Make the 13-case Action Boundary Challenge browsable

README.md

@@ -24,7 +24,7 @@
 
 **Explore the interface:** [Live lab](https://aruintelligence.github.io/aml-core/) · [View Meaning™ inspector](https://aruintelligence.github.io/aml-core/view-meaning.html) · [API contract](protocol/aml-http.openapi.yaml)
 
-**Explore the next boundary:** [Try the Action Boundary Lab](https://aruintelligence.github.io/aml-core/action-lab.html?view=action-path-1) — change an agent's intended tool call and see an exact policy decision, digest, stale simulated approval, and uncertain outcome. [Run the 13-case outside implementation challenge](publications/ACTION_BOUNDARY_CHALLENGE.md), or [read the pilot](pilots/action-boundary/README.md) and its [six published vectors](pilots/action-boundary/vectors.json). The browser rehearsal and repository self-test are project-authored, with no live tool access.
+**Explore the next boundary:** [Try the Action Boundary Lab](https://aruintelligence.github.io/aml-core/action-lab.html?view=action-path-1) — change an agent's intended tool call and see an exact policy decision, digest, stale simulated approval, and uncertain outcome. [Explore the visual 13-case challenge](https://aruintelligence.github.io/aml-core/action-challenge.html), [read its adapter contract](publications/ACTION_BOUNDARY_CHALLENGE.md), or [read the pilot](pilots/action-boundary/README.md) and its [six published vectors](pilots/action-boundary/vectors.json). The browser rehearsal and repository self-test are project-authored, with no live tool access.
 
 [![Illustrated local action boundary: an agent proposes sending to an outside destination; the host policy blocks the call before dispatch.](docs/action-boundary-story.svg)](https://aruintelligence.github.io/aml-core/action-lab.html?view=action-path-1)
 

docs/action-challenge-board.json

@@ -0,0 +1,98 @@
+{
+  "protocol": "aml-action-boundary-challenge/1",
+  "vectors_file": "pilots/action-boundary/vectors.json",
+  "command_contract": {
+    "invocation": "<executable> <case.json>",
+    "stdout": "one JSON object with protocol aml-action-boundary-result/1, plan, receipt, tool_calls, executed_proposal",
+    "exit_code": "zero for a valid response, including denied or unknown outcomes",
+    "no_live_tools": true
+  },
+  "cases": [
+    {
+      "id": "approved-send",
+      "vector": "approved_route",
+      "host": { "approval": "matching", "tool": "return" },
+      "expected": { "decision": "requires_approval", "reason": "exact_rule", "status": "dispatched", "receipt_reason": "host_dispatch_returned", "tool_calls": 1, "executed_vector": "approved_route" }
+    },
+    {
+      "id": "reordered-keys",
+      "vector": "same_action_reordered_keys",
+      "host": { "approval": "matching", "tool": "return" },
+      "expected": { "decision": "requires_approval", "reason": "exact_rule", "status": "dispatched", "receipt_reason": "host_dispatch_returned", "tool_calls": 1, "executed_vector": "same_action_reordered_keys" }
+    },
+    {
+      "id": "changed-destination",
+      "vector": "changed_destination",
+      "host": { "approval": "matching", "tool": "return" },
+      "expected": { "decision": "deny", "reason": "no_exact_rule", "status": "blocked", "receipt_reason": "no_exact_rule", "tool_calls": 0 }
+    },
+    {
+      "id": "stale-body-approval",
+      "vector": "changed_body",
+      "host": { "approval": "fixed", "approval_digest_vector": "approved_route", "tool": "return" },
+      "expected": { "decision": "requires_approval", "reason": "exact_rule", "status": "blocked", "receipt_reason": "approval_missing_or_mismatched", "tool_calls": 0 }
+    },
+    {
+      "id": "allowed-read",
+      "vector": "read_route",
+      "host": { "approval": "missing", "tool": "return" },
+      "expected": { "decision": "allow", "reason": "exact_rule", "status": "dispatched", "receipt_reason": "host_dispatch_returned", "tool_calls": 1, "executed_vector": "read_route" }
+    },
+    {
+      "id": "undeclared-effect",
+      "vector": "undeclared_effect",
+      "host": { "approval": "matching", "tool": "return" },
+      "expected": { "decision": "deny", "reason": "no_exact_rule", "status": "blocked", "receipt_reason": "no_exact_rule", "tool_calls": 0 }
+    },
+    {
+      "id": "missing-approval",
+      "vector": "approved_route",
+      "host": { "approval": "missing", "tool": "return" },
+      "expected": { "decision": "requires_approval", "reason": "exact_rule", "status": "blocked", "receipt_reason": "approval_unavailable", "tool_calls": 0 }
+    },
+    {
+      "id": "approval-error",
+      "vector": "approved_route",
+      "host": { "approval": "throw", "tool": "return" },
+      "expected": { "decision": "requires_approval", "reason": "exact_rule", "status": "blocked", "receipt_reason": "approval_error", "tool_calls": 0 }
+    },
+    {
+      "id": "mutated-while-awaiting",
+      "vector": "approved_route",
+      "host": { "approval": "matching", "mutate_proposal_body": "MUTATED", "tool": "return" },
+      "expected": { "decision": "requires_approval", "reason": "exact_rule", "status": "dispatched", "receipt_reason": "host_dispatch_returned", "tool_calls": 1, "executed_vector": "approved_route" }
+    },
+    {
+      "id": "policy-revoked-while-awaiting",
+      "vector": "approved_route",
+      "host": { "approval": "matching", "remove_policy_rule": true, "tool": "return" },
+      "expected": { "decision": "requires_approval", "reason": "exact_rule", "status": "blocked", "receipt_reason": "policy_changed", "tool_calls": 0 }
+    },
+    {
+      "id": "dispatch-uncertain",
+      "vector": "approved_route",
+      "host": { "approval": "matching", "tool": "throw" },
+      "expected": { "decision": "requires_approval", "reason": "exact_rule", "status": "unknown", "receipt_reason": "host_dispatch_error", "tool_calls": 1, "executed_vector": "approved_route" }
+    },
+    {
+      "id": "ambiguous-policy",
+      "vector": "approved_route",
+      "policy_variant": "duplicate_matching_rule",
+      "host": { "approval": "matching", "tool": "return" },
+      "expected": { "decision": "deny", "reason": "ambiguous_policy", "status": "blocked", "receipt_reason": "ambiguous_policy", "tool_calls": 0, "null_digest": true }
+    },
+    {
+      "id": "malformed-proposal",
+      "vector": "approved_route",
+      "proposal_variant": "extra_top_level_field",
+      "host": { "approval": "matching", "tool": "return" },
+      "expected": { "decision": "deny", "reason": "invalid_proposal", "status": "blocked", "receipt_reason": "invalid_proposal", "tool_calls": 0, "null_digest": true }
+    }
+  ],
+  "independence": {
+    "outside_implementation_required_for_external_witness_credit": true,
+    "must_not_import_or_wrap_the_aml_core_reference": true,
+    "pass_fail_mixed_reports_welcome": true
+  },
+  "claim_boundary": "A passing project-defined black-box run is compatibility evidence for these cases, not production authorization, human consent, independent adoption, certification, or a ratified standard."
+}