@blamejs/exceptd-skills 0.18.13 → 0.18.15

package/data/playbooks/vc-wallet-trust.json

@@ -528,11 +528,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "An internet-facing verifier accepts an unanchored issuer key OR a replayable presentation gating a high-value entitlement",
+          "condition": "issuer-key-not-pinned-to-trust-anchor == true OR presentation-no-nonce-audience-binding == true",
           "action": "raise_severity"
         },
         {
-          "condition": "Revocation is unenforced on a credential type used for ongoing authorization",
+          "condition": "credential-revocation-status-not-checked == true",
           "action": "trigger_playbook"
         }
       ]
@@ -543,7 +543,7 @@
           "id": "pin-issuer-trust-anchors",
           "description": "Replace open issuerKeyResolver acceptance with an issuer allowlist / x5c-or-federation chain validated to a configured trust anchor; reject issuer keys that do not chain to it.",
           "preconditions": [
-            "verifier owns or can configure the set of trusted issuers"
+            "verifier_controls_trusted_issuers == true"
           ],
           "priority": 1,
           "for_signals": [
@@ -557,7 +557,7 @@
           "id": "enforce-revocation-on-accept",
           "description": "Resolve the status_list on the accept path and reject on a set status bit; treat a status fetch failure as fail-closed (not \"valid\").",
           "preconditions": [
-            "credentials carry a status mechanism"
+            "credentials_carry_status_mechanism == true"
           ],
           "priority": 1,
           "for_signals": [
@@ -568,7 +568,7 @@
           "id": "bind-presentations-to-nonce-audience",
           "description": "Issue a fresh per-request nonce, require a Key-Binding JWT echoing that nonce + the verifier audience, and verify device-auth for mdoc; reject unbound presentations.",
           "preconditions": [
-            "verifier controls the request/challenge"
+            "verifier_controls_request_challenge == true"
           ],
           "priority": 1,
           "for_signals": [

package/data/playbooks/webhook-callback-abuse.json

@@ -694,7 +694,7 @@
           "id": "policy-exception",
           "description": "Generate an auditor-ready policy exception when faster paths are blocked (legacy receiver cannot be patched within window, provider does not offer state-parameter enforcement, etc.) with compensating controls and time-bound risk acceptance.",
           "preconditions": [
-            "remediation_paths[1..3] all blocked",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 4,

package/lib/playbook-runner.js

@@ -953,6 +953,31 @@ function detect(playbookId, directiveId, agentSubmission = {}, runOpts = {}) {
 
 // --- phase 5: analyze ---
 
+/**
+ * Mirror the FIRED detect indicators (verdict === 'hit') into a flat
+ * `{ <indicator-id>: true }` map for the escalation / feeds_into / precondition
+ * eval contexts. Indicator hits arrive from the collector / AI evidence path as
+ * `signal_overrides` (which detect() reads); the condition contexts spread
+ * `agentSubmission.signals`, NOT signal_overrides — so an escalation written as
+ * `<indicator-id> == true` (the catalog's canonical form) stayed false even when
+ * that indicator DETECTED, unless the operator redundantly re-submitted the id
+ * under `signals`. The standard `exceptd collect <playbook>` path never does
+ * that, so the entire indicator-gated escalation/chain layer was dead on the
+ * real evidence path. Mirroring fired indicators here binds the condition layer
+ * to the detect layer. Only verdict 'hit' (FP-checks satisfied) is mirrored — an
+ * 'inconclusive' indicator is unconfirmed and must not fire an escalation. The
+ * map is spread with the LOWEST precedence (before agentSignals, which is before
+ * the engine roots) so an operator can still override a specific id and the
+ * engine-computed values always win.
+ */
+function firedIndicatorSignals(detectIndicators) {
+  const out = {};
+  for (const ind of (detectIndicators || [])) {
+    if (ind && ind.verdict === 'hit' && typeof ind.id === 'string') out[ind.id] = true;
+  }
+  return out;
+}
+
 /**
  * RWEP composition + blast-radius scoring + theater check + framework gap
  * mapping + escalation evaluation. Inputs are the detect result + any
@@ -1490,7 +1515,7 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     findingShape = {};
   }
   for (const ec of an.escalation_criteria || []) {
-    if (evalCondition(ec.condition, { ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, compliance_theater_check: result.compliance_theater_check, jurisdiction_obligations: (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [], analyze: result, matched_cve: result.matched_cves || [],
+    if (evalCondition(ec.condition, { ...firedIndicatorSignals(detectResult.indicators), ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, compliance_theater_check: result.compliance_theater_check, jurisdiction_obligations: (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [], analyze: result, matched_cve: result.matched_cves || [],
         // finding.* is two-sourced: the engine computes the CVE/severity-derived
         // keys (severity, rwep_adjusted, matched_cve_*, blast_radius_score,
         // active_exploitation, framework/control_id_first) via analyzeFindingShape,
@@ -1579,9 +1604,38 @@ function capSummary(s, max = 240) {
 
 function validate(playbookId, directiveId, analyzeResult, agentSignals = {}, runOpts = {}) {
   const playbook = runOpts._playbookCache || loadPlaybook(playbookId);
-  // Surface evalCondition regex errors raised here into the same
-  // run-wide accumulator that analyze() reads.
-  const evalCtx = runOpts._runErrors ? { ...agentSignals, _runErrors: runOpts._runErrors } : agentSignals;
+  // Remediation-path preconditions are evaluated through the SAME evalCondition
+  // the analyze/close phases use, so the precondition context must expose the
+  // SAME engine-computed roots those phases thread in — otherwise a precondition
+  // that gates on `rwep`, `finding.severity`, `matched_cve.*`,
+  // `blast_radius_score`, or `theater_verdict` resolves null and can NEVER be
+  // satisfied, so its remediation path is only ever reachable as the priority
+  // fallback (kernel's `any matched_cve.vector matches 'userns|bpf|ptrace|kptr'`
+  // hardening-compensation path was permanently unsatisfiable for this reason).
+  // agentSignals spread FIRST so the engine-computed values WIN on collision (a
+  // poisoning signals.rwep can't override the engine value) — mirrors the
+  // escalation (analyze) and feeds_into (close) contexts. finding.* merges the
+  // host-AI-asserted descriptive keys UNDER the engine shape with the same
+  // !Array.isArray guard used there.
+  const govern = (playbook.phases && playbook.phases.govern) || {};
+  let findingShape = {};
+  try { findingShape = analyzeFindingShape(analyzeResult || {}); } catch { findingShape = {}; }
+  const evalCtx = {
+    // Fired detect indicators mirrored in (lowest precedence) so a precondition
+    // referencing an indicator id resolves on the collector path. See
+    // firedIndicatorSignals.
+    ...firedIndicatorSignals(analyzeResult && analyzeResult._detect_indicators),
+    ...agentSignals,
+    rwep: analyzeResult && analyzeResult.rwep ? analyzeResult.rwep.adjusted : undefined,
+    blast_radius_score: analyzeResult ? analyzeResult.blast_radius_score : undefined,
+    theater_verdict: analyzeResult && analyzeResult.compliance_theater_check ? analyzeResult.compliance_theater_check.verdict : undefined,
+    compliance_theater_check: analyzeResult ? analyzeResult.compliance_theater_check : undefined,
+    jurisdiction_obligations: govern.jurisdiction_obligations || [],
+    matched_cve: (analyzeResult && analyzeResult.matched_cves) || [],
+    analyze: analyzeResult,
+    finding: { ...(agentSignals.finding && typeof agentSignals.finding === 'object' && !Array.isArray(agentSignals.finding) ? agentSignals.finding : {}), ...findingShape },
+    ...(runOpts._runErrors ? { _runErrors: runOpts._runErrors } : {}),
+  };
   const v = resolvedPhase(playbook, directiveId, 'validate');
 
   // Pick the highest-priority remediation_path whose preconditions are all
@@ -2058,6 +2112,11 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
   // feeds_into chaining — full analyze result is exposed so conditions can
   // reference `analyze.compliance_theater_check.verdict` etc.
   const feedsCtx = {
+    // Fired detect indicators (verdict 'hit') mirrored in so a feeds_into
+    // condition written as `<indicator-id> == true` resolves on the standard
+    // collector path (signal_overrides), not only when the id is re-submitted
+    // under signals. Lowest precedence — operator signals and engine values win.
+    ...firedIndicatorSignals(analyzeResult && analyzeResult._detect_indicators),
     // Operator-submitted signals come FIRST so the engine-computed reserved
     // keys below always win — otherwise a submitted signals.rwep / finding /
     // analyze would override the engine value the feeds_into condition tests
@@ -4035,10 +4094,32 @@ function extractSubmissionForHash(sub) {
     // canonicalStringify can serialize them.
     const signals = {};
     for (const [k, v] of Object.entries(sub.signals)) {
+      // Underscore-prefixed signal keys are runner-internal / output-rendering
+      // directives, NOT operator evidence: `_bundle_formats` (the CLI sets it
+      // from `--format sarif|openvex|csaf`) only chooses which bundle close()
+      // renders — the analyzed posture is identical. Hashing it broke the
+      // "same evidence → same evidence_hash" contract: two runs over identical
+      // evidence that differ only in `--format` produced different digests and
+      // a self-contradicting attest diff. Exclude every `_`-prefixed signal key
+      // (matches the file-wide "underscore = internal" convention). vex_filter /
+      // vex_fixed are deliberately NOT excluded — they DROP CVEs from
+      // matched_cves and change the finding, so they are posture-affecting
+      // evidence; excluding them would make reattest blind to a VEX-driven
+      // posture change (a real drift hidden behind an unchanged hash).
+      if (k.startsWith('_')) continue;
       if (v instanceof Set) signals[k] = Array.from(v).sort();
       else signals[k] = v;
     }
-    pick.signals = signals;
+    // Omit an empty signals bag rather than recording `signals: {}`. A
+    // submission whose ONLY signal was a `_`-prefixed render directive
+    // (`{ _bundle_formats: [...] }`, injected by `ci`/`run --format`) reduces to
+    // {} after the filter above; the baseline no-format submission carries no
+    // `signals` key at all. Recording `{}` vs omitting it would hash identical
+    // evidence as `{signals:{}}` vs no-signals and reintroduce the exact
+    // --format-driven evidence_hash / session-id drift this exclusion exists to
+    // prevent. Only attach signals when at least one operator-meaningful key
+    // survived.
+    if (Object.keys(signals).length > 0) pick.signals = signals;
   }
   if (sub.precondition_checks && typeof sub.precondition_checks === 'object') {
     pick.precondition_checks = sub.precondition_checks;

package/lib/validate-playbooks.js

@@ -79,6 +79,70 @@ const fs = require('node:fs');
 const path = require('node:path');
 const process = require('node:process');
 const { safeExit } = require('./exit-codes');
+// _evalCondition is the SAME parser the runner uses at analyze/validate/close
+// time. Exercising every escalation / feeds_into / remediation-precondition
+// condition through the real evaluator lets the validator reject a condition the
+// engine cannot parse (condition_unparsed) — a prose / bare-token /
+// unimplemented-syntax condition that would silently return false for every
+// input and disable the escalation it gates. No cycle: playbook-runner does not
+// require this validator. Loaded defensively: the engine carries a dependency
+// closure (scoring / cross-ref-api / id-validation) that a stripped test mirror
+// staging only the validator + schema does not copy, so a hard top-level require
+// would crash the validator there. In the real repo and the shipped tarball the
+// engine is always present, so the parse-gate always runs; when it is genuinely
+// unresolvable the gate surfaces a WARNING (never a silent error-skip — see
+// checkCrossRefs) so the degradation is observable rather than a false pass.
+let _evalCondition = null;
+try { ({ _evalCondition } = require('./playbook-runner')); } catch { /* warned at the gate */ }
+
+// Decompose a condition into its leaf atoms the SAME way evalCondition does —
+// strip wrapping parens, split on top-level OR (lowest precedence), then on
+// top-level AND, quote- and depth-aware. This exists because evalCondition
+// evaluates AND via `.every` / OR via `.some`, which SHORT-CIRCUIT: a dead
+// (unparseable) sub-clause behind a leading clause that resolves false (AND) or
+// true (OR) in the empty validation context is never reached, so running the
+// whole condition once never surfaces its condition_unparsed. Atomizing and
+// parse-checking each leaf independently catches a dead sub-clause regardless of
+// short-circuit (e.g. `blast_radius_score >= 3 AND any deterministic indicator
+// fires` — the first clause is false with no signals, so the dead prose second
+// clause never parsed). Mirrors evalCondition's splitAtTopLevel / stripOuterParens.
+function _splitTopLevel(expr, sep) {
+  const parts = []; const needle = ' ' + sep + ' ';
+  let depth = 0, buf = '', i = 0, quote = null;
+  while (i < expr.length) {
+    const ch = expr[i];
+    if (quote) { if (ch === '\\' && i + 1 < expr.length) { buf += ch + expr[i + 1]; i += 2; continue; } if (ch === quote) quote = null; buf += ch; i++; continue; }
+    if (ch === "'" || ch === '"') { quote = ch; buf += ch; i++; continue; }
+    if (ch === '(') { depth++; buf += ch; i++; continue; }
+    if (ch === ')') { depth--; buf += ch; i++; continue; }
+    if (depth === 0 && expr.startsWith(needle, i)) { parts.push(buf.trim()); buf = ''; i += needle.length; continue; }
+    buf += ch; i++;
+  }
+  parts.push(buf.trim());
+  return parts;
+}
+function _stripWrappingParens(e) {
+  e = e.trim();
+  while (e.startsWith('(') && e.endsWith(')')) {
+    let d = 0, wraps = true;
+    for (let i = 0; i < e.length; i++) {
+      if (e[i] === '(') d++;
+      else if (e[i] === ')') { d--; if (d === 0 && i < e.length - 1) { wraps = false; break; } }
+    }
+    if (wraps) e = e.slice(1, -1).trim(); else break;
+  }
+  return e;
+}
+function atomizeCondition(cond) {
+  const atoms = [];
+  (function rec(e) {
+    e = _stripWrappingParens(e);
+    const ors = _splitTopLevel(e, 'OR'); if (ors.length > 1) { ors.forEach(rec); return; }
+    const ands = _splitTopLevel(e, 'AND'); if (ands.length > 1) { ands.forEach(rec); return; }
+    atoms.push(e);
+  })(cond);
+  return atoms;
+}
 
 const REPO_ROOT = path.resolve(__dirname, '..');
 const SCHEMA_PATH = path.join(REPO_ROOT, 'lib', 'schemas', 'playbook.schema.json');
@@ -550,6 +614,74 @@ function checkCrossRefs(playbook, ctx, playbookIds) {
     }
   }
 
+  // Condition PARSEABILITY gate. The path-root check above only catches a
+  // dotted path rooted at an unavailable phase; the broader and far more common
+  // dead-condition shape is a condition the evaluator cannot parse AT ALL —
+  // free-text prose ("A single compromised identity can rewrite the trail"), a
+  // bare-truthiness token without `== true`, an unimplemented keyword
+  // (`<tok> fired`, `not in`, `is`), or an apostrophe-bearing token that fails
+  // the LHS pattern. Every such condition falls through evalCondition to a
+  // silent `false` for every input, so the raise_severity / trigger_playbook /
+  // remediation-precondition it gates never fires — and nothing flagged it,
+  // because the validator never ran the actual evaluator. Run each condition in
+  // the THREE locations the runner threads through evalCondition (analyze
+  // escalation_criteria, _meta.feeds_into, validate remediation_paths
+  // preconditions) and hard-fail on condition_unparsed. Scoped to exactly those
+  // three: scoring_rubric entries are descriptive blast-level prose (never
+  // evaluated — the score comes from agentSignals.blast_radius_score) and
+  // regression_trigger conditions are consumed by computeRegressionNextRun's own
+  // cadence/event parser, so neither is in scope here. Gate ONLY on
+  // condition_unparsed — a genuine PARSE failure is input-independent;
+  // condition_path_unresolved / condition_type_mismatch are runtime data
+  // diagnostics that would false-positive against this empty validation context
+  // (a dotted path legitimately resolves null when no run has populated it).
+  if (!_evalCondition) {
+    // Engine module not resolvable from this validator location (a stripped
+    // test mirror). Surface it as a WARNING so the skip is observable — in the
+    // real repo + shipped tarball the engine always loads and this never fires.
+    warn(
+      'escalation/feeds_into/precondition parse-gate skipped: lib/playbook-runner.js (the condition evaluator) was not resolvable from this validator location, so condition parseability was not checked',
+    );
+  }
+  const conditionParses = (cond) => {
+    if (typeof cond !== 'string' || !cond.trim()) return true;
+    if (!_evalCondition) return true; // engine unavailable — warned above, never a silent error-skip
+    // Check EACH atomic leaf, not the whole condition once: evalCondition's
+    // AND/OR short-circuit hides a dead sub-clause behind a leading clause that
+    // resolves false (AND) / true (OR) in the empty validation context.
+    for (const atom of atomizeCondition(cond)) {
+      const runErrors = [];
+      try { _evalCondition(atom, { _runErrors: runErrors }, { _runErrors: runErrors }); }
+      catch { continue; } // an evaluator throw is a separate concern, not "unparseable"
+      if (runErrors.some((e) => e && e.kind === 'condition_unparsed')) return false;
+    }
+    return true;
+  };
+  for (const [i, ec] of (((phases.analyze || {}).escalation_criteria) || []).entries()) {
+    if (ec && typeof ec === 'object' && !conditionParses(ec.condition)) {
+      err(
+        `phases.analyze.escalation_criteria[${i}].condition: not parseable by the runner's evalCondition (${JSON.stringify(String(ec.condition).slice(0, 80))}) — it returns false for every input, so action "${ec.action || '?'}" never fires. Rewrite into the mini-language (<indicator-id> == true [AND/OR …], engine roots rwep/blast_radius_score/matched_cve/finding.*, membership IN [...], quantifier any/all, matches '…').`,
+      );
+    }
+  }
+  for (const [i, f] of (meta.feeds_into || []).entries()) {
+    if (f && typeof f === 'object' && !conditionParses(f.condition)) {
+      err(
+        `_meta.feeds_into[${i}].condition: not parseable by the runner's evalCondition (${JSON.stringify(String(f.condition).slice(0, 80))}) — the chain to "${f.playbook_id || '?'}" never fires. Rewrite into the mini-language.`,
+      );
+    }
+  }
+  for (const [i, rp] of (validatePhase.remediation_paths || []).entries()) {
+    if (!rp || typeof rp !== 'object' || !Array.isArray(rp.preconditions)) continue;
+    for (const [j, pc] of rp.preconditions.entries()) {
+      if (!conditionParses(pc)) {
+        err(
+          `phases.validate.remediation_paths[${i}] (${rp.id || 'unknown'}).preconditions[${j}]: not parseable by the runner's evalCondition (${JSON.stringify(String(pc).slice(0, 80))}) — it is never satisfiable, so the path can only be selected as the priority fallback. Rewrite into the mini-language (bare token → "<token> == true", prose gate → an operator-signalable "<snake_token> == true").`,
+        );
+      }
+    }
+  }
+
   // Air-gap completeness. When _meta.air_gap_mode is true the runner refuses
   // to touch the network, so every artifact whose source is a network call
   // (https://, http://, gh api, gh release, curl, wget, fetch) MUST carry a