+        diagnostics.push({
+            code: "E_SCENARIO_NOT_FOUND",
+            severity: "error",
+            message: `No scenario named ${options.scenario}.`,
+            at: null,
+            help: `Use one of: ${(ir.scenarios ?? []).map((s) => s.name).join(", ") || "no scenarios declared"}.`,
+            fix: null,
+        });
+        return report();
+    }
+    const runtimeError = (cause, at) => diagnostics.push({
+        code: "E_TEST_RUNTIME",
+        severity: "error",
+        message: String(cause),
+        at,
+        help: "Reduce this test-engine failure to its source example and report it.",
+        fix: null,
+    });
+    for (const scenario of selected) {
+        try {
+            const result = run(scenario);
+            for (const step of result.steps)
+                observe?.(step.reconciliation, { kind: "scenario", name: scenario.name });
+            scenarios.push({
+                name: result.name,
+                passed: result.passed,
+                assertions: result.assertions,
+                failures: result.failures.map(scenarioFailure),
+            });
+        }
+        catch (cause) {
+            runtimeError(cause, scenario.at);
+        }
+    }
+    if (options.scenario === undefined)
+        for (const property of ir.properties ?? []) {
+            try {
+                const result = checkProperty(ir, property, budgets, (observed) => {
+                    for (const step of observed.steps)
+                        observe?.(step.reconciliation, { kind: "property", name: property.name });
+                }, run), f = result.failure;
+                for (const antecedent of result.antecedents)
+                    if (antecedent.cases === 0)
+                        diagnostics.push({
+                            code: "W_PROPERTY_VACUOUS",
+                            severity: "warning",
+                            message: `${property.name}: implication antecedent was true in 0 of ${result.cases} generated cases.`,
+                            at: antecedent.at,
+                            help: "Seed facts and evidence with a property given block so this antecedent is exercised.",
+                            fix: null,
+                        });
+                if (!f) {
+                    properties.push({
+                        name: result.name,
+                        passed: result.passed,
+                        seed: result.seed,
+                        cases: result.cases,
+                        checks: result.checks,
+                        antecedents: result.antecedents,
+                    });
+                    continue;
+                }
+                const { source, attempts, complete, originalSize, shrunkSize } = shrinkPropertyFailure(ir, property, f);
+                properties.push({
+                    name: result.name,
+                    passed: false,
+                    seed: result.seed,
+                    cases: result.cases,
+                    checks: result.checks,
+                    antecedents: result.antecedents,
+                    failure: {
+                        code: "E_PROPERTY_ASSERT",
+                        severity: "error",
+                        message: `${property.name} was ${f.actual} for ${f.binding}, seed ${f.seed}, case ${f.index}.`,
+                        at: f.at,
+                        help: "Compile the counterexample with the original definitions/property to replay this failed claim.",
+                        fix: null,
+                        seed: f.seed,
+                        index: f.index,
+                        binding: f.binding,
+                        actual: f.actual,
+                        counterexample: { source, attempts, complete, originalSize, shrunkSize },
+                    },
+                });
+            }
+            catch (cause) {
+                runtimeError(cause, property.predicate.at);
+            }
+        }
+    return report();
+};

package/dist/world.d.ts

@@ -0,0 +1,7 @@
+export { open, type OpenOptions } from "./handle/open.js";
+export { host, WorldError, type Actor, type Change, type HostOptions, type InstanceStatus, type Operation, type Outcome, type PerformOptions, type RequirementStatus, type Scalar, type Status, type Subject, type SubjectStatus, type WorkItem, type World, type WriteOptions, } from "./handle/world.js";
+export { memory, type Receipt, type Store, type StoreState } from "./handle/store.js";
+export type { ExplainedRequirement } from "./explain.js";
+export type { WorldTypes, TypedWorld, TypedSubject, WorkId } from "./handle/types.js";
+export { operate } from "./handle/protocol.js";
+export type { Draft, Proposal, Verb, Request, Response, Result, ProtocolError, } from "./_internal/protocol/index.js";

package/dist/world.js

@@ -0,0 +1,5 @@
+// The embedding API: `import { open } from "worldvm"`.
+export { open } from "./handle/open.js";
+export { host, WorldError, } from "./handle/world.js";
+export { memory } from "./handle/store.js";
+export { operate } from "./handle/protocol.js";

package/docs/authoring/vendor-risk/example.forma

@@ -0,0 +1,11 @@
+;; Synthetic example account; illustrative only.
+(entity Person "A synthetic person." :ns :example.person :display name
+  :implements {vendor/person {:name name}} {:name String})
+(entity Vendor "A synthetic vendor." :ns :example.vendor :display name
+  :implements {vendor/record {:name name :owner owner :cisos cisos :tier tier :status status
+                              :opened opened}}
+  {:name String :owner (Id Person) :cisos Group :tier RiskTier :status VendorStatus
+   :opened Date})
+(account example "An isolated synthetic vendor-risk account."
+  :requires {example.vendor-risk "1.0"} :package example
+  (for-each vendor/record VendorReview))

package/docs/authoring/vendor-risk/library/vendor.forma

@@ -0,0 +1,76 @@
+;; Vendor risk review, rewritten from the cold-author trial with the AUTHORING.md idioms.
+;; Synthetic policy; illustrative, not legal or compliance advice.
+(library example.vendor-risk
+  "Security review requirements for vendors that touch customer data."
+  :version "1.0" :subject vendor/record)
+
+(type RiskTier (Union :high :standard :none))
+(type VendorStatus (Union :onboarding :active))
+(role vendor/person "A reviewer, CISO or procurement user." {:name String})
+(role vendor/record "A vendor with a review owner, CISO group and lifecycle status."
+  {:name String :owner (Id vendor/person) :cisos Group :tier RiskTier
+   :status VendorStatus :opened Date})
+
+(source vendor-policy
+  "Synthetic vendor-risk policy; not legal or compliance advice."
+  :kind :policy :url "https://example.invalid/vendor-policy" :as-of "2026-11-06")
+
+(evidence SecurityQuestionnaire "A completed, signed vendor security questionnaire." :of VendorReview
+  :expires (months-after signed-on 12)
+  {:summary String}
+  (attest :signer vendor.owner :covers :all :method :otp))
+(evidence Soc2Report "A SOC 2 Type II report, valid until the date its auditor states." :of VendorReview
+  :expires valid-until
+  {:summary String :valid-until Date}
+  (attest :signer vendor.owner :covers :all :method :otp))
+(evidence DataProcessingAgreement "A signed data processing agreement." :of VendorReview
+  {:summary String}
+  (attest :signer vendor.owner :covers :all :method :otp))
+
+(layout ReviewLayout "Record and sign a review artifact."
+  (step record "Record" (field summary) (sign)))
+(layout Soc2Layout "Record the SOC 2 report and its validity."
+  (step record "Record" (field summary) (field valid-until) (sign)))
+(interaction QuestionnaireEntry "Complete the questionnaire."
+  :actor vendor.owner :produces SecurityQuestionnaire :layout ReviewLayout)
+(interaction Soc2Entry "Record the SOC 2 report."
+  :actor vendor.owner :produces Soc2Report :layout Soc2Layout)
+(interaction DpaEntry "Record the DPA."
+  :actor vendor.owner :produces DataProcessingAgreement :layout ReviewLayout)
+
+(component VendorReview "Track the security review of one vendor."
+  :key [vendor] :inputs {:vendor (Id vendor/record)}
+  :operations [submit-questionnaire submit-soc2 submit-dpa approve-exception]
+  (requirement questionnaire
+    :cites [(vendor-policy "1: completed security questionnaire, renewed every 12 months")]
+    :applies-when (!= vendor.tier :none)
+    :satisfied-by (valid SecurityQuestionnaire)
+    :renew-within (days 30))
+  (requirement soc2-or-exception
+    :cites [(vendor-policy "2: current SOC 2 Type II or an approved exception")]
+    :applies-when (!= vendor.tier :none)
+    :satisfied-by (or (valid Soc2Report) (decided approve-exception)))
+  (requirement dpa
+    :cites [(vendor-policy "3: high-risk vendors need a DPA")]
+    :applies-when (= vendor.tier :high)
+    :satisfied-by (attested DataProcessingAgreement))
+  (requirement active-only-if-reviewed
+    :cites [(vendor-policy "4: not active while the review is incomplete or expired")]
+    :applies-when (= vendor.status :active)
+    :satisfied-by (met? self.review-complete))
+  (invariant no-activation-before-review
+    :cites [(vendor-policy "4: not active while the review is incomplete or expired")]
+    :forbids (action-kind :activate :subject vendor)
+    :while (not (met? self.review-complete)))
+  (action submit-questionnaire :advances questionnaire :assignee vendor.owner
+    :via (interaction QuestionnaireEntry))
+  (action submit-soc2 :advances soc2-or-exception :assignee vendor.owner :via (interaction Soc2Entry))
+  (action submit-dpa :advances dpa :assignee vendor.owner :via (interaction DpaEntry))
+  (output review-complete (all-of questionnaire soc2-or-exception dpa))
+  (output reviewed (all-of review-complete active-only-if-reviewed)))
+
+(decision approve-exception
+  "Only a CISO approves a SOC 2 exception, with a reason; it lasts six months."
+  :of VendorReview :applies soc2-or-exception :by (members vendor.cisos)
+  :effect :approve :reason String :expires (months 6)
+  :cites [(vendor-policy "5: CISO-only exceptions with a reason, expiring after six months")])

package/docs/authoring/vendor-risk/scenarios/reviews.forma

@@ -0,0 +1,107 @@
+;; Synthetic scenarios; illustrative, not legal or compliance advice.
+(scenario high-risk-complete "A high-risk vendor with every artifact is reviewed." :world example
+  (given (entity Person owner {:name "Owner"})
+    (entity Vendor v {:name "Acme Analytics" :owner owner :cisos "CISO" :tier :high
+                      :status :onboarding :opened "2026-11-06"})
+    (actor owner))
+  (at "2026-11-06" (expect (status (VendorReview v) dpa) :Open))
+  (do (evidence SecurityQuestionnaire :for (VendorReview v) :requirement questionnaire :by owner
+        :values {:summary "Completed"})
+      (evidence Soc2Report :for (VendorReview v) :requirement soc2-or-exception :by owner
+        :values {:summary "SOC 2 Type II" :valid-until "2027-06-01"})
+      (evidence DataProcessingAgreement :for (VendorReview v) :requirement dpa :by owner
+        :values {:summary "DPA on file"}))
+  (at "2026-11-07" (expect (status (VendorReview v) review-complete) :Satisfied)))
+
+(scenario standard-needs-no-dpa "A standard-risk vendor does not need a DPA." :world example
+  (given (entity Person owner {:name "Owner"})
+    (entity Vendor v {:name "Pencils Inc" :owner owner :cisos "CISO" :tier :standard
+                      :status :onboarding :opened "2026-11-06"}))
+  (at "2026-11-06"
+    (expect (status (VendorReview v) dpa) :NotApplicable)
+    (expect (status (VendorReview v) questionnaire) :Open)))
+
+(scenario no-customer-data "A vendor that touches no customer data owes no review." :world example
+  (given (entity Person owner {:name "Owner"})
+    (entity Vendor v {:name "Coffee Co" :owner owner :cisos "CISO" :tier :none
+                      :status :onboarding :opened "2026-11-06"}))
+  (at "2026-11-06"
+    (expect (status (VendorReview v) questionnaire) :NotApplicable)
+    (expect (status (VendorReview v) soc2-or-exception) :NotApplicable)
+    (expect (status (VendorReview v) review-complete) :NotApplicable)))
+
+(scenario no-data-vendor-can-be-active "A vendor that owes no review may be activated." :world example
+  (given (entity Person owner {:name "Owner"}) (entity Person buyer {:name "Buyer"})
+    (entity Vendor v {:name "Coffee Co" :owner owner :cisos "CISO" :tier :none
+                      :status :onboarding :opened "2026-11-06"})
+    (actor buyer :groups ["Procurement"]))
+  (do (set v :status :active :kind :activate :subject v :by buyer))
+  (at "2026-11-06" (expect (status (VendorReview v) active-only-if-reviewed) :Satisfied)))
+
+(scenario soc2-report-expires "A SOC 2 report counts until its stated validity date." :world example
+  (given (entity Person owner {:name "Owner"})
+    (entity Vendor v {:name "Acme Analytics" :owner owner :cisos "CISO" :tier :standard
+                      :status :onboarding :opened "2026-11-06"})
+    (actor owner))
+  (do (evidence Soc2Report :for (VendorReview v) :requirement soc2-or-exception :by owner
+        :values {:summary "SOC 2 Type II" :valid-until "2027-06-01"}))
+  (at "2027-05-31" (expect (status (VendorReview v) soc2-or-exception) :Satisfied))
+  (at "2027-06-01" (expect (status (VendorReview v) soc2-or-exception) :Open)))
+
+(scenario questionnaire-expires "A questionnaire lasts 12 months from signing, then reopens." :world example
+  (given (entity Person owner {:name "Owner"})
+    (entity Vendor v {:name "Acme Analytics" :owner owner :cisos "CISO" :tier :standard
+                      :status :onboarding :opened "2026-11-06"})
+    (actor owner))
+  (do (evidence SecurityQuestionnaire :for (VendorReview v) :requirement questionnaire :by owner
+        :values {:summary "Completed"}))
+  (at "2026-11-07" (expect (status (VendorReview v) questionnaire) :Satisfied))
+  (at "2027-11-06" (expect (status (VendorReview v) questionnaire) :Satisfied))
+  (at "2027-11-07" (expect (status (VendorReview v) questionnaire) :Open)))
+
+(scenario ciso-exception "Only a CISO approves an exception, and it expires after six months." :world example
+  (given (entity Person owner {:name "Owner"}) (entity Person ciso {:name "CISO"})
+    (entity Vendor v {:name "Acme Analytics" :owner owner :cisos "CISO" :tier :standard
+                      :status :onboarding :opened "2026-11-06"})
+    (actor owner :groups ["Owners"]) (actor ciso :groups ["CISO"]))
+  (do (decide (VendorReview v) approve-exception :by owner :reason "I want it"))
+  (at "2026-11-06"
+    (expect (rejected 1) :decision-authority)
+    (expect (status (VendorReview v) soc2-or-exception) :Open))
+  (do (decide (VendorReview v) approve-exception :by ciso :reason "Compensating controls reviewed"))
+  (at "2026-11-07" (expect (status (VendorReview v) soc2-or-exception) :Satisfied))
+  (at "2027-05-06" (expect (status (VendorReview v) soc2-or-exception) :Satisfied))
+  (at "2027-05-07" (expect (status (VendorReview v) soc2-or-exception) :Open)))
+
+(scenario activation-blocked "Procurement cannot activate a vendor until its review is complete." :world example
+  (given (entity Person owner {:name "Owner"}) (entity Person buyer {:name "Buyer"})
+    (entity Vendor v {:name "Acme Analytics" :owner owner :cisos "CISO" :tier :standard
+                      :status :onboarding :opened "2026-11-06"})
+    (actor owner) (actor buyer :groups ["Procurement"]))
+  (do (set v :status :active :kind :activate :subject v :by buyer))
+  (at "2026-11-06"
+    (expect (rejected 1) :no-activation-before-review)
+    (expect (status (VendorReview v) active-only-if-reviewed) :NotApplicable))
+  (do (evidence SecurityQuestionnaire :for (VendorReview v) :requirement questionnaire :by owner
+        :values {:summary "Completed"})
+      (evidence Soc2Report :for (VendorReview v) :requirement soc2-or-exception :by owner
+        :values {:summary "SOC 2" :valid-until "2028-01-01"}))
+  (at "2026-11-07" (expect (status (VendorReview v) review-complete) :Satisfied))
+  (do (set v :status :active :kind :activate :subject v :by buyer))
+  (at "2026-11-08" (expect (status (VendorReview v) reviewed) :Satisfied)))
+
+(scenario active-without-review "An active vendor with no review is flagged." :world example
+  (given (entity Person owner {:name "Owner"})
+    (entity Vendor v {:name "Rogue SaaS" :owner owner :cisos "CISO" :tier :standard
+                      :status :active :opened "2026-11-06"}))
+  (at "2026-11-06" (expect (status (VendorReview v) active-only-if-reviewed) :Open)))
+
+(property active-implies-reviewed "An active vendor that handles data is reviewed or flagged."
+  :world example :at "2026-11-06" :for-all (v Vendor)
+  (implies (and (known? v.status) (known? v.tier) (= v.status :active) (!= v.tier :none))
+    (or (= (status (VendorReview v) review-complete) :Satisfied)
+        (= (status (VendorReview v) active-only-if-reviewed) :Open))))
+
+(property dpa-only-for-high "A vendor below high risk never owes a DPA."
+  :world example :at "2026-11-06" :for-all (v Vendor)
+  (implies (and (known? v.tier) (!= v.tier :high)) (met? (status (VendorReview v) dpa))))