@clear-capabilities/agentic-security-scanner 0.128.1 → 0.132.0

package/src/posture/execution-proof.js

@@ -0,0 +1,92 @@
+// Promote a finding to execution-proven by running its proof-of-concept inside
+// the confined execution sandbox and observing a real effect.
+//
+// Proof is a file the PoC writes, NOT an exit code: the sandbox cannot reliably
+// distinguish "denied" from "ran and exited 0", so exit status is not evidence.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { runConfined, sandboxAvailable, detectBackend } from '../sandbox/index.js';
+import { attachProofTier, proofTierOf } from './proof-tier.js';
+
+const PROOF_MARKER = 'PROVEN';
+
+function _evidence(over = {}) {
+  return {
+    tier: 'taint-proven', backend: detectBackend(), ran: false, observed: null,
+    reason: null, exitCode: null, timedOut: false, at: new Date().toISOString(), ...over,
+  };
+}
+
+// A run that never got as far as executing the PoC. `ran:false` for these is
+// the whole point: 'proof-failed' asserts "the PoC ran and the predicted effect
+// did not appear", which is a triage signal about the FINDING. A sandbox that
+// could not start says nothing about the finding at all, and must leave it at
+// its static tier rather than manufacturing a failed exploit attempt.
+const _DID_NOT_EXECUTE = new Set(['disabled', 'error']);
+
+// Materialise caller-supplied files into the sandbox root so a PoC can import
+// the code it is supposed to exploit. Paths are confined to the root: an
+// absolute path or one that climbs out is refused rather than clamped, because
+// silently rewriting a path would put a file somewhere the caller did not ask
+// for and the PoC would then exercise the wrong code.
+function _materialise(root, files) {
+  for (const [rel, content] of Object.entries(files || {})) {
+    if (typeof content !== 'string') continue;
+    const abs = path.resolve(root, rel);
+    if (abs !== root && !abs.startsWith(root + path.sep)) {
+      return `refusing to write '${rel}': it resolves outside the sandbox root`;
+    }
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, content, 'utf8');
+  }
+  return null;
+}
+
+/**
+ * @param {object} finding    carries `poc: {lang, code}`
+ * @param {object} [opts]
+ * @param {object} [opts.files]  rel→content written into the sandbox root before
+ *   the PoC runs. This is what lets the SAME PoC be run against a candidate
+ *   patch: pass the patched contents and a still-`execution-proven` verdict
+ *   means the fix did not close the hole.
+ */
+export async function proveFinding(finding, { timeoutMs = 10000, force, files } = {}) {
+  const poc = finding?.poc;
+  if (!poc?.code) {
+    return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: 'no proof-of-concept attached' }));
+  }
+  if (poc.lang !== 'js') {
+    return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: `unsupported poc language: ${poc.lang}` }));
+  }
+  if (!sandboxAvailable()) {
+    return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: 'no confinement primitive available; refusing to execute' }));
+  }
+
+  const root = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), 'proof-')));
+  try {
+    const badPath = _materialise(root, files);
+    if (badPath) {
+      return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: badPath }));
+    }
+    fs.writeFileSync(path.join(root, 'poc.mjs'), poc.code, 'utf8');
+    const r = runConfined([process.execPath, 'poc.mjs'], { root, timeoutMs, force });
+    const proven = fs.existsSync(path.join(root, PROOF_MARKER));
+    const ran = !r.timedOut && !_DID_NOT_EXECUTE.has(r.status);
+
+    return attachProofTier(finding, _evidence({
+      tier: proven ? 'execution-proven' : ran ? 'proof-failed' : proofTierOf(finding),
+      backend: r.backend,
+      ran,
+      observed: proven ? `proof marker '${PROOF_MARKER}' written by the proof-of-concept` : null,
+      reason: proven ? null
+        : r.status === 'error' ? `the confinement sandbox could not start, so the proof-of-concept never executed (${r.backend} backend): ${String(r.stderr || '').trim() || 'no detail reported'}`
+        : r.status === 'disabled' ? 'confined execution is disabled; the proof-of-concept was refused and never executed'
+        : r.timedOut ? 'proof-of-concept exceeded its time budget'
+        : 'proof-of-concept ran but did not demonstrate the predicted effect',
+      exitCode: r.exitCode, timedOut: r.timedOut,
+    }));
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+}

package/src/posture/exploitability-probability.js

@@ -79,7 +79,7 @@ const FACTORS = [
     name: 'source-from-network',
     factor: 1.3,
     test: (f) => (f.trace || f.chain || []).some(t =>
-      /http-body|url-param|header|cookie/i.test(t.provenance || '')),
+      /http-body|url-param|header|cookie|network/i.test(t.provenance || '')),
   },
   {
     name: 'critical-severity-detector',

package/src/posture/falsification.js

@@ -16,6 +16,10 @@
 // the deterministic core runs fully offline.
 
 import { isValidSanitizerFor } from '../dataflow/sanitizer-proof.js';
+import {
+  recordProducer, assertSeparation, recordVerdict, consensusOf, producerIdOf,
+  VERIFIER_FALSIFICATION, VERIFIER_LLM_REVIEW,
+} from './verification-separation.js';
 
 const DEMOTE_FACTOR = 0.4;               // mirror proof-gate.js
 const TIERS = ['low', 'medium', 'high']; // confidence / exploitability tier order
@@ -76,6 +80,15 @@ export function classifyFinding(finding, fileContents) {
   return { verdict: 'survived', reasons: ['no context-matched control found between source and sink'] };
 }
 
+// Map a falsification-style verdict onto the verification vocabulary.
+// 'blocked'/'refuted' = the finding was disproved on this lens; 'survived' =
+// the attempt to disprove it failed, so the finding stands on this lens.
+function _verdictFor(v) {
+  if (v === 'blocked' || v === 'refuted' || v === 'false-positive') return 'refuted';
+  if (v === 'survived' || v === 'upheld' || v === 'true-positive') return 'upheld';
+  return 'undecided';
+}
+
 /**
  * Default-on annotator. Adds `finding.falsification = { verdict, reasons }` to
  * every taint-style finding; demotes + quarantines the ones falsified as blocked.
@@ -95,6 +108,23 @@ export function annotateFalsification(findings, fileContents, opts = {}) {
     catch { res = { verdict: 'unproven', reasons: ['classification error'] }; }
     f.falsification = { verdict: res.verdict, reasons: res.reasons };
 
+    // R7 — enforced separation. The detector produced this finding; the
+    // falsification pass is a *different* party, and records its verdict only
+    // after the separation check passes. Recall-preserving: a 'refuted'
+    // verdict is recorded, never acted on by deletion or severity change.
+    try {
+      recordProducer(f, producerIdOf(f));
+      if (assertSeparation(f, VERIFIER_FALSIFICATION).ok) {
+        recordVerdict(f, {
+          verifierId: VERIFIER_FALSIFICATION,
+          lens: 'control-flow',
+          verdict: _verdictFor(res.verdict),
+          reason: res.reasons && res.reasons[0],
+        });
+      }
+      f.verification.consensus = consensusOf(f);
+    } catch { /* verification bookkeeping is advisory; never break the scan */ }
+
     if (res.verdict === 'blocked') {
       f.quarantined = true;
       if (typeof f.confidence === 'number') {
@@ -113,7 +143,21 @@ export function annotateFalsification(findings, fileContents, opts = {}) {
     for (const f of survivors) {
       try {
         const llm = opts.llmReview(f);
-        if (llm) f.falsification.llm = llm;
+        if (llm) {
+          f.falsification.llm = llm;
+          // A second, independently-identified verifier arguing the opposing
+          // case — this is what makes a contested finding visible as contested
+          // rather than resolved by whoever spoke last.
+          if (assertSeparation(f, VERIFIER_LLM_REVIEW).ok) {
+            recordVerdict(f, {
+              verifierId: VERIFIER_LLM_REVIEW,
+              lens: 'llm-review',
+              verdict: _verdictFor(llm.verdict),
+              reason: llm.reason,
+            });
+            f.verification.consensus = consensusOf(f);
+          }
+        }
       } catch { /* the LLM tier is advisory; never let it break the scan */ }
     }
   }

package/src/posture/fix-metrics.js

@@ -0,0 +1,197 @@
+// Time-to-validated-fix (R5, the reporting half).
+//
+// `verifyFix` already RUNS the stages and `test-runner.js` already times the
+// slowest one. What did not exist was anything durable to read afterwards, so
+// "how long does a fix actually take to validate" had no answer from real runs
+// — only an estimate (`time-to-fix.js` guesses engineering hours from family
+// and patch shape, before anything runs). This module is the opposite: it
+// records what the pipeline observed and reports the distribution.
+//
+// THE HONESTY RULES, which are most of why this file is longer than a mean:
+//
+//  1. A failed attempt is NOT a data point about how long a fix takes. Fixes
+//     that fail verification fail fast (a re-scan that still sees the finding
+//     never reaches the test suite), so blending them into one average makes
+//     the pipeline look faster the worse it performs. Validated and failed
+//     attempts are summarised separately and never merged.
+//
+//  2. "Tests skipped" is not "tests passed". A project with no detectable
+//     suite can reach `ok:true` having run only the re-scan and the linter.
+//     That is a weaker claim than a fix whose suite executed, and it is also
+//     much faster, so counting the two together would quietly deflate the
+//     headline. They get their own bucket: `validated` means the suite ran and
+//     passed, `validatedWithoutTests` means there was no suite to run.
+//
+//  3. Every figure carries its `n`, and a percentile computed from too few
+//     samples is labelled unreliable rather than omitted or silently reported.
+//     Same precedent as the accuracy scorecard's `{n, d}` rates: a number
+//     without its denominator is not a measurement.
+//
+// Storage is append-only JSONL at `<scanRoot>/.agentic-security/fix-metrics.jsonl`,
+// one record per verification attempt. Nothing here throws (posture
+// convention) — an unwritable or corrupt log degrades to "no metrics", never
+// to a failed verification.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { isSafeStateDir } from './state-dir.js';
+
+const STATE_DIR = '.agentic-security';
+const LOG_FILE = 'fix-metrics.jsonl';
+
+// Below this many samples a percentile is an artifact of the sample, not a
+// property of the pipeline. Reported anyway (hiding it invites re-deriving it
+// wrong downstream) but flagged, so a caller cannot quote it as settled.
+const RELIABLE_N = 10;
+
+// The stages verifyFix runs, in execution order. Kept here so the recorder and
+// the summariser cannot drift apart on stage naming.
+export const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
+
+function _logPath(scanRoot) {
+  return path.join(scanRoot, STATE_DIR, LOG_FILE);
+}
+
+/**
+ * Append one verification attempt. Best-effort and silent on failure: metrics
+ * must never be able to fail a fix that otherwise verified.
+ *
+ * @returns {boolean} whether the record was written (for tests, not callers).
+ */
+export function recordFixAttempt(scanRoot, record) {
+  if (!scanRoot || !record || typeof record !== 'object') return false;
+  try {
+    const dir = path.join(scanRoot, STATE_DIR);
+    if (!isSafeStateDir(dir)) return false;
+    fs.mkdirSync(dir, { recursive: true });
+    // One writeSync of one newline-terminated line: a concurrent reader sees
+    // whole records or nothing, and a torn tail is dropped on read.
+    fs.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');
+    return true;
+  } catch { return false; }
+}
+
+/**
+ * Read every well-formed attempt. A line that does not parse is skipped, not
+ * fatal — the last line of an interrupted write is the expected case.
+ */
+export function loadFixAttempts(scanRoot) {
+  try {
+    const raw = fs.readFileSync(_logPath(scanRoot), 'utf8');
+    const out = [];
+    for (const line of raw.split('\n')) {
+      if (!line.trim()) continue;
+      try {
+        const rec = JSON.parse(line);
+        if (rec && typeof rec === 'object' && typeof rec.totalMs === 'number') out.push(rec);
+      } catch { /* torn or hand-edited line — drop it, keep the rest */ }
+    }
+    return out;
+  } catch { return []; }
+}
+
+// Nearest-rank percentile over an ascending array. Nearest-rank rather than
+// interpolated because these are observed durations, and an interpolated p50
+// reports a duration that no run actually took.
+function _pct(sorted, p) {
+  if (!sorted.length) return null;
+  const rank = Math.ceil((p / 100) * sorted.length);
+  return sorted[Math.min(sorted.length - 1, Math.max(0, rank - 1))];
+}
+
+function _dist(values) {
+  const v = values.filter(x => typeof x === 'number' && Number.isFinite(x) && x >= 0).sort((a, b) => a - b);
+  if (!v.length) return { n: 0, minMs: null, p50Ms: null, p90Ms: null, maxMs: null, meanMs: null, reliable: false };
+  const sum = v.reduce((a, b) => a + b, 0);
+  return {
+    n: v.length,
+    minMs: v[0],
+    p50Ms: _pct(v, 50),
+    p90Ms: _pct(v, 90),
+    maxMs: v[v.length - 1],
+    meanMs: Math.round(sum / v.length),
+    // Says whether the percentiles above may be quoted, not whether the count
+    // is real. n and min/max/mean are exact at any sample size.
+    reliable: v.length >= RELIABLE_N,
+  };
+}
+
+// Which bucket an attempt belongs to. Deliberately total: every attempt lands
+// in exactly one, so the bucket counts always sum to the attempt count and a
+// mis-shaped record cannot silently vanish from the denominator.
+export function bucketOf(a) {
+  if (!a?.ok) return 'failed';
+  return a.testsRan ? 'validated' : 'validatedWithoutTests';
+}
+
+/**
+ * Summarise a set of attempts into the reported distribution.
+ *
+ * `validated` is the headline: attempts that verified AND whose test suite
+ * actually ran and passed. The other two buckets exist so that headline cannot
+ * be inflated by counting weaker or faster outcomes inside it.
+ */
+export function summarizeFixDurations(attempts) {
+  const all = Array.isArray(attempts) ? attempts : [];
+  const buckets = { validated: [], validatedWithoutTests: [], failed: [] };
+  for (const a of all) buckets[bucketOf(a)].push(a);
+
+  const byStage = {};
+  for (const stage of FIX_STAGES) {
+    // Per-stage timings come from validated runs only. A stage's duration in a
+    // failed run is truncated by the failure (the pipeline stops), so mixing
+    // them in would understate every stage after the first failure point.
+    byStage[stage] = _dist(buckets.validated.map(a => a?.stages?.[stage]));
+  }
+
+  return {
+    attempts: all.length,
+    counts: {
+      validated: buckets.validated.length,
+      validatedWithoutTests: buckets.validatedWithoutTests.length,
+      failed: buckets.failed.length,
+    },
+    timeToValidatedFix: _dist(buckets.validated.map(a => a.totalMs)),
+    timeToValidatedFixWithoutTests: _dist(buckets.validatedWithoutTests.map(a => a.totalMs)),
+    timeToFailure: _dist(buckets.failed.map(a => a.totalMs)),
+    byStage,
+    reliableAtOrAbove: RELIABLE_N,
+  };
+}
+
+/** Read + summarise in one step. */
+export function fixDurationReport(scanRoot) {
+  return summarizeFixDurations(loadFixAttempts(scanRoot));
+}
+
+function _ms(v) {
+  if (v == null) return '—';
+  return v >= 1000 ? `${(v / 1000).toFixed(1)}s` : `${v}ms`;
+}
+
+/**
+ * One-paragraph human summary. Returns null when there is nothing measured —
+ * callers print nothing rather than printing an empty table.
+ */
+export function renderFixDurationSummary(sum) {
+  if (!sum || !sum.attempts) return null;
+  const d = sum.timeToValidatedFix;
+  const parts = [];
+  if (d.n) {
+    parts.push(
+      `time-to-validated-fix: median ${_ms(d.p50Ms)}, p90 ${_ms(d.p90Ms)} `
+      + `(n=${d.n}${d.reliable ? '' : `, below ${sum.reliableAtOrAbove} — percentiles not yet reliable`})`,
+    );
+  } else {
+    parts.push('time-to-validated-fix: no fix has both verified and had its test suite run yet');
+  }
+  if (sum.counts.validatedWithoutTests) {
+    parts.push(`${sum.counts.validatedWithoutTests} verified with no detectable test suite (excluded from the median above)`);
+  }
+  if (sum.counts.failed) {
+    parts.push(`${sum.counts.failed} failed verification, median ${_ms(sum.timeToFailure.p50Ms)} (counted separately)`);
+  }
+  return parts.join('; ') + '.';
+}
+
+export const _internals = { _dist, _pct, RELIABLE_N };

package/src/posture/fix-verify.js

@@ -6,6 +6,10 @@
 //   1. The original finding's stableId no longer fires on the patched file.
 //   2. No new findings at severity ≥ medium were introduced by the patch.
 //   3. The project's existing linter (when present) passes on the patched file.
+//   4. The project's own test suite (when detectable) still passes. This is
+//      the R5 gap-closer: a patch that silently deletes the feature would
+//      satisfy (1) and (2) just as well as a real fix — only running the
+//      tests catches that. See `test-runner.js` for detection + execution.
 //
 // If any of those fail, the caller is expected to NOT apply the patch and
 // instead surface a "fix plan" — a numbered list of steps the engineer can
@@ -16,6 +20,8 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { runFullScan } from '../engine.js';
 import { gateFixOutput } from './fix-honesty-gate.js';
+import { runProjectTests } from './test-runner.js';
+import { recordFixAttempt } from './fix-metrics.js';
 
 const SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
 
@@ -119,27 +125,148 @@ function runLinter(cwd, cmd, args) {
 // dishonest or over-claiming fix fails the gate. When `fixMeta` is absent
 // (the deterministic MCP write path, which has no claims to check) the honesty
 // gate is skipped and behavior is unchanged.
+// R5 (partial) — the test-suite stage. Runs the target project's own tests,
+// in the target project's own directory, against whatever is currently on
+// disk there. See `test-runner.js`'s header comment for why that run is
+// deliberately NOT routed through the R1 PoC-confinement sandbox: this is
+// the project's own already-trusted suite, not untrusted synthesized code.
+//
+// Caveat that matters for callers: `verifyPatch` above re-scans the
+// candidate patch purely in memory (no write to disk), but a test runner
+// needs real files — there is no cheap way to hand a runner an in-memory
+// overlay. So this leg reports on the CURRENT on-disk tree, not the
+// candidate `files` map, when `verifyFix` is used as a pre-write preview
+// (e.g. the `verify_fix` MCP tool). Callers that apply the patch first and
+// then re-verify get the strongest signal; that ordering is not enforced
+// here — it's the caller's responsibility, same as it already is for the
+// closed-loop `fix-verify-loop.js` path.
+// Does the caller's candidate patch differ from what is on disk right now?
+// If so, any test run necessarily exercised the pre-patch tree. Compared by
+// content so a patch that happens to match disk (already applied) is correctly
+// treated as NOT pre-patch.
+function _candidateDiffersFromDisk(scanRoot, files) {
+  if (!files || typeof files !== 'object') return false;
+  for (const [rel, content] of Object.entries(files)) {
+    if (typeof content !== 'string') continue;
+    try {
+      const abs = path.resolve(scanRoot, rel);
+      if (fs.readFileSync(abs, 'utf8') !== content) return true;
+    } catch {
+      return true; // candidate file absent on disk -> definitely not applied
+    }
+  }
+  return false;
+}
+
 export async function verifyFix({
   scanRoot,
   originalFindingStableId,
   files,
   depFileContents,
   fixMeta,
+  testTimeoutMs,
+  recordMetrics = true,
+  poc,
 } = {}) {
+  // R5 (reporting half) — time each stage as it runs. Measured here rather
+  // than inside each stage because only this function knows the boundaries of
+  // one verification ATTEMPT, which is the unit the distribution is over.
+  const stages = {};
+  const t0 = Date.now();
+  let mark = t0;
+  const _lap = (name) => { const now = Date.now(); stages[name] = now - mark; mark = now; };
+
   const rescan = await verifyPatch({ scanRoot, originalFindingStableId, files, depFileContents });
+  _lap('rescan');
   const lint = runProjectLinter(scanRoot, Object.keys(files || {}));
+  _lap('lint');
+  const tests = runProjectTests(scanRoot, testTimeoutMs != null ? { timeoutMs: testTimeoutMs } : {});
+  _lap('tests');
+  // True when a candidate patch was supplied but has not been written, so the
+  // suite necessarily ran against the pre-patch tree. Surfaced in the summary
+  // and on the result so a caller cannot mistake it for a verified patch.
+  const _testedPrePatch = !tests.skipped && _candidateDiffersFromDisk(scanRoot, files);
+  const testsOk = tests.skipped ? true : tests.passed === true;
   let honesty = null;
   if (fixMeta && typeof fixMeta === 'object') {
     try { honesty = gateFixOutput(fixMeta); } catch { honesty = null; }
   }
-  const ok = rescan.ok && (lint.ok || lint.skipped) && (honesty ? honesty.ok : true);
+  _lap('honesty');
+
+  // R5 — the PoC leg. Re-run the finding's proof-of-concept against the
+  // CANDIDATE patch inside R1's sandbox. A patch that still lets the PoC
+  // demonstrate the predicted effect has not fixed anything, however green the
+  // re-scan looks: the re-scan only proves the DETECTOR stopped firing, which
+  // a cosmetic edit can achieve. Execution is the stronger claim.
+  //
+  // Direction matters and is asymmetric on purpose. `execution-proven` after
+  // the patch is a hard FAIL. Anything else is NOT a pass — a PoC that failed
+  // to run, or a sandbox that could not start, is recorded as `inconclusive`
+  // and left out of the verdict entirely. Treating "could not prove it" as
+  // "fixed" is exactly the false confidence this leg exists to prevent.
+  let pocLeg = { status: 'not-requested', reason: null, tier: null };
+  if (poc?.code) {
+    try {
+      const { proveFinding } = await import('./execution-proof.js');
+      const proved = await proveFinding({ ...(poc.finding || {}), poc }, { files });
+      const tier = proved.proofTier;
+      pocLeg = tier === 'execution-proven'
+        ? { status: 'still-exploitable', tier, reason: proved.proofEvidence?.observed || null }
+        : proved.proofEvidence?.ran
+          ? { status: 'no-longer-proven', tier, reason: proved.proofEvidence?.reason || null }
+          : { status: 'inconclusive', tier, reason: proved.proofEvidence?.reason || null };
+    } catch (e) {
+      pocLeg = { status: 'inconclusive', tier: null, reason: `proof harness error: ${e.message}` };
+    }
+  }
+  _lap('poc');
+  const pocOk = pocLeg.status !== 'still-exploitable';
+
+  const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && pocOk && (honesty ? honesty.ok : true);
+  const durations = { ...stages, totalMs: Date.now() - t0 };
   const summary = [
     `re-scan: ${rescan.ok ? 'PASS' : 'FAIL — ' + rescan.reason}`,
     `linter:  ${lint.runner === 'none' ? 'skipped (no linter config)'
               : lint.skipped ? `${lint.runner} not installed`
               : lint.ok ? `${lint.runner} PASS`
               : `${lint.runner} FAIL (exit ${lint.exitCode})`}`,
+    // Say which tree the suite actually ran against. `files` is a candidate
+    // patch held in memory; the runner needs real files, so it sees whatever is
+    // on disk. Reporting a bare "PASS" here would let a caller believe the
+    // PATCH passed the tests when the suite may have run on unpatched code.
+    `tests:   ${tests.skipped ? `skipped (${tests.reason})`
+              : tests.timedOut ? 'FAIL (timed out)'
+              : tests.passed ? `PASS${_testedPrePatch ? ' — on the CURRENT on-disk tree, NOT the candidate patch' : ''}`
+              : `FAIL (exit ${tests.exitCode})`}`,
     honesty ? `honesty: ${honesty.ok ? `PASS (${honesty.tier})` : 'FAIL — ' + honesty.violations.join('; ')}` : null,
+    // Never render `inconclusive` as a pass — say plainly that nothing was proven.
+    pocLeg.status === 'not-requested' ? null
+      : pocLeg.status === 'still-exploitable' ? `poc:     FAIL — the proof-of-concept still demonstrates the vulnerability against the patch`
+      : pocLeg.status === 'no-longer-proven' ? 'poc:     PASS (ran against the patch and no longer demonstrates the vulnerability)'
+      : `poc:     inconclusive — not counted either way (${pocLeg.reason || 'no detail reported'})`,
   ].filter(Boolean).join('\n');
-  return { ok, rescan, lint, honesty, summary };
+  // Persist the attempt so the distribution can be reported from real runs.
+  // `testsRan` is the load-bearing field: it is what keeps "verified with no
+  // test suite to run" out of the headline time-to-validated-fix bucket.
+  // A patch that was never written to disk is recorded too, but flagged — its
+  // suite ran against the pre-patch tree, so its timing is real while its
+  // verdict is about a different tree.
+  if (recordMetrics && scanRoot) {
+    recordFixAttempt(scanRoot, {
+      at: new Date().toISOString(),
+      stableId: originalFindingStableId || null,
+      ok,
+      testsRan: !tests.skipped,
+      testsPassed: tests.skipped ? null : tests.passed === true,
+      testedPrePatch: _testedPrePatch,
+      lintRan: !(lint.skipped || lint.runner === 'none'),
+      honestyGated: honesty != null,
+      pocStatus: pocLeg.status,
+      files: Object.keys(files || {}).length,
+      stages,
+      totalMs: durations.totalMs,
+    });
+  }
+
+  return { ok, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
 }

package/src/posture/license-policy.js

@@ -14,7 +14,7 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import * as yaml from 'js-yaml';
+import * as yaml from '../util/yaml.js';
 
 const DEFAULT_POLICY = {
   allow: [],

package/src/posture/profile.js

@@ -5,7 +5,7 @@
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import * as yaml from 'js-yaml';
+import * as yaml from '../util/yaml.js';
 import { statePath, safeWriteState, resolveProjectRoot } from './state-dir.js';
 
 export const PROFILES = ['vibecoder', 'pro'];

package/src/posture/proof-tier.js

@@ -0,0 +1,33 @@
+// How strongly a finding is backed by evidence.
+//
+//   execution-proven — a proof-of-concept RAN inside the sandbox and produced
+//                      the predicted observable effect. The strongest claim.
+//   proof-failed     — a proof-of-concept ran and did NOT demonstrate the bug.
+//                      A triage signal, NOT an automatic false-positive verdict:
+//                      absence of proof is not proof of absence.
+//   taint-proven     — the analyser's static reasoning found it; nothing executed.
+//   unproven         — no analyser backing recorded.
+export const PROOF_TIERS = Object.freeze([
+  'execution-proven', 'proof-failed', 'taint-proven', 'unproven',
+]);
+
+// Parsers that represent real analysis rather than a plain pattern match.
+const _ANALYSED = new Set(['IR-TAINT', 'MULTI-SINK']);
+
+export function proofTierOf(finding) {
+  if (finding?.proofTier) return finding.proofTier;
+  return _ANALYSED.has(finding?.parser) ? 'taint-proven' : 'unproven';
+}
+
+export function attachProofTier(finding, evidence) {
+  if (!PROOF_TIERS.includes(evidence?.tier)) {
+    throw new Error(`unknown proof tier: ${evidence?.tier}`);
+  }
+  let tier = evidence.tier;
+  // Guard the central honesty rule: nothing that did not RUN may be called
+  // execution-proven or proof-failed. Fall back to the finding's static standing.
+  if (!evidence.ran && (tier === 'execution-proven' || tier === 'proof-failed')) {
+    tier = proofTierOf({ ...finding, proofTier: undefined });
+  }
+  return { ...finding, proofTier: tier, proofEvidence: { ...evidence, tier } };
+}