@clear-capabilities/agentic-security-scanner 0.130.0 → 0.132.0

package/CHANGELOG.md

@@ -1,5 +1,127 @@
 # Changelog
 
+## 0.132.0 — a proven exploit becomes a permanent regression test
+
+The corpus stops being only a regression net and starts being fed by the engine
+itself. Every claim below was verified by a command in the session that made it.
+
+- **Execution-proven findings auto-enrol as corpus entries.** This was R2's
+  differentiator and the last missing piece of it. A finding whose
+  proof-of-concept RAN in the sandbox and produced the predicted effect can now
+  be turned into a permanent `pre:TP post:TN` corpus entry, so every exploit
+  proved once is defended against its own regression forever. Demonstrated end
+  to end rather than in a unit test: a real command-injection finding was proved
+  in the sandbox, its fix supplied the `post/` tree, and the entry was enrolled
+  and scored by the real gate — **the baseline moved 199 → 200**. Proven in the
+  other direction too: with the entry's `pre/` neutered the gate reports
+  `REGRESSED (1)` and exits non-zero.
+- **Nothing reaches the corpus unscored.** The entry is built in a temporary
+  directory, `pre/` and `post/` are scanned, and it is moved into the corpus
+  only on `pre:TP post:TN`. There is no force flag, and the scoring function is
+  unexported so no caller can score by one route and write by another — the
+  v0.106.0 mistake (fixtures committed without verifying they score) is the one
+  thing an automated writer must never industrialise. Scoring itself now lives
+  in one module shared by the enroller and the corpus runner, so the two cannot
+  drift apart; the refactor was proven behaviour-preserving at 199/199, no drift.
+  New entries land in `capability/`, never the CI-gated `regression/` tier — a
+  machine must not decide what blocks everyone's build.
+- **`verify_fix` now runs the proof-of-concept against the candidate patch.** A
+  re-scan only proves the DETECTOR stopped firing, which a cosmetic edit
+  achieves; re-running the exploit proves the hole is shut. Still-exploitable
+  after the patch is a hard failure. Deliberately asymmetric: a PoC that could
+  not run is recorded `inconclusive` and excluded from the verdict, because
+  reading "could not prove it" as "fixed" is exactly the false confidence this
+  leg exists to prevent. Both directions were executed against the real sandbox.
+- **Time-to-validated-fix is now measured and reported**, closing R5. Every
+  verification stage is timed and appended to a per-project log, and the
+  reported distribution is deliberately hard to flatter: failed attempts never
+  enter the validated median (they short-circuit, so blending them makes a worse
+  pipeline look faster), "no test suite to run" is bucketed apart from "tests
+  passed", and per-stage timings come from validated runs only. Percentiles are
+  nearest-rank — every figure shown is a duration some run actually took — and
+  are flagged unreliable below n=10 rather than quoted as settled.
+- **Cross-machine determinism now has a gate behind it.** A dependency-free
+  fixture is scanned on two operating systems and the run-attestation digests
+  must match. The comparator refuses every route to a meaningless pass: fewer
+  than two attestations, two runs from the same platform, a zero-finding digest,
+  mismatched canonicalisations, unparseable input. Each refusal was fired
+  deliberately and confirmed to exit non-zero.
+
+Honest limits, stated rather than implied:
+
+- The enrolment loop is **not yet automatic end to end**. Nothing in the scan
+  pipeline attaches a proof-of-concept to a finding or promotes proof tiers, so
+  a scan never produces an `execution-proven` finding on its own; PoCs come from
+  the generator and are proved at enrol time. Automatic attachment during a scan
+  is the remaining work.
+- The cross-machine determinism jobs have **not yet run in CI**, so no second
+  machine has actually been compared. Same-machine repeatability is verified.
+  The attestation's own "does not prove" statement is unchanged and stays
+  correct either way: one attestation is one run on one machine.
+- The sandbox wall-clock timeout stops the **direct child, not the process
+  tree**, on both backends. No test asserts a backgrounded grandchild dies.
+
+Also in this release:
+
+- **Documentation corrected against evidence.** The roadmap and the sandbox and
+  posture guides still described the kernel-namespace backend as "implemented,
+  unverified" after CI had already proved otherwise; they now cite the run
+  (Ubuntu 24.04, kernel 6.17.0-1020-azure, 41 assertions, 0 failures, all eight
+  escape cases). The corpus entry count was three tiers and 14 entries out of
+  date.
+- **Dependency advisories cleared** in the extension tree and `@types/node`
+  brought current in both trees.
+
+## 0.131.0 — decorated files stop vanishing; the Linux sandbox is verified
+
+Two correctness fixes, both found by pushing measurement further than the last
+release did.
+
+- **Decorator syntax is now accepted by the IR frontend.** The parser was told
+  about TypeScript and JSX but not decorators, so it rejected the ENTIRE file on
+  the first `@tracked` it met — no error, no warning, just findings that never
+  existed. Measured on a live third-party target: **4,023 of 4,271 JavaScript
+  files parsed before, 4,262 after** — 239 files, roughly 6% of that project,
+  were invisible to the scanner and are now analysed. `decorators-legacy` plus
+  `decoratorAutoAccessors` was chosen over the modern `decorators` variant
+  because the modern one cannot parse TypeScript parameter decorators; it would
+  have swapped one blind spot for another. No new dependency. Guarded by a
+  regression test proven in both directions — 5/5 pass with the fix, 4 fail
+  without it.
+- **The kernel-namespace sandbox now confines writes, and is verified.** It
+  previously confined network only and had never been executed. It now enters a
+  private mount namespace, rebinds every mount read-only except the sandbox
+  root, and drops the entire capability set before exec so a payload cannot
+  rebind the tree writable. A CI job relaxes the host restriction on
+  unprivileged user namespaces and runs the real escape suite: a write outside
+  the root is blocked with no file created, and outbound egress is blocked. The
+  verifier exits non-zero unless that suite actually RAN, so a skip can never be
+  read as a pass. Execution-proof on Linux no longer rests on an unexercised
+  backend.
+
+Also in this release:
+
+- **A quadratic blowup in the root-cause sweep**, which ran on every full scan:
+  it re-split the whole corpus into lines once per finding and kept a record per
+  finding x matching line. The largest benchmark corpus went from dying after
+  55+ minutes to **exit 0, 933 MB peak, 330s** — smaller and roughly ten times
+  faster, with metrics identical before and after.
+- **Benchmark corpora are fetched by pinned commit** instead of guessing a clone
+  depth; six corpora had never been scoreable because their pin sat more than
+  100 commits back.
+- **A pre-push gate** runs bundle integrity, the full suite, the corpus baseline
+  and the precision baseline before anything leaves the machine, plus branch
+  protection requiring green checks to merge.
+- **A dependency-currency release gate**: any advisory at moderate or above
+  fails with no opt-out; anything behind latest fails unless explicitly held
+  with a stated reason and a review date that expires.
+- **The glob dependency was replaced by the platform built-in** — 92 to 73
+  production packages — after a differential over 320 trees and 1,419,229 paths
+  showed zero differences.
+
+`npm test` 2072/0; cve-replay 199/199; self-scan no drift; proof corpus
+ghost/superset/godot all 100% parse coverage.
+
 ## 0.130.0 — the roadmap's first ten: provable security over orchestration parity
 
 A capability roadmap (`docs/ROADMAP.md`) plus its first ten items, derived from a

package/bin/agentic-security.js

@@ -28,7 +28,7 @@ import { syncTickets } from '../src/integrations/tickets.js';
 import { decide as decideNextAction, explain as explainDecision } from '../src/posture/router.js';
 import * as triage from '../src/posture/triage.js';
 import { buildSlackDigest, buildDiscordDigest, postWebhook, buildJiraIssue, buildPrComment, buildSiemEvent, loadIntegrationConfig } from '../src/integrations/index.js';
-import fg from 'fast-glob';
+import { globFiles } from '../src/util/glob.js';
 
 // last-scan.json integrity helpers — implementation in posture/integrity.js
 // so the MCP server tools can share verification.
@@ -483,7 +483,7 @@ async function cmdScan(args) {
   // fingerprint and tracking provenance via sources[].
   if (args.flags['ingest-sarif']) {
     const glob = args.flags['ingest-sarif'];
-    const paths = await fg(glob, { dot: false, onlyFiles: true });
+    const paths = await globFiles(glob);
     if (paths.length) {
       const r = ingestAndMerge(scan, paths);
       if (process.stderr.isTTY) process.stderr.write(`[ingest] merged ${r.merged} / added ${r.added} findings from ${paths.length} SARIF file(s)\n`);
@@ -655,6 +655,23 @@ async function cmdScan(args) {
           if (sla) process.stderr.write(`⏰ agentic-security: ${sla}\n`);
         }
       } catch { /* MTTR is best-effort — never block a scan write */ }
+
+      // R5 — report the observed time-to-validated-fix distribution from the
+      // fix attempts recorded by `verifyFix`. This is measurement, not
+      // estimation: it says nothing until fixes have actually been verified in
+      // this project, and it prints nothing when there is nothing measured.
+      // Skipped under --deterministic for the same reason MTTR is: the
+      // durations are wall-clock and would break byte-identical state.
+      try {
+        const { fixDurationReport, renderFixDurationSummary } = await import('../src/posture/fix-metrics.js');
+        const fixMetrics = fixDurationReport(path.resolve(target));
+        if (fixMetrics.attempts > 0) {
+          persistedScan.fixMetrics = fixMetrics;
+          const isJsonFmt = format === 'json' || format === 'sarif' || format === 'cyclonedx' || format === 'sbom' || format === 'spdx' || format === 'vex' || format === 'openvex' || format === 'pbom' || format === 'aibom';
+          const line = renderFixDurationSummary(fixMetrics);
+          if (!isJsonFmt && line) process.stderr.write(`🔧 agentic-security: ${line}\n`);
+        }
+      } catch { /* fix metrics are best-effort — never block a scan write */ }
     }
     // #22 — live-secret validation (opt-in, offline-degrading). Label each
     // detected secret live | dead | unknown via a read-only provider "whoami".

package/dist/113.index.js

@@ -1,7 +1,220 @@
 export const id = 113;
-export const ids = [113,526];
+export const ids = [113,238,526];
 export const modules = {
 
+/***/ 2238:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   I3: () => (/* binding */ recordFixAttempt),
+/* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
+/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary)
+/* harmony export */ });
+/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+// Time-to-validated-fix (R5, the reporting half).
+//
+// `verifyFix` already RUNS the stages and `test-runner.js` already times the
+// slowest one. What did not exist was anything durable to read afterwards, so
+// "how long does a fix actually take to validate" had no answer from real runs
+// — only an estimate (`time-to-fix.js` guesses engineering hours from family
+// and patch shape, before anything runs). This module is the opposite: it
+// records what the pipeline observed and reports the distribution.
+//
+// THE HONESTY RULES, which are most of why this file is longer than a mean:
+//
+//  1. A failed attempt is NOT a data point about how long a fix takes. Fixes
+//     that fail verification fail fast (a re-scan that still sees the finding
+//     never reaches the test suite), so blending them into one average makes
+//     the pipeline look faster the worse it performs. Validated and failed
+//     attempts are summarised separately and never merged.
+//
+//  2. "Tests skipped" is not "tests passed". A project with no detectable
+//     suite can reach `ok:true` having run only the re-scan and the linter.
+//     That is a weaker claim than a fix whose suite executed, and it is also
+//     much faster, so counting the two together would quietly deflate the
+//     headline. They get their own bucket: `validated` means the suite ran and
+//     passed, `validatedWithoutTests` means there was no suite to run.
+//
+//  3. Every figure carries its `n`, and a percentile computed from too few
+//     samples is labelled unreliable rather than omitted or silently reported.
+//     Same precedent as the accuracy scorecard's `{n, d}` rates: a number
+//     without its denominator is not a measurement.
+//
+// Storage is append-only JSONL at `<scanRoot>/.agentic-security/fix-metrics.jsonl`,
+// one record per verification attempt. Nothing here throws (posture
+// convention) — an unwritable or corrupt log degrades to "no metrics", never
+// to a failed verification.
+
+
+
+
+
+const STATE_DIR = '.agentic-security';
+const LOG_FILE = 'fix-metrics.jsonl';
+
+// Below this many samples a percentile is an artifact of the sample, not a
+// property of the pipeline. Reported anyway (hiding it invites re-deriving it
+// wrong downstream) but flagged, so a caller cannot quote it as settled.
+const RELIABLE_N = 10;
+
+// The stages verifyFix runs, in execution order. Kept here so the recorder and
+// the summariser cannot drift apart on stage naming.
+const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
+
+function _logPath(scanRoot) {
+  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR, LOG_FILE);
+}
+
+/**
+ * Append one verification attempt. Best-effort and silent on failure: metrics
+ * must never be able to fail a fix that otherwise verified.
+ *
+ * @returns {boolean} whether the record was written (for tests, not callers).
+ */
+function recordFixAttempt(scanRoot, record) {
+  if (!scanRoot || !record || typeof record !== 'object') return false;
+  try {
+    const dir = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR);
+    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
+    // One writeSync of one newline-terminated line: a concurrent reader sees
+    // whole records or nothing, and a torn tail is dropped on read.
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');
+    return true;
+  } catch { return false; }
+}
+
+/**
+ * Read every well-formed attempt. A line that does not parse is skipped, not
+ * fatal — the last line of an interrupted write is the expected case.
+ */
+function loadFixAttempts(scanRoot) {
+  try {
+    const raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(_logPath(scanRoot), 'utf8');
+    const out = [];
+    for (const line of raw.split('\n')) {
+      if (!line.trim()) continue;
+      try {
+        const rec = JSON.parse(line);
+        if (rec && typeof rec === 'object' && typeof rec.totalMs === 'number') out.push(rec);
+      } catch { /* torn or hand-edited line — drop it, keep the rest */ }
+    }
+    return out;
+  } catch { return []; }
+}
+
+// Nearest-rank percentile over an ascending array. Nearest-rank rather than
+// interpolated because these are observed durations, and an interpolated p50
+// reports a duration that no run actually took.
+function _pct(sorted, p) {
+  if (!sorted.length) return null;
+  const rank = Math.ceil((p / 100) * sorted.length);
+  return sorted[Math.min(sorted.length - 1, Math.max(0, rank - 1))];
+}
+
+function _dist(values) {
+  const v = values.filter(x => typeof x === 'number' && Number.isFinite(x) && x >= 0).sort((a, b) => a - b);
+  if (!v.length) return { n: 0, minMs: null, p50Ms: null, p90Ms: null, maxMs: null, meanMs: null, reliable: false };
+  const sum = v.reduce((a, b) => a + b, 0);
+  return {
+    n: v.length,
+    minMs: v[0],
+    p50Ms: _pct(v, 50),
+    p90Ms: _pct(v, 90),
+    maxMs: v[v.length - 1],
+    meanMs: Math.round(sum / v.length),
+    // Says whether the percentiles above may be quoted, not whether the count
+    // is real. n and min/max/mean are exact at any sample size.
+    reliable: v.length >= RELIABLE_N,
+  };
+}
+
+// Which bucket an attempt belongs to. Deliberately total: every attempt lands
+// in exactly one, so the bucket counts always sum to the attempt count and a
+// mis-shaped record cannot silently vanish from the denominator.
+function bucketOf(a) {
+  if (!a?.ok) return 'failed';
+  return a.testsRan ? 'validated' : 'validatedWithoutTests';
+}
+
+/**
+ * Summarise a set of attempts into the reported distribution.
+ *
+ * `validated` is the headline: attempts that verified AND whose test suite
+ * actually ran and passed. The other two buckets exist so that headline cannot
+ * be inflated by counting weaker or faster outcomes inside it.
+ */
+function summarizeFixDurations(attempts) {
+  const all = Array.isArray(attempts) ? attempts : [];
+  const buckets = { validated: [], validatedWithoutTests: [], failed: [] };
+  for (const a of all) buckets[bucketOf(a)].push(a);
+
+  const byStage = {};
+  for (const stage of FIX_STAGES) {
+    // Per-stage timings come from validated runs only. A stage's duration in a
+    // failed run is truncated by the failure (the pipeline stops), so mixing
+    // them in would understate every stage after the first failure point.
+    byStage[stage] = _dist(buckets.validated.map(a => a?.stages?.[stage]));
+  }
+
+  return {
+    attempts: all.length,
+    counts: {
+      validated: buckets.validated.length,
+      validatedWithoutTests: buckets.validatedWithoutTests.length,
+      failed: buckets.failed.length,
+    },
+    timeToValidatedFix: _dist(buckets.validated.map(a => a.totalMs)),
+    timeToValidatedFixWithoutTests: _dist(buckets.validatedWithoutTests.map(a => a.totalMs)),
+    timeToFailure: _dist(buckets.failed.map(a => a.totalMs)),
+    byStage,
+    reliableAtOrAbove: RELIABLE_N,
+  };
+}
+
+/** Read + summarise in one step. */
+function fixDurationReport(scanRoot) {
+  return summarizeFixDurations(loadFixAttempts(scanRoot));
+}
+
+function _ms(v) {
+  if (v == null) return '—';
+  return v >= 1000 ? `${(v / 1000).toFixed(1)}s` : `${v}ms`;
+}
+
+/**
+ * One-paragraph human summary. Returns null when there is nothing measured —
+ * callers print nothing rather than printing an empty table.
+ */
+function renderFixDurationSummary(sum) {
+  if (!sum || !sum.attempts) return null;
+  const d = sum.timeToValidatedFix;
+  const parts = [];
+  if (d.n) {
+    parts.push(
+      `time-to-validated-fix: median ${_ms(d.p50Ms)}, p90 ${_ms(d.p90Ms)} `
+      + `(n=${d.n}${d.reliable ? '' : `, below ${sum.reliableAtOrAbove} — percentiles not yet reliable`})`,
+    );
+  } else {
+    parts.push('time-to-validated-fix: no fix has both verified and had its test suite run yet');
+  }
+  if (sum.counts.validatedWithoutTests) {
+    parts.push(`${sum.counts.validatedWithoutTests} verified with no detectable test suite (excluded from the median above)`);
+  }
+  if (sum.counts.failed) {
+    parts.push(`${sum.counts.failed} failed verification, median ${_ms(sum.timeToFailure.p50Ms)} (counted separately)`);
+  }
+  return parts.join('; ') + '.';
+}
+
+const _internals = { _dist, _pct, RELIABLE_N };
+
+
+/***/ }),
+
 /***/ 4113:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
@@ -521,6 +734,8 @@ function runProjectTests(scanRoot, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
   };
 }
 
+// EXTERNAL MODULE: ./src/posture/fix-metrics.js
+var fix_metrics = __webpack_require__(2238);
 ;// CONCATENATED MODULE: ./src/posture/fix-verify.js
 // Closed-loop /fix verification (Sentinel-parity FR-L4-4, FR-L4-5).
 //
@@ -546,6 +761,7 @@ function runProjectTests(scanRoot, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
 
 
 
+
 const SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
 
 // Run a focused re-scan over just the patched file(s) using the in-memory
@@ -688,10 +904,23 @@ async function verifyFix({
   depFileContents,
   fixMeta,
   testTimeoutMs,
+  recordMetrics = true,
+  poc,
 } = {}) {
+  // R5 (reporting half) — time each stage as it runs. Measured here rather
+  // than inside each stage because only this function knows the boundaries of
+  // one verification ATTEMPT, which is the unit the distribution is over.
+  const stages = {};
+  const t0 = Date.now();
+  let mark = t0;
+  const _lap = (name) => { const now = Date.now(); stages[name] = now - mark; mark = now; };
+
   const rescan = await verifyPatch({ scanRoot, originalFindingStableId, files, depFileContents });
+  _lap('rescan');
   const lint = runProjectLinter(scanRoot, Object.keys(files || {}));
+  _lap('lint');
   const tests = runProjectTests(scanRoot, testTimeoutMs != null ? { timeoutMs: testTimeoutMs } : {});
+  _lap('tests');
   // True when a candidate patch was supplied but has not been written, so the
   // suite necessarily ran against the pre-patch tree. Surfaced in the summary
   // and on the result so a caller cannot mistake it for a verified patch.
@@ -701,7 +930,39 @@ async function verifyFix({
   if (fixMeta && typeof fixMeta === 'object') {
     try { honesty = gateFixOutput(fixMeta); } catch { honesty = null; }
   }
-  const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && (honesty ? honesty.ok : true);
+  _lap('honesty');
+
+  // R5 — the PoC leg. Re-run the finding's proof-of-concept against the
+  // CANDIDATE patch inside R1's sandbox. A patch that still lets the PoC
+  // demonstrate the predicted effect has not fixed anything, however green the
+  // re-scan looks: the re-scan only proves the DETECTOR stopped firing, which
+  // a cosmetic edit can achieve. Execution is the stronger claim.
+  //
+  // Direction matters and is asymmetric on purpose. `execution-proven` after
+  // the patch is a hard FAIL. Anything else is NOT a pass — a PoC that failed
+  // to run, or a sandbox that could not start, is recorded as `inconclusive`
+  // and left out of the verdict entirely. Treating "could not prove it" as
+  // "fixed" is exactly the false confidence this leg exists to prevent.
+  let pocLeg = { status: 'not-requested', reason: null, tier: null };
+  if (poc?.code) {
+    try {
+      const { proveFinding } = await __webpack_require__.e(/* import() */ 259).then(__webpack_require__.bind(__webpack_require__, 8259));
+      const proved = await proveFinding({ ...(poc.finding || {}), poc }, { files });
+      const tier = proved.proofTier;
+      pocLeg = tier === 'execution-proven'
+        ? { status: 'still-exploitable', tier, reason: proved.proofEvidence?.observed || null }
+        : proved.proofEvidence?.ran
+          ? { status: 'no-longer-proven', tier, reason: proved.proofEvidence?.reason || null }
+          : { status: 'inconclusive', tier, reason: proved.proofEvidence?.reason || null };
+    } catch (e) {
+      pocLeg = { status: 'inconclusive', tier: null, reason: `proof harness error: ${e.message}` };
+    }
+  }
+  _lap('poc');
+  const pocOk = pocLeg.status !== 'still-exploitable';
+
+  const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && pocOk && (honesty ? honesty.ok : true);
+  const durations = { ...stages, totalMs: Date.now() - t0 };
   const summary = [
     `re-scan: ${rescan.ok ? 'PASS' : 'FAIL — ' + rescan.reason}`,
     `linter:  ${lint.runner === 'none' ? 'skipped (no linter config)'
@@ -717,8 +978,36 @@ async function verifyFix({
               : tests.passed ? `PASS${_testedPrePatch ? ' — on the CURRENT on-disk tree, NOT the candidate patch' : ''}`
               : `FAIL (exit ${tests.exitCode})`}`,
     honesty ? `honesty: ${honesty.ok ? `PASS (${honesty.tier})` : 'FAIL — ' + honesty.violations.join('; ')}` : null,
+    // Never render `inconclusive` as a pass — say plainly that nothing was proven.
+    pocLeg.status === 'not-requested' ? null
+      : pocLeg.status === 'still-exploitable' ? `poc:     FAIL — the proof-of-concept still demonstrates the vulnerability against the patch`
+      : pocLeg.status === 'no-longer-proven' ? 'poc:     PASS (ran against the patch and no longer demonstrates the vulnerability)'
+      : `poc:     inconclusive — not counted either way (${pocLeg.reason || 'no detail reported'})`,
   ].filter(Boolean).join('\n');
-  return { ok, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, summary };
+  // Persist the attempt so the distribution can be reported from real runs.
+  // `testsRan` is the load-bearing field: it is what keeps "verified with no
+  // test suite to run" out of the headline time-to-validated-fix bucket.
+  // A patch that was never written to disk is recorded too, but flagged — its
+  // suite ran against the pre-patch tree, so its timing is real while its
+  // verdict is about a different tree.
+  if (recordMetrics && scanRoot) {
+    (0,fix_metrics/* recordFixAttempt */.I3)(scanRoot, {
+      at: new Date().toISOString(),
+      stableId: originalFindingStableId || null,
+      ok,
+      testsRan: !tests.skipped,
+      testsPassed: tests.skipped ? null : tests.passed === true,
+      testedPrePatch: _testedPrePatch,
+      lintRan: !(lint.skipped || lint.runner === 'none'),
+      honestyGated: honesty != null,
+      pocStatus: pocLeg.status,
+      files: Object.keys(files || {}).length,
+      stages,
+      totalMs: durations.totalMs,
+    });
+  }
+
+  return { ok, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
 }
 
 

package/dist/207.index.js

@@ -73,10 +73,13 @@ const PROVES =
   '(same rule id, severity, file, line, cwe, vuln, and multiplicity) produced by the same ' +
   'engine version, ruleset version, and bundle — regardless of emission order.';
 const DOES_NOT_PROVE =
-  'It does not prove cross-machine reproducibility: no run on a second machine, OS, or Node ' +
-  'version is compared here, and some detectors are environment-sensitive. A signature, when ' +
-  'present, is a symmetric per-install HMAC — tamper-evidence for this install, not ' +
-  'third-party non-repudiation.';
+  'It does not prove cross-machine reproducibility: this attestation is one run on one machine, ' +
+  'nothing here compares a second machine, OS, or Node version, and some detectors are ' +
+  'environment-sensitive. That property is tested separately by the determinism-attest / ' +
+  'determinism-compare CI jobs, which run the same commit on two operating systems and fail ' +
+  'unless the digests match — evidence about the ENGINE, not about this attestation. ' +
+  'A signature, when present, is a symmetric per-install HMAC — tamper-evidence for this ' +
+  'install, not third-party non-repudiation.';
 
 function _str(v) { return v === undefined || v === null ? '' : String(v); }