@blamejs/exceptd-skills 0.18.6 → 0.18.8

package/lib/playbook-runner.js

@@ -249,15 +249,22 @@ function preflight(playbook, runOpts = {}) {
 
   // 1. Currency gate
   const score = meta.threat_currency_score;
-  if (score < 50 && !runOpts.forceStale) {
+  // A non-numeric score (absent / null / NaN from a malformed _meta) must HARD
+  // BLOCK, not slip through: `undefined < 50` is false, which would silently
+  // bypass the staleness gate on exactly the playbooks whose currency metadata
+  // is broken. Treat "no usable score" as the most-stale state.
+  const scoreUsable = typeof score === 'number' && !Number.isNaN(score);
+  if ((!scoreUsable || score < 50) && !runOpts.forceStale) {
     return {
       ok: false,
       blocked_by: 'currency',
-      reason: `threat_currency_score = ${score} (< 50). Hard-blocked. Pass forceStale=true to override.`,
+      reason: scoreUsable
+        ? `threat_currency_score = ${score} (< 50). Hard-blocked. Pass forceStale=true to override.`
+        : `threat_currency_score is absent or non-numeric (${JSON.stringify(score)}). Hard-blocked — a playbook without a usable currency score is treated as stale. Fix _meta.threat_currency_score, or pass forceStale=true to override.`,
       issues
     };
   }
-  if (score < 70) {
+  if (scoreUsable && score < 70) {
     issues.push({ kind: 'currency_warn', message: `threat_currency_score = ${score} (< 70). Threat model is stale — recommend running the skill-update-loop before relying on findings.` });
   }
 
@@ -357,19 +364,53 @@ function preflight(playbook, runOpts = {}) {
   return { ok: true, issues };
 }
 
-// lockDir lives at a stable global path so two CLI invocations from
+// lockDir lives at a stable per-user path so two CLI invocations from
 // different working directories still share lock state for cross-process
 // mutex enforcement. A process.cwd()-relative dir would let invocations
 // from /tmp and from /home/user/project simultaneously each see an empty
-// locks dir and both run unchallenged. The path
-// keys on os.platform() so Windows/macOS/Linux locks live under separate
-// directories (avoids cross-platform stale-PID confusion when a host is
-// shared across OSes via networked FS). Override via EXCEPTD_LOCK_DIR for
-// container/CI scenarios that need an explicit shared location.
+// locks dir and both run unchallenged.
+//
+// Resolution order (most-specific first):
+//   1. EXCEPTD_LOCK_DIR        explicit container/CI override
+//   2. EXCEPTD_HOME || ~/.exceptd  + /locks/<platform>   per-user default
+//   3. os.tmpdir()/exceptd-locks-<platform>              last-resort fallback
+//      when the per-user home is non-writable (read-only home, restricted
+//      sandbox/CI runner).
+//
+// The per-user home (mirroring the orchestrator's watch.lock + attestation
+// roots) is both the safer location — a per-user dir is not the
+// world-writable shared OS tempdir a preplant/symlink attack targets — and
+// the better fit for lockDir's stated goal: ~/.exceptd is per-user-stable
+// across working directories, whereas the shared tmpdir is the weaker
+// choice. The path keys on os.platform() so Windows/macOS/Linux locks live
+// under separate directories (avoids cross-platform stale-PID confusion when
+// a host is shared across OSes via networked FS).
+function resolveLockDir() {
+  if (process.env.EXCEPTD_LOCK_DIR) return process.env.EXCEPTD_LOCK_DIR;
+  const home = process.env.EXCEPTD_HOME || (os.homedir() && path.join(os.homedir(), '.exceptd'));
+  if (home) {
+    const dir = path.join(home, 'locks', process.platform);
+    try {
+      fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+      // Probe writability with a marker; remove on success. A home that
+      // mkdirs but can't be written (read-only mount, restrictive ACL) must
+      // fall through to the tmpdir fallback rather than silently no-op every
+      // lock write.
+      const probe = path.join(dir, `.write-probe-${process.pid}`);
+      fs.writeFileSync(probe, '');
+      fs.unlinkSync(probe);
+      return dir;
+    } catch { /* home non-writable — fall through to tmpdir */ }
+  }
+  return path.join(os.tmpdir(), `exceptd-locks-${process.platform}`);
+}
+
 function lockDir() {
-  const dir = process.env.EXCEPTD_LOCK_DIR
-    || path.join(os.tmpdir(), `exceptd-locks-${process.platform}`);
-  try { fs.mkdirSync(dir, { recursive: true }); } catch {}
+  const dir = resolveLockDir();
+  // Owner-only (0700): the mutex lock files inside use O_EXCL ('wx'), but
+  // tightening the parent directory keeps another local user from listing or
+  // tampering with this user's lock set.
+  try { fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); } catch { /* exists / EACCES — non-fatal */ }
   return dir;
 }
 
@@ -388,14 +429,27 @@ function lockFilePath(playbookId) {
 // lifetime.
 const STALE_LOCK_MS = 30_000;
 
+// Create the mutex lock file with an exclusive, owner-only descriptor
+// (O_CREAT | O_EXCL | 0o600 via openSync 'wx'). The lock-file NAME is
+// deliberately predictable — it IS the cross-process mutex, so every contender
+// must agree on it; security comes from the exclusive create (a preplanted file
+// or symlink makes the open throw EEXIST/EPERM, never a silent follow), the
+// 0o700 lock directory, and the 0o600 mode — written through openSync so the
+// secure-create primitive is explicit rather than a bare writeFileSync. Throws
+// EEXIST when the lock is already held, which every caller already handles.
+function writeLockFile(p, playbookId) {
+  const fd = fs.openSync(p, 'wx', 0o600);
+  try {
+    fs.writeSync(fd, JSON.stringify({ pid: process.pid, started_at: new Date().toISOString(), playbook: playbookId }, null, 2));
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
 function acquireLock(playbookId) {
   const p = lockFilePath(playbookId);
   if (!p) return null;
-  const writePayload = () => fs.writeFileSync(
-    p,
-    JSON.stringify({ pid: process.pid, started_at: new Date().toISOString(), playbook: playbookId }, null, 2),
-    { flag: 'wx' }
-  );
+  const writePayload = () => writeLockFile(p, playbookId);
   try {
     writePayload();
     return p;
@@ -458,9 +512,7 @@ function acquireLockDiagnostic(playbookId) {
   const p = lockFilePath(playbookId);
   if (!p) return { ok: false, reason: 'no_lock_path' };
   try {
-    fs.writeFileSync(p,
-      JSON.stringify({ pid: process.pid, started_at: new Date().toISOString(), playbook: playbookId }, null, 2),
-      { flag: 'wx' });
+    writeLockFile(p, playbookId);
     return { ok: true, path: p };
   } catch (e) {
     if (e && (e.code === 'EEXIST' || e.code === 'EPERM')) {
@@ -476,9 +528,7 @@ function acquireLockDiagnostic(playbookId) {
       if (Number.isInteger(pid) && pid > 0 && pid !== process.pid && !pidAlive(pid)) {
         try { fs.unlinkSync(p); } catch {}
         try {
-          fs.writeFileSync(p,
-            JSON.stringify({ pid: process.pid, started_at: new Date().toISOString(), playbook: playbookId }, null, 2),
-            { flag: 'wx' });
+          writeLockFile(p, playbookId);
           return { ok: true, path: p, reclaimed_from_pid: pid };
         } catch (e2) {
           return { ok: false, reason: 'reclaim_failed', error: e2.message, lock_path: p, holder_pid: pid };
@@ -494,9 +544,7 @@ function acquireLockDiagnostic(playbookId) {
         if (mtimeMs !== null && (Date.now() - mtimeMs) > STALE_LOCK_MS) {
           try { fs.unlinkSync(p); } catch {}
           try {
-            fs.writeFileSync(p,
-              JSON.stringify({ pid: process.pid, started_at: new Date().toISOString(), playbook: playbookId }, null, 2),
-              { flag: 'wx' });
+            writeLockFile(p, playbookId);
             return { ok: true, path: p, reclaimed_self_stale_pid: true, prior_mtime_ms: mtimeMs };
           } catch (e3) {
             return { ok: false, reason: 'reclaim_failed', error: e3.message, lock_path: p, holder_pid: pid };
@@ -608,7 +656,12 @@ function look(playbookId, directiveId, runOpts = {}) {
       // Surface the air-gap alternative as the primary source when air_gap_mode
       // is active, so the agent doesn't accidentally hit the network.
       source: airGap && a.air_gap_alternative ? a.air_gap_alternative : a.source,
-      _original_source: a.source
+      _original_source: a.source,
+      // In air-gap mode an artifact with NO air_gap_alternative silently keeps
+      // its original (possibly network-bound) source — defeating air-gap with no
+      // signal. Flag it so the agent treats the source as not-offline-verified
+      // and the gap is observable instead of a silent network fallback.
+      ...(airGap && !a.air_gap_alternative ? { air_gap_alternative_missing: true } : {}),
     })),
     collection_scope: l.collection_scope,
     environment_assumptions: l.environment_assumptions || [],
@@ -978,8 +1031,12 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     : [];
   // VEX-fixed CVEs remain in matched/catalog arrays but get annotated
   // with vex_status:'fixed' downstream so consumers see them as resolved.
+  // Source from catalogBaselineCves (post-vexFilter survivors), NOT allCves: a
+  // CVE the operator marked BOTH not_affected (dropped by vexFilter) AND fixed
+  // is contradictory, and listing it as fixed while it's absent from
+  // matched/baseline would have it appear in fixed_cves but nowhere else.
   const vexFixedIds = vexFixed
-    ? allCves.filter(c => vexFixed.has(c.cve_id)).map(c => c.cve_id)
+    ? catalogBaselineCves.filter(c => vexFixed.has(c.cve_id)).map(c => c.cve_id)
     : [];
 
   // Build correlation map: cve_id -> array of "indicator_hit:<id>" / "signal:<id>" reasons.
@@ -1058,6 +1115,14 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     const vexStatus = (vexFixed && vexFixed.has(c.cve_id)) ? 'fixed' : null;
     return {
       cve_id: c.cve_id,
+      // attack_class is the coarse chainable taxonomy (kernel-lpe /
+      // mcp-supply-chain / ai-c2 / prompt-injection / container-escape / …)
+      // the sbom -> deep-dive feeds_into rules quantify over
+      // (`any matched_cve.attack_class == 'kernel-lpe'`). It comes from the
+      // catalog entry's explicit attack_class only — no fuzzy inference from
+      // the free-form `type`, so an unclassified CVE stays null and the chain
+      // correctly does not fire (no false escalation) rather than misrouting.
+      attack_class: c.entry?.attack_class ?? null,
       rwep: c.rwep_score,
       cvss_score: c.entry?.cvss_score ?? null,
       cvss_vector: c.entry?.cvss_vector ?? null,
@@ -1408,7 +1473,7 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     findingShape = {};
   }
   for (const ec of an.escalation_criteria || []) {
-    if (evalCondition(ec.condition, { ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, analyze: result, finding: findingShape }, playbook)) {
+    if (evalCondition(ec.condition, { ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, compliance_theater_check: result.compliance_theater_check, jurisdiction_obligations: (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [], analyze: result, matched_cve: result.matched_cves || [], finding: findingShape }, playbook)) {
       escalations.push({ condition: ec.condition, action: ec.action, target_playbook: ec.target_playbook || null });
     }
   }
@@ -1695,8 +1760,16 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
   };
   const enrichNotification = (na) => {
     const obligation = (g.jurisdiction_obligations || []).find(o =>
+      o && typeof o === 'object' &&
       `${o.jurisdiction}/${o.regulation} ${o.window_hours}h` === na.obligation_ref
     );
+    // A non-empty obligation_ref that resolves to nothing leaves the
+    // jurisdiction / regulation / deadline fields null below — surface it as a
+    // runtime_error so the unmatched ref is observable, not a silent null record.
+    if (!obligation && na && typeof na.obligation_ref === 'string' && na.obligation_ref &&
+        Array.isArray(runOpts && runOpts._runErrors)) {
+      pushRunError(runOpts._runErrors, { kind: 'unresolved_obligation_ref', obligation_ref: na.obligation_ref }, { dedupeKey: x => x.obligation_ref || '' });
+    }
     // Thread runOpts + the engine-computed classification through so
     // computeClockStart can check operator_consent.explicit before
     // auto-stamping detect_confirmed, and so an engine-confirmed detection
@@ -1727,9 +1800,23 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
       && autoStartEvent
       && eventReady
       && !(runOpts && runOpts.operator_consent && runOpts.operator_consent.explicit === true);
-    const deadline = obligation && clockValid
+    // window_hours must be a finite number before it enters the deadline
+    // arithmetic — a malformed obligation with an undefined/null/non-number
+    // window_hours would otherwise compute `getTime() + NaN` and crash the
+    // close phase at `new Date(NaN).toISOString()`. Runtime validation of the
+    // playbook is not enforced, so guard here independently of the schema.
+    const windowValid = obligation && typeof obligation.window_hours === 'number' && Number.isFinite(obligation.window_hours);
+    const deadline = obligation && clockValid && windowValid
       ? new Date(clockStart.getTime() + obligation.window_hours * 3600 * 1000).toISOString()
       : 'pending_clock_start_event';
+    // A notification_action whose obligation_ref was specified but resolves to
+    // no obligation is an internally-inconsistent playbook (the schema requires
+    // obligation_ref to name a real govern obligation). The unmatched ref is
+    // already surfaced as a runtime_error above; drop the record rather than
+    // emit a null-jurisdiction/regulation entry that pollutes the deadline list.
+    if (!obligation && na && typeof na.obligation_ref === 'string' && na.obligation_ref) {
+      return null;
+    }
     return {
       ...na,
       // Carry obligation metadata forward so each notification entry is
@@ -1778,7 +1865,10 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
       })(),
     };
   };
-  const notificationActions = (c.notification_actions || []).map(enrichNotification);
+  // enrichNotification returns null for an unresolved specified obligation_ref
+  // (already surfaced as a runtime_error); filter those out so the notification
+  // list never carries a null-jurisdiction record.
+  const notificationActions = (c.notification_actions || []).map(enrichNotification).filter(Boolean);
 
   // A govern obligation that declares a notification duty but has no
   // matching close.notification_actions entry would otherwise never surface
@@ -1790,15 +1880,27 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
   // can tell it apart from a playbook-authored action.
   const coveredObligationRefs = new Set((c.notification_actions || []).map(na => na.obligation_ref));
   for (const o of (g.jurisdiction_obligations || [])) {
+    if (!o || typeof o !== 'object') continue; // skip a null/malformed obligation rather than crash close() during synthesis
     if (!String(o.obligation || '').startsWith('notify')) continue;
+    // A notify obligation with a non-number window_hours is malformed: it would
+    // synthesize a "…/… undefinedh" ref and could not produce a real deadline.
+    // Surface it as a runtime_error and skip synthesis rather than emit a bogus
+    // record (the deadline guard in enrichNotification also prevents the crash).
+    if (typeof o.window_hours !== 'number' || !Number.isFinite(o.window_hours)) {
+      if (Array.isArray(runOpts && runOpts._runErrors)) {
+        pushRunError(runOpts._runErrors, { kind: 'malformed_obligation_window_hours', obligation: `${o.jurisdiction}/${o.regulation}` }, { dedupeKey: x => x.obligation || '' });
+      }
+      continue;
+    }
     const ref = `${o.jurisdiction}/${o.regulation} ${o.window_hours}h`;
     if (coveredObligationRefs.has(ref)) continue;
-    notificationActions.push(enrichNotification({
+    const synthesized = enrichNotification({
       obligation_ref: ref,
       recipient: null,
       draft_notification: null,
       synthesized_from_obligation: true,
-    }));
+    });
+    if (synthesized) notificationActions.push(synthesized);
   }
 
   // exception_generation — evaluate trigger.
@@ -1932,7 +2034,37 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
     // and could suppress a legitimate downstream chain.
     ...agentSignals,
     rwep: analyzeResult.rwep?.adjusted,
-    theater_score: analyzeResult.compliance_theater_check?.verdict === 'theater' ? 0 : 100,
+    // Bare-token parity with the escalation context (analyze()): catalog
+    // feeds_into conditions reference the unqualified tokens `blast_radius_score`
+    // and `theater_verdict` (e.g. framework.json's feeds_into into sbom). Without
+    // these top-level keys resolvePath returns null and `null >= 4` is false
+    // regardless of the engine-computed blast radius, so the chain is dead. They
+    // are spread AFTER ...agentSignals so the engine value wins over any
+    // operator-submitted signals.blast_radius_score / signals.theater_verdict.
+    blast_radius_score: analyzeResult.blast_radius_score,
+    theater_verdict: analyzeResult.compliance_theater_check?.verdict,
+    // Bare top-level `compliance_theater_check` so catalog conditions that
+    // reference `compliance_theater_check.verdict` unqualified (framework.json's
+    // feeds_into into sbom) resolve — without it resolvePath returns null and the
+    // clause is dead regardless of the engine verdict. The `analyze.*` alias
+    // below stays for conditions that use the qualified path.
+    compliance_theater_check: analyzeResult.compliance_theater_check,
+    // Govern-phase jurisdiction obligations so feeds_into conditions like
+    // `… AND jurisdiction_obligations contains 'EU'` (framework → sbom) resolve.
+    jurisdiction_obligations: (g && g.jurisdiction_obligations) || (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [],
+    // theater_score follows lib/framework-gap.js's convention: HIGH = more
+    // theater detected (worse). A 'theater' verdict (a gap exists) is the
+    // concerning case, so it scores 100; a clear verdict scores 0. (Earlier
+    // this was inverted, so a feeds_into condition like `theater_score >= 50`
+    // would have failed to fire exactly when a gap was found.)
+    theater_score: analyzeResult.compliance_theater_check?.verdict === 'theater' ? 100 : 0,
+    // Top-level matched_cve array so the shipped sbom feeds_into quantifiers
+    // (`any matched_cve.attack_class == 'kernel-lpe'`, … IN ['ai-c2', …]) re-root
+    // at each matched CVE. Without it the quantifier head resolves null and the
+    // sbom -> kernel/mcp/ai-api deep-dive chains stay dead even when a matched
+    // CVE carries the attack_class. The `analyze.matched_cves` alias stays for
+    // conditions that use the qualified path.
+    matched_cve: analyzeResult.matched_cves || [],
     analyze: analyzeResult,
     validate: validateResult,
     finding: analyzeFindingShape(analyzeResult),
@@ -2397,11 +2529,12 @@ function sanitizeOperatorText(s) {
   // U+007F, U+0080-009F, private-use, unassigned), so the family pass is a
   // documented-intent superset removal and the result is identical to the
   // single \p{C} strip.
-  const familyStripped = normalised
-    .replace(codepointClass.BIDI_RE_G, '')
-    .replace(codepointClass.C0_CTRL_RE_G, '')
-    .replace(codepointClass.ZW_RE_G, '')
-    .replace(codepointClass.NULL_RE_G, '');
+  const familyStripped = codepointClass.applyCharStripPolicies(normalised, {
+    bidiPolicy: 'strip',
+    controlPolicy: 'strip',
+    zeroWidthPolicy: 'strip',
+    nullBytePolicy: 'strip',
+  });
   const stripped = familyStripped.replace(/\p{C}/gu, '');
   const trimmed = stripped.trim();
   if (trimmed.length === 0) return null;
@@ -3309,7 +3442,23 @@ function normalizeSubmission(submission, playbook) {
     }
     if (typeof val === "object" && val !== null) {
       const aid = knownArtifacts.has(key) ? key : (val.artifact || key);
-      out.artifacts[aid] = { value: val.value, captured: val.captured !== false };
+      // Preserve every evidence-bearing key the observation carried, not just
+      // `value`. An observation whose secret/path lives under a non-`value`
+      // key (e.g. { path, matched, reason } — a natural collector shape) was
+      // previously collapsed to { value: undefined, captured } here, silently
+      // discarding the actual evidence. Two observations capturing DIFFERENT
+      // secrets under path/matched then hashed and diffed byte-identical, so
+      // `attest diff` reported a false "unchanged" and masked real drift.
+      // The reserved control keys (artifact/indicator/result) drive
+      // signal_overrides below and are intentionally not echoed as evidence.
+      const { artifact: _a, indicator: _i, result: _r, captured: _c, value: _v, ...evidence } = val;
+      const normalizedArtifact = { captured: val.captured !== false };
+      if (val.value !== undefined) normalizedArtifact.value = val.value;
+      for (const [ek, ev] of Object.entries(evidence)) {
+        if (ek === "__proto__" || ek === "constructor" || ek === "prototype") continue;
+        normalizedArtifact[ek] = ev;
+      }
+      out.artifacts[aid] = normalizedArtifact;
       if (val.indicator && val.result !== undefined) {
         const newVerdict = canonicalizeOutcome(val.result);
         if (out.signal_overrides[val.indicator] !== undefined && out._signal_origins[val.indicator] !== undefined) {
@@ -3861,6 +4010,15 @@ function extractSubmissionForHash(sub) {
   return pick;
 }
 
+// Identity fields a `contains`/`includes` membership test targets when the
+// array holds objects (e.g. jurisdiction_obligations records). Membership is
+// field-scoped to these so a non-identity field (clock_starts, obligation,
+// regulation, a free-form tag) that happens to equal the member cannot satisfy
+// the predicate. `jurisdiction` is the only field the catalog's object-array
+// `contains` conditions target today; the allowlist is the seam to extend if a
+// future condition deliberately matches a different identity field.
+const OBJECT_MEMBERSHIP_FIELDS = ['jurisdiction'];
+
 function evalCondition(expr, ctx, playbook) {
   if (!expr) return false;
   expr = expr.trim();
@@ -3879,6 +4037,91 @@ function evalCondition(expr, ctx, playbook) {
   const andParts = splitAtTopLevel(expr, 'AND');
   if (andParts.length > 1) return andParts.every(s => evalCondition(s, ctx, playbook));
 
+  // Quantifier prefix: catalog conditions write `any <path> <op> <value>`
+  // (e.g. framework.json's feeds_into `any compliance_theater_check.verdict ==
+  // 'theater' …`). An unhandled `any `/`all ` prefix is unparseable and falls
+  // through to `false`, silently disabling the clause it gates. Strip the
+  // quantifier and re-evaluate the inner comparison: when the LHS path resolves
+  // to a scalar (the framework theater_verdict case) the quantifier is prose
+  // emphasis and the scalar comparison is the intended test; when the LHS first
+  // segment resolves to an array, apply the predicate existentially (`any`) /
+  // universally (`all`) across its elements. The inner clause is only the leaf
+  // comparison (the surrounding AND/OR has already been split off above).
+  const quant = expr.match(/^(any|all)\s+(.+)$/);
+  if (quant) {
+    const [, kind, inner] = quant;
+    // `any head.rest <op|keyword> …` → re-root the predicate at each element of
+    // `head` and apply it existentially (`any`) / universally (`all`). The head
+    // is the FIRST dotted-path token of the inner clause; what follows it (`==`,
+    // `IN [...]`, `contains`, `matches /…/`, `>=`, …) is operator-agnostic — the
+    // inner clause is re-evaluated whole against `{ …ctx, [head]: el }`, so every
+    // operator the leaf parser already understands works under a quantifier.
+    // Earlier this branch only re-rooted clauses whose operator was in the
+    // comparison set (`>=|<=|==|=|<|>|!=`); `IN`/`contains`/`matches` were
+    // omitted, so e.g. sbom.json's `any matched_cve.attack_class IN
+    // ['ai-c2','prompt-injection']` (the sbom→ai-api feeds_into trigger) fell
+    // through to a whole-ctx eval where `matched_cve.attack_class` resolved to
+    // undefined on the array and the clause was permanently false, while the
+    // sibling `== 'kernel-lpe'` quantifiers fired. Requiring a `.`-qualified head
+    // keeps the bare-token form (`any <path>`) routed to the non-emptiness branch
+    // below.
+    const headMatch = inner.match(/^([A-Za-z_][\w-]*)(?:\.[A-Za-z_][\w-]*)+(?:[\s.[]|$)/);
+    if (headMatch) {
+      const head = headMatch[1];
+      const arr = resolvePath(ctx, head);
+      if (Array.isArray(arr)) {
+        const test = el => evalCondition(inner, { ...ctx, [head]: el }, playbook);
+        return kind === 'all' ? arr.length > 0 && arr.every(test) : arr.some(test);
+      }
+    }
+    // Bare-quantifier non-emptiness form: `any <path>` / `all <path>` with no
+    // comparison operator is a quantifier OVER the resolved collection itself —
+    // the author's intent is "at least one X exists" (`any`) / "every X is
+    // truthy" (`all`), i.e. a non-emptiness / existence test. sbom.json's
+    // `any actively_exploited_match …` EU CRA Art.14 (24h) notify_legal
+    // escalation is the canonical case. Without this, the inner bare token has
+    // no operator, so no comparison branch parses it and it falls through to
+    // condition_unparsed → false, silently disabling the escalation even when
+    // the array holds entries. Match ONLY a pure dotted-path token (no operator,
+    // keyword, bracket, or space); anything with a comparison/keyword still
+    // routes to the prose fall-through below so a genuinely malformed inner
+    // clause stays observable.
+    if (/^[A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*$/.test(inner)) {
+      const v = resolvePath(ctx, inner);
+      if (Array.isArray(v)) {
+        return kind === 'all' ? v.length > 0 && v.every(Boolean) : v.length > 0;
+      }
+      // Non-array scalar: existence/truthiness (null/undefined/0/'' → false).
+      return !!v;
+    }
+    // Scalar (or unresolved-array) LHS: the quantifier is prose; evaluate the
+    // bare inner comparison. If it still doesn't parse it falls through to the
+    // condition_unparsed diagnostic below, so a genuinely malformed clause stays
+    // observable rather than silently passing.
+    return evalCondition(inner, ctx, playbook);
+  }
+
+  // Membership clauses (`contains`/`includes`/`IN [...]`) parse fine but resolve
+  // their LHS path to a collection. When that path does NOT exist in ctx (the
+  // resolved value is null/undefined — an authoring typo in the LHS token, or a
+  // wrong-shape ctx that never populated the collection), the branch returns a
+  // silent `false` that disables whatever escalation / feeds_into the clause
+  // gates with no signal. The clause PARSED, so condition_unparsed (a
+  // parse-failure diagnostic) never fires. Surface a distinct, low-severity
+  // condition_path_unresolved so an LHS-path typo is observable — deduped on the
+  // condition string like condition_unparsed. A present-but-empty array (or any
+  // present value that simply isn't a collection) is a LEGITIMATE false, not an
+  // unresolved path, so it does NOT push: only a literally-absent path does.
+  const pushPathUnresolved = () => {
+    const target = (ctx && Array.isArray(ctx._runErrors)) ? ctx._runErrors
+      : (playbook && Array.isArray(playbook._runErrors)) ? playbook._runErrors
+      : null;
+    if (target) {
+      pushRunError(target, { kind: 'condition_path_unresolved', condition: String(expr).slice(0, 200) },
+        { dedupeKey: x => x.condition || '' });
+    }
+  };
+
   // "rwep >= 90". The LHS/RHS path tokens admit hyphens because signal and
   // indicator IDs are canonically hyphenated across the catalog (e.g.
   // `no-security-md`, `kver-in-affected-range`); a `\w`-only token silently
@@ -3921,15 +4164,79 @@ function evalCondition(expr, ctx, playbook) {
   // "scope.targets includes named_remote" — `contains` is accepted as a
   // synonym for `includes` (the catalog uses both); hyphenated paths + members
   // are admitted for the same reason as the comparison branch above.
-  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+(?:includes|contains)\s+([\w-]+)$/);
+  // The member may be a bare token OR a quoted string (the catalog's
+  // `jurisdiction_obligations contains 'EU'` / `contains 'EU/EU CRA Art.14 24h'`
+  // forms). When the array holds objects (jurisdiction_obligations are records
+  // like `{ jurisdiction:'EU', regulation:'NIS2 Art.21', … }`), membership is
+  // field-TARGETED: it matches an identity field of the obligation, not ANY
+  // field value. An unscoped `Object.values(el).includes(member)` over-matched
+  // — `contains 'EU'` would be satisfied by a non-jurisdiction field that
+  // happened to equal 'EU' (e.g. a tag), and `contains 'detect_confirmed'`
+  // would match the unrelated `clock_starts` field that holds that exact value
+  // in the shipped obligations. Scoping to OBJECT_MEMBERSHIP_FIELDS keeps the
+  // intended "the obligation is for jurisdiction X" semantic and prevents a
+  // future field collision (or an operator-/agent-supplied obligations array)
+  // from forcing a notify_legal escalation via a non-jurisdiction field.
+  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+(?:includes|contains)\s+(?:'([^']+)'|"([^"]+)"|([\w-]+))$/);
   if (m) {
+    const member = m[2] !== undefined ? m[2] : (m[3] !== undefined ? m[3] : m[4]);
     const arr = resolvePath(ctx, m[1]);
-    return Array.isArray(arr) && arr.includes(m[2]);
+    if (!Array.isArray(arr)) {
+      if (arr == null) pushPathUnresolved();
+      return false;
+    }
+    return arr.some((el) =>
+      el === member ||
+      (el && typeof el === 'object' &&
+        OBJECT_MEMBERSHIP_FIELDS.some((f) => el[f] === member))
+    );
   }
 
-  // "matched_cve.vector matches /regex/"
-  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+matches\s+\/(.+)\/$/);
+  // "matched_cve.attack_class IN ['kernel-lpe', 'rce']" — membership against a
+  // bracketed literal list; members may be quoted or bare. A scalar LHS must be
+  // in the list; an array LHS must intersect it. Unhandled before, so every
+  // `IN [...]` escalation/feeds_into atom fell through to a silent false.
+  // The member list is split quote-aware: a naive `split(',')` is unaware of
+  // quotes, so a quoted member that itself contains a comma (`'EU, US'`) would
+  // be broken into two members (`EU` and `US`), neither of which equals the
+  // author's intended whole member — the clause then evaluated false with no
+  // diagnostic (the regex still matched the bracket, so condition_unparsed never
+  // fired). splitInMembers walks the list tracking single/double quote state and
+  // only splits on commas at quote-depth 0, then strips the surrounding quotes.
+  // The CLOSING `]` is located quote-aware too: a `[^\]]*` capture stops at the
+  // FIRST `]`, so a quoted member containing a literal `]` (`'a]b'`) truncated
+  // the list early and left trailing text the `$` anchor couldn't match — the
+  // whole clause then fell through to condition_unparsed for every input. The
+  // matching bracket is now found at quote-depth 0 (an unquoted `]` is still the
+  // terminator; a `]` inside a quoted member is part of that member). Trailing
+  // text after the closing bracket, or an unterminated bracket, still fails to
+  // match and surfaces as condition_unparsed.
+  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+IN\s+\[/);
   if (m) {
+    const body = sliceInBracketBody(expr.slice(m[0].length));
+    if (body !== null) {
+      const members = splitInMembers(body);
+      const lv = resolvePath(ctx, m[1]);
+      if (Array.isArray(lv)) return lv.some((x) => members.includes(String(x)));
+      // lv == null means the LHS path doesn't exist in ctx (typo / wrong-shape) —
+      // surface it as condition_path_unresolved so the dead clause is observable,
+      // mirroring the contains/includes branch. A present scalar that's simply not
+      // in the member list is a legitimate false and pushes nothing.
+      if (lv == null) { pushPathUnresolved(); return false; }
+      return members.includes(String(lv));
+    }
+    // body === null → no quote-depth-0 closing `]` ends the string; fall through
+    // to the condition_unparsed diagnostic so the malformed clause stays visible.
+  }
+
+  // "matched_cve.vector matches /regex/" — both delimiters are accepted: the
+  // slash form `matches /re/` and the quote form `matches 're'` / `matches "re"`.
+  // The catalog authors both (mcp.json's feeds_into uses the quoted form), and a
+  // delimiter-specific parser silently disabled whichever form it didn't match —
+  // the same class as the hyphenated-token gap above.
+  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+matches\s+(?:\/(.+)\/|'([^']+)'|"([^"]+)")$/);
+  if (m) {
+    const pattern = m[2] !== undefined ? m[2] : (m[3] !== undefined ? m[3] : m[4]);
     const val = resolvePath(ctx, m[1]);
     if (typeof val !== 'string') return false;
     // An operator-supplied or playbook-supplied regex with a syntax bug
@@ -3939,9 +4246,9 @@ function evalCondition(expr, ctx, playbook) {
     // analyze() can surface analyze.runtime_errors[] without losing the
     // diagnostic.
     try {
-      return new RegExp(m[2], 'i').test(val); // allow:dynamic-regex — m[2] comes from an Ed25519-signed catalog playbook condition (/…/), so the pattern cannot be attacker-controlled without breaking the signature; the try/catch covers construction-time syntax errors only (it does NOT defend against catastrophic backtracking — do not reuse this shape for operator-supplied patterns)
+      return new RegExp(pattern, 'i').test(val); // allow:dynamic-regex — pattern comes from an Ed25519-signed catalog playbook condition (/…/ or '…'), so it cannot be attacker-controlled without breaking the signature; the try/catch covers construction-time syntax errors only (it does NOT defend against catastrophic backtracking — do not reuse this shape for operator-supplied patterns)
     } catch (e) {
-      const errorRec = { _regex_eval_error: { source: m[1], expr: m[2], message: e && e.message ? String(e.message) : String(e) } };
+      const errorRec = { _regex_eval_error: { source: m[1], expr: pattern, message: e && e.message ? String(e.message) : String(e) } };
       // Two sites where ctx may carry an accumulator: runOpts._runErrors
       // (threaded from run()) or ctx._runErrors directly. Prefer the runOpts
       // form; fall back to ctx.
@@ -3993,9 +4300,23 @@ function resolvePath(obj, dot) {
 function splitAtTopLevel(expr, sep) {
   const parts = [];
   const needle = ' ' + sep + ' ';
-  let depth = 0, buf = '', i = 0;
+  let depth = 0, buf = '', i = 0, quote = null;
   while (i < expr.length) {
     const ch = expr[i];
+    // Inside a quoted string literal, parens and the ` AND `/` OR ` needle are
+    // LITERAL text, not boolean structure. A regex member like `matches 'foo('`
+    // carries an unbalanced `(` that — counted blindly — would leave depth=1 so
+    // a real top-level OR/AND would never split at depth 0 (silently disabling
+    // the disjunct/conjunct), and a member like `contains 'EU AND US'` would be
+    // torn at the inner ` AND ` as if it were an operator. Track quote state and
+    // skip both while inside a quote. An unescaped matching quote closes the
+    // literal; `\'`/`\"` stay in. Mirrors splitInMembers' quote-aware walk.
+    if (quote) {
+      if (ch === '\\' && i + 1 < expr.length) { buf += ch + expr[i + 1]; i += 2; continue; }
+      if (ch === quote) quote = null;
+      buf += ch; i++; continue;
+    }
+    if (ch === "'" || ch === '"') { quote = ch; buf += ch; i++; continue; }
     if (ch === '(') { depth++; buf += ch; i++; continue; }
     if (ch === ')') { depth--; buf += ch; i++; continue; }
     if (depth === 0 && expr.startsWith(needle, i)) {
@@ -4011,18 +4332,90 @@ function splitAtTopLevel(expr, sep) {
   return parts;
 }
 
+/**
+ * Quote-aware splitter for the body of an `IN [...]` member list. Splits on
+ * commas that are OUTSIDE any quoted run, then strips the surrounding quotes and
+ * trims each member. A naive `.split(',')` is quote-unaware, so a quoted member
+ * that contains a comma (`'EU, US'`) would be torn into two members; this walks
+ * the string tracking single/double quote state so a comma inside a quoted run
+ * is treated as a literal part of that member. Bare (unquoted) members are
+ * supported too — the catalog authors both forms (`'ai-c2', 'prompt-injection'`
+ * and bare `kernel-lpe`). Empty members (e.g. a trailing comma) are dropped.
+ */
+function splitInMembers(listStr) {
+  const out = [];
+  let buf = '';
+  let quote = null;
+  for (let i = 0; i < listStr.length; i++) {
+    const ch = listStr[i];
+    if (quote) {
+      if (ch === quote) quote = null;
+      else buf += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') { quote = ch; continue; }
+    if (ch === ',') { out.push(buf.trim()); buf = ''; continue; }
+    buf += ch;
+  }
+  out.push(buf.trim());
+  return out.filter((s) => s.length);
+}
+
+/**
+ * Locate the closing `]` of an `IN [...]` list quote-aware and return the body
+ * between the (already-consumed) `[` and that `]`. `rest` is the text after the
+ * opening bracket. The terminator is the first `]` encountered at quote-depth 0;
+ * a `]` inside a single/double-quoted member (`'a]b'`) is part of the member, not
+ * the terminator. A `[^\]]*` regex capture instead stops at the FIRST `]`, so a
+ * quoted `]` truncated the list and left trailing text the `$` anchor rejected —
+ * the clause then fell through to condition_unparsed for every input.
+ *
+ * Returns the body string on success, or `null` when the list is malformed:
+ * unterminated (no quote-depth-0 `]`) or carrying non-whitespace text after the
+ * closing bracket. `null` lets the caller fall through to the condition_unparsed
+ * diagnostic so a malformed clause stays observable rather than passing silently.
+ */
+function sliceInBracketBody(rest) {
+  let quote = null;
+  for (let i = 0; i < rest.length; i++) {
+    const ch = rest[i];
+    if (quote) { if (ch === quote) quote = null; continue; }
+    if (ch === "'" || ch === '"') { quote = ch; continue; }
+    if (ch === ']') {
+      // The bracket must be the final structural token: only whitespace may
+      // follow. Anything else (e.g. `IN ['a'] AND …` reaching here, or stray
+      // trailing text) is malformed for this leaf parser.
+      return rest.slice(i + 1).trim() === '' ? rest.slice(0, i) : null;
+    }
+  }
+  return null; // no quote-depth-0 closing bracket → unterminated list
+}
+
 /**
  * Strip a balanced pair of outer parens, if and only if the very first and last
  * characters are matching parens at the same depth boundary. `(A) AND (B)` keeps
- * its parens; `((A AND B))` peels one layer.
+ * its parens; `((A AND B))` peels one layer. The depth scan is quote-aware: a
+ * paren inside a quoted string literal (e.g. a regex member `matches '(a|b)'` or
+ * an unbalanced `matches 'foo('`) is literal text, not grouping structure, so it
+ * must not move the depth counter — otherwise a quoted `)` could make the outer
+ * pair look unbalanced (skipping a legitimate strip) or an unbalanced quoted `(`
+ * could make a non-wrapping pair look outer-spanning (stripping wrongly).
  */
 function stripOuterParens(expr) {
   while (expr.length >= 2 && expr[0] === '(' && expr[expr.length - 1] === ')') {
     let depth = 0;
     let outerMatches = true;
+    let quote = null;
     for (let i = 0; i < expr.length - 1; i++) {
-      if (expr[i] === '(') depth++;
-      else if (expr[i] === ')') depth--;
+      const ch = expr[i];
+      if (quote) {
+        if (ch === '\\') { i++; continue; }
+        if (ch === quote) quote = null;
+        continue;
+      }
+      if (ch === "'" || ch === '"') { quote = ch; continue; }
+      if (ch === '(') depth++;
+      else if (ch === ')') depth--;
       if (depth === 0 && i < expr.length - 1) { outerMatches = false; break; }
     }
     if (outerMatches) expr = expr.slice(1, -1).trim();