@clear-capabilities/agentic-security-scanner 0.140.0 → 0.142.0

package/CHANGELOG.md

@@ -9,6 +9,289 @@
 > make the history less accurate, not more.
 
 
+
+
+## 0.142.0 — The last five PRD items, and three criteria that now fail on evidence
+
+0.141.0 built instruments for the surfaces that had none. This closes the
+remainder of `docs/WORLD_CLASS_HARNESS_PRD.md`: four of the five items found
+live engine bugs, and the fifth re-derived the headline the whole document rests
+on. Three success criteria now **fail** — measured, rather than unknown.
+
+### A sanitizer could be undone and the flow still read as clean
+
+`he.decode(escapeHtml(req.query.name))` reaching an HTML sink was reported
+**sanitized**. The decode puts back exactly what the escape removed, so this was
+a missed XSS presented as a clean flow.
+
+Nothing modelled reversal: the catalog holds sanitizers, a decoder is the
+opposite, so it was never even recorded on the path. Fixed across three layers —
+the taint walk now collects un-sanitizer callees, the gate maps them to the
+family they reverse (percent-decoding does **not** undo HTML escaping, so a flat
+list would be wrong), and the finding-projection allowlist had to learn the new
+field. That last one is why the fix looked inert through three rounds of
+debugging.
+
+Found by the mutation gate, which went from 12 to **34 cases** — the five
+detector families 0.141.0 shipped had owed a metamorphic pair and an adversarial
+near-miss and had none.
+
+### The CloudFormation ingress rule was keyed on YAML key order
+
+`- CidrIp:` first and `- IpProtocol:` first are the same template — YAML mappings
+are unordered — and only the second matched. The rule was keyed on the author's
+formatting, which is syntax, not meaning. Also caught by the mutation gate, by
+the metamorphic case that exists for exactly this.
+
+### Every reachability demotion we could adjudicate was wrong
+
+Reachability was reported as a demotion *rate*, and that rate was **0 for every
+entry by construction**: `bench/sca-replay` fetched lockfiles, so the analysis
+had no source to walk. A number that is structurally zero looks like a
+measurement and is not one.
+
+With source fetched and scored against an import-level oracle: **3 adjudicable
+demotions, 3 false-unreachable — 100% wrong, in the missed-exploit direction.**
+`express`/`cookie`, `express`/`send`, `poetry`/`requests` — each demoted to
+`info` and out of the report, each verified by hand as genuinely imported.
+
+Three defects behind it:
+
+- **Failure to prove reachability was reported as proof of unreachability.** A
+  site the analysis could not reason about became a positive claim. It is now
+  `unknown`, a state the code already used elsewhere.
+- **A project with no routes was still asked "reachable from a route?"** For a
+  library that question has no answer — its callers are its users, not in the
+  tree.
+- **`_enclosingFn` knew two of four declaration forms.** `res.cookie = function
+  (…)` — how most of the JS ecosystem defines a public method — was invisible, so
+  the scan attributed call sites to unrelated functions further up the file. It
+  now also tracks whether the enclosing function is **exported**, because a
+  public-API function with no in-tree caller is the normal case, not dead code.
+
+**If you use SCA reachability to triage, this affected you**: findings were being
+demoted out of your report on projects that genuinely import the vulnerable
+package.
+
+### The VS Code extension had never been type-checked
+
+`typescript` is now a devDependency and `npm run typecheck` runs in CI. It found
+errors immediately: the tsconfig declared no `types` at all, so `process`,
+`setTimeout` and `NodeJS.Timeout` were every one of them unresolved — `@types/node`
+was installed and nothing consumed it — plus two implicit `any` parameters. The
+build is esbuild, which strips types without checking them, so none of this had
+ever surfaced.
+
+Neovim and JetBrains are now smoke-tested in CI too. JetBrains is classified
+**informational**: it downloads a full IntelliJ distribution, so red there is more
+often the network than this code, and a habitually-red gate stops being read.
+
+## The population re-measured — and it is worse
+
+991 scored entries at engine 0.141.0 (the code that ships here), against 315 at
+0.138.0 before:
+
+| | before | **now** |
+|---|---:|---:|
+| localized recall | 3.56% | **2.83%** |
+| localized precision | 44.00% | **36.36%** |
+| fix-discrimination | 81.8% | **71.43%** |
+| held-out recall | — | **2.93%** |
+
+**The headline fell because the question got harder.** The corpus tripled once
+the advisory miner could page past the first hundred entries per ecosystem, and
+what it pulled in is recent, TypeScript-heavy and dominated by authorization
+classes. Held-out tracks development almost exactly, so nothing is fitted.
+
+**Ruby 0% → 3.20%. Go 0% → 1.19%.** Both measured zeros are off zero, on
+populations 8× and 1.2× their old size. **PHP is the new zero, at 0/73.**
+
+Two of this release's own fixes are confirmed on real code rather than their own
+fixtures: the Ruby `File.join` rule earns `lsegal/yard`, and `CONVENTION` earns
+its first localized true positive ever on GitPython — the family recorded as
+permanently silent until it turned out to be mislocalized by five lines.
+
+### Three success criteria now fail, on evidence
+
+- **Fix-discrimination is 71.43%**, below its 80% floor. 8 of 28 findings still
+  fire on the code the fix produced — those detected an API, not a vulnerability.
+- **Taint contributes 1 of 28** localized true positives. It was 1 of 12; the
+  count did not move while the population tripled. Deep mode also costs 5 extra
+  false positives and **loses** a Go finding that pattern-only makes.
+- **Compliance still has no accuracy instrument** — the last feature measured by
+  nothing.
+
+### Measured and deliberately not fixed
+
+- **The agent trust-boundary delta is 0 of 0 — undefined, not zero.** The
+  population now holds 28 entries of real MCP-server code; the engine produces no
+  localized true positives on any of them, so there is nothing for the boundary
+  modelling to have contributed to. It is not silent there — 21 findings per
+  entry, all on the advisory's own files, none of the labelled class. WRONG-CWE,
+  on the most differentiated surface in the product.
+- **Reachability now demotes nothing** on the source-bearing corpus. The false
+  demotions are gone; whether the new caution is correct needs applications with
+  real routes, which those four entries are not.
+
+## Also
+
+- A whole-population benchmark run **wedged** at 0.0% CPU after 4.5 hours, taking
+  every already-scored entry with it. `bench/independent/runner.mjs` now takes
+  `--offset`/`--limit` and `merge-chunks.mjs` reassembles the slices,
+  **recomputing** every aggregate from the per-entry rows and refusing to write
+  unless that reproduces each chunk's own numbers exactly. It caught two of its
+  own bugs that way.
+- A guard-shaped method NAME on a declaration line (`def check_static_cache(`) no
+  longer counts as a containment guard, which had been silently dropping path
+  findings inside any method called `check*` / `validate*` / `ensure*`.
+
+## 0.141.0 — Six new instruments, and the seven live bugs they found
+
+The previous release fixed five bugs found by measuring. This one builds the
+instruments that do the measuring for the surfaces that had none — SCA, secrets,
+IaC, prompt injection, remediation, and the IDE/MCP surfaces — and then fixes
+what they reported. Every number below is reproducible with a command in
+`bench/*/README.md`.
+
+None of the improvements came from tuning. They came from files that were never
+read, patterns that could never fire, and versions that were silently rewritten.
+
+### SCA never read a transitive dependency tree on any real project
+
+`readTree` skipped **any file over 500 KB before deciding what kind of file it
+was.** npm/cli's `package-lock.json` is 666 KB, next.js's `pnpm-lock.yaml` is
+910 KB, magento2's `composer.lock` is 501 KB. On every project big enough for
+supply-chain risk to matter, the lockfile was dropped and SCA fell back to
+whatever exact versions appeared in `package.json` — direct dependencies only,
+while the headline claim of the feature is transitive reachability.
+
+Manifests now have their own, much larger cap. The 500 KB cap on **code** files
+is unchanged: that one protects the analysis path and was never the problem.
+
+Two more admission gaps in the same area: `go.sum` was never admitted though
+`_parseGoSum` and its dispatch entry had always existed, and only the exact
+basename `requirements.txt` was matched — so `requirements/dev.txt`, which is
+what pallets/flask ships, scored 0 of 11.
+
+**Measured effect (`bench/sca-replay`, 13 real repos, 7 ecosystems, labels from
+the advisory database via readers that share no code with the engine): version
+recall 10.89% → 77.92% at 100% precision, held-out 84.29%.**
+
+### Go dependency versions were rewritten into versions that do not exist
+
+`v0.0.0-20210903162142-ad29c8ab022f` became `0.0.0` in three separate places —
+not a shorter version but a different one, collapsing every pseudo-versioned
+module in a tree onto a single key. **Go went from 5.28% to 100%** once versions
+survived intact.
+
+This also corrupted the emitted SBOM, which is the worse half: an SBOM saying
+`golang.org/x/net@0.0.0` is wrong in a document other people are supposed to
+rely on.
+
+### The typosquat detector reported 166 findings, none of them typosquats
+
+Across 13 real repositories, at critical and high severity: `ms ~ ws`,
+`acorn ~ cors`, `ajv ~ ava`, `six ~ tox`, `arg ~ yargs`, `bail ~ babel`. Every
+one is a legitimate, popular package; `ms` is a top-50 npm package.
+
+Absolute edit distance is meaningless on short names — two edits on a
+four-character name changes half of it, and every two-character package is one
+edit from every other. Now Damerau-Levenshtein, so a transposition (`lodahs` for
+`lodash`, the commonest real typo) costs 1 rather than 2, gated on
+`distance / min(len) ≤ 0.25`.
+
+### The VS Code extension had never been able to find the scanner
+
+It looked for the bundle under a hardcoded
+`…/agentic-security/0.1.0/scanner/dist/…`, and Claude Code caches a plugin under
+its **plugin** version — 0.128.2, 0.136.9, 0.139.1, never 0.1.0. `0.1.0` was the
+extension's own version pasted into the wrong path, so the fallback could not
+resolve on any install and every user got *"scanner not found."*
+
+Nothing tested it, because the function read `vscode.workspace` and could not be
+imported outside a VS Code host. The resolver is now a pure function that
+discovers the version instead of hardcoding one, prefers `CLAUDE_PLUGIN_ROOT`,
+and is covered by 15 tests plus a CI job that fails on a stale committed bundle.
+
+### Three IaC formats had no rules at all
+
+CloudFormation, Bicep and Helm chart values scored **0** against every control
+tested — not weak rules, no rules, and for CloudFormation no file admission
+either, since a template is a `.yaml` that no path predicate recognises.
+
+`bench/iac-coverage` scores **verdict flip**: a control counts only when the
+misconfigured variant fires *and* the hardened one stays silent. That caught
+something a recall-only bench never would — `FROM ubuntu@sha256:…`, the most
+tightly pinned form a Dockerfile can use, was reported as *"ubuntu:latest
+(floating tag)"* because the digest was matched but not captured. A false
+positive on the hardened configuration tells the people who did the right thing
+that they did the wrong one.
+
+**Coverage 8/14 → 23/26**, with the three still open marked as needing semantic
+analysis rather than another pattern.
+
+### Credential patterns that could never fire
+
+`CRED_PREFILTER` is a whole-file gate: `scanCredentials` returns early unless
+that one regex matches, so a pattern whose trigger token is missing is dead code
+however correct it is. The generic "Password in URL" rule was in exactly that
+state.
+
+Also absent entirely: `postgres://user:pass@host/db` and `mongodb+srv://…` —
+among the commonest real leaks there are — plus GitLab, DigitalOcean, Azure
+Storage, Supabase and HubSpot tokens. Only `jdbc:` was covered.
+
+**Format coverage 60% → 92.11%, with correct silence at 28/28** on a hard
+negative set of lockfile integrity fields, git SHAs, content digests, Terraform
+state ids and a security rule file that defines key formats.
+
+### Prompt-injection patterns that were correct and far too literal
+
+The override rule required the object noun to be one of seven words, so *"Forget
+all previous **tasks**"* and *"Ignore all preceding **orders**"* missed.
+Exfiltration could not match *"show me all your prompt texts"*.
+
+**Recall 6.08% → 18.25% against `deepset/prompt-injections` (Apache-2.0, 263
+injections and 399 legitimate prompts), precision and correct-silence at 100%
+throughout.** Reported per technique, because an aggregate hides which one is
+weak: role-play 100%, exfiltration 60%, override 41.86%.
+
+And the engine caught its own author — the widened pattern was flagged by this
+project's own ReDoS detector on the self-scan gate, twice, before it was
+rewritten as a flat alternation that scores identically.
+
+## Measured, published, and deliberately not "fixed"
+
+- **Fix synthesis produces a patch for 0 of 6** real true positives on
+  third-party code (`bench/fix-correctness`, scored against the upstream fix
+  commit). The deterministic synthesizer has two rules, both JS/Python; the real
+  population is injection and authorization across seven languages. Widening it
+  to guess at an authorization check would produce patches that pass
+  verification while changing behaviour.
+- **German prompt injection scores 2.30% against English's 28.57%.** Patching it
+  because *this corpus* is German would be fitting to the benchmark.
+- **Datadog, Vercel and Algolia keys stay undetected.** They are a bare run of
+  hex; a pattern for "32 hex characters" would fire on every content digest and
+  checksum in existence.
+- **`CODEGEN` produces nothing on any of the five advisories in its own header.**
+  Measured dead, and left for a deliberate retire-or-fix decision rather than
+  removed silently.
+
+## Also
+
+- The advisory miner **was not paginating** — the API ignores `&page=N` — so the
+  evaluation population was capped at ~100 advisories per ecosystem by
+  construction. Fixed via the `Link` cursor: **315 → 1004 entries**, Ruby 32 →
+  250, Kotlin 0 → 2.
+- `File.join(<root>, …, <variable>)` reaching a filesystem call with no traversal
+  guard is now detected for Ruby (CWE-22), the dominant real-world shape the
+  existing rule could not reach.
+- A guard-shaped method **name** on a declaration line (`def check_static_cache(`)
+  no longer counts as a containment guard, which was silently dropping path
+  findings inside any method called `check*`/`validate*`/`ensure*`.
+- MCP is now smoke-tested end to end over stdio through the shipped binary, with
+  both write tools asserted to refuse out-of-tree paths in both directions.
+
 ## 0.140.0 — Five shipped bugs, found by measuring instead of reading
 
 Every fix here is a defect that was live in 0.139.1. None came from the feature

package/dist/113.index.js

@@ -10,7 +10,7 @@ export const modules = {
 /* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
 /* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary)
 /* harmony export */ });
-/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals */
+/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
 /* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
@@ -213,6 +213,82 @@ function renderFixDurationSummary(sum) {
 const _internals = { _dist, _pct, RELIABLE_N };
 
 
+// ── PRD F6.1 — score fixes on THREE AXES, not one ──────────────────────────
+//
+// The three axes the PRD names:
+//   (a) does the finding disappear      — the rescan leg
+//   (b) does the project's own suite pass — the tests leg
+//   (c) does an independent verifier agree — the PoC re-check leg
+//
+// All three were already computed by verifyFixCore and then collapsed into one
+// boolean, which is the problem: **(a) alone is satisfiable by deleting code.**
+// A patch that removes the vulnerable function passes the rescan, has nothing
+// left to fail, and — on a project with no detectable test suite — reaches
+// ok:true having proven only that the detector went quiet.
+//
+// Reporting the axes separately makes that visible. `aOnly` is the number that
+// matters most and the one nobody was publishing: attempts that satisfied ONLY
+// the disappearance axis. A high aOnly with a high headline is the shape of a
+// remediation feature that is deleting code and calling it a fix.
+function summarizeFixAxes(attempts) {
+  const list = Array.isArray(attempts) ? attempts.filter(Boolean) : [];
+  const d = list.length;
+
+  const rate = (pred) => ({ n: list.filter(pred).length, d });
+
+  // Each axis is judged INDEPENDENTLY of the overall verdict, so a leg that
+  // passed inside a failed attempt still counts for its own axis. Reading them
+  // off `ok` would make the three axes three copies of the same number.
+  const findingDisappeared = rate((a) => a.rescanOk === true || (a.ok === true && a.rescanOk !== false));
+  const testsStillPass = rate((a) => a.testsRan === true && a.testsOk !== false);
+  const verifierAgrees = rate((a) => a.pocOk === true);
+
+  const satisfiesAll = rate((a) =>
+    (a.rescanOk === true || (a.ok === true && a.rescanOk !== false))
+    && a.testsRan === true && a.testsOk !== false
+    && a.pocOk === true);
+
+  // The honesty number: disappearance WITHOUT either corroborating axis.
+  const aOnly = rate((a) => {
+    const disappeared = a.rescanOk === true || (a.ok === true && a.rescanOk !== false);
+    const corroborated = (a.testsRan === true && a.testsOk !== false) || a.pocOk === true;
+    return disappeared && !corroborated;
+  });
+
+  return {
+    total: d,
+    findingDisappeared,
+    testsStillPass,
+    verifierAgrees,
+    satisfiesAll,
+    aOnly,
+    meaning:
+      'findingDisappeared = the detector went quiet; testsStillPass = the project suite ran AND passed; '
+      + 'verifierAgrees = an independent PoC re-check confirmed the hole is shut. '
+      + 'aOnly counts attempts that satisfied ONLY disappearance — the shape a code-deleting "fix" produces.',
+    caveat: d === 0
+      ? 'no attempts recorded; every rate is 0/0 and means nothing'
+      : 'rates carry {n,d}; a small d is indicative, not settled',
+  };
+}
+
+/** Markdown for a report. Denominators always attached. */
+function renderFixAxes(sum) {
+  if (!sum || !sum.total) return '_No fix attempts recorded._\n';
+  const row = (label, r, note) => `| ${label} | ${r.n}/${r.d} | ${note} |`;
+  return [
+    '| Axis | Rate | Meaning |',
+    '|---|---|---|',
+    row('(a) finding disappeared', sum.findingDisappeared, 'the detector went quiet'),
+    row('(b) project tests pass', sum.testsStillPass, 'the suite RAN and passed'),
+    row('(c) verifier agrees', sum.verifierAgrees, 'an independent PoC re-check confirmed it'),
+    row('all three', sum.satisfiesAll, 'the only row that means "fixed"'),
+    row('(a) ALONE', sum.aOnly, 'satisfiable by deleting code — watch this number'),
+    '',
+  ].join('\n');
+}
+
+
 /***/ }),
 
 /***/ 4113:
@@ -415,8 +491,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 203 modules
-var engine = __webpack_require__(6622);
+// EXTERNAL MODULE: ./src/engine.js + 200 modules
+var engine = __webpack_require__(3474);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6622);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(3474);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/238.index.js

@@ -10,7 +10,7 @@ export const modules = {
 /* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
 /* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary)
 /* harmony export */ });
-/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals */
+/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
 /* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
@@ -213,6 +213,82 @@ function renderFixDurationSummary(sum) {
 const _internals = { _dist, _pct, RELIABLE_N };
 
 
+// ── PRD F6.1 — score fixes on THREE AXES, not one ──────────────────────────
+//
+// The three axes the PRD names:
+//   (a) does the finding disappear      — the rescan leg
+//   (b) does the project's own suite pass — the tests leg
+//   (c) does an independent verifier agree — the PoC re-check leg
+//
+// All three were already computed by verifyFixCore and then collapsed into one
+// boolean, which is the problem: **(a) alone is satisfiable by deleting code.**
+// A patch that removes the vulnerable function passes the rescan, has nothing
+// left to fail, and — on a project with no detectable test suite — reaches
+// ok:true having proven only that the detector went quiet.
+//
+// Reporting the axes separately makes that visible. `aOnly` is the number that
+// matters most and the one nobody was publishing: attempts that satisfied ONLY
+// the disappearance axis. A high aOnly with a high headline is the shape of a
+// remediation feature that is deleting code and calling it a fix.
+function summarizeFixAxes(attempts) {
+  const list = Array.isArray(attempts) ? attempts.filter(Boolean) : [];
+  const d = list.length;
+
+  const rate = (pred) => ({ n: list.filter(pred).length, d });
+
+  // Each axis is judged INDEPENDENTLY of the overall verdict, so a leg that
+  // passed inside a failed attempt still counts for its own axis. Reading them
+  // off `ok` would make the three axes three copies of the same number.
+  const findingDisappeared = rate((a) => a.rescanOk === true || (a.ok === true && a.rescanOk !== false));
+  const testsStillPass = rate((a) => a.testsRan === true && a.testsOk !== false);
+  const verifierAgrees = rate((a) => a.pocOk === true);
+
+  const satisfiesAll = rate((a) =>
+    (a.rescanOk === true || (a.ok === true && a.rescanOk !== false))
+    && a.testsRan === true && a.testsOk !== false
+    && a.pocOk === true);
+
+  // The honesty number: disappearance WITHOUT either corroborating axis.
+  const aOnly = rate((a) => {
+    const disappeared = a.rescanOk === true || (a.ok === true && a.rescanOk !== false);
+    const corroborated = (a.testsRan === true && a.testsOk !== false) || a.pocOk === true;
+    return disappeared && !corroborated;
+  });
+
+  return {
+    total: d,
+    findingDisappeared,
+    testsStillPass,
+    verifierAgrees,
+    satisfiesAll,
+    aOnly,
+    meaning:
+      'findingDisappeared = the detector went quiet; testsStillPass = the project suite ran AND passed; '
+      + 'verifierAgrees = an independent PoC re-check confirmed the hole is shut. '
+      + 'aOnly counts attempts that satisfied ONLY disappearance — the shape a code-deleting "fix" produces.',
+    caveat: d === 0
+      ? 'no attempts recorded; every rate is 0/0 and means nothing'
+      : 'rates carry {n,d}; a small d is indicative, not settled',
+  };
+}
+
+/** Markdown for a report. Denominators always attached. */
+function renderFixAxes(sum) {
+  if (!sum || !sum.total) return '_No fix attempts recorded._\n';
+  const row = (label, r, note) => `| ${label} | ${r.n}/${r.d} | ${note} |`;
+  return [
+    '| Axis | Rate | Meaning |',
+    '|---|---|---|',
+    row('(a) finding disappeared', sum.findingDisappeared, 'the detector went quiet'),
+    row('(b) project tests pass', sum.testsStillPass, 'the suite RAN and passed'),
+    row('(c) verifier agrees', sum.verifierAgrees, 'an independent PoC re-check confirmed it'),
+    row('all three', sum.satisfiesAll, 'the only row that means "fixed"'),
+    row('(a) ALONE', sum.aOnly, 'satisfiable by deleting code — watch this number'),
+    '',
+  ].join('\n');
+}
+
+
 /***/ })
 
 };

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(6622);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3474);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.
 
 

package/dist/435.index.js

@@ -806,6 +806,18 @@ function _maybeOffload(sessionRoot, toolName, items) {
 }
 
 // ─── scan_diff ───────────────────────────────────────────────────────────────
+// Test seam for the write boundary (PRD F6.4).
+//
+// `_confine` and `isReservedWrite` ARE the confinement contract in
+// agents/_CONFINEMENT.md. A boundary is only worth what its refusals are worth,
+// and refusals cannot be adversarially tested through the public tools without
+// also exercising a real scan, a real patch and a real filesystem write — so
+// the check would be measuring four things and attributing failure to one.
+//
+// Exported under the `_internals` convention this codebase already uses
+// (see posture/poc-inprocess.js). Not part of the MCP tool surface.
+const tools_internals = { _confine, isReservedWrite: _isReservedWritePath };
+
 const scan_diff = {
   name: 'scan_diff',
   description: 'Scan a list of files for security findings. Use BEFORE writing a Write/Edit to disk so the agent can self-correct. Returns findings with severity, file:line, title, remediation. Snippets are redacted of obvious secret patterns. Paths confined to the session root; symlinks are refused.',

package/dist/526.index.js

@@ -10,7 +10,7 @@ export const modules = {
 /* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
 /* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary)
 /* harmony export */ });
-/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals */
+/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
 /* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
@@ -213,6 +213,82 @@ function renderFixDurationSummary(sum) {
 const _internals = { _dist, _pct, RELIABLE_N };
 
 
+// ── PRD F6.1 — score fixes on THREE AXES, not one ──────────────────────────
+//
+// The three axes the PRD names:
+//   (a) does the finding disappear      — the rescan leg
+//   (b) does the project's own suite pass — the tests leg
+//   (c) does an independent verifier agree — the PoC re-check leg
+//
+// All three were already computed by verifyFixCore and then collapsed into one
+// boolean, which is the problem: **(a) alone is satisfiable by deleting code.**
+// A patch that removes the vulnerable function passes the rescan, has nothing
+// left to fail, and — on a project with no detectable test suite — reaches
+// ok:true having proven only that the detector went quiet.
+//
+// Reporting the axes separately makes that visible. `aOnly` is the number that
+// matters most and the one nobody was publishing: attempts that satisfied ONLY
+// the disappearance axis. A high aOnly with a high headline is the shape of a
+// remediation feature that is deleting code and calling it a fix.
+function summarizeFixAxes(attempts) {
+  const list = Array.isArray(attempts) ? attempts.filter(Boolean) : [];
+  const d = list.length;
+
+  const rate = (pred) => ({ n: list.filter(pred).length, d });
+
+  // Each axis is judged INDEPENDENTLY of the overall verdict, so a leg that
+  // passed inside a failed attempt still counts for its own axis. Reading them
+  // off `ok` would make the three axes three copies of the same number.
+  const findingDisappeared = rate((a) => a.rescanOk === true || (a.ok === true && a.rescanOk !== false));
+  const testsStillPass = rate((a) => a.testsRan === true && a.testsOk !== false);
+  const verifierAgrees = rate((a) => a.pocOk === true);
+
+  const satisfiesAll = rate((a) =>
+    (a.rescanOk === true || (a.ok === true && a.rescanOk !== false))
+    && a.testsRan === true && a.testsOk !== false
+    && a.pocOk === true);
+
+  // The honesty number: disappearance WITHOUT either corroborating axis.
+  const aOnly = rate((a) => {
+    const disappeared = a.rescanOk === true || (a.ok === true && a.rescanOk !== false);
+    const corroborated = (a.testsRan === true && a.testsOk !== false) || a.pocOk === true;
+    return disappeared && !corroborated;
+  });
+
+  return {
+    total: d,
+    findingDisappeared,
+    testsStillPass,
+    verifierAgrees,
+    satisfiesAll,
+    aOnly,
+    meaning:
+      'findingDisappeared = the detector went quiet; testsStillPass = the project suite ran AND passed; '
+      + 'verifierAgrees = an independent PoC re-check confirmed the hole is shut. '
+      + 'aOnly counts attempts that satisfied ONLY disappearance — the shape a code-deleting "fix" produces.',
+    caveat: d === 0
+      ? 'no attempts recorded; every rate is 0/0 and means nothing'
+      : 'rates carry {n,d}; a small d is indicative, not settled',
+  };
+}
+
+/** Markdown for a report. Denominators always attached. */
+function renderFixAxes(sum) {
+  if (!sum || !sum.total) return '_No fix attempts recorded._\n';
+  const row = (label, r, note) => `| ${label} | ${r.n}/${r.d} | ${note} |`;
+  return [
+    '| Axis | Rate | Meaning |',
+    '|---|---|---|',
+    row('(a) finding disappeared', sum.findingDisappeared, 'the detector went quiet'),
+    row('(b) project tests pass', sum.testsStillPass, 'the suite RAN and passed'),
+    row('(c) verifier agrees', sum.verifierAgrees, 'an independent PoC re-check confirmed it'),
+    row('all three', sum.satisfiesAll, 'the only row that means "fixed"'),
+    row('(a) ALONE', sum.aOnly, 'satisfiable by deleting code — watch this number'),
+    '',
+  ].join('\n');
+}
+
+
 /***/ }),
 
 /***/ 3526:
@@ -234,8 +310,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 203 modules
-var engine = __webpack_require__(6622);
+// EXTERNAL MODULE: ./src/engine.js + 200 modules
+var engine = __webpack_require__(3474);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //

package/dist/637.index.js

@@ -11,7 +11,7 @@ export const modules = {
 /* harmony export */   renderPrDeltaText: () => (/* binding */ renderPrDeltaText)
 /* harmony export */ });
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6622);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3474);
 // Shadowscan / security-DELTA on PR (v0.72).
 //
 // Most SAST PR-comment integrations show absolute counts — "12 findings