fix(rules): RISK-008 detect one-sided consequential-damages waiver for any party label (v1.1.0)

What was wrong: RISK-008 (one-sided consequential-damages waiver) detected the
one-sided clause only when the protected party was labeled Provider/Vendor/
Company, so a waiver protecting only the Supplier, Licensor, Seller, Customer,
etc. slipped through entirely and never fired.

How it was fixed: broadened the one-sided-trigger party vocabulary to match the
beneficiary counter's list (adding Seller to both so the two stay in sync). The
existing ">=2 distinct beneficiaries" guard still clears a genuinely mutual
"X … and Y shall not be liable …" clause, so a mutual Seller/Buyer waiver stays
silent.

Proof: a new RISK-008.test.ts pins the one-sided waivers (Supplier / Licensor)
firing and the mutual / "neither party" waivers staying silent (7 tests). Full
suite green (5649 passing). RISK-008 is a launch rule, so all four golden corpora
(integration v2/v3, tests/golden/v3, tests/golden/v4, tests/golden/v4/bundle)
were checked with a finding-level delta before regen — zero finding drift across
every fixture (version-only hash bump; RISK-008 only).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: clay-good

src/engine/rules/risk-allocation/RISK-008.test.ts

@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vitest";
+import { rule as RISK_008 } from "./RISK-008.js";
+import { buildContext } from "../../_test-fixtures.js";
+
+describe("RISK-008 — one-sided consequential-damages waiver", () => {
+  const fires = (b: string) => !!RISK_008.check(buildContext(["Liability", b]) as never);
+
+  it.each([
+    "The Company shall not be liable for any consequential damages.",
+    "The Supplier shall not be liable for any consequential or special damages.",
+    "Licensor shall not be liable for any indirect, incidental, or consequential damages.",
+  ])("fires on a one-sided waiver regardless of the protected party's label: %s", (b) => {
+    expect(fires(b)).toBe(true);
+  });
+
+  it.each([
+    "Neither party shall be liable for any consequential damages.",
+    "The Company shall not be liable for consequential damages, and the Customer shall not be liable for consequential damages.",
+    "The Seller shall not be liable for consequential damages, and the Buyer shall not be liable for consequential damages.",
+  ])("stays silent on a mutual waiver: %s", (b) => {
+    expect(fires(b)).toBe(false);
+  });
+
+  it("emits a warning-severity finding", () => {
+    const f = RISK_008.check(
+      buildContext([
+        "Liability",
+        "The Supplier shall not be liable for consequential damages.",
+      ]) as never,
+    );
+    expect(f?.severity).toBe("warning");
+  });
+});

src/engine/rules/risk-allocation/RISK-008.ts

@@ -3,7 +3,7 @@ import { emit, firstParagraphMatch } from "../_helpers.js";
 
 /** Every party named as protected by a consequential-damages waiver in `text`. */
 const WAIVER_BENEFICIARY =
-  /\b(Provider|Vendor|Company|Supplier|Contractor|Licensor|Customer|Client|Licensee|Subscriber|Buyer|Purchaser)\s+(?:will|shall)\s+not\s+be\s+liable[\s\S]{0,200}?\b(?:consequential|special|incidental|punitive)\s+damages?\b/gi;
+  /\b(Provider|Vendor|Company|Supplier|Contractor|Licensor|Customer|Client|Licensee|Subscriber|Buyer|Purchaser|Seller)\s+(?:will|shall)\s+not\s+be\s+liable[\s\S]{0,200}?\b(?:consequential|special|incidental|punitive)\s+damages?\b/gi;
 
 function countWaiverBeneficiaries(text: string): number {
   const seen = new Set<string>();
@@ -16,7 +16,7 @@ function countWaiverBeneficiaries(text: string): number {
 /** RISK-008 — Consequential damages waiver mutuality (warning). */
 export const rule: Rule = {
   id: "RISK-008",
-  version: "1.0.0",
+  version: "1.1.0",
   name: "Consequential damages waiver mutuality",
   category: "risk-allocation",
   default_severity: "warning",
@@ -28,9 +28,14 @@ export const rule: Rule = {
       /\b(?:neither\s+party|neither\s+\w+\s+nor\s+\w+)\s+(?:will|shall)\s+be\s+liable[\s\S]{0,200}\b(?:consequential|special|incidental|punitive)\s+damages?\b/i,
     );
     if (hit) return null;
+    // v1.0.0 detected the one-sided waiver only when Provider/Vendor/Company was
+    // the protected party, so a waiver protecting only the Supplier / Licensor /
+    // Seller (etc.) slipped through entirely. Match the same party vocabulary the
+    // beneficiary counter uses; the >=2-beneficiary guard below still clears a
+    // genuinely mutual "X … and Y shall not be liable" clause.
     const oneSided = firstParagraphMatch(
       ctx,
-      /\b(?:Provider|Vendor|Company)\s+(?:will|shall)\s+not\s+be\s+liable[\s\S]{0,200}\b(?:consequential|special|incidental|punitive)\s+damages?\b/i,
+      /\b(?:Provider|Vendor|Company|Supplier|Contractor|Licensor|Customer|Client|Licensee|Subscriber|Buyer|Purchaser|Seller)\s+(?:will|shall)\s+not\s+be\s+liable[\s\S]{0,200}\b(?:consequential|special|incidental|punitive)\s+damages?\b/i,
     );
     if (!oneSided) return null;
     // A mutual waiver is just as often drafted as two symmetric grants

tests/fixtures/expected/bad-consulting-success-fee.json

@@ -434,7 +434,7 @@
       "elapsed_ms": 0,
       "fired": false,
       "rule_id": "RISK-008",
-      "rule_version": "1.0.0"
+      "rule_version": "1.1.0"
     },
     {
       "elapsed_ms": 0,
@@ -974,7 +974,7 @@
   "playbook_id": "consulting-agreement",
   "playbook_match_confidence": 0.9,
   "playbook_match_reasoning": "Selected consulting-agreement (score 0.9). Title matched: \"advisory agreement\". Distinguishing phrases: \"advisory services\", \"deliverables\", \"independent contractor\".",
-  "result_hash": "6aa36c5150a1f6290a75c4f4b560c0254cea97d5f4c7a3394822c2d04f49640a",
+  "result_hash": "a22ce028ed9f1f0c9534e3cacd3ea235e1e152261fd9886298f84996adeaa796",
   "source_file": {
     "name": "bad-consulting-success-fee.docx",
     "sha256": "6bc505eb0c1641cda4c3466a62f0b3eead258e2dc3a385e792e79f4a717ad6a5",

tests/fixtures/expected/bad-consulting.json

@@ -438,7 +438,7 @@
       "elapsed_ms": 0,
       "fired": false,
       "rule_id": "RISK-008",
-      "rule_version": "1.0.0"
+      "rule_version": "1.1.0"
     },
     {
       "elapsed_ms": 0,
@@ -1055,7 +1055,7 @@
   "playbook_id": "consulting-agreement",
   "playbook_match_confidence": 0.9,
   "playbook_match_reasoning": "Selected consulting-agreement (score 0.9). Title matched: \"consulting agreement\". Distinguishing phrases: \"Consultant\", \"advisory services\", \"deliverables\", \"independent contractor\", \"the Consulting Services\".",
-  "result_hash": "4cb43c3669db3a1a434dd36738a51e29a38a690593f83ec9c0c36ae158cf1c4f",
+  "result_hash": "a31e12f3f0d373796d571f2f88f4031729bbbb5e39158ecf717ee405b4d0d813",
   "source_file": {
     "name": "bad-consulting.docx",
     "sha256": "f66f070f4bb768dbc3f21ee6782418bca5ed64451d483dab533b345a8ddbe691",

tests/fixtures/expected/bad-contractor-leaseback.json

@@ -431,7 +431,7 @@
       "elapsed_ms": 0,
       "fired": false,
       "rule_id": "RISK-008",
-      "rule_version": "1.0.0"
+      "rule_version": "1.1.0"
     },
     {
       "elapsed_ms": 0,
@@ -882,7 +882,7 @@
   "playbook_id": "independent-contractor",
   "playbook_match_confidence": 1,
   "playbook_match_reasoning": "Selected independent-contractor (score 1). Title matched: \"independent contractor\", \"contractor agreement\". Distinguishing phrases: \"independent contractor\", \"Contractor shall\".",
-  "result_hash": "a80726082e47ddede6401fe3aa451fdd5ab1dd61315600e11982f6a787c473aa",
+  "result_hash": "4cdee6928508f7916cccc9caa8f32237f64fca74aec1d2f3ca4878c35d193f51",
   "source_file": {
     "name": "bad-contractor-leaseback.docx",
     "sha256": "82496f664a3abe77b7ed03c7c77b47c9ffbd8c5f883389cb761b7ba68b31f98d",

tests/fixtures/expected/bad-contractor.json

@@ -437,7 +437,7 @@
       "elapsed_ms": 0,
       "fired": false,
       "rule_id": "RISK-008",
-      "rule_version": "1.0.0"
+      "rule_version": "1.1.0"
     },
     {
       "elapsed_ms": 0,
@@ -1084,7 +1084,7 @@
   "playbook_id": "independent-contractor",
   "playbook_match_confidence": 1,
   "playbook_match_reasoning": "Selected independent-contractor (score 1). Title matched: \"independent contractor\", \"contractor agreement\". Distinguishing phrases: \"independent contractor\", \"Contractor shall\".",
-  "result_hash": "7cb3cd66896d98fd801191694a099ed30b278a078f4a563c0d22595e672b3af1",
+  "result_hash": "6f50ba820ce29a8ee2a837a1227ec117f7dd563985c8f164fd0db6a95c5f7b3c",
   "source_file": {
     "name": "bad-contractor.docx",
     "sha256": "7a40a2e53d068557d47cf7690838b907085994f596a0c6e2380b8ac2607543df",

tests/fixtures/expected/bad-employment-choice-of-law.json

@@ -432,7 +432,7 @@
       "elapsed_ms": 0,
       "fired": false,
       "rule_id": "RISK-008",
-      "rule_version": "1.0.0"
+      "rule_version": "1.1.0"
     },
     {
       "elapsed_ms": 0,
@@ -928,7 +928,7 @@
   "playbook_id": "employment-at-will-us",
   "playbook_match_confidence": 0.9,
   "playbook_match_reasoning": "Selected employment-at-will-us (score 0.9). Title matched: \"employment agreement\". Distinguishing phrases: \"at-will\", \"exempt\", \"Employee\".",
-  "result_hash": "8fdda017f5d4922ee0663b6a311527e2cee6da2f2ab403ca922583846c56c602",
+  "result_hash": "c5e0faceb6c70675b68a6b70fddf2c516a23700bd30b8e6cd81678a4ab0c4e2b",
   "source_file": {
     "name": "bad-employment-choice-of-law.docx",
     "sha256": "432c209852332e09cdc68eec7a183f61c5da1fa8aafe36b92e3b8bf6fd2e6c26",

tests/fixtures/expected/bad-employment-trap.json

@@ -437,7 +437,7 @@
       "elapsed_ms": 0,
       "fired": false,
       "rule_id": "RISK-008",
-      "rule_version": "1.0.0"
+      "rule_version": "1.1.0"
     },
     {
       "elapsed_ms": 0,
@@ -1027,7 +1027,7 @@
   "playbook_id": "employment-at-will-us",
   "playbook_match_confidence": 0.9,
   "playbook_match_reasoning": "Selected employment-at-will-us (score 0.9). Title matched: \"employment agreement\". Distinguishing phrases: \"at-will\", \"exempt\", \"salary\", \"Employee\".",
-  "result_hash": "f96228c6b1bd5c181efaea41c4316cd5e2162c77fed46502a10e4022665a86b0",
+  "result_hash": "a4249103f20389edabec7f24637e28c5ea832ff951c9016d94e54e51290cfcb3",
   "source_file": {
     "name": "bad-employment-trap.docx",
     "sha256": "c0ef11cc8a800daead332bf1bc265f96d72af1c51953958734b1bf18c4058b2a",

tests/fixtures/expected/bad-employment.json

@@ -444,7 +444,7 @@
       "elapsed_ms": 0,
       "fired": false,
       "rule_id": "RISK-008",
-      "rule_version": "1.0.0"
+      "rule_version": "1.1.0"
     },
     {
       "elapsed_ms": 0,
@@ -1232,7 +1232,7 @@
   "playbook_id": "employment-at-will-us",
   "playbook_match_confidence": 1,
   "playbook_match_reasoning": "Selected employment-at-will-us (score 1). Title matched: \"employment agreement\". Required clauses present: \"confidentiality-obligation\". Distinguishing phrases: \"at-will\", \"exempt\", \"salary\", \"Employee\".",
-  "result_hash": "6dad4cfe04279eb12d7c7ec115592277131035d8d894b1400c3a06cd1083acbd",
+  "result_hash": "f67d14b05753d7cfb43c9f5de2c347bd905466d5cdc9a2a0e1c34a2d028452e9",
   "source_file": {
     "name": "bad-employment.docx",
     "sha256": "44e689f2fe4e8767866844995363dda962260fd37d54469e6d0fdf443136013c",

tests/fixtures/expected/bad-lease-cam.json

@@ -429,7 +429,7 @@
       "elapsed_ms": 0,
       "fired": false,
       "rule_id": "RISK-008",
-      "rule_version": "1.0.0"
+      "rule_version": "1.1.0"
     },
     {
       "elapsed_ms": 0,
@@ -921,7 +921,7 @@
   "playbook_id": "lease-commercial-multitenant",
   "playbook_match_confidence": 0.9,
   "playbook_match_reasoning": "Selected lease-commercial-multitenant (score 0.9). Title matched: \"office lease\". Distinguishing phrases: \"Landlord\", \"Tenant\", \"Premises\", \"Rentable Square Feet\", \"Base Rent\", \"Operating Expenses\".",
-  "result_hash": "f377529964aed62b9e9cfc2fed4382cef2429334e83cfbf5e8c2a727fb274e91",
+  "result_hash": "4c666258dc5d6fcf02938955c0b83a5cb094b14878b20875018b124298a93a81",
   "source_file": {
     "name": "bad-lease-cam.docx",
     "sha256": "1de7804edf376ad66d1a78b0c998aa4a479a18835fa4e104e20057385337a0b6",