feat: counterparty risk, compliance snapshots, notification ownership, freeze windows

[fortezzalaboratory]

What

Adds four policy and audit modules for Utix: counterparty risk scoring, immutable compliance snapshots, notification preference ownership with mandatory-alert auditing, and operational freeze windows with an audited emergency bypass.

Issues Resolved

Closes #175
Closes #176
Closes #177
Closes #178

Changes

#175 - Add counterparty risk scoring and visibility controls

core/policy/counterparty-risk.ts feeds profile signals (account age, disputes, fraud flag, bulk transfers) through the existing assessRisk engine, so the score is reproducible from documented inputs. States are low, medium, high, unknown, with a maintainer override that replaces the state while keeping the score for review. toPublicRiskSummary returns only id and state, so thresholds and signals never reach non-maintainers.

#176 - Create immutable compliance snapshot for critical lifecycle events

core/audit/compliance-snapshot.ts stores canonical (sorted-key) JSON with a schema version and a SHA-256 integrity hash. ComplianceSnapshotStore.capture is idempotent per event id, and read is restricted to the maintainer scope and verifies the hash before returning. CRITICAL_SNAPSHOT_EVENTS declares which audit actions require a snapshot.

#177 - Implement participant notification preferences with mandatory alert overrides

Preference edits now require the recipient as the actor. Other edits are audited as denied and throw. Mandatory alerts already bypassed opt-out in publish. This change also adds the notification audit actions to SENSITIVE_ACTIONS, because recordAudit silently rejected unknown actions, so mandatory overrides were not actually being recorded.

#178 - Add operational freeze window for risky maintenance actions

core/policy/freeze-window.ts validates windows (known action scopes, startsAt < endsAt), blocks listed actions while active (end instant is exclusive), and allows an emergency bypass only for the exact window id with a named approver and justification. Every bypass and refused bypass is audited (freeze.bypassed, freeze.bypass_denied).

Assumptions

• Counterparty states for the 175 signals and freeze action scopes were chosen from the issue text; the exact weights are documented in counterparty-risk.ts.
• updatePreferences and resetPreferences take an optional actor argument that defaults to the recipient, so existing callers keep working.
• Snapshot and freeze modules are added as library code. Wiring them into every emitting call site is not in this PR.

How to Test

1. npm run test -- core/policy core/audit core/notifications
2. Expected: new tests in counterparty-risk.test.ts, freeze-window.test.ts, compliance-snapshot.test.ts and mandatory-preferences.test.ts pass.

Follow-Up

• Docs for these controls are not yet in docs/.
• Freeze windows and compliance snapshots are not yet enforced at ticket issuance, transfer or redemption call sites.
• Tests were written but not executed in this change; CI should be the first run.

[drips-wave]

@fortezzalaboratory Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[prissca]

This October PR is currently conflicting/dirty against the base branch and was not merged. Please update the branch, resolve conflicts, rerun CI, and request a fresh review.