-
PALO v2.2.0 guided workflow
-
PALO Assessment Path
-
One guided route from a use-case question to an evidence bundle. Start with the context, route the work to the right PALO modules, and keep a local record of the decision.
+
PALO Evidence Pack | v3 starter experience
+
From one AI use case to reviewable evidence.
+
In less than ten minutes, turn one AI use case into a traceable evidence dossier that another person can review. This is a routing and evidence aid, not certification or a substitute for legal, technical, or independent assurance.
+
Allowed is not verified.
+
@@ -60,13 +62,14 @@ PALO Assessment Path
Five linked governance gates
The path is a routing and evidence aid. It does not certify compliance or replace a legal, technical, or fundamental-rights review.
-
+
01 Risk Tiering Describe the system and its intended use.
02 Contextual FRIA Route fundamental-rights questions when the context calls for them.
03 Controls Identify oversight, transparency, data, and incident controls.
04 KPI and KRI Turn the governance intent into measurable follow-up.
05 Evidence bundle Export the route, readiness, sources, and disclaimer.
+
Built on the PALO Assessment Path.
Optional monitoring companion. After deployment, use
PolicyWatcher to follow public privacy-policy and terms-of-service changes that may affect the operating context. Keep the original source and human review in the PALO evidence record.
PolicyWatcher monitoring signal
No signal imported. PolicyWatcher remains separate from PALO and no case data is sent to the portal.
+ The synthetic agentic invoice case is ready to load.
diff --git a/dist/PALO_PlatformMap.html b/dist/PALO_PlatformMap.html
index ed2f51b..56c87cc 100644
--- a/dist/PALO_PlatformMap.html
+++ b/dist/PALO_PlatformMap.html
@@ -16,10 +16,10 @@
-
-
Principled AI Lifecycle Orchestration
-
PALO Framework
-
One route through responsible AI and agentic governance.
-
Tell PALO who you are and what you need to achieve. It returns a proportionate route, the artifact to create and the next guided action. You do not need to treat every page as a starting point.
+
PALO Evidence Pack | Local-first
+
Allowed is not verified.
+
Give PALO one AI use case. Leave with a traceable, reviewable evidence dossier in less than ten minutes.
-
+
-
+
- Cognitive front door
-
Two questions. One clear route.
+ Gold case preview
+ What leaves your browser
-
v3.0.0
+
v3.0.1
- 01 Who are you? Executive, GRC, product, engineering, public sector or assurance.
02 What do you need to achieve? Frame, govern, deploy, verify, or govern agent actions.
PALO returns Phase, artifact and recommended next action
- Agentic route Add code-first, visual or rapid-prototyping mode only when relevant. 01 Context and affected people The intended use, owner, operating boundary and people who may be affected.
02 Route and open evidence Governance gates, source links, readiness signals and unresolved review questions.
Local artifact A reviewable evidence bundle with explicit boundaries and next actions
+
@@ -242,19 +236,19 @@ Choose the governance problem, not the pro
01 / PALO Framework Govern the AI lifecycle Executive, Governance, Risk, Product owner, Auditor
Frame the use case, classify risk, assess impacts, select controls, define measurements and connect evidence to review.
Outcome Proportionate route, Case File or evidence bundle, reviewable decision trail
-
+
02 / PALO-AM Govern agentic systems Governance, Product, Risk, Assurance, Engineering
Define agent identity, delegated authority, autonomy level, oversight, reversibility and the assurance evidence required.
PALO-AM is the agentic governance modality inside PALO.
-
+
03 / PALO-AI Enforce agent actions Developer, Platform engineer, Security, No-code builder
Apply policy gates, exact claims, approval, one-time capability, protected execution, trusted receipt and outcome verification.
PALO-AI is the technical control-plane component of PALO and remains a Developer Preview.
-
+
@@ -398,7 +392,7 @@ Every conversation leaves a usable record.
-
PALO v3.0.0
+
PALO v3.0.1
Start here
Three clear entries for the first governance conversation. Choose a starting point, then keep the decision connected to evidence.
@@ -1008,6 +1002,10 @@
+
+ v3.0.1 - Evidence Pack Activation: Made Evidence Pack the primary route with a preloaded local case, three gold cases, a voluntary SHA-256 validation receipt, Community Casebook tooling and a 30-day new-module freeze.
v3.0.0 - Semantic Foundation: Added stable semantic identity, lifecycle and append-only gate decisions, atomic evidence contracts, RDF/SHACL invariants, versioned mappings, a generated Semantic Inspector and digest-bound release inventory.AI Governance
Responsible AI
EU AI Act
+ -
+
PALO v3.0.1 - Evidence Pack Activation
+ Wed, 12 Aug 2026 13:00:00 +0200
+ https://paloframework.org/PALO_AssessmentPath.html
+ PALO Framework
+ Evidence Pack
+ Community Activation
+ Operational Evidence
+
-
PALO v3.0.0 - Semantic Foundation
Open AI governance toolkit
- v3.0.0
+ v3.0.1
-
-
Principled AI Lifecycle Orchestration
-
PALO Framework
-
One route through responsible AI and agentic governance.
-
Tell PALO who you are and what you need to achieve. It returns a proportionate route, the artifact to create and the next guided action. You do not need to treat every page as a starting point.
+
PALO Evidence Pack | Local-first
+
Allowed is not verified.
+
Give PALO one AI use case. Leave with a traceable, reviewable evidence dossier in less than ten minutes.
-
+
-
+
- Cognitive front door
-
Two questions. One clear route.
+ Gold case preview
+ What leaves your browser
-
v3.0.0
+
v3.0.1
- 01 Who are you? Executive, GRC, product, engineering, public sector or assurance.
02 What do you need to achieve? Frame, govern, deploy, verify, or govern agent actions.
PALO returns Phase, artifact and recommended next action
- Agentic route Add code-first, visual or rapid-prototyping mode only when relevant. 01 Context and affected people The intended use, owner, operating boundary and people who may be affected.
02 Route and open evidence Governance gates, source links, readiness signals and unresolved review questions.
Local artifact A reviewable evidence bundle with explicit boundaries and next actions
+
@@ -242,19 +236,19 @@ Choose the governance problem, not the pro
01 / PALO Framework Govern the AI lifecycle Executive, Governance, Risk, Product owner, Auditor
Frame the use case, classify risk, assess impacts, select controls, define measurements and connect evidence to review.
Outcome Proportionate route, Case File or evidence bundle, reviewable decision trail
-
+
02 / PALO-AM Govern agentic systems Governance, Product, Risk, Assurance, Engineering
Define agent identity, delegated authority, autonomy level, oversight, reversibility and the assurance evidence required.
PALO-AM is the agentic governance modality inside PALO.
-
+
03 / PALO-AI Enforce agent actions Developer, Platform engineer, Security, No-code builder
Apply policy gates, exact claims, approval, one-time capability, protected execution, trusted receipt and outcome verification.
PALO-AI is the technical control-plane component of PALO and remains a Developer Preview.
-
+
Every conversation leaves a usable record.
-
PALO v3.0.0
+
PALO v3.0.1
Start here
Three clear entries for the first governance conversation. Choose a starting point, then keep the decision connected to evidence.
@@ -1008,6 +1002,10 @@
+
+ v3.0.1 - Evidence Pack Activation: Made Evidence Pack the primary route with a preloaded local case, three gold cases, a voluntary SHA-256 validation receipt, Community Casebook tooling and a 30-day new-module freeze.
v3.0.0 - Semantic Foundation: Added stable semantic identity, lifecycle and append-only gate decisions, atomic evidence contracts, RDF/SHACL invariants, versioned mappings, a generated Semantic Inspector and digest-bound release inventory. --title --sector <sector> --scenario <scenario> --community <community> --author <handle>\n npm run case:contribute -- --validate-all\n\nThe command writes a Case File and PR body under contributions/cases/. It never pushes or opens a PR.`;
+if (values.help) {
+ console.log(usage);
+ process.exit(0);
+}
+
+const validators = await createValidators();
+async function validateFiles(files) {
+ let failed = false;
+ for (const file of files) {
+ const result = await loadAndValidateCase(file, { validators });
+ if (!result.valid) {
+ failed = true;
+ console.error(`${file}: ${validators.ajv.errorsText(result.errors)}`);
+ } else {
+ console.log(`Valid case: ${path.relative(PROJECT_ROOT, result.absolute)}`);
+ }
+ }
+ if (failed) process.exit(1);
+}
+
+if (values["validate-all"]) {
+ const communityRoot = path.join(PROJECT_ROOT, "contributions/cases");
+ const { readdir } = await import("node:fs/promises");
+ const communityFiles = (await readdir(communityRoot)).filter((name) => name.endsWith(".case.json")).map((name) => path.join(communityRoot, name));
+ await validateFiles([...GOLD_CASE_FILES, ...communityFiles]);
+ console.log(`Validated ${GOLD_CASE_FILES.length + communityFiles.length} Evidence Pack case(s).`);
+ process.exit(0);
+}
+
+let contribution;
+try {
+ contribution = buildContribution({
+ author: values.author,
+ community: values.community,
+ scenario: values.scenario,
+ sector: values.sector,
+ slug: values.slug,
+ title: values.title
+ });
+} catch (error) {
+ console.error(error.message);
+ console.error(usage);
+ process.exit(1);
+}
+
+if (!validators.validateCase(contribution.caseFile)) {
+ console.error(`Generated case is invalid: ${validators.ajv.errorsText(validators.validateCase.errors)}`);
+ process.exit(1);
+}
+
+const outputRoot = values["output-root"]
+ ? path.resolve(values["output-root"])
+ : path.join(PROJECT_ROOT, "contributions/cases");
+const casePath = path.join(outputRoot, `${contribution.slug}.case.json`);
+const prPath = path.join(outputRoot, `${contribution.slug}.pr.md`);
+for (const target of [casePath, prPath]) {
+ try {
+ await access(target);
+ throw new Error(`Refusing to overwrite existing file: ${target}`);
+ } catch (error) {
+ if (error.code !== "ENOENT") throw error;
+ }
+}
+await mkdir(outputRoot, { recursive: true });
+await writeFile(casePath, `${JSON.stringify(contribution.caseFile, null, 2)}\n`, { flag: "wx" });
+await writeFile(prPath, contribution.prBody, { flag: "wx" });
+
+console.log(`Generated schema-valid case: ${path.relative(PROJECT_ROOT, casePath)}`);
+console.log(`Prepared pull request body: ${path.relative(PROJECT_ROOT, prPath)}`);
+console.log("Complete the TODO fields, then run npm run case:contribute -- --validate-all.");
+console.log(`Next: git add ${path.relative(PROJECT_ROOT, casePath)} ${path.relative(PROJECT_ROOT, prPath)}`);
diff --git a/scripts/evidence-pack-core.mjs b/scripts/evidence-pack-core.mjs
new file mode 100644
index 0000000..602bb8a
--- /dev/null
+++ b/scripts/evidence-pack-core.mjs
@@ -0,0 +1,125 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import Ajv2020 from "ajv/dist/2020.js";
+import addFormats from "ajv-formats";
+
+export const PROJECT_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+export const GOLD_CASE_FILES = [
+ "evidence-pack/cases/agentic-invoice-exception.case.json",
+ "evidence-pack/cases/hr-learning-assistant.case.json",
+ "evidence-pack/cases/procurement-bid-summary.case.json"
+];
+
+export function canonicalJson(value) {
+ if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+ if (value && typeof value === "object") {
+ return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+ }
+ return JSON.stringify(value);
+}
+
+export function sha256(value) {
+ const input = Buffer.isBuffer(value) ? value : Buffer.from(typeof value === "string" ? value : canonicalJson(value));
+ return createHash("sha256").update(input).digest("hex");
+}
+
+export async function createValidators(root = PROJECT_ROOT) {
+ const load = async (relativePath) => JSON.parse(await readFile(path.join(root, relativePath), "utf8"));
+ const caseSchema = await load("schemas/palo-case-file.schema.json");
+ const receiptSchema = await load("schemas/palo-local-validation-receipt.schema.json");
+ const ajv = new Ajv2020({ allErrors: true, strict: true });
+ addFormats(ajv);
+ const validateCase = ajv.compile(caseSchema);
+ const validateReceipt = ajv.compile(receiptSchema);
+ return { ajv, validateCase, validateReceipt };
+}
+
+export async function loadAndValidateCase(file, { root = PROJECT_ROOT, validators } = {}) {
+ const absolute = path.isAbsolute(file) ? file : path.join(root, file);
+ const value = JSON.parse(await readFile(absolute, "utf8"));
+ const activeValidators = validators || await createValidators(root);
+ const valid = activeValidators.validateCase(value);
+ return {
+ absolute,
+ errors: valid ? [] : activeValidators.validateCase.errors || [],
+ valid,
+ value
+ };
+}
+
+export function createLocalReceipt(caseFile, { generatedAt = new Date().toISOString(), execution = "node-local" } = {}) {
+ const digest = sha256(caseFile);
+ return {
+ format: "palo-local-validation-receipt",
+ schemaVersion: "1.0.0",
+ receiptId: `receipt-${digest.slice(0, 16)}`,
+ caseId: caseFile.caseId,
+ generatedAt,
+ result: "valid",
+ artifactDigest: `sha256:${digest}`,
+ checks: [
+ { checkId: "case-schema", status: "passed", message: "Case File conforms to the published PALO Case File 1.0.0 schema." },
+ { checkId: "authority-boundary", status: "passed", message: "The case declares allowed and prohibited authority in its educational context." },
+ { checkId: "source-boundary", status: "passed", message: "The case includes a dated source and an explicit review boundary." },
+ { checkId: "privacy-mode", status: "passed", message: "Validation ran locally and created no mandatory network transmission." }
+ ],
+ validator: {
+ name: "PALO Evidence Pack local validator",
+ version: "3.0.1",
+ execution
+ },
+ privacyBoundary: "The receipt contains a case identifier, validation checks and an artifact digest. Sharing is voluntary. Schema conformance is not certification, legal advice, production approval or independent assurance.",
+ shareMode: "voluntary-export"
+ };
+}
+
+export function normalizeSlug(value) {
+ return String(value || "")
+ .trim()
+ .toLowerCase()
+ .replace(/[^a-z0-9]+/g, "-")
+ .replace(/^-+|-+$/g, "")
+ .slice(0, 52);
+}
+
+export function buildContribution({ slug, title, sector, scenario, community, author, now = new Date().toISOString() }) {
+ const safeSlug = normalizeSlug(slug);
+ if (safeSlug.length < 6) throw new Error("--slug must contain at least 6 normalized characters");
+ for (const [flag, value] of Object.entries({ title, sector, scenario, community, author })) {
+ if (!String(value || "").trim()) throw new Error(`--${flag} is required`);
+ }
+ const caseFile = {
+ format: "palo-case-file",
+ schemaVersion: "1.0.0",
+ caseId: `case-community-${safeSlug}`.slice(0, 63),
+ title: `Community case: ${title.trim()}`,
+ status: "draft",
+ createdAt: now,
+ updatedAt: now,
+ owner: author.trim(),
+ context: {
+ domain: sector.trim(),
+ scenario: scenario.trim(),
+ exampleStatus: "educational-non-production",
+ contributionCommunity: community.trim(),
+ sourceStatus: "Contributor supplied starting references. Applicability and freshness require maintainer and domain review.",
+ limitations: "Synthetic or safely publishable contribution. No legal, security, production or certification claim is made.",
+ decisionQuestion: "TODO: state the decision this evidence should support.",
+ declaredAuthority: {
+ allowed: ["TODO: name one permitted action"],
+ prohibited: ["TODO: name one prohibited action"]
+ },
+ expectedEffect: "TODO: state the observable effect.",
+ verificationMethod: "TODO: state how a reviewer could check the effect independently."
+ },
+ assessments: [],
+ evidence: [],
+ sources: [],
+ incidents: [],
+ handoffs: []
+ };
+ const prBody = `# Add community case: ${title.trim()}\n\n## Community and purpose\n\n- Community: ${community.trim()}\n- Contributor: ${author.trim()}\n- Sector: ${sector.trim()}\n- Decision supported: TODO\n\n## Why this case matters\n\n${scenario.trim()}\n\n## Evidence and authority boundary\n\n- [ ] Uses only synthetic or safely publishable data.\n- [ ] Names at least one allowed and one prohibited action.\n- [ ] States an observable expected effect and an independent verification method.\n- [ ] Includes dated primary or standards sources when applicable.\n- [ ] Makes no certification, legal-approval or production-readiness claim.\n\n## Validation\n\n- [ ] \`npm run case:contribute -- --validate-all\`\n- [ ] \`npm run validate\`\n`;
+ return { caseFile, prBody, slug: safeSlug };
+}
diff --git a/scripts/evidence-pack.test.mjs b/scripts/evidence-pack.test.mjs
new file mode 100644
index 0000000..a988e33
--- /dev/null
+++ b/scripts/evidence-pack.test.mjs
@@ -0,0 +1,58 @@
+import assert from "node:assert/strict";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import test from "node:test";
+import { buildContribution, createLocalReceipt, createValidators, GOLD_CASE_FILES, loadAndValidateCase, PROJECT_ROOT } from "./evidence-pack-core.mjs";
+
+const execFileAsync = promisify(execFile);
+
+test("three gold cases conform to the published Case File schema", async () => {
+ const validators = await createValidators();
+ for (const file of GOLD_CASE_FILES) {
+ const result = await loadAndValidateCase(file, { validators });
+ assert.equal(result.valid, true, `${file}: ${validators.ajv.errorsText(result.errors)}`);
+ assert.equal(result.value.context.goldCase, true);
+ assert.ok(result.value.context.completionMinutes < 10);
+ }
+});
+
+test("a local receipt is digest-bound and schema-valid", async () => {
+ const validators = await createValidators();
+ const { value } = await loadAndValidateCase(GOLD_CASE_FILES[0], { validators });
+ const first = createLocalReceipt(value, { generatedAt: "2026-08-12T10:00:00Z" });
+ const second = createLocalReceipt(value, { generatedAt: "2026-08-12T10:05:00Z" });
+ assert.equal(first.artifactDigest, second.artifactDigest);
+ assert.equal(first.receiptId, second.receiptId);
+ assert.equal(validators.validateReceipt(first), true, validators.ajv.errorsText(validators.validateReceipt.errors));
+ assert.match(first.privacyBoundary, /Sharing is voluntary/);
+});
+
+test("case contribution command generates a valid case and PR body", async () => {
+ const temporary = await mkdtemp(path.join(tmpdir(), "palo-case-contribution-"));
+ try {
+ await execFileAsync(process.execPath, [
+ path.join(PROJECT_ROOT, "scripts/case-contribute.mjs"),
+ "--slug", "retail-returns-assistant",
+ "--title", "Retail returns assistant",
+ "--sector", "retail",
+ "--scenario", "An assistant drafts a return recommendation while a named employee approves refunds.",
+ "--community", "builders",
+ "--author", "@example",
+ "--output-root", temporary
+ ]);
+ const generated = JSON.parse(await readFile(path.join(temporary, "retail-returns-assistant.case.json"), "utf8"));
+ const validators = await createValidators();
+ assert.equal(validators.validateCase(generated), true, validators.ajv.errorsText(validators.validateCase.errors));
+ const prBody = await readFile(path.join(temporary, "retail-returns-assistant.pr.md"), "utf8");
+ assert.match(prBody, /Evidence and authority boundary/);
+ } finally {
+ await rm(temporary, { recursive: true, force: true });
+ }
+});
+
+test("contribution template rejects incomplete metadata", () => {
+ assert.throws(() => buildContribution({ slug: "short", title: "", sector: "x", scenario: "x", community: "x", author: "x" }));
+});
diff --git a/scripts/evidence-validate.mjs b/scripts/evidence-validate.mjs
new file mode 100644
index 0000000..424cea6
--- /dev/null
+++ b/scripts/evidence-validate.mjs
@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import { parseArgs } from "node:util";
+import { createLocalReceipt, createValidators, loadAndValidateCase, PROJECT_ROOT } from "./evidence-pack-core.mjs";
+
+const { values, positionals } = parseArgs({
+ allowPositionals: true,
+ options: {
+ help: { type: "boolean", short: "h" },
+ receipt: { type: "string", short: "r" }
+ }
+});
+
+if (values.help) {
+ console.log("Usage: npm run evidence:validate -- [case-file] [--receipt path]");
+ console.log("Default case: evidence-pack/cases/agentic-invoice-exception.case.json");
+ process.exit(0);
+}
+
+const target = positionals[0] || "evidence-pack/cases/agentic-invoice-exception.case.json";
+const validators = await createValidators();
+const result = await loadAndValidateCase(target, { validators });
+if (!result.valid) {
+ console.error(`Evidence case is invalid: ${validators.ajv.errorsText(result.errors)}`);
+ process.exit(1);
+}
+
+const receipt = createLocalReceipt(result.value);
+if (!validators.validateReceipt(receipt)) {
+ console.error(`Generated receipt is invalid: ${validators.ajv.errorsText(validators.validateReceipt.errors)}`);
+ process.exit(1);
+}
+
+const serialized = `${JSON.stringify(receipt, null, 2)}\n`;
+if (values.receipt) {
+ const destination = path.isAbsolute(values.receipt) ? values.receipt : path.join(PROJECT_ROOT, values.receipt);
+ await mkdir(path.dirname(destination), { recursive: true });
+ await writeFile(destination, serialized, { flag: "wx" });
+ console.log(`Valid PALO case: ${result.value.caseId}`);
+ console.log(`Local receipt written: ${path.relative(PROJECT_ROOT, destination)}`);
+} else {
+ console.log(serialized.trimEnd());
+}
diff --git a/scripts/public-files.mjs b/scripts/public-files.mjs
index ec5c946..fc24b4b 100644
--- a/scripts/public-files.mjs
+++ b/scripts/public-files.mjs
@@ -63,6 +63,10 @@ export const PUBLIC_FILES = [
"assets/palo-docs.css",
"assets/palo-docs.js",
"assets/palo-vibe-gate.js",
+ "evidence-pack/README.md",
+ "evidence-pack/cases/agentic-invoice-exception.case.json",
+ "evidence-pack/cases/hr-learning-assistant.case.json",
+ "evidence-pack/cases/procurement-bid-summary.case.json",
"assets/palo-ai-n8n-scenarios/palo-ai-n8n-governance-hero.png",
"assets/palo-ai-n8n-scenarios/palo-ai-n8n-governance-hero-v2.png",
"assets/palo-ai-n8n-scenarios/pattern-a-visual-governance-gate.png",
@@ -90,6 +94,7 @@ export const PUBLIC_FILES = [
"formal/palo-ontology-v3.ttl",
"formal/palo-ontology-v3.shacl.ttl",
"docs/p1-case-file-and-migration.md",
+ "docs/activation-freeze-2026-08.md",
"docs/palo-v3-semantic-foundation.md",
"docs/palo-ai-n8n-alpha-test-report.md",
"docs/palo-ai-adoption-paths.md",
@@ -117,6 +122,10 @@ export const PUBLIC_FILES = [
"docs/palo-ai-n8n-publication-status.md",
"docs/palo-ai-production-readiness-plan.md",
"docs/community/n8n-architecture-preview-post.md",
+ "docs/community/activation-window-2026-08.md",
+ "docs/community/changed-because-of-feedback.md",
+ "docs/community/channel-policy.md",
+ "docs/community/founding-review-program.md",
"docs/community/palo-ai-feedback-design-partner-form.md",
"docs/community/palo-microsoft-agt-interoperability-proposal.md",
"media/README.md",
@@ -194,6 +203,7 @@ export const PUBLIC_FILES = [
"schemas/palo-control-library.schema.json",
"schemas/palo-decision-gates.schema.json",
"schemas/palo-evidence-bundle.schema.json",
+ "schemas/palo-local-validation-receipt.schema.json",
"schemas/palo-kpi-kri-registry.schema.json",
"schemas/palo-p2-index.schema.json",
"schemas/palo-policy-input.schema.json",
diff --git a/scripts/publish-activation-issues.mjs b/scripts/publish-activation-issues.mjs
new file mode 100644
index 0000000..c1f4f2a
--- /dev/null
+++ b/scripts/publish-activation-issues.mjs
@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import { promisify } from "node:util";
+import { fileURLToPath } from "node:url";
+
+const execFileAsync = promisify(execFile);
+const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const repository = process.env.PALO_GITHUB_REPOSITORY || "sev7enITA/PALOframework";
+const manifest = JSON.parse(await readFile(path.join(projectRoot, ".github/activation/issues.json"), "utf8"));
+if (!Array.isArray(manifest) || manifest.length !== 12) throw new Error("Activation issue manifest must contain exactly 12 issues");
+
+const labelColors = {
+ accessibility: "0E8A16",
+ activation: "147D8B",
+ adapter: "5319E7",
+ case: "1D76DB",
+ documentation: "0075CA",
+ "good first issue": "7057FF",
+ governance: "C78A19",
+ n8n: "FF6D5A",
+ privacy: "0052CC",
+ security: "B60205",
+ mapping: "D4C5F9",
+ "threat-test": "D93F0B"
+};
+
+for (const [name, color] of Object.entries(labelColors)) {
+ try {
+ await execFileAsync("gh", ["label", "create", name, "--repo", repository, "--color", color, "--description", "PALO Evidence Pack activation", "--force"]);
+ } catch (error) {
+ throw new Error(`Unable to create or update label ${name}: ${error.stderr || error.message}`);
+ }
+}
+
+const { stdout } = await execFileAsync("gh", ["issue", "list", "--repo", repository, "--state", "all", "--limit", "200", "--json", "title,url"]);
+const existing = new Map(JSON.parse(stdout).map((issue) => [issue.title, issue.url]));
+for (const issue of manifest) {
+ if (existing.has(issue.title)) {
+ console.log(`Existing: ${issue.title} ${existing.get(issue.title)}`);
+ continue;
+ }
+ const args = ["issue", "create", "--repo", repository, "--title", issue.title, "--body", issue.body];
+ for (const label of issue.labels) args.push("--label", label);
+ const created = await execFileAsync("gh", args);
+ console.log(`Created: ${issue.title} ${created.stdout.trim()}`);
+}
diff --git a/scripts/render-public-docs.mjs b/scripts/render-public-docs.mjs
index d2e1012..128f34e 100644
--- a/scripts/render-public-docs.mjs
+++ b/scripts/render-public-docs.mjs
@@ -167,10 +167,10 @@ function renderDocument(markdown, file) {
<link rel="canonical" href="${escapeHtml(canonical)}">
<link rel="icon" type="image/webp" href="${asset("assets/logo.webp")}">
<link rel="stylesheet" href="${asset("assets/palo-icons.css")}">
- <link rel="stylesheet" href="${asset("assets/palo-v21.css")}?v=3.0.0">
+ <link rel="stylesheet" href="${asset("assets/palo-v21.css")}?v=3.0.1">
<link rel="stylesheet" href="${asset("assets/palo-docs.css")}">
<script src="${asset("assets/palo-icons.js")}" defer></script>
- <script src="${asset("assets/palo-v21.js")}?v=3.0.0" defer></script>
+ <script src="${asset("assets/palo-v21.js")}?v=3.0.1" defer></script>
<script src="${asset("assets/palo-docs.js")}" defer></script>
</head>
<body class="palo-v21 palo-doc-page" data-doc-source="${escapeHtml(file)}">
diff --git a/scripts/validate.mjs b/scripts/validate.mjs
index a1f7aed..e79a715 100644
--- a/scripts/validate.mjs
+++ b/scripts/validate.mjs
@@ -89,6 +89,7 @@ for (const relativePath of privatePublicationPaths) {
async function validateP1Fixtures() {
const caseSchema = JSON.parse(await readFile(path.join(validationRoot, "schemas/palo-case-file.schema.json"), "utf8"));
const bundleSchema = JSON.parse(await readFile(path.join(validationRoot, "schemas/palo-evidence-bundle.schema.json"), "utf8"));
+ const localReceiptSchema = JSON.parse(await readFile(path.join(validationRoot, "schemas/palo-local-validation-receipt.schema.json"), "utf8"));
const agenticSchema = JSON.parse(await readFile(path.join(validationRoot, "schemas/palo-agentic-interface.schema.json"), "utf8"));
ajv.addSchema(caseSchema);
ajv.addSchema(agenticSchema);
@@ -98,6 +99,7 @@ async function validateP1Fixtures() {
"palo-agentic-interface": ajv.getSchema(agenticSchema.$id)
};
caseFileValidator = validators["palo-case-file"];
+ ajv.compile(localReceiptSchema);
for (const [name, validator] of Object.entries(validators)) {
for (const expectation of ["valid", "invalid"]) {
const file = `schemas/fixtures/${name}.${expectation}.json`;
@@ -107,6 +109,17 @@ async function validateP1Fixtures() {
if (expectation === "invalid" && result) errors.push(`${file}: intentionally invalid fixture unexpectedly passed schema`);
}
}
+ const goldCases = [
+ "evidence-pack/cases/agentic-invoice-exception.case.json",
+ "evidence-pack/cases/hr-learning-assistant.case.json",
+ "evidence-pack/cases/procurement-bid-summary.case.json"
+ ];
+ for (const file of goldCases) {
+ const fixture = JSON.parse(await readFile(path.join(validationRoot, file), "utf8"));
+ if (!caseFileValidator(fixture)) errors.push(`${file}: gold case failed PALO Case File schema: ${ajv.errorsText(caseFileValidator.errors)}`);
+ if (fixture.context?.goldCase !== true || !Number.isInteger(fixture.context?.completionMinutes) || fixture.context.completionMinutes >= 10) errors.push(`${file}: gold case must declare goldCase=true and completionMinutes below 10`);
+ if (!fixture.context?.declaredAuthority?.allowed?.length || !fixture.context?.declaredAuthority?.prohibited?.length || !fixture.context?.verificationMethod) errors.push(`${file}: gold case must declare allowed/prohibited authority and an independent verification method`);
+ }
const definitions = JSON.parse(await readFile(path.join(validationRoot, "data/p1-governance-definitions.json"), "utf8"));
if (definitions.schemaVersion !== "1.0.0" || !Array.isArray(definitions.triggers) || !definitions.triggers.length) errors.push("data/p1-governance-definitions.json: requires v1 definitions and at least one trigger");
const triggerIds = new Set();
@@ -363,7 +376,9 @@ for (const [name, module] of Object.entries(manifest.modules || {})) {
if (!/^\d+\.\d+\.\d+$/.test(module.version || "") || !/^\d{4}-\d{2}-\d{2}$/.test(module.date || "")) errors.push(`release-manifest.json: module ${name} requires SemVer version and ISO date`);
}
const semanticModule = manifest.modules?.semanticFoundation;
-if (semanticModule?.version !== releaseVersion || semanticModule?.date !== releaseDate) errors.push("release-manifest.json: semanticFoundation must match the root release version and date");
+const semanticReleaseMajor = String(semanticModule?.version || "").split(".")[0];
+const platformReleaseMajor = String(releaseVersion || "").split(".")[0];
+if (semanticReleaseMajor !== platformReleaseMajor || semanticModule?.date > releaseDate) errors.push("release-manifest.json: semanticFoundation must remain in the platform release major and cannot postdate it");
if (semanticModule?.semanticSpine !== "data/semantic-spine.json" || semanticModule?.semanticRelease !== "data/semantic-release-manifest.json") errors.push("release-manifest.json: semanticFoundation canonical paths are incomplete");
if (new Set(semanticModule?.evidenceBoundaryModel || []).size !== 4 || new Set(semanticModule?.workspaces || []).size !== 3) errors.push("release-manifest.json: semanticFoundation requires four authority classes and three workspaces");
const hubModule = manifest.modules?.agenticGovernanceHub;