feat: add SOD constraints to system-prompt and claude-code adapters

- system-prompt.ts: exports SOD role assignments, conflict rules,
  handoff requirements, isolation constraints, and DUTIES.md content
- claude-code.ts: includes SOD subsection in Compliance output and
  loads DUTIES.md into generated CLAUDE.md

Part 3 of 4 — depends on feat/sod-2-cli-commands

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: patel-lyzr

src/adapters/claude-code.ts

@@ -26,6 +26,12 @@ export function exportToClaudeCode(dir: string): string {
     parts.push(rules);
   }
 
+  // DUTIES.md → segregation of duties policy
+  const duty = loadFileIfExists(join(agentDir, 'DUTIES.md'));
+  if (duty) {
+    parts.push(duty);
+  }
+
   // Skills — loaded via skill-loader
   const skillsDir = join(agentDir, 'skills');
   const skills = loadAllSkills(skillsDir);
@@ -77,6 +83,36 @@ export function exportToClaudeCode(dir: string): string {
       complianceParts.push('- All actions are audit-logged');
     }
 
+    if (c.segregation_of_duties) {
+      const sod = c.segregation_of_duties;
+      complianceParts.push('\n### Segregation of Duties');
+      complianceParts.push(`Enforcement: ${sod.enforcement ?? 'strict'}`);
+      if (sod.assignments) {
+        complianceParts.push('\nRole assignments:');
+        for (const [agent, roles] of Object.entries(sod.assignments)) {
+          complianceParts.push(`- ${agent}: ${roles.join(', ')}`);
+        }
+      }
+      if (sod.conflicts) {
+        complianceParts.push('\nConflict rules (must not be same agent):');
+        for (const [a, b] of sod.conflicts) {
+          complianceParts.push(`- ${a} <-> ${b}`);
+        }
+      }
+      if (sod.handoffs) {
+        complianceParts.push('\nRequired handoffs:');
+        for (const h of sod.handoffs) {
+          complianceParts.push(`- ${h.action}: ${h.required_roles.join(' → ')}`);
+        }
+      }
+      if (sod.isolation?.state === 'full') {
+        complianceParts.push('- Agent state is fully isolated per role');
+      }
+      if (sod.isolation?.credentials === 'separate') {
+        complianceParts.push('- Credentials are segregated per role');
+      }
+    }
+
     parts.push(complianceParts.join('\n'));
   }
 

src/adapters/system-prompt.ts

@@ -25,6 +25,12 @@ export function exportToSystemPrompt(dir: string): string {
     parts.push(rules);
   }
 
+  // DUTIES.md
+  const duty = loadFileIfExists(join(agentDir, 'DUTIES.md'));
+  if (duty) {
+    parts.push(duty);
+  }
+
   // Skills — loaded via skill-loader
   const skillsDir = join(agentDir, 'skills');
   const skills = loadAllSkills(skillsDir);
@@ -82,6 +88,37 @@ export function exportToSystemPrompt(dir: string): string {
       constraints.push('- Do not process any personally identifiable information');
     }
 
+    if (c.segregation_of_duties) {
+      const sod = c.segregation_of_duties;
+      constraints.push('- Segregation of duties is enforced:');
+      if (sod.assignments) {
+        for (const [agentName, roles] of Object.entries(sod.assignments)) {
+          constraints.push(`  - Agent "${agentName}" has role(s): ${roles.join(', ')}`);
+        }
+      }
+      if (sod.conflicts) {
+        constraints.push('- Duty separation rules (no single agent may hold both):');
+        for (const [a, b] of sod.conflicts) {
+          constraints.push(`  - ${a} and ${b}`);
+        }
+      }
+      if (sod.handoffs) {
+        constraints.push('- The following actions require multi-agent handoff:');
+        for (const h of sod.handoffs) {
+          constraints.push(`  - ${h.action}: must pass through roles ${h.required_roles.join(' → ')}${h.approval_required !== false ? ' (approval required)' : ''}`);
+        }
+      }
+      if (sod.isolation?.state === 'full') {
+        constraints.push('- Agent state/memory is fully isolated per role — do not access another agent\'s state');
+      }
+      if (sod.isolation?.credentials === 'separate') {
+        constraints.push('- Credentials are segregated per role — use only credentials assigned to your role');
+      }
+      if (sod.enforcement === 'strict') {
+        constraints.push('- SOD enforcement is STRICT — violations will block execution');
+      }
+    }
+
     if (constraints.length > 0) {
       parts.push(`## Compliance Constraints\n${constraints.join('\n')}`);
     }