vc-risk-evidence-pack

Create a harness folder inside the selected plan's task directory and populate five JSON artifacts: risk-gate, context-snippets, verification, review-decision, and adversarial-validation. Then run the validate-risk-artifacts.mjs script against that directory to check required fields.

Six classes qualify: auth or identity flows, billing or credit accounting, schema migrations or destructive writes, public API or external contract changes, deploy/runtime/container/proxy behavior, and permission, secret, or trust-boundary logic.

Run node validate-risk-artifacts.mjs with the artifact directory path. It checks required fields in each JSON file, enforces riskLevel values, and exits with code 1 if any failure is found, printing warnings and failures as JSON.

No. The contract is manual-first and opt-in by risk class. The validation scripts check shape only and do not hook into CI or enforce adoption by default; the auto-stop rule is a workflow convention, not a blocking hook.

It is required for high-risk or attack-sensitive paths such as auth bypass, privilege escalation, secret exfiltration, or trust-boundary violations. The validator emits a warning when a high-risk pack is missing this artifact.