apsimo 1.3.0__py3-none-any.whl

apsimo/directives/extractor.py

@@ -0,0 +1,188 @@
+"""DirectiveExtractor -- capture standing directives from owner messages.
+
+Deterministic, cue-driven detection of prohibitions ("don't / stop / avoid /
+leave X alone"), requirements ("always / from now on / make sure to X"), and
+revocations ("you can X again / disregard that"). Owner-gated by the caller.
+
+Only explicitly lasting clauses become standing rules. Ordinary task limits
+stay in their source conversation. Pure communication-STYLE directives
+("be concise", "no emoji") are left to the PreferenceLearner and skipped here.
+"""
+
+from __future__ import annotations
+
+import re
+from typing import List
+
+from apsimo.directives.models import (
+    Directive, Polarity, normalize_terms,
+)
+
+# Prohibition openers -> capture the subject that follows.
+_PROHIBIT_PATTERNS = [
+    re.compile(r"\b(?:do\s*not|don'?t|never|no\s+longer)\s+(?P<subj>.+)", re.I),
+    re.compile(r"\b(?:stop|avoid|quit|cease|drop|skip)\s+(?P<subj>.+)", re.I),
+    re.compile(r"\b(?:steer\s+clear\s+of|stay\s+away\s+from|lay\s+off|hands\s+off)\s+(?P<subj>.+)", re.I),
+    re.compile(r"\bleave\s+(?P<subj>.+?)\s+alone\b", re.I),
+    re.compile(r"\b(?:ignore|forget\s+about)\s+(?P<subj>.+)", re.I),
+]
+
+# Revocation openers -> the owner is lifting a prior boundary.
+_REVOKE_PATTERNS = [
+    re.compile(r"\b(?:you\s+can\s+now|go\s+ahead\s+and|actually,?\s+(?:you\s+can|go\s+ahead)|nevermind|never\s+mind|disregard(?:\s+(?:that|what\s+i\s+said))?|forget\s+what\s+i\s+said)\s*(?P<subj>.*)", re.I),
+    re.compile(r"\b(?:resume|unpause|restart)\s+(?P<subj>.+)", re.I),
+]
+
+# One-command global pause (Amendment 1.5): the owner's kill switch. Any of
+# these phrasings becomes an immediate GLOBAL ACT-level boundary: every
+# autonomous act is refused until the owner lifts it (staged confirmation,
+# like any boundary lift). Perception/reads stay open (ACT semantics).
+_GLOBAL_PAUSE_PATTERNS = [
+    re.compile(r"\b(?:stop|pause|halt|freeze|suspend)\s+(?:(?:all|your|the|any)\s+)*"
+               r"(?:acting|autonomy|autonomous\s+(?:actions?|work|mode)|"
+               r"taking\s+actions?|doing\s+things)\b", re.I),
+    re.compile(r"\bstand\s+down\b", re.I),
+    re.compile(r"\bstop\s+acting\s+on\s+your\s+own\b", re.I),
+]
+
+
+def make_global_pause_directive(raw_text: str = "",
+                                source: str = "owner_explicit") -> Directive:
+    """The global ACT-level pause boundary (kill switch)."""
+    from apsimo.directives.models import GLOBAL_PAUSE_TERM, Level
+    return Directive(
+        subject="all autonomous actions (global pause)",
+        polarity=Polarity.PROHIBIT,
+        raw_text=raw_text or "stop acting",
+        # GLOBAL_PAUSE_TERM makes the guard refuse every act-capability
+        # action; the plain terms let "resume autonomy/acting" find and lift
+        # this directive through the normal staged confirmation.
+        match_terms=[GLOBAL_PAUSE_TERM, "autonomy", "acting", "autonomous"],
+        source=source, confidence=1.0, level=Level.ACT,
+    )
+
+# Clause terminators: cut the subject at the first of these.
+_CLAUSE_END = re.compile(r"\.(?=\s|$)|[;,!?\n]| but | and then | because | since | unless | so that ", re.I)
+
+# Words that mark a pure communication-style directive (handled elsewhere).
+_STYLE_ONLY = frozenset({
+    "concise", "verbose", "brief", "shorter", "longer", "emoji", "emojis",
+    "formal", "casual", "tone", "bullets", "bullet", "markdown", "wordy",
+    "replies", "reply", "responses", "response", "language", "words", "word",
+    # fillers that commonly accompany a pure style directive
+    "using", "use", "being", "sound", "sounding", "talking", "writing",
+})
+
+
+def _clean_subject(subj: str) -> str:
+    subj = _CLAUSE_END.split(subj, 1)[0].strip()
+    # strip a leading gerund/verb that adds no discriminating value is NOT done
+    # here: keeping "researching competitors" preserves intent; the guard's
+    # loose stem matching handles research/researching.
+    return subj.strip(" '\"")
+
+
+def _is_style_only(subj: str) -> bool:
+    terms = set(normalize_terms(subj))
+    return bool(terms) and terms.issubset(_STYLE_ONLY)
+
+
+# Durable admission requires positive lasting scope. Task instructions remain
+# canonical evidence, even when they contain imperatives such as "never".
+_TASK_SCOPE = re.compile(
+    r"\b(?:for|during) (?:this|the current) (?:task|request|phase|run|example)\b"
+    r"|\b(?:this is|these are) (?:an? |the )?(?:temporary|one[- ]off) (?:task |standing )?(?:instruction|requirement|rule|constraint)s?\b"
+    r"|(?:^|[.!?;\n]\s*)(?:temporary|one[- ]off) (?:task )?(?:instruction|requirement|rule|constraint)s?\s*[:.!?;\n]"
+    r"|\bnot (?:a |my )?(?:personal preference|standing (?:rule|instruction|boundary))\b"
+    r"|\b(?:for now|until (?:this|the) (?:task|phase|run) (?:ends|finishes|completes))\b", re.I)
+_STANDING = re.compile(r"^(?:please\s+)?(?:(?:from now on|going forward|as a standing rule|as a permanent rule|permanently)[,:]?\s+|(?:always|never)\s+)", re.I)
+_SENTENCES = re.compile(r"(?<=[.!?])\s+|[;\n]+")
+
+
+def standing_clauses(message: str) -> List[str]:
+    """Bounded, exact clauses with explicit lasting intent, not inferred intent."""
+    text = (message or '').strip()
+    if not text or _TASK_SCOPE.search(text):
+        return []
+    admitted = []
+    for candidate in _SENTENCES.split(text):
+        clause = candidate.strip()
+        prefix = _STANDING.match(clause)
+        if prefix is None:
+            continue
+        # The keyword guard cannot enforce exceptions or contextual conditions.
+        # Keep these instructions in the conversation instead of broadening
+        # them into an unconditional standing prohibition.
+        if re.search(r'\b(?:unless|until|except|if|when|without)\b', clause, re.I):
+            continue
+        # Keep the exact rule clause, excluding explanatory or unrelated text.
+        ending = _CLAUSE_END.search(clause, prefix.end())
+        if ending:
+            end = ending.start() + (ending[0] in '.!?')
+            clause = clause[:end].strip()
+        if 0 < len(clause) <= 500:
+            if clause not in admitted:
+                admitted.append(clause)
+    return admitted
+
+
+def extract_directives(message: str, *, source: str = "owner_explicit") -> List[Directive]:
+    """Extract explicit standing owner rules; one-off work is not a rule."""
+    from apsimo.directives.models import Level
+    text = (message or '').strip()
+    if not text:
+        return []
+    # The standalone pause command retains its immediate, explicit meaning.
+    command = re.sub(r'^please\s+', '', text.rstrip('.!?'), flags=re.I)
+    command = re.sub(r'\s+(?:for now|for a while)$', '', command, flags=re.I)
+    if any(pattern.fullmatch(command) for pattern in _GLOBAL_PAUSE_PATTERNS):
+        return [make_global_pause_directive(text, source=source)]
+    # Lifting a rule is explicit interaction with an existing rule, not new
+    # durable learning. Keep the existing confirmation behavior unchanged.
+    for pattern in _REVOKE_PATTERNS:
+        match = pattern.match(text)
+        if match and not _TASK_SCOPE.search(text):
+            subject = _clean_subject(match.group('subj') or '')
+            if subject and not _is_style_only(subject):
+                directive = Directive(subject=subject, polarity=Polarity.PREFER,
+                                      raw_text=text, source=source)
+                directive.__dict__['_revocation'] = True
+                return [directive]
+            return []
+    result = []
+    for clause in standing_clauses(text):
+        prefix = _STANDING.match(clause)
+        body = clause[prefix.end():].strip()
+        # Never/always themselves are the lasting imperative.
+        if re.search(r'\bnever\s+$', prefix[0], re.I):
+            body = 'never '+body
+        polarity, subject = Polarity.REQUIRE, body
+        for pattern in _PROHIBIT_PATTERNS:
+            match = pattern.match(body)
+            if match:
+                polarity, subject = Polarity.PROHIBIT, match.group('subj')
+                break
+        if polarity == Polarity.PROHIBIT and re.search(r'\b(?:before|after|once)\b', body, re.I):
+            continue
+        subject = re.sub(r'^always\s+', '', _clean_subject(subject), flags=re.I)
+        if polarity == Polarity.PROHIBIT and re.match(
+                r'^(?:(?:forget|fail|neglect|refuse)\s+to\b|stop\s+\w+ing\b)', subject, re.I):
+            continue  # Negated omissions do not prohibit the underlying action.
+        if (not subject or len(subject) < 2 or _is_style_only(subject)
+                or re.match(r'^(?:(?:I|we|he|she|they|my|your|did|had|has|was|were|is|am|are)\b|have\s+(?:I|we|they)\b)', subject, re.I)
+                or re.match(r'^(?:(?:again|ever|really|actually|previously|once)\s+)*(?:did|do|does|have|has|had|am|is|are|was|were)\s+(?:I|we|he|she|they|you)\b', subject, re.I)
+                or polarity == Polarity.REQUIRE and not re.match(
+                    r'^(?:ask|check|confirm|consult|contact|keep|leave|look|make|maintain|notify|obtain|read|remember|report|request|require|respect|review|run|save|seek|send|show|tell|test|track|use|verify|wait)\b', subject, re.I)):
+            continue
+        # Only the prohibited action determines observation versus action.
+        # Unrelated "read the documentation" elsewhere cannot escalate it.
+        perception = re.match(r'^(?:even\s+)?(?:look(?:ing)?\s+at|read(?:ing)?\b|watch(?:ing)?\b|monitor(?:ing)?\b|track(?:ing)?\b|stay\s+out\s+of|snoop|peek|observ(?:e|ing))', subject, re.I)
+        result.append(Directive(subject=subject, polarity=polarity, raw_text=clause,
+            match_terms=normalize_terms(subject), source=source,
+            confidence=0.9 if source == 'owner_explicit' else 0.6,
+            level=Level.OBSERVE if polarity == Polarity.PROHIBIT and perception else Level.ACT))
+    return result
+
+
+def is_revocation(directive: Directive) -> bool:
+    return bool(directive.__dict__.get("_revocation"))

apsimo/directives/guard.py

@@ -0,0 +1,364 @@
+"""DirectiveGuard -- enforce owner boundaries before any autonomous action.
+
+Given a proposed action (deliver a message, execute a tool, run a directed
+task, generate an initiative), the guard checks it against every active
+PROHIBIT directive and returns a Verdict. Callers at each action chokepoint
+(executor, delivery, generation, directed-action) consult it and REFUSE when
+a boundary is violated.
+
+Matching is deterministic and biased toward catching real violations on
+SPECIFIC subjects (repo names, business names, proper nouns) while avoiding
+false blocks on generic words. This hard, code-level gate is paired with
+soft LLM awareness (active directives injected into reasoning context), so a
+model can neither forget nor talk its way past a standing boundary.
+"""
+
+from __future__ import annotations
+
+import logging
+import re
+import time
+from collections import deque
+from dataclasses import dataclass, field
+from typing import Any, Dict, List, Optional
+
+from apsimo.directives.models import (
+    GLOBAL_PAUSE_TERM, Directive, Level, Polarity, normalize_terms,
+)
+
+logger = logging.getLogger(__name__)
+
+# Capability classes (tiered boundary semantics): boundaries bind ACTION, not
+# judgment or perception, unless explicitly about perception. READ kinds stay
+# open under an ACT-level boundary and are blocked only by an OBSERVE
+# blackout. Active autonomous work (research jobs, delegation, delivery,
+# execution) is an ACT capability -- "stop researching X" must stop research
+# about X, while awareness/reads of X survive "don't touch X".
+_READ_KINDS = frozenset({"repo_read", "read", "recall", "populate", "observe"})
+
+
+class DirectiveStoreUnavailable(RuntimeError):
+    """The active owner-boundary set could not be read safely.
+
+    An unavailable or malformed store is not equivalent to a healthy store
+    with zero active prohibitions.  Enforcement callers use this distinct
+    failure to apply their capability-specific fail-closed policy.
+    """
+
+
+def action_capability(kind: str) -> str:
+    return "read" if (kind or "").lower() in _READ_KINDS else "act"
+
+
+def boundary_fail_closed() -> bool:
+    """Whether an ERROR inside a boundary check refuses the action.
+
+    Default TRUE: a boundary is an owner-set prohibition, so an exception
+    while evaluating it must refuse (fail closed) rather than silently
+    allow the very action the owner may have forbidden. Set
+    COLONY_BOUNDARY_FAIL_CLOSED=false to restore the legacy allow-on-error
+    behavior.
+    """
+    from apsimo.util.autonomy_preset import resolve_bool
+    return resolve_bool("COLONY_BOUNDARY_FAIL_CLOSED", True)
+
+
+@dataclass
+class Action:
+    """A proposed autonomous action to be checked against boundaries."""
+
+    kind: str                       # deliver | execute_tool | directed_action | generate | research
+    text: str = ""                  # description / message / topic
+    target: str = ""                # recipient / repo / business / subject
+    entity_id: str = ""             # optional graph entity id
+    tool_name: str = ""
+    args: Optional[Dict[str, Any]] = None
+    high_risk: bool = False         # outbound / mutating / directed -> fail-closed on ambiguity
+
+    def searchable_terms(self) -> List[str]:
+        parts = [self.text, self.target, self.tool_name]
+        if self.args:
+            for v in self.args.values():
+                if isinstance(v, (str, int, float)):
+                    parts.append(str(v))
+        toks = set()
+        for p in parts:
+            toks.update(normalize_terms(p))
+        return list(toks)
+
+
+@dataclass
+class Verdict:
+    allowed: bool
+    violations: List[Directive] = field(default_factory=list)
+    reason: str = "ok"
+
+    def as_dict(self) -> Dict[str, Any]:
+        return {
+            "allowed": self.allowed,
+            "reason": self.reason,
+            "violations": [
+                {"id": d.id, **({} if d.evidence else {"subject": d.subject, "raw_text": d.raw_text})}
+                for d in self.violations
+            ],
+        }
+
+
+def _common_terms() -> frozenset:
+    """Terms that appear in virtually every internal action text and must
+    never count as a match signal on their own: the product name, the agent's
+    own name, plus any deployment-supplied extras (COLONY_MATCH_COMMON_TERMS,
+    csv). Live incident 2026-07-05: a fragment boundary whose only surviving
+    term was "colony" matched every job that said "report to Colony"."""
+    import os
+    terms = {"colony"}
+    agent = os.environ.get("COLONY_AGENT_NAME", "")
+    for tok in re.findall(r"[a-z0-9]+", agent.lower()):
+        if len(tok) > 1:
+            terms.add(tok)
+    extra = os.environ.get("COLONY_MATCH_COMMON_TERMS", "")
+    for tok in extra.lower().split(","):
+        tok = tok.strip()
+        if tok:
+            terms.add(tok)
+    return frozenset(terms)
+
+
+def _is_distinctive(term: str) -> bool:
+    """A term specific enough that a single match is a real signal.
+
+    The bar is deliberately high (>=8 chars, or a separator/digit shape like
+    repo/path/version tokens): mid-length generic words ("attempt",
+    "respond", "message") matching alone caused mass false blocks. Shorter
+    real subjects still match through the all-terms path below.
+    """
+    if term in _common_terms():
+        return False
+    return (
+        len(term) >= 8
+        or any(c in term for c in "-_/.")
+        or any(c.isdigit() for c in term)
+    )
+
+
+def _terms_match(directive_terms: List[str], action_terms: List[str]) -> bool:
+    """True if the directive's subject matches the action's terms."""
+    if not directive_terms:
+        return False
+    action = set(action_terms)
+
+    def _hit(t: str) -> bool:
+        if t in action:
+            return True
+        # Stem/prefix containment for morphological variants only
+        # (research/researching, cert/certs, deploy/deployment). The shorter
+        # side must be a real stem: >=5 chars, or within 2 chars of the
+        # longer word. Without that floor, "what" counted as a variant of
+        # "whatsapp" and a WhatsApp boundary matched any sentence containing
+        # the word "what" (live false-block, 2026-07-05).
+        if len(t) >= 4:
+            for a in action:
+                if a == t:
+                    return True
+                if len(a) >= 4 and (a.startswith(t) or t.startswith(a)):
+                    shorter, longer = (a, t) if len(a) <= len(t) else (t, a)
+                    if len(shorter) >= 5 or len(longer) - len(shorter) <= 2:
+                        return True
+        return False
+
+    hits = [t for t in directive_terms if _hit(t)]
+    if not hits:
+        return False
+    # A distinctive subject term (repo/business/proper-noun-like) matching alone
+    # is a real signal. Generic short terms require the whole subject to match,
+    # and an all-terms match must include at least one substantive (len>=4,
+    # non-common) term so pronoun-grade fragments can never bind.
+    if any(_is_distinctive(t) for t in hits):
+        return True
+    common = _common_terms()
+    if not any(len(t) >= 4 and t not in common for t in hits):
+        return False
+    return len(hits) == len(directive_terms)
+
+
+class DirectiveGuard:
+    """Consults the directive store and enforces PROHIBIT boundaries."""
+
+    def __init__(self, store: Any) -> None:
+        self._store = store
+        # Recent refusals, for observability / "why didn't you do X" answers.
+        self._recent_blocks: deque = deque(maxlen=100)
+        # Entity-scoped matching (2): {frozenset(alias_tokens): entity_id}. Built
+        # from the world model as entities are learned; empty -> keyword-only.
+        self._entity_index: Dict[frozenset, str] = {}
+
+    def set_entity_index(self, entities: Dict[str, List[str]]) -> None:
+        """Refresh the alias->entity_id index. entities = {entity_id: [names/aliases]}."""
+        index: Dict[frozenset, str] = {}
+        for eid, aliases in (entities or {}).items():
+            for alias in aliases:
+                toks = frozenset(normalize_terms(alias))
+                if toks:
+                    index[toks] = eid
+        self._entity_index = index
+
+    def _resolve_entities(self, terms: set) -> set:
+        """Entity IDs whose alias tokens are all present in `terms`."""
+        if not self._entity_index or not terms:
+            return set()
+        return {eid for alias_toks, eid in self._entity_index.items()
+                if alias_toks <= terms}
+
+    def _active_prohibitions(self) -> List[Directive]:
+        if self._store is None:
+            raise DirectiveStoreUnavailable("directive store is unavailable")
+        try:
+            active = self._store.active(polarity=Polarity.PROHIBIT)
+        except Exception as exc:
+            logger.warning("DirectiveGuard: store read failed: %s", exc)
+            raise DirectiveStoreUnavailable(
+                "directive store active-boundary read failed"
+            ) from exc
+
+        if not isinstance(active, (list, tuple)) or any(
+            not isinstance(directive, Directive) for directive in active
+        ):
+            logger.warning(
+                "DirectiveGuard: store returned a malformed active-boundary set"
+            )
+            raise DirectiveStoreUnavailable(
+                "directive store returned a malformed active-boundary set"
+            )
+        return list(active)
+
+    def check(self, action: Action) -> Verdict:
+        """Return a Verdict. allowed=False means the action violates a boundary."""
+        prohibitions = self._active_prohibitions()
+        if not prohibitions:
+            return Verdict(allowed=True, reason="no_active_boundaries")
+
+        action_terms = action.searchable_terms()
+        action_term_set = set(action_terms)
+        capability = action_capability(action.kind)
+
+        # Global pause (Amendment 1.5): an active kill-switch boundary refuses
+        # every act-capability action immediately, no matching required.
+        # Reads/perception stay open (ACT semantics).
+        if capability != "read":
+            paused = [d for d in prohibitions
+                      if GLOBAL_PAUSE_TERM in (d.match_terms or [])]
+            if paused:
+                d = paused[0]
+                action_summary = (action.text or action.target or action.tool_name)[:120]
+                logger.warning(
+                    "DirectiveGuard GLOBAL PAUSE active [%s]: %s action (%r) "
+                    "refused", d.id, action.kind, "source-bound action" if d.evidence else action_summary,
+                )
+                self._recent_blocks.append({
+                    "ts": time.time(),
+                    "action_kind": action.kind,
+                    "capability": capability,
+                    "action_summary": action_summary,
+                    "directive_ids": [d.id],
+                    "subjects": [d.subject],
+                    "directives": [d.raw_text or d.subject],
+                })
+                return Verdict(allowed=False, violations=[d],
+                               reason="global_pause_active")
+        # Entity-scoped: resolve the action's target/terms to entity IDs so a
+        # directive about an entity blocks actions naming it by ANY alias, not
+        # just a keyword hit. Keyword matching (below) stays as the fallback.
+        action_entities = {action.entity_id} if action.entity_id else set()
+        action_entities |= self._resolve_entities(action_term_set)
+        violations: List[Directive] = []
+        for d in prohibitions:
+            # Tiered semantics: an ACT-level boundary binds actions only;
+            # reads/perception stay open. Only an OBSERVE blackout binds reads.
+            if capability == "read" and (d.level or Level.ACT) != Level.OBSERVE:
+                continue
+            # scope by action kind if the directive restricts kinds
+            if d.action_kinds and action.kind not in d.action_kinds:
+                continue
+            directive_entities = set(d.entity_ids) | self._resolve_entities(set(d.match_terms))
+            if action_entities and directive_entities & action_entities:
+                violations.append(d)
+                continue
+            if _terms_match(d.match_terms, action_terms):
+                violations.append(d)
+
+        if violations:
+            subjects = "; ".join(v.id if v.evidence else v.subject for v in violations)
+            ids = ",".join(v.id for v in violations)
+            action_summary = (action.text or action.target or action.tool_name)[:120]
+            logged_summary = "source-bound action" if any(v.evidence for v in violations) else action_summary
+            logged_subjects = subjects
+            if capability == "read":
+                # OBSERVE blackout on a read: logged so introspection about the
+                # blindspot's existence still works ("not looking, per directive").
+                logger.info(
+                    "DirectiveGuard: not looking, per directive [%s] -- %s read "
+                    "of %r withheld (%s)",
+                    ids, action.kind, logged_summary, logged_subjects,
+                )
+            else:
+                logger.warning(
+                    "DirectiveGuard BLOCKED %s action (%r): violates boundary(ies) "
+                    "[%s]: %s",
+                    action.kind, logged_summary, ids, logged_subjects,
+                )
+            self._recent_blocks.append({
+                "ts": time.time(),
+                "action_kind": action.kind,
+                "capability": capability,
+                "action_summary": action_summary,
+                "directive_ids": [v.id for v in violations],
+                "subjects": [v.subject for v in violations],
+                "directives": [v.raw_text or v.subject for v in violations],
+            })
+            return Verdict(allowed=False, violations=violations,
+                           reason=f"boundary_violation: {subjects}")
+        return Verdict(allowed=True, reason="ok")
+
+    def recent_blocks(self, limit: int = 20) -> List[Dict[str, Any]]:
+        """Most-recent refusals (for the 'why didn't you do X' introspection)."""
+        # A forgotten/corrected source must not reappear through this cache.
+        items = [item for item in self._recent_blocks
+                 if self._store is not None and all(self._store.get(identifier)
+                     for identifier in item["directive_ids"])][-limit:]
+        items.reverse()
+        return items
+
+    def obligations(self) -> List[Directive]:
+        """Active REQUIRE directives (standing obligations)."""
+        if self._store is None:
+            return []
+        try:
+            return self._store.active(polarity=Polarity.REQUIRE)
+        except Exception:
+            return []
+
+    def context_brief(self, limit: int = 20) -> str:
+        """Render active boundaries/obligations for injection into reasoning."""
+        if self._store is None:
+            return ""
+        try:
+            active = self._store.active()
+        except Exception:
+            return ""
+        if not active:
+            return ""
+        lines: List[str] = []
+        prohibits = [d for d in active if d.polarity == Polarity.PROHIBIT][:limit]
+        requires = [d for d in active if d.polarity == Polarity.REQUIRE][:limit]
+        if prohibits:
+            lines.append("MUST NOT (standing boundaries from the owner):")
+            # Several extracted clauses can reference the same complete owner
+            # message. Keep every selected quotation, but render it only once
+            # per polarity; action enforcement still consults every directive.
+            for text in dict.fromkeys(d.raw_text or d.subject for d in prohibits):
+                lines.append(f"  - {text}")
+        if requires:
+            lines.append("MUST (standing obligations from the owner):")
+            for text in dict.fromkeys(d.raw_text or d.subject for d in requires):
+                lines.append(f"  - {text}")
+        return "\n".join(lines)