@blamejs/exceptd-skills 0.19.33 → 0.19.34

package/lib/collectors/crypto.js

@@ -1,22 +1,11 @@
 "use strict";
 
 /**
- * lib/collectors/crypto.js
- *
- * Companion collector for the `crypto` playbook. Linux-only. Reads
- * the host's TLS library state (openssl version + KEM / signature
- * algorithm catalogues) and sshd_config (effective directives after
- * Include expansion) to flip post-quantum-readiness indicators.
- *
- * Skipped indicators (require operator judgement or live behavioural
- * data, left unflipped so the runner returns inconclusive rather
- * than a forced miss):
- *
- *   tls-no-hybrid-group         needs a real TLS handshake against
- *                               a target server
- *   rsa-2048-cert-long-life     cert content + chain walk; sensitivity-
- *                               horizon comparison is operator review
- *   no-crypto-inventory         governance / process indicator
+ * Companion collector for the `crypto` playbook, Linux only. Reads the host's
+ * TLS library state (openssl version, KEM and signature catalogues) and the
+ * effective sshd_config after Include expansion, to flip post-quantum readiness
+ * indicators. Indicators needing a live handshake, a certificate-chain review
+ * or governance evidence are left unflipped.
  *
  * Interface: see lib/collectors/README.md
  */
@@ -33,18 +22,16 @@ function readFileSafe(p, max = 256 * 1024) {
     fd = fs.openSync(p, "r");
     const st = fs.fstatSync(fd);
     if (st.size > max) return null;
-    // readFileSync(fd) loops read() to EOF — a single readSync may return
-    // fewer than st.size bytes on network/FUSE/sync-backed fds, which would
-    // leave the buffer tail NUL-filled and silently drop trailing content.
-    // Reading via the already-open fd keeps the fstat-then-read TOCTOU-free.
+    // readFileSync(fd), never a single readSync: on network/FUSE fds a short read
+    // leaves the tail NUL-filled. The open fd also keeps fstat-then-read TOCTOU-free.
     return fs.readFileSync(fd, "utf8");
   } catch { return null; }
   finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
-// Same sshd_config Include-expansion logic as the hardening
-// collector: first-match-wins, inline drop-in files in lexical
-// order at the textual position of the `Include` directive.
+// Drop-in files are inlined in lexical order at the textual position of the
+// `Include` directive, so a later first-match-wins parse sees what sshd sees.
+// The hardening collector expands sshd_config the same way.
 function expandSshdConfig(baseContent, configDPath) {
   if (!baseContent) return "";
   const out = [];
@@ -74,8 +61,7 @@ function expandSshdConfig(baseContent, configDPath) {
   return out.join("\n");
 }
 
-// First-match-wins parse of KexAlgorithms / MACs / Ciphers /
-// PermitRootLogin from the effective sshd_config content.
+// First match wins, as in sshd itself; an unset directive stays null.
 function parseSshdEffective(content) {
   if (content == null) return { kex: null, macs: null, ciphers: null };
   const out = { kex: null, macs: null, ciphers: null };
@@ -92,9 +78,8 @@ function parseSshdEffective(content) {
   return out;
 }
 
-// Compare OpenSSL banner string against the 3.5.0 native-ML-KEM cutoff.
-// Returns "hit" (< 3.5.0), "miss" (>= 3.5.0), or undefined (banner
-// could not be parsed — collector returns inconclusive).
+// 3.5.0 is the native-ML-KEM cutoff: "hit" below it, "miss" at or above, and
+// undefined when the banner does not parse, which leaves it inconclusive.
 function compareOpensslVersion(verStr) {
   if (!verStr) return undefined;
   const m = verStr.match(/OpenSSL\s+(\d+)\.(\d+)\.(\d+)/);
@@ -106,21 +91,16 @@ function compareOpensslVersion(verStr) {
   return "miss";
 }
 
-// PQC kex: hit when KexAlgorithms is absent (no PQC by default) OR
-// present-without sntrup761x25519 / mlkem768x25519 / mlkem1024.
+// Hits when KexAlgorithms is absent (no PQC kex by default) or lacks a hybrid.
 function parsePqcKex(content, hasSshdContent) {
   if (!hasSshdContent) return undefined;
   if (content == null) return "hit";
   return /sntrup761x25519|mlkem768x25519|mlkem1024/.test(content) ? "miss" : "hit";
 }
 
-// Weak mac or cipher: hit when MACs contains hmac-md5 / hmac-sha1
-// (without -etm suffix) OR Ciphers contains arcfour / 3des-cbc /
-// des-cbc / blowfish-cbc / aes-cbc. The playbook treats every CBC
-// mode as weak under modern SSH cipher policy (BEAST / padding
-// oracle / chosen-plaintext considerations) — aes128-cbc /
-// aes192-cbc / aes256-cbc still appear in legacy sshd configs and
-// must be flagged. Both fields absent → undefined (inconclusive).
+// The playbook treats EVERY CBC mode as weak, aes256-cbc included. hmac-md5 and
+// hmac-sha1 are weak only without the -etm suffix. Both fields absent leaves the
+// indicator undefined, hence inconclusive.
 function parseWeakMacOrCipher(macs, ciphers) {
   if (macs == null && ciphers == null) return undefined;
   const macsWeak = macs && /(?:^|,)(?:hmac-md5(?!-etm)|hmac-sha1(?!-etm))(?:,|$)/.test(macs);
@@ -128,13 +108,10 @@ function parseWeakMacOrCipher(macs, ciphers) {
   return (macsWeak || cipherWeak) ? "hit" : "miss";
 }
 
-// Either read a path-override fixture (synthetic-tempdir tests) or
-// invoke the named binary via execFile-shape spawning. Never
-// shell-interpolated. ENOENT / EACCES → null; caller surfaces that
-// via collector_errors / unflipped indicators. Some binaries write
-// their banner to stderr (e.g. `ssh -V`); others to stdout
-// (`openssl version`). Prefer stdout, fall back to stderr when
-// stdout is empty so the banner is not lost.
+// A path override reads a fixture; otherwise the binary is spawned argv-style,
+// never through a shell. A missing binary returns null, which the caller
+// surfaces as an unflipped indicator. `ssh -V` writes its banner to stderr and
+// `openssl version` to stdout, so stdout wins and stderr is the fallback.
 function readOrSpawn(pathOverride, cmd, args, errors) {
   if (pathOverride != null) return readFileSafe(pathOverride);
   const r = spawnSync(cmd, args, {
@@ -179,25 +156,20 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     };
   }
 
-  // TLS library version + algorithm catalogues.
   const opensslVer = readOrSpawn(paths.opensslVersionOutput, "openssl", ["version", "-a"], errors);
   const opensslKem = readOrSpawn(paths.opensslKemOutput, "openssl", ["list", "-kem-algorithms"], errors);
   const opensslSig = readOrSpawn(paths.opensslSignatureOutput, "openssl", ["list", "-signature-algorithms"], errors);
   const sshVer = readOrSpawn(paths.sshVersionOutput, "ssh", ["-V"], errors);
 
-  // sshd_config: read base + expand Include directives. The base
-  // can come from a path override (tests stage a synthetic file
-  // tree); otherwise read /etc/ssh/sshd_config directly.
+  // A path override lets a test stage a synthetic tree in place of /etc/ssh.
   const sshdConfigPath = paths.sshdConfig || "/etc/ssh/sshd_config";
   const sshdConfigDPath = paths.sshdConfigD || "/etc/ssh/sshd_config.d";
   const sshdBase = readFileSafe(sshdConfigPath);
   const sshdEffective = sshdBase ? expandSshdConfig(sshdBase, sshdConfigDPath) : null;
   const sshdParsed = parseSshdEffective(sshdEffective);
 
-  // Flip indicators only when the underlying source was readable.
-  // Unreadable openssl / sshd_config → indicator stays out of
-  // signal_overrides so the runner returns inconclusive rather than
-  // asserting a clean posture without evidence.
+  // An indicator is flipped only when its source was readable; otherwise it stays
+  // out of this object and the runner returns inconclusive.
   const signal_overrides = {};
 
   const verSig = compareOpensslVersion(opensslVer);
@@ -220,8 +192,6 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     : undefined;
   if (weakSig !== undefined) signal_overrides["weak-mac-or-cipher"] = weakSig;
 
-  // certificate-store: list count of *.pem / *.crt under the
-  // standard trust roots. Path overridable for tests.
   let certStoreSummary;
   const certStoreRoot = paths.certStore || "/etc/ssl/certs";
   try {

package/lib/collectors/hardening.js

@@ -1,13 +1,8 @@
 "use strict";
 
 /**
- * lib/collectors/hardening.js
- *
- * Companion collector for the `hardening` playbook. Linux-only:
- * reads `/proc/sys/kernel/*`, `/proc/cmdline`,
- * `/sys/kernel/security/lockdown`, and `/etc/ssh/sshd_config` to
- * flip deterministic indicators. On non-Linux platforms the
- * precondition fails and the collector emits an empty submission.
+ * Companion collector for the `hardening` playbook. Linux-only: off Linux the
+ * precondition fails and the submission comes back empty.
  *
  * Interface: see lib/collectors/README.md
  */
@@ -30,21 +25,15 @@ function readFileSafe(p, max = 256 * 1024) {
     fd = fs.openSync(p, "r");
     const st = fs.fstatSync(fd);
     if (st.size > max) return null;
-    // readFileSync(fd) loops read() to EOF — a single readSync may return
-    // fewer than st.size bytes on network/FUSE/sync-backed fds, which would
-    // leave the buffer tail NUL-filled and silently drop trailing content.
-    // Reading via the already-open fd keeps the fstat-then-read TOCTOU-free.
+    // readFileSync(fd) loops to EOF, where one readSync can return short on a
+    // network/FUSE fd and NUL-fill the tail; via the fd it is also TOCTOU-free.
     return fs.readFileSync(fd, "utf8");
   } catch { return null; }
   finally { if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* non-fatal */ } } }
 }
 
-// Expand the base sshd_config into the effective directive stream by
-// inlining `Include <glob>` directives at their textual position.
-// Mirrors OpenSSH's parse order: first-match-wins, and the first match
-// can come from a drop-in file when `Include` appears earlier in the
-// base config than the directive it sets. Drop-in files within an
-// Include are processed in lexical order (matching OpenSSH glob).
+// Inlines `Include <glob>` at its textual position: OpenSSH is first-match-wins,
+// so a drop-in included early beats a later line in the base config.
 function expandSshdConfig(baseContent, configDPath) {
   if (!baseContent) return "";
   const out = [];
@@ -53,13 +42,9 @@ function expandSshdConfig(baseContent, configDPath) {
     const m = stripped.match(/^Include\s+(\S+)/i);
     if (!m) { out.push(raw); continue; }
     const glob = m[1];
-    // Resolve the include glob — only handle the common
-    // `<dir>/*.conf` form; other shapes fall back to no-op.
+    // Only the common `<dir>/*.conf` form resolves; other shapes are no-ops.
     let dir = null;
     if (glob.endsWith("/sshd_config.d/*.conf")) {
-      // The canonical sshd-config drop-in directory. Honour the
-      // path override (tests / chroot / sshd_config.d outside the
-      // default location).
       dir = configDPath;
     } else {
       const dirMatch = glob.match(/^(.*)\/\*\.conf$/);
@@ -80,9 +65,7 @@ function expandSshdConfig(baseContent, configDPath) {
 }
 
 function parseSshdEffective(content) {
-  // Best-effort: scan uncommented `PermitRootLogin <value>` and
-  // `PasswordAuthentication <value>` lines. sshd_config is parsed
-  // first-match-wins for most directives.
+  // First occurrence wins, as sshd_config parses these directives.
   if (!content) return { permitRootLogin: null, passwordAuth: null };
   const out = { permitRootLogin: null, passwordAuth: null };
   for (const raw of content.split(/\r?\n/)) {
@@ -100,10 +83,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   const errors = [];
   const startTime = Date.now();
   const root = path.resolve(cwd);
-  // Path-override hooks for tests: caller can pass args.paths to
-  // redirect /proc / /sys / /etc reads to a synthetic tempdir
-  // mirroring the real layout. Without overrides the collector
-  // reads the live host paths.
+  // args.paths redirects the /proc, /sys and /etc reads at a synthetic tree.
   const paths = args.paths || {};
   const P = {
     kptrRestrict: paths.kptrRestrict || "/proc/sys/kernel/kptr_restrict",
@@ -117,9 +97,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     sshdConfigD: paths.sshdConfigD || "/etc/ssh/sshd_config.d",
     kallsyms: paths.kallsyms || "/proc/kallsyms",
   };
-  // Force-linux switch lets tests exercise the Linux code path even
-  // when running on win32 / darwin. Without it, the platform gate
-  // remains the source of truth for whether the collector runs.
+  // args.forceLinux exercises the Linux path from win32 / darwin.
   const isLinux = args.forceLinux === true || process.platform === "linux";
 
   if (!isLinux) {
@@ -160,8 +138,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     };
   }
 
-  // Sysctl reads. `null` means the sysctl path didn't exist (older
-  // kernel / non-standard build).
+  // `null` means the sysctl path is absent (older kernel, non-standard build).
   const kptrRestrict = readSysctl(P.kptrRestrict);
   const unprivUserns = readSysctl(P.unprivUserns);
   const unprivBpf = readSysctl(P.unprivBpf);
@@ -170,21 +147,12 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   const cmdline = readFileSafe(P.cmdline) || "";
   const lockdown = readSysctl(P.lockdown) || "";
 
-  // sshd_config: expand Include directives in-place so the
-  // first-match-wins parse honours OpenSSH's effective directive
-  // order. On Debian/Ubuntu the default sshd_config begins with
-  // `Include /etc/ssh/sshd_config.d/*.conf` — drop-in values take
-  // precedence over the base file's later lines.
   const sshdBase = readFileSafe(P.sshdConfig);
   const sshdContent = sshdBase ? expandSshdConfig(sshdBase, P.sshdConfigD) : null;
   const sshdParsed = parseSshdEffective(sshdContent);
 
-  // Indicator predicates. Each sysctl-derived indicator emits a
-  // verdict ONLY when the underlying sysctl was readable; unreadable
-  // sysctls (e.g. masked /proc in a constrained container, kernel
-  // built without that knob) leave the indicator unflipped so the
-  // runner returns inconclusive rather than forging a "hardened"
-  // miss without evidence.
+  // A sysctl-derived indicator flips only when the sysctl was readable, so an
+  // unreadable knob reports inconclusive rather than a "hardened" miss.
   function fromSysctl(value, hitWhen) {
     if (value == null) return undefined; // unreadable → inconclusive
     return value === hitWhen ? "hit" : "miss";
@@ -200,9 +168,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   const yamaSig = fromSysctl(yamaPtrace, "0");
   if (yamaSig !== undefined) signal_overrides["yama-ptrace-permissive"] = yamaSig;
 
-  // /proc/cmdline derives kaslr / mitigations / lockdown=. If we
-  // couldn't read it at all, those three indicators stay unflipped
-  // (inconclusive) rather than asserting an absent string.
+  // An unreadable cmdline leaves both unflipped, not asserted against nothing.
   if (cmdline) {
     const kaslrDisabled = /\bnokaslr\b/.test(cmdline) || /\bkaslr=off\b/.test(cmdline);
     const mitigationsOff = /\bmitigations=off\b/.test(cmdline);
@@ -210,10 +176,8 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     signal_overrides["mitigations-off"] = mitigationsOff ? "hit" : "miss";
   }
 
-  // kernel-lockdown-none: the file shows `[none]` OR is absent and
-  // /proc/cmdline carries no lockdown= parameter. When both the
-  // lockdown file AND /proc/cmdline are unreadable, leave the
-  // indicator unflipped.
+  // Lockdown is none when the file shows `[none]`, or it is absent and no
+  // lockdown= rides the cmdline. Both unreadable leaves the indicator unflipped.
   if (lockdown || cmdline) {
     const lockdownShowsNone = /\[none\]/.test(lockdown);
     const lockdownCmdline = /\blockdown=(?:integrity|confidentiality)\b/.test(cmdline);
@@ -223,8 +187,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     signal_overrides["kernel-lockdown-none"] = lockdownNoneHit ? "hit" : "miss";
   }
 
-  // sshd-permitrootlogin-yes: emit a verdict only when sshd_config
-  // was readable. Missing config (no SSH server) → unflipped.
+  // A missing sshd_config (no SSH server) leaves this unflipped.
   let sshdRootHit = false;
   if (sshdContent !== null) {
     sshdRootHit =
@@ -235,30 +198,9 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
 
   const kptrHit = kptrSig === "hit";
 
-  // Per-indicator __fp_checks attestation. The collector attests
-  // ONLY the checks it actually performed; operator-judgement /
-  // network-required FP checks remain unsatisfied so the runner
-  // honestly downgrades to inconclusive.
-  //
-  //   kptr-restrict-disabled:
-  //     [0] kdump / perf debug-session runbook — operator judgement
-  //     [1] /proc/kallsyms zero-leakage cross-check — collector CAN
-  //         attest (read first line as unprivileged user).
-  //   yama-ptrace-permissive:
-  //     [0] MAC enforcement (AppArmor / SELinux) — operator
-  //     [1] container observability — operator
-  //     [2] single-tenant dev VM — operator
-  //   kaslr-disabled-at-boot:
-  //     [0] kdump runbook — operator
-  //     [1] dmesg KASLR offsets — collector cannot read dmesg
-  //         without root on most distros (dmesg-restrict=1).
-  //   mitigations-off:
-  //     [0] HPC/benchmark exemption — operator
-  //     [1] single-tenant — operator
-  //
-  // For kptr-restrict-disabled the kallsyms cross-check is the only
-  // FP-check the collector can attest; we attest index 1 when we
-  // observed the kallsyms first line carries non-zero hex.
+  // __fp_checks attests only the checks actually performed; the rest stay
+  // unsatisfied so the runner downgrades to inconclusive. Index 1 of
+  // kptr-restrict-disabled is the /proc/kallsyms leakage cross-check.
   if (kptrHit) {
     let kallsymsLeaks = false;
     try {

package/lib/collectors/kernel.js

@@ -1,18 +1,10 @@
 "use strict";
 
 /**
- * lib/collectors/kernel.js
- *
- * Companion collector for the `kernel` playbook. Establishes
- * preconditions (linux-platform / uname-available) and captures the
- * kernel release string for the kver-in-affected-range indicator.
- *
- * Scope: Linux only. On macOS / Windows the playbook's linux-platform
- * precondition halts at preflight; the collector reports that
- * truthfully so the operator sees the visibility gap without the
- * runner having to re-derive it.
- *
- * Interface: see lib/collectors/README.md
+ * Companion collector for the `kernel` playbook: the linux-platform and
+ * uname-available preconditions, plus the kernel release, cmdline and sysctl
+ * snapshot its indicators read. Off Linux it reports the visibility gap rather
+ * than staying silent. Interface: lib/collectors/README.md
  */
 
 const { execFileSync } = require("node:child_process");
@@ -32,12 +24,8 @@ function runUname(arg) {
 function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   const errors = [];
 
-  // Precondition 1: linux-platform. Use process.platform first
-  // (Node-derived, always available); cross-check against uname -s
-  // when available.
   const linuxPlatform = process.platform === "linux";
 
-  // Precondition 2: uname-available. Pure capability check.
   const unameR = runUname("-r");
   const unameAvailable = unameR.ok;
   if (!unameAvailable && linuxPlatform) {
@@ -47,10 +35,8 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     });
   }
 
-  // Artifact: kernel-release. The exact string returned by `uname -r`,
-  // e.g. "5.15.0-69-generic". When uname is unavailable, the artifact
-  // is captured=false with the reason; the runner treats the
-  // dependent indicators as inconclusive.
+  // captured=false carries the reason, so the runner reads dependent indicators
+  // as inconclusive rather than as a miss.
   const artifacts = {};
   if (unameR.ok) {
     artifacts["kernel-release"] = { value: unameR.value, captured: true };
@@ -64,9 +50,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     };
   }
 
-  // Optional artifact: cmdline. Not always required but useful for
-  // KASLR / unpriv-userns / unpriv-bpf indicator evaluation. Read
-  // from /proc directly so we don't fork another process.
+  // kernel-cmdline feeds the KASLR / unpriv-userns / unpriv-bpf indicators.
   if (linuxPlatform) {
     try {
       const fs = require("node:fs");
@@ -79,8 +63,6 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
         reason: `/proc/cmdline read failed: ${e.message}`,
       });
     }
-    // sysctl snapshot for kernel.unprivileged_userns_clone +
-    // kernel.unprivileged_bpf_disabled when readable.
     try {
       const fs = require("node:fs");
       const sysctls = {};
@@ -93,8 +75,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
         try {
           sysctls[path.basename(p)] = fs.readFileSync(p, "utf8").trim();
         } catch {
-          // Best-effort; a missing file usually means the sysctl
-          // doesn't exist on this kernel.
+          // A missing file means the sysctl does not exist on this kernel.
         }
       }
       if (Object.keys(sysctls).length) {
@@ -109,10 +90,8 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     }
   }
 
-  // Running-kernel build config (/boot/config-$(uname -r)) backs the
-  // CONFIG_* false_positive_checks_required entries: a sysctl is moot if the
-  // feature is compiled out of the kernel. Best-effort — unreadable on many
-  // hardened hosts.
+  // The running kernel's build config backs the CONFIG_* false-positive checks:
+  // a sysctl is moot when the feature is compiled out. Often unreadable.
   let kernelConfig = null;
   if (linuxPlatform && unameR.ok) {
     try {
@@ -121,10 +100,8 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     } catch { /* config not readable — CONFIG_* checks stay unattested */ }
   }
 
-  // Signal overrides: we can't decide kver-in-affected-range without
-  // the CVE-affected-version catalog (the runner does that
-  // correlation). But we CAN flip the deterministic indicators that
-  // read directly off the sysctl snapshot.
+  // kver-in-affected-range needs the CVE affected-version catalog, so the runner
+  // correlates that; only straight sysctl reads are decided here.
   const signal_overrides = {};
   const sysctl = artifacts["sysctl-snapshot"];
   if (sysctl && sysctl.captured) {
@@ -136,29 +113,22 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
         const v = parseInt(parsed.randomize_va_space, 10);
         signal_overrides["kaslr-disabled"] = (v < 2) ? "hit" : "miss";
       }
-      // unpriv-userns-enabled: clone == 1 means enabled (risky).
+      // unprivileged_userns_clone == 1 means unprivileged userns is enabled.
       if (parsed.unprivileged_userns_clone != null) {
         const v = parseInt(parsed.unprivileged_userns_clone, 10);
         const hit = v === 1;
         signal_overrides["unpriv-userns-enabled"] = hit ? "hit" : "miss";
-        // FP[1]: CONFIG_USER_NS=y — the sysctl is live only when userns is
-        // compiled in. Attested when /boot/config confirms it. FP[0]
-        // (rootless-runtime exception + LSM enforcement) is operator
-        // judgement and stays unattested.
+        // Attests FP[1] only: the sysctl is live only when userns is compiled in.
         if (hit && kernelConfig && /^CONFIG_USER_NS=y$/m.test(kernelConfig)) {
           signal_overrides["unpriv-userns-enabled__fp_checks"] = { "1": true };
         }
       }
-      // unpriv-bpf-allowed: bpf_disabled == 0 means unprivileged BPF
-      // is allowed (risky).
+      // unprivileged_bpf_disabled == 0 means unprivileged BPF is allowed.
       if (parsed.unprivileged_bpf_disabled != null) {
         const v = parseInt(parsed.unprivileged_bpf_disabled, 10);
         const hit = v === 0;
         signal_overrides["unpriv-bpf-allowed"] = hit ? "hit" : "miss";
-        // FP[0]: CONFIG_BPF_SYSCALL=y AND CONFIG_BPF_JIT=y — the sysctl is
-        // moot if BPF is compiled out. Attested when /boot/config confirms
-        // both. FP[1] (enforcing LSM bpf() restriction) is operator
-        // judgement and stays unattested.
+        // Attests FP[0] only: the sysctl is moot if BPF is compiled out.
         if (hit && kernelConfig &&
             /^CONFIG_BPF_SYSCALL=y$/m.test(kernelConfig) &&
             /^CONFIG_BPF_JIT=y$/m.test(kernelConfig)) {