feat: add grounded contract review skill

skills/contract-review/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: contract-review
+version: 0.1.0
+description: Extract contract clauses, compare them only with a supplied terms playbook, and produce cited redlines plus a human-gated risk summary.
+source:
+  type: cli-tool
+  command: node
+  args:
+    - run.mjs
+links:
+  source: https://github.com/luismireles12/runx/tree/feat/contract-review/skills/contract-review
+runx:
+  category: legal
+---
+
+# Contract Review
+
+`contract-review` performs a deterministic, read-only comparison between a
+contract and a supplied acceptable-terms playbook. It extracts only clauses
+present in the input, cites the exact playbook rule behind every redline, and
+returns an analysis artifact for a human reviewer.
+
+It never signs, accepts, rejects, sends, files, or negotiates a contract and
+does not provide a final legal conclusion.
+
+## Inputs
+
+- `contract`: an object containing `id` plus either structured `clauses` or
+  labelled contract `text`.
+- `playbook`: an object containing `id` and a non-empty `rules` array.
+
+Structured clauses should contain `id`, `type`, `title`, and `text`. Rules may
+contain:
+
+- `id` and `clause_type`
+- `requirement`
+- `severity`
+- `max_days`
+- `forbidden_terms`
+- `required_terms`
+- `require_cap`
+- `required`
+- `proposed_text`
+
+## Outputs
+
+- `clauses[]`: only clauses traceable to the contract input.
+- `redlines[]`: each item cites its clause and supplied playbook rule, explains
+  the detected variance, and includes proposed text only when the playbook
+  supplied it.
+- `risk_summary`: counts, severity, input references, and explicit read-only
+  constraints.
+
+## Guardrails
+
+- Refuse non-contract or unparseable input.
+- Refuse a playbook without rules.
+- Never create clause text that is absent from the contract.
+- Never create a policy requirement or proposed replacement that is absent
+  from the playbook.
+- Redact obvious credentials and payment-card numbers from quoted evidence.
+- Emit no effects. A human decides whether to accept, negotiate, or escalate.
+
+## Review procedure
+
+1. Validate both input objects and the supplied playbook rules.
+2. Extract structured clauses or labelled sections from contract text.
+3. Reject the run if the input cannot be identified as a contract.
+4. Match each rule to a clause by normalized type or supplied keywords.
+5. Record missing required clauses without inventing clause text.
+6. Evaluate only explicitly encoded rule conditions.
+7. Return risk ordered from high to low with exact source citations.
+
+## Example
+
+If a termination clause requires 90 days while the supplied rule caps notice
+at 30 days, the redline cites the 90-day clause, cites the 30-day playbook
+requirement, and uses replacement text only if `proposed_text` was supplied.
+
+This artifact is suitable for a first-pass commercial review, not a substitute
+for advice from qualified counsel.

skills/contract-review/X.yaml

@@ -0,0 +1,84 @@
+skill: contract-review
+version: "0.1.0"
+
+catalog:
+  kind: skill
+  audience: operator
+  visibility: public
+  role: canonical
+
+harness:
+  cases:
+    - name: cited-redlines
+      inputs:
+        contract:
+          id: msa-example
+          clauses:
+            - id: term-1
+              type: termination
+              title: Termination
+              text: Either party may terminate for convenience with 90 days written notice.
+            - id: liability-1
+              type: liability
+              title: Limitation of Liability
+              text: Vendor liability is unlimited for every category of damages.
+        playbook:
+          id: commercial-terms-v1
+          rules:
+            - id: termination-notice
+              clause_type: termination
+              requirement: Notice must not exceed 30 days.
+              max_days: 30
+              severity: medium
+              proposed_text: Either party may terminate for convenience with 30 days written notice.
+            - id: liability-cap
+              clause_type: liability
+              requirement: Liability must contain an express monetary cap.
+              require_cap: true
+              severity: high
+              proposed_text: Aggregate liability will not exceed fees paid in the preceding 12 months.
+      expect:
+        status: sealed
+        receipt:
+          schema: runx.receipt.v1
+          state: sealed
+          disposition: closed
+
+    - name: refuse-non-contract
+      inputs:
+        contract:
+          id: lunch-note
+          text: Soup, salad, and coffee are available today.
+        playbook:
+          id: commercial-terms-v1
+          rules:
+            - id: termination-notice
+              clause_type: termination
+              requirement: Notice must not exceed 30 days.
+      expect:
+        status: failure
+
+runners:
+  review:
+    default: true
+    type: cli-tool
+    command: node
+    args:
+      - run.mjs
+    inputs:
+      contract:
+        type: json
+        required: true
+        description: "Contract text or explicitly supplied clauses."
+      playbook:
+        type: json
+        required: true
+        description: "The only acceptable-terms rules the review may apply."
+    outputs:
+      clauses: array
+      redlines: array
+      risk_summary: object
+    artifacts:
+      wrap_as: contract_review_packet
+      packet: runx.contract_review.v1
+

skills/contract-review/fixtures/cited-redlines.json

@@ -0,0 +1,41 @@
+{
+  "contract": {
+    "id": "msa-example",
+    "clauses": [
+      {
+        "id": "term-1",
+        "type": "termination",
+        "title": "Termination",
+        "text": "Either party may terminate for convenience with 90 days written notice."
+      },
+      {
+        "id": "liability-1",
+        "type": "liability",
+        "title": "Limitation of Liability",
+        "text": "Vendor liability is unlimited for every category of damages."
+      }
+    ]
+  },
+  "playbook": {
+    "id": "commercial-terms-v1",
+    "rules": [
+      {
+        "id": "termination-notice",
+        "clause_type": "termination",
+        "requirement": "Notice must not exceed 30 days.",
+        "max_days": 30,
+        "severity": "medium",
+        "proposed_text": "Either party may terminate for convenience with 30 days written notice."
+      },
+      {
+        "id": "liability-cap",
+        "clause_type": "liability",
+        "requirement": "Liability must contain an express monetary cap.",
+        "require_cap": true,
+        "severity": "high",
+        "proposed_text": "Aggregate liability will not exceed fees paid in the preceding 12 months."
+      }
+    ]
+  }
+}
+

skills/contract-review/fixtures/refuse-non-contract.json

@@ -0,0 +1,16 @@
+{
+  "contract": {
+    "id": "lunch-note",
+    "text": "Soup, salad, and coffee are available today."
+  },
+  "playbook": {
+    "id": "commercial-terms-v1",
+    "rules": [
+      {
+        "id": "termination-notice",
+        "clause_type": "termination",
+        "requirement": "Notice must not exceed 30 days."
+      }
+    ]
+  }
+}

skills/contract-review/references/dogfood-receipt.json

@@ -0,0 +1,2 @@
+{"schema":"runx.receipt.v1","id":"sha256:35b48f3bb480b8445f1b98ccf9c7866bf71ebcad83245d2e5edc9457584835f0","created_at":"2026-06-23T05:44:23.579Z","canonicalization":"runx.receipt.c14n.v1","issuer":{"type":"hosted","kid":"runx-demo-key","public_key_sha256":"sha256:3097e2dee2cb4a34b53840cdb705aed71067c36f68db0e0f559c3f3fa043315f"},"signature":{"alg":"Ed25519","value":"base64:cJu63ccV0U7sqeojnD82WdDJgE3W4kaXVDVYBVUd_jjIrNkjIVDssrGQba7bdCXWwJ7QENxhnx6T8--cktC3BA"},"digest":"sha256:e35292df2c1c8b8c4174dcab5ae831b1e02843810fb8d37d268667955d215ea2","idempotency":{"intent_key":"sha256:run_review_cc9aaecb4870-review-intent","trigger_fingerprint":"sha256:run_review_cc9aaecb4870-review-trigger","content_hash":"sha256:run_review_cc9aaecb4870-review-content"},"subject":{"kind":"skill","ref":{"type":"harness","uri":"hrn_run_review_cc9aaecb4870_review"},"commitments":[]},"authority":{"actor_ref":{"type":"principal","uri":"runx:principal:local_runtime"},"grant_refs":[],"scope_refs":[],"authority_proof_refs":[],"attenuation":{"parent_authority_ref":null,"subset_proof":null},"terms":[],"enforcement":{"profile_hash":"sha256:runtime-skeleton-enforcement","redaction_refs":[],"setup_refs":[],"teardown_refs":[]}},"signals":[],"decisions":[{"decision_id":"dec_review","choice":"open","inputs":{"signal_refs":[],"target_ref":null,"opportunity_refs":[],"selection_ref":null},"proposed_intent":{"purpose":"Open runtime node review","legitimacy":"Local graph execution requested this node","success_criteria":[],"constraints":[],"derived_from":[]},"selected_act_id":"act_review","selected_harness_ref":null,"justification":{"summary":"runtime graph planner selected this node","evidence_refs":[]},"closure":null,"artifact_refs":[]}],"acts":[{"id":"act_review","form":"observation","intent":{"purpose":"Run graph step review","legitimacy":"Runtime graph execution was admitted by the local harness","success_criteria":[{"criterion_id":"process_exit","statement":"cli-tool exits successfully","required":true}],"constraints":[],"derived_from":[]},"summary":"Executed graph step review","criterion_bindings":[{"criterion_id":"process_exit","status":"verified","evidence_refs":[],"verification_refs":[],"summary":"cli-tool exited successfully"}],"source_refs":[],"target_refs":[],"artifact_refs":[],"closure":{"disposition":"closed","reason_code":"process_exit","summary":"cli-tool exited successfully","closed_at":"2026-06-23T05:44:23.579Z"}}],"seal":{"disposition":"closed","reason_code":"process_closed","summary":"cli-tool review completed","closed_at":"2026-06-23T05:44:23.579Z","last_observed_at":"2026-06-23T05:44:23.579Z","criteria":[{"criterion_id":"process_exit","status":"verified","evidence_refs":[],"verification_refs":[],"summary":"cli-tool exited successfully"}]},"lineage":{"children":[],"sync":[]}}
+

skills/contract-review/references/evidence.json

@@ -0,0 +1,122 @@
+{
+  "schema": "frantic.evidence.v1",
+  "summary": "Published and independently installed contract-review package. The post-publish dogfood run extracted three supplied clauses, produced three playbook-cited redlines, emitted no effects, and generated a sealed receipt that verifies as valid.",
+  "observations": [
+    {
+      "id": "cli-version",
+      "command": "runx --version",
+      "output": "runx-cli 0.6.13",
+      "details": {"publisher_owner": "luismireles12", "package_name": "contract-review"}
+    },
+    {
+      "id": "source-provenance",
+      "command": "gh pr view 128 --repo runxhq/runx",
+      "output": "Public PR open with the contract-review package and evidence.",
+      "details": {
+        "pr_url": "https://github.com/runxhq/runx/pull/128",
+        "source_url": "https://github.com/luismireles12/runx/tree/feat/contract-review/skills/contract-review",
+        "x_yaml": "https://raw.githubusercontent.com/luismireles12/runx/feat/contract-review/skills/contract-review/X.yaml",
+        "skill_md": "https://raw.githubusercontent.com/luismireles12/runx/feat/contract-review/skills/contract-review/SKILL.md",
+        "verification_json": "https://raw.githubusercontent.com/luismireles12/runx/feat/contract-review/skills/contract-review/references/verification.json"
+      }
+    },
+    {
+      "id": "local-harness",
+      "command": "runx harness skills/contract-review --json",
+      "output": "passed: 2 cases, 0 assertion errors",
+      "details": {
+        "cases": [
+          {"name": "cited-redlines", "status": "sealed"},
+          {"name": "refuse-non-contract", "status": "refused"}
+        ]
+      }
+    },
+    {
+      "id": "publish",
+      "command": "runx login --provider github --for publish; runx registry publish ./skills/contract-review/SKILL.md --registry https://api.runx.ai --json",
+      "output": "published",
+      "details": {
+        "version": "sha-2a3aa46f2351",
+        "registry_ref": "luismireles12/contract-review@sha-2a3aa46f2351",
+        "public_url": "https://runx.ai/x/luismireles12/contract-review@sha-2a3aa46f2351",
+        "hosted_harness_status": "passed"
+      }
+    },
+    {
+      "id": "registry-read",
+      "command": "runx registry read luismireles12/contract-review@sha-2a3aa46f2351 --registry https://api.runx.ai --json",
+      "output": "status: success; owner: luismireles12; trust_tier: community",
+      "details": {
+        "digest": "83995c7034d7a9479bae246742b66c1121cc0320614a45e58825ef4dd038d798",
+        "profile_digest": "5d51769d898f4b35dc9cce4000f71992f5bd1e41978a3800ae47b8b77c457175"
+      }
+    },
+    {
+      "id": "clean-install",
+      "command": "runx add luismireles12/contract-review@sha-2a3aa46f2351 --registry https://api.runx.ai --to ./clean-install --json",
+      "output": "status: installed",
+      "details": {"install_count": 1}
+    },
+    {
+      "id": "dogfood",
+      "command": "runx skill luismireles12/contract-review@sha-2a3aa46f2351 --registry https://api.runx.ai -R ./published-dogfood --input-json contract=<bounded-public-example> --input-json playbook=<bounded-public-playbook> --json",
+      "output": "status: sealed; 3 clauses; 3 redlines; risk level high",
+      "details": {
+        "clause_list": ["payment-1", "termination-1", "liability-1"],
+        "receipt_ref": "runx:receipt:sha256:35b48f3bb480b8445f1b98ccf9c7866bf71ebcad83245d2e5edc9457584835f0"
+      }
+    },
+    {
+      "id": "cited-redlines",
+      "command": "inspect dogfood structured output",
+      "output": "Every redline cites a supplied clause and playbook rule.",
+      "details": {
+        "redlines": [
+          {"clause_id": "liability-1", "rule_id": "liability-cap", "severity": "high", "citation": "Liability must contain an express cap tied to fees."},
+          {"clause_id": "payment-1", "rule_id": "payment-net-30", "severity": "medium", "citation": "Invoice terms must not exceed 30 days."},
+          {"clause_id": "termination-1", "rule_id": "termination-30", "severity": "medium", "citation": "Termination notice must not exceed 30 days."}
+        ]
+      }
+    },
+    {
+      "id": "risk-and-effects",
+      "command": "inspect dogfood risk_summary",
+      "output": "high risk; read_only true; effects_emitted empty",
+      "details": {"clause_count": 3, "redline_count": 3, "read_only": true, "effects_emitted": []}
+    },
+    {
+      "id": "receipt-verification",
+      "command": "runx verify sha256:35b48f3bb480b8445f1b98ccf9c7866bf71ebcad83245d2e5edc9457584835f0 --receipt-dir ./published-dogfood --json",
+      "output": "valid: true",
+      "details": {
+        "signature_mode": "production",
+        "findings": [],
+        "receipt_url": "https://raw.githubusercontent.com/luismireles12/runx/feat/contract-review/skills/contract-review/references/dogfood-receipt.json"
+      }
+    },
+    {
+      "id": "new-user-flow",
+      "command": "install, run, and verify the published package",
+      "output": "No private context is required.",
+      "details": {
+        "steps": [
+          "Install the exact registry ref.",
+          "Run with bounded contract and playbook JSON.",
+          "Save the emitted receipt.",
+          "Verify it with runx verify."
+        ]
+      }
+    }
+  ],
+  "dogfood": {
+    "package": "luismireles12/contract-review@sha-2a3aa46f2351",
+    "input": "Public synthetic cloud order form with payment, termination, and liability clauses plus an explicit commercial playbook.",
+    "command": "runx skill luismireles12/contract-review@sha-2a3aa46f2351 --registry https://api.runx.ai ... --json",
+    "receipt_ref": "runx:receipt:sha256:35b48f3bb480b8445f1b98ccf9c7866bf71ebcad83245d2e5edc9457584835f0",
+    "verify_verdict": "valid: true",
+    "harness_cases": [
+      {"name": "cited-redlines", "status": "sealed"},
+      {"name": "refuse-non-contract", "status": "refused"}
+    ]
+  }
+}

skills/contract-review/references/harness-evidence.json

@@ -0,0 +1,41 @@
+{
+  "schema": "runx.contract_review.harness_evidence.v1",
+  "generated_at": "2026-06-23T05:38:00Z",
+  "cli_version": "runx-cli 0.6.13",
+  "command": "runx harness skills/contract-review --receipt-dir ./local-harness --json",
+  "result": {
+    "status": "passed",
+    "case_count": 2,
+    "assertion_error_count": 0,
+    "case_names": [
+      "cited-redlines",
+      "refuse-non-contract"
+    ],
+    "receipt_ids": [
+      "sha256:1d5c524b4feca791d75a4d3d7a66db8310bf83461eb4b730c532ba70d4bf5700",
+      "sha256:6c64d599c1a815b8514d4402c5e0012a0a13cc652533b7b7c0f0f2d394ea72cd"
+    ]
+  },
+  "observations": {
+    "clauses": [
+      "term-1",
+      "liability-1"
+    ],
+    "redlines": [
+      {
+        "rule_id": "liability-cap",
+        "clause_id": "liability-1",
+        "citation": "Liability must contain an express monetary cap."
+      },
+      {
+        "rule_id": "termination-notice",
+        "clause_id": "term-1",
+        "citation": "Notice must not exceed 30 days."
+      }
+    ],
+    "risk_summary": "high: one high and one medium redline",
+    "refusal": "A lunch note exits with failure instead of fabricating contract clauses.",
+    "effects": []
+  }
+}
+