Alert Triage: environment #2, built end to end by the pipeline

The first environment shipped through .claude/workflows/new-environment.js:
specification, three adversarial reviews (all 'fixable', none fatal), the
Python environment, the TypeScript port, captured rollouts, and the demo page.
Eleven agents, no errors.

The proof that the platform scales is one line long. Alert Triage has a
completely different shape from Word Five — JSON actions, priced lookups, an
analyst screen instead of a grid — and the only change under
src/components/demo/ is a comment edit, because the isolation lint refused the
word "wordle" there. Zero shell code changed. 415 contract checks now pass
against two demos, up from 206 against one.

The environment is honest by construction. Every alert is synthetic, generated
from the seed, and the banner saying so sits inside the board surface. Two of
the eleven scenario templates are hidden-suspicious: generated by the same code
as their benign twin with the signal overlaid only in lookup data, so the free
screen is identically distributed and a screen-only policy STRUCTURALLY cannot
tell them apart. The probe ladder measures it: `fast` catches 0.0 of hidden
seeds. That is the counterweight made real rather than asserted.

Twelve policies, thirteen ladder assertions, a genuine three-way trade:

  fast      0.846   wins hours (0.85), misses every hidden case
  targeted  0.894   wins the shipped total
  thorough  0.820   wins evidence (1.00), spends 2.9 hours

None dominates. 92 Python tests, 35 TypeScript tests, 65 fixtures replaying at
delta 0, and conformance gated on world + scorer + protocol so the browser shows
the same alert for ?seed= that Python generated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019mt6sHQHEnEYrJZvoMCJSB

envs/alert_triage/names/PROVENANCE.md

@@ -0,0 +1,31 @@
+# Where these names came from
+
+Every list in this directory was written by hand for this environment. None
+is derived from a customer file, a sanctions list, a leaked dataset, a public
+records scrape or any other collection of real people or real businesses.
+
+- **`first_names.json`, `surnames.json`** — 40 given names and 40 surnames,
+  chosen to be common across many languages so that no generated customer
+  reads as belonging to one region. A generated name such as "Priya Whitlock"
+  or "Dmitri Okafor" is a random pairing; any resemblance to a real person is
+  the ordinary consequence of common names being common. Analysts who "closed"
+  prior alerts are drawn from the same two lists.
+- **`words.json`** — business names are composed as `adjective + noun +
+  suffix` ("Harbor Lane Bistro LLC" is the shape). Branch codes and street
+  names are invented.
+- **`jurisdictions.json`** — every counterparty jurisdiction is **fictional**.
+  The "monitored" list is the synthetic institution's own high-risk corridor
+  list; it names no real country and makes no claim about any real
+  jurisdiction's risk rating. The customer's home country is the United States
+  in the main seed slice and the fictional "Karnland" (currency KRN) in the
+  held-out slice, where the reporting threshold is a fictional 20,000 KRN
+  rather than the public 10,000 USD currency-transaction-report threshold.
+
+Licence: these lists are part of the repository and carry its Apache-2.0
+licence.
+
+The scenario *templates* in `../alert_triage/generator.py` are written from
+public typology descriptions — FinCEN's SAR narrative guidance and the FATF
+typology reports — which are cited on the demo's evidence tab as references.
+Nothing from those documents is shipped as data, and no template is a real
+case.