Sprint 31 · F-14.6 regex instrumentation · B-17 HA2

Two agent-executable items under Standing Orders #1-#5 · del.auth in force. F-14.6 closes the fall-open defect surfaced by Sprint 30's 16th audit; B-17 reaches HA2 and awaits marketing-authority triad HA3 sight-check.

31.1 · F-14.6 · loud invalid-rule-regex instrumentation

Adds s14_validateRule() pre-validation pass at audit-run start. For every active rule with a regex field (detect_pattern for regex kinds, context_exclude always), the pass (a) auto-strips leading JavaScript-incompatible inline flag groups (?i), (?m), (?s) with a rule-inline-flag-stripped: warning; (b) tests via new RegExp(pat, 'i') and emits a rule-invalid-regex: error on failure. Invalid rules are skipped for the whole run — no fall-open. Response surfaces rules_loaded, rules_skipped, and a rule_warnings object as first-class fields.

31.2 · B-17 awareness campaign brief · HA1 → HA2

Agent self-checked against the 4 deliverable classes × 5 guardrails matrix baked into the HA1 draft (Sprint 30.5). All 5 guardrails verified: Two-tier depiction v1.1 Tier 1+2, clause 4(a) constitutional language, audience targeting non-goals, SO #3 truthful non-compliance, MUST_NOT-PRIV-01 pre-check pattern. Two flags forwarded to HA3 marketing-authority triad: (A) campaign-name relabel awareness → mission-education; (B) peak-body outreach authority (Board resolution recommended).

Latest compliance audit

Sprint 31 delta

• Kits: Kit-01 3× HA5 · Kit-02 3× HA5 · Kit-03 3× HA2 · Kit-04 8× HA3 · B-17 1× HA2 (was HA1)
• Backlog: F-14.6 delivered (fall-open defect closed) · B-17 progression from HA1 → HA2
• Migrations: +0 this sprint · total 61 applied · code-only sprint on the compliance surface
• Compliance: 32 active rules · pre-validation health CLEAN
• Standing Orders: all 5 held in force
• Hard constraint: cosai-proposal.html byte-identical since 18d9ea7 · unchanged

Discipline · durable lesson banked this sprint

1. Fall-open is a defect, not a safety net. A catch { /* fail open */ } block around a live-production rule silently no-ops on any invalid input — the audit runs green and the operator has no signal that a rule is broken. Sprint 30's 16th-audit false-positive volley was masked for exactly this reason: (?i) in context_exclude threw "Invalid group", the catch ate it, and MUST_NOT-PRIV-01 fired against policy-negation text as if no context filter existed. Fix pattern: pre-validate the rule-set once at run start, surface every parse failure as a run-level errors[] entry, skip invalid rules with a loud signal, and only fall back to try/catch as defense-in-depth at the hot path. Bank: invalid config should never look like clean output.