fix(rules): DPA-049 detect 'be responsible for' / 'pay' / passive 'borne by Controller' audit-cost allocation (v1.1.0)

v1.0.0 required the exact verb "bear" ("controller shall bear all costs of
any audit") or "at controller's expense", and missed the common variants:
the active verbs "shall be responsible for" / "shall pay" / "shall cover"
all audit costs, and the passive voice "all costs of any audit shall be
borne by the Controller". Add an active-verb pattern and a passive pattern,
both still requiring an all-encompassing quantifier (all / entire / full /
any) so a partial-cost split is not flagged. The existing except/unless
carve-out guards are unchanged.

Probe: 5 fire cases (2 baseline + 3 previously-missed), 4 silent cases
(except-carve-out, each-party-own-cost, shared-equally, reversed processor-
pays-on-breach). Finding-delta over the contracts corpus and v3/v4 goldens:
zero fired-flips, zero finding-count changes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: clay-good

src/engine/rules/v3/dpa-gdpr/dpa-gdpr-ruleset.test.ts

@@ -593,3 +593,33 @@ describe("DPA-023 — hand-waving security recognizes bare 'reasonable/adequate
     expect(await fires(b)).toBe(false);
   });
 });
+
+describe("DPA-049 — audit-cost allocation recognizes 'be responsible for' / 'pay' / passive 'borne by' forms (v1.1.0)", () => {
+  const fires = async (b: string) =>
+    (
+      await runEngine({
+        rules: DPA_GDPR_RULES,
+        ctx: withDpa(buildContext(["DPA", b])),
+        source_file: SRC,
+      })
+    ).findings.some((f) => f.rule_id === "DPA-049");
+
+  it.each([
+    "Controller shall bear all costs of any audit.",
+    "Any audit shall be at the Controller's sole expense.",
+    "Controller shall be responsible for all costs of the audit.",
+    "All costs and expenses of any audit shall be borne by the Controller.",
+    "The Controller shall pay all costs associated with any audit or inspection.",
+  ])("fires on all-audit-cost-on-controller: %s", async (b) => {
+    expect(await fires(b)).toBe(true);
+  });
+
+  it.each([
+    "Controller shall bear the costs of a routine audit, except where the audit reveals a material breach, in which case Processor shall bear the cost.",
+    "Each party shall bear its own costs of any audit.",
+    "The cost of the audit shall be shared equally between the parties.",
+    "Processor shall bear the cost of any audit that reveals a material breach.",
+  ])("stays silent on a carve-out / split / reversed allocation: %s", async (b) => {
+    expect(await fires(b)).toBe(false);
+  });
+});

src/engine/rules/v3/dpa-gdpr/rules.ts

@@ -984,6 +984,7 @@ export const DPA_GDPR_RULES: Rule[] = [
   }),
   language({
     id: "DPA-049",
+    version: "1.1.0",
     name: "Processor caps audit cost on controller exclusively",
     description:
       "Flags clauses where the controller must bear the entire cost of any audit, including audits triggered by processor breach.",
@@ -995,9 +996,18 @@ export const DPA_GDPR_RULES: Rule[] = [
       "Standard practice splits routine-audit cost to the controller but allocates cost to the processor where the audit uncovers material breach.",
     recommendation:
       "Carve out an exception for audits revealing material breach (cost shifts to the processor).",
+    // v1.0.0 required the exact verb "bear" ("controller shall bear all costs")
+    // or "at controller's expense". It missed the equally-common active verb
+    // variants ("controller shall be responsible for / shall pay all costs of
+    // the audit") and the passive voice ("all costs of any audit shall be borne
+    // by the Controller"). Add an active-verb pattern (bear / pay / cover /
+    // be responsible|liable for) and a passive pattern, both still requiring an
+    // all-encompassing quantifier so a partial-cost split is not flagged.
     bad_patterns: [
       /controller\s+(shall|will)\s+bear\s+(all|the\s+entire|the\s+full)\s+costs?\s+of\s+(any\s+)?audit/i,
       /audit.{0,80}(at\s+(the\s+)?controller'?s?\s+(sole\s+)?(cost|expense))/is,
+      /(?:the\s+)?controller\s+(?:shall|will|must|agrees?\s+to)\s+(?:bear|pay|cover|be\s+(?:responsible|liable)\s+for)\s+(?:all|the\s+(?:entire|full)|any)\s+costs?(?:\s+and\s+expenses?)?[^.]{0,40}audit/is,
+      /(?:all\s+)?costs?(?:\s+and\s+expenses?)?\s+of\s+(?:any\s+|the\s+)*audit[^.]{0,60}(?:borne|paid)\s+(?:solely\s+|exclusively\s+)?by\s+(?:the\s+)?controller/is,
     ],
     // The finding claims costs are allocated "without exception", but the
     // patterns never look for one. A clause carrying the exact carve-out this