@clear-capabilities/agentic-security-scanner 0.143.0 → 0.144.0

package/dist/265.index.js

@@ -0,0 +1,191 @@
+export const id = 265;
+export const ids = [265];
+export const modules = {
+
+/***/ 4265:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   createCascadePool: () => (/* binding */ createCascadePool)
+/* harmony export */ });
+/* unused harmony export DEFAULT_GRACE_MS */
+/* harmony import */ var node_worker_threads__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5919);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var node_url__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(3136);
+// FR-202 phase 3b (D-0050): a pool of long-lived workers, each running engine.js's
+// _runFileCascade for many files over its lifetime, instead of the one-shot-per-call
+// model runWithDeadline/analyzer-supervisor.js uses (which is correct for FR-202's
+// primitive-level proof but would force whole-project setup — _buildProjectIndex,
+// _buildGlobalJavaTaintedMethodIndex, _loadCustomRules — to redo per FILE, an O(n^2)
+// cost across a scan). Each worker performs that setup ONCE at creation via
+// _initCascadeWorkerState, then answers task messages over its lifetime.
+//
+// A task that exceeds its deadline+grace gets its OWN worker terminated (genuinely
+// preemptive, mirroring analyzer-supervisor.js's worker.terminate() precedent) and a
+// fresh replacement worker is spawned to keep the pool at full size for later files —
+// one hung file costs one worker restart, not the whole scan.
+
+
+
+
+// `new Worker()` needs a REAL file on disk -- once ncc bundles this module's code
+// into a dist/ chunk, `import.meta.url` resolves to that chunk's location (dist/),
+// not to src/pipeline/, so a naive path.join(HERE, 'cascade-worker.js') would look
+// for a file that was never copied there. src/ always ships as a sibling of dist/
+// (see package.json's "files"), in both a dev checkout and the published npm
+// package, so fall back to the real, unbundled worker script in that case.
+function _resolveDefaultWorkerScript() {
+  const hereDir = node_path__WEBPACK_IMPORTED_MODULE_1__.dirname((0,node_url__WEBPACK_IMPORTED_MODULE_2__.fileURLToPath)(import.meta.url));
+  if (node_path__WEBPACK_IMPORTED_MODULE_1__.basename(hereDir) === 'pipeline') return node_path__WEBPACK_IMPORTED_MODULE_1__.join(hereDir, 'cascade-worker.js');
+  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(hereDir, '..', 'src', 'pipeline', 'cascade-worker.js');
+}
+const DEFAULT_WORKER_SCRIPT = _resolveDefaultWorkerScript();
+const DEFAULT_GRACE_MS = 500;
+
+function spawnReadyWorker({ workerScript, modulePath, fileContents, scanRoot }) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const worker = new node_worker_threads__WEBPACK_IMPORTED_MODULE_0__.Worker(workerScript, { workerData: { modulePath, fileContents, scanRoot } });
+    const finish = (fn, value) => {
+      if (settled) return;
+      settled = true;
+      worker.off('message', onMessage);
+      worker.off('error', onError);
+      fn(value);
+    };
+    const onMessage = (msg) => {
+      if (!msg) return;
+      if (msg.type === 'ready') finish(resolve, worker);
+      else if (msg.type === 'init-error') { worker.terminate().catch(() => {}); finish(reject, new Error(msg.error)); }
+    };
+    const onError = (err) => { worker.terminate().catch(() => {}); finish(reject, err); };
+    worker.on('message', onMessage);
+    worker.on('error', onError);
+  });
+}
+
+/**
+ * @param {object} opts
+ * @param {Record<string,string>} opts.fileContents - broadcast once to every worker at creation.
+ * @param {string|null} opts.scanRoot
+ * @param {number} [opts.poolSize=4]
+ * @param {string} opts.modulePath - absolute path to the engine.js each worker imports.
+ * @param {string} [opts.workerScript] - defaults to cascade-worker.js next to this file.
+ * @param {number} [opts.graceMs]
+ */
+function createCascadePool(opts = {}) {
+  const {
+    fileContents = {},
+    scanRoot = null,
+    poolSize = 4,
+    workerScript = DEFAULT_WORKER_SCRIPT,
+    modulePath,
+    graceMs = DEFAULT_GRACE_MS,
+  } = opts;
+  if (!modulePath) throw new Error('createCascadePool requires opts.modulePath');
+  if (!(Number.isInteger(poolSize) && poolSize > 0)) throw new Error('createCascadePool requires opts.poolSize to be a positive integer');
+
+  const idle = [];
+  const pendingIdle = [];
+  const allWorkers = new Set();
+  let nextTaskId = 1;
+  let closed = false;
+  let spawnFailureCount = 0;
+  let lastSpawnError = null;
+
+  function spawnAndRegister() {
+    return spawnReadyWorker({ workerScript, modulePath, fileContents, scanRoot }).then((w) => {
+      allWorkers.add(w);
+      return w;
+    });
+  }
+
+  // Background respawn after a killed worker (see runFile's timeout branch)
+  // is deliberately fire-and-forget -- the timed-out task has already
+  // resolved and nothing is waiting on this promise -- but a swallowed
+  // failure here would otherwise shrink the pool invisibly (e.g. thread
+  // exhaustion making every future respawn fail silently forever). Track
+  // it instead of a bare `.catch(() => {})`.
+  function respawnInBackground() {
+    spawnAndRegister().then(releaseWorker).catch((err) => {
+      spawnFailureCount += 1;
+      lastSpawnError = err;
+    });
+  }
+
+  function releaseWorker(w) {
+    if (closed) { allWorkers.delete(w); w.terminate().catch(() => {}); return; }
+    if (pendingIdle.length) pendingIdle.shift()(w);
+    else idle.push(w);
+  }
+
+  function acquireWorker() {
+    if (idle.length) return Promise.resolve(idle.pop());
+    return new Promise((resolve) => pendingIdle.push(resolve));
+  }
+
+  const ready = Promise.all(
+    Array.from({ length: poolSize }, () => spawnAndRegister().then(releaseWorker))
+  );
+
+  /**
+   * Run one file's cascade on a pooled worker. Resolves with
+   * {ok:true, result} | {ok:false, error} | {ok:false, timedOut:true, timeoutMs, graceMs}.
+   * Never rejects.
+   */
+  async function runFile(p, c, taskScanRoot, detectorErrors, taskOpts = {}) {
+    await ready;
+    if (closed) return { ok: false, error: 'pool is closed' };
+    const timeoutMs = taskOpts.timeoutMs;
+    const worker = await acquireWorker();
+    const id = nextTaskId++;
+    return new Promise((resolve) => {
+      let settled = false;
+      let killTimer = null;
+      const onMessage = (msg) => {
+        if (settled || !msg || msg.id !== id) return;
+        settled = true;
+        if (killTimer) clearTimeout(killTimer);
+        worker.off('message', onMessage);
+        releaseWorker(worker);
+        resolve(msg.ok ? { ok: true, result: msg.result } : { ok: false, error: msg.error });
+      };
+      worker.on('message', onMessage);
+      if (Number.isFinite(timeoutMs) && timeoutMs > 0) {
+        killTimer = setTimeout(() => {
+          if (settled) return;
+          settled = true;
+          worker.off('message', onMessage);
+          allWorkers.delete(worker);
+          worker.terminate().catch(() => {});
+          if (!closed) respawnInBackground();
+          resolve({ ok: false, timedOut: true, timeoutMs, graceMs });
+        }, timeoutMs + graceMs);
+        killTimer.unref?.();
+      }
+      worker.postMessage({ type: 'task', id, p, c, scanRoot: taskScanRoot, detectorErrors });
+    });
+  }
+
+  async function shutdown() {
+    closed = true;
+    await ready.catch(() => {});
+    for (const w of allWorkers) await w.terminate().catch(() => {});
+    allWorkers.clear();
+    idle.length = 0;
+  }
+
+  return {
+    runFile,
+    shutdown,
+    ready,
+    DEFAULT_GRACE_MS: graceMs,
+    getSpawnFailureCount: () => spawnFailureCount,
+    getLastSpawnError: () => lastSpawnError,
+  };
+}
+
+
+/***/ })
+
+};

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3474);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7087);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.
 
 

package/dist/435.index.js

@@ -23,6 +23,12 @@ var external_node_url_ = __webpack_require__(3136);
 var promises_ = __webpack_require__(1455);
 // EXTERNAL MODULE: ./src/posture/fix-history.js
 var fix_history = __webpack_require__(4407);
+// EXTERNAL MODULE: ./src/fix/apply-fix-service.js
+var apply_fix_service = __webpack_require__(7730);
+// EXTERNAL MODULE: ./src/posture/material-change.js
+var material_change = __webpack_require__(4629);
+// EXTERNAL MODULE: ./src/fix/approver-registry.js
+var approver_registry = __webpack_require__(437);
 ;// CONCATENATED MODULE: ./src/posture/deterministic-fix.js
 // Deterministic fix synthesis (#1) — for the narrow set of vulnerability classes
 // where a context-INDEPENDENT literal swap is a safe, correct fix, produce a
@@ -92,6 +98,8 @@ function synthesizeDeterministicPatch(finding, fileContent) {
 
 // EXTERNAL MODULE: ./src/posture/integrity.js
 var integrity = __webpack_require__(1130);
+// EXTERNAL MODULE: ./src/posture/state-dir.js
+var state_dir = __webpack_require__(1174);
 // EXTERNAL MODULE: ./src/posture/cache-economics.js
 var cache_economics = __webpack_require__(8752);
 ;// CONCATENATED MODULE: ./src/mcp/redact.js
@@ -197,10 +205,8 @@ function redactArgsBlob(s) {
   return redactString(s);
 }
 
-// EXTERNAL MODULE: ./src/report/index.js + 2 modules
-var report = __webpack_require__(3550);
-// EXTERNAL MODULE: ./src/posture/state-dir.js
-var state_dir = __webpack_require__(1174);
+// EXTERNAL MODULE: ./src/report/index.js + 3 modules
+var report = __webpack_require__(457);
 ;// CONCATENATED MODULE: ./src/posture/agents-memory.js
 // AGENTS.md — writable continual-learning memory (harness-anatomy #2).
 //
@@ -499,6 +505,10 @@ const cve_lookup_internals = { CACHE_DIR, CVE_RE, _stalenessTier };
 
 
 
+
+
+
+
 // Lazy-loaded: these transitively pull in npm packages (@babel/core and
 // friends) that aren't available in the plugin-cache install path
 // (no node_modules). Deferring keeps the MCP server bootable everywhere;
@@ -863,26 +873,44 @@ const scan_diff = {
     // / MAX_TOTAL_SCAN_BYTES, so this does not turn scan_diff into a
     // full-project deep scan).
     const runScan = await getRunScan();
-    const result = await runScan(sessionRoot, { network: false, fileContents, deep: true, deepInCi: true });
+    // FR-704 (assurance-hardening PRD): this tool's own description promises
+    // "runs scan in memory" — without this, runFullScan's own state writers
+    // (dpia.md, ropa.md, privacy-framework.json, threat-model.json, and
+    // others) fire unconditionally on every call, silently mutating the
+    // user's real project on every pre-write self-correction scan. Confirmed
+    // by direct execution before this fix (11 state artifacts written by a
+    // single scan_diff-shaped call).
+    const result = await (0,state_dir/* withStateWritesDisabled */.Ao)(() =>
+      runScan(sessionRoot, { network: false, fileContents, deep: true, deepInCi: true }));
     const wantSet = new Set(Object.keys(fileContents));
     const sevRank = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
     const min = sevRank[severity] ?? 0;
-    // Stage 6 correctness audit: this only ever read result.scan.findings
-    // (the SAST channel) — scan.secrets and scan.logicVulns are separate
-    // arrays on the raw runScan() result (report/index.js's normalizeFindings
-    // is what merges all four channels, and that merge hasn't run yet here).
-    // A file containing a bare hardcoded credential reported findingCount: 0
-    // through a tool whose own description promises "Use BEFORE writing a
-    // Write/Edit to disk so the agent can self-correct". Also reused
-    // _remediationOf so a fix-string detector (the majority of engine.js's
-    // own, ~127 call sites) doesn't silently report an empty `description`
-    // the way reading only `.remediation` did.
-    const findings = [...(result.scan.findings || []), ...(result.scan.secrets || []), ...(result.scan.logicVulns || [])]
+    // Stage 6 correctness audit (historical): this used to only read
+    // result.scan.findings (the SAST channel) — scan.secrets and
+    // scan.logicVulns are separate arrays on the raw runScan() result, and a
+    // hand-rolled 3-channel concat here was a second, divergent copy of the
+    // merge report/index.js's normalizeFindings() already does (four
+    // channels, plus per-channel defaulting and remediation-string
+    // resolution the old concat re-implemented separately and could drift
+    // from). Assurance-hardening PRD FR-105 ("JSON, SARIF, HTML, CSV, JUnit,
+    // and MCP outputs derive from the same validated object"): route through
+    // the same canonical merge every other output format uses.
+    //
+    // This closes the field-mapping/dedup divergence, but does NOT make
+    // scan_diff surface SCA/supply-chain findings end to end: this handler
+    // never builds a `depFileContents` map (everything a caller passes in
+    // `files`, manifests included, lands in `fileContents`), and manifest-
+    // based supply-chain detection in engine.js reads only `depFileContents`
+    // — so `result.scan.supplyChain` is always empty for this tool today
+    // regardless of this fix. That is a separate, real limitation (scan_diff
+    // was designed for pre-write code self-correction, not manifest
+    // scanning), left as-is rather than silently claimed fixed here.
+    const findings = (0,report.normalizeFindings)(result.scan)
       .filter(f => wantSet.has(String(f.file || '').replace(/\\/g, '/')) && (sevRank[f.severity] ?? 0) >= min)
       .map(f => redactFinding({
         id: f.id, severity: f.severity, file: f.file, line: f.line,
-        title: f.title || f.vuln, cwe: f.cwe,
-        description: f.description, remediation: (0,report/* _remediationOf */.uV)(f),
+        title: f.vuln, cwe: f.cwe,
+        description: f.description, remediation: f.remediation,
       }));
     // Harness-anatomy #1: offload when the result exceeds OFFLOAD_THRESHOLD.
     // The agent gets a head+tail preview plus a path it can page through;
@@ -1032,7 +1060,7 @@ const explain_finding = {
 // ─── apply_fix ───────────────────────────────────────────────────────────────
 const apply_fix = {
   name: 'apply_fix',
-  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing.',
+  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing. On success, `verified:true` means verification passed but `verifiedFull:true` is the honest signal that every required leg (lint when configured, tests when a runner exists) genuinely ran — a false `verifiedFull` with `verified:true` means the pass is real but degraded (see `verify.degradedLegs`), not a full verification.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -1073,6 +1101,27 @@ const apply_fix = {
               partialSanitization: { type: 'boolean' },
             },
           },
+          // FR-307/FR-1002: this schema had `additionalProperties: false`
+          // and never declared `approval` — the property apply-fix-
+          // service.js's high-impact-change gate has required since FR-307
+          // was built. A real MCP caller supplying fixMeta.approval was
+          // rejected by validate.js at the schema layer before the handler
+          // ever ran, silently making the approval gate (and FR-1002's
+          // identity check layered on it) unreachable from this tool's
+          // only real production entry point. See D-0024.
+          approval: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+              approvedBy: { type: 'string', minLength: 1, maxLength: 200 },
+              reason: { type: 'string', minLength: 1, maxLength: 1000 },
+            },
+          },
+          // FR-1003: separation-of-duties. Self-reported the same way
+          // approvedBy is — this tool has no way to determine who actually
+          // wrote a patch, so `author` is a claim, checked against a
+          // configurable policy the same way `approval` is.
+          author: { type: 'string', minLength: 1, maxLength: 200 },
         },
       },
     },
@@ -1147,20 +1196,78 @@ const apply_fix = {
           verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok }, honesty: verdict.honesty || null },
         };
       }
+      // FR-307/FR-1002/D-0024: this caller-supplied-patch branch writes via
+      // applyFixHistory() directly and never called applyVerifiedFix() — so
+      // the high-impact-change approval gate (auth/authZ/crypto/PII/schema/
+      // infra-privilege/public-API) built for the OTHER apply_fix branch
+      // (stored fix.replacement) never ran here at all, for any input. Since
+      // this is the branch the tool's own description calls the one that
+      // covers "~100% of findings that ship only a template," that gap was
+      // the larger of the two found this cycle. Same before/after content
+      // shape `apply-fix-service.js` already uses — read-first-in-try/catch
+      // (D-0012), never existsSync-then-readFileSync.
+      const filesForMaterialClassification = {};
+      for (const [rel, v] of Object.entries(confinedAbs)) {
+        let before = '';
+        try { before = await promises_.readFile(v.abs, 'utf8'); } catch { /* new file — before stays '' */ }
+        filesForMaterialClassification[rel] = { before, after: v.content };
+      }
+      const materialClassification = (0,material_change/* classifyFixMaterialRisk */.kz)(filesForMaterialClassification);
       if (dry_run) {
-        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary };
+        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, materialClassification };
+      }
+      if (materialClassification.highImpactCategories.length) {
+        const approval = fixMeta && typeof fixMeta === 'object' ? fixMeta.approval : null;
+        const hasApprovalEvidence = !!(approval && typeof approval === 'object' &&
+          typeof approval.approvedBy === 'string' && approval.approvedBy.trim().length > 0 &&
+          typeof approval.reason === 'string' && approval.reason.trim().length > 0);
+        if (!hasApprovalEvidence) {
+          return {
+            _meta: META, applied: false,
+            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) requires approval evidence — pass fixMeta.approval: {approvedBy, reason} — before it can be applied`,
+            materialClassification,
+          };
+        }
+        const approverRegistry = (0,approver_registry/* loadApproverRegistry */.P4)(ctx.sessionRoot);
+        const requiredRoles = (0,approver_registry/* requiredRolesFor */.Kq)(approverRegistry, materialClassification.highImpactCategories);
+        const identityCheck = (0,approver_registry/* verifyApprover */.$N)(approverRegistry, approval.approvedBy, requiredRoles);
+        if (!identityCheck.verified) {
+          return {
+            _meta: META, applied: false,
+            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${identityCheck.reason}`,
+            materialClassification,
+          };
+        }
+        // FR-1003: separation-of-duties, same no-op-unless-configured gate
+        // as apply-fix-service.js's own copy — see approver-registry.js.
+        const sodCheck = (0,approver_registry/* checkSeparationOfDuties */.I0)(approverRegistry, fixMeta?.author, approval.approvedBy);
+        if (!sodCheck.ok) {
+          return {
+            _meta: META, applied: false,
+            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${sodCheck.reason}`,
+            materialClassification,
+          };
+        }
       }
       const written = [];
       try {
         for (const [rel, v] of Object.entries(confinedAbs)) {
-          const originalContent = external_node_fs_.existsSync(v.abs) ? await promises_.readFile(v.abs, 'utf8') : '';
+          const fileExisted = external_node_fs_.existsSync(v.abs);
+          const originalContent = fileExisted ? await promises_.readFile(v.abs, 'utf8') : '';
           const entry = await (0,fix_history/* applyFix */.oM)({
-            scanRoot: ctx.sessionRoot, file: rel, originalContent, newContent: v.content,
+            scanRoot: ctx.sessionRoot, file: rel, originalContent, newContent: v.content, fileExisted,
             findingId: f.id, stableId: f.stableId, ruleId: f.ruleId || f.cwe || f.family || null, vuln: f.vuln || f.title || null,
           });
           written.push({ file: rel, historyId: entry.id, backupPath: entry.backupPath });
         }
       } catch (e) {
+        // FR-306: roll back every file THIS batch already wrote before the
+        // failure — applyFixHistory already restored the one file that just
+        // failed; this covers the rest, so a multi-file patch never leaves
+        // some files patched and others not.
+        for (const w of written) {
+          try { await (0,fix_history/* revertEntryById */.rJ)(ctx.sessionRoot, w.historyId); } catch { /* best-effort; original error still propagates below */ }
+        }
         if (e && e.name === 'FixAttemptBudgetExceededError') {
           return { _meta: META, applied: false, reason: `budget-exceeded: ${e.message}`, budgetExceeded: true, attempts: e.attempts, maxAttempts: e.max, key: e.key };
         }
@@ -1168,7 +1275,7 @@ const apply_fix = {
       }
       let acceptance = null;
       try { acceptance = (0,fix_history/* fixAcceptanceRate */.XR)(ctx.sessionRoot); } catch { /* best-effort */ }
-      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance };
+      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance, materialClassification };
     }
 
     if (typeof f.fix?.replacement !== 'string') {
@@ -1205,41 +1312,47 @@ const apply_fix = {
       };
     }
 
-    let entry;
-    try {
-      entry = await (0,fix_history/* applyFix */.oM)({
-        scanRoot: ctx.sessionRoot,
-        file: f.file,
-        originalContent,
-        newContent: f.fix.replacement,
-        findingId: f.id,
-        stableId: f.stableId || null,   // premortem 4R-8
-        ruleId: f.ruleId || f.cwe || f.family || null,
-        vuln: f.vuln || f.title || null,
-      });
-    } catch (e) {
-      // Harness-engineering: step-budget refusal (post-derived). The
-      // deterministic layer enforces at-most-N attempts per stableId. When
-      // exceeded, surface it as a structured `budget-exceeded` outcome the
-      // agent can recognize — not a generic error.
-      if (e && e.name === 'FixAttemptBudgetExceededError') {
-        return {
-          _meta: META,
-          applied: false,
-          reason: `budget-exceeded: ${e.message}`,
-          budgetExceeded: true,
-          attempts: e.attempts,
-          maxAttempts: e.max,
-          key: e.key,
-        };
+    // FR-301/A-08 (assurance-hardening PRD): this branch used to write
+    // f.fix.replacement straight to disk with NO fresh verification — no
+    // rescan, no lint, nothing confirming the stored replacement actually
+    // closes the finding it claims to fix. The caller-patch branch above
+    // already required this; there is no reason a STORED fix should be
+    // trusted more than a caller-supplied one just because it shipped with
+    // the finding. Routed through the same applyVerifiedFix() service the
+    // CLI's `fix --apply` now also uses (src/fix/apply-fix-service.js) —
+    // confinement/reserved-path are re-checked there too (harmless
+    // redundancy with the dry_run preview above, kept for that preview's
+    // size-diff shape) but the load-bearing addition is the verification
+    // gate before the write.
+    if (!f.stableId) {
+      return { _meta: META, applied: false, reason: 'finding has no stableId — cannot verify a stored fix against it' };
+    }
+    const result = await (0,apply_fix_service/* applyVerifiedFix */.On)({
+      scanRoot: ctx.sessionRoot,
+      finding: f,
+      files: { [f.file]: f.fix.replacement },
+      fixMeta,
+    });
+    if (!result.ok) {
+      if (result.budgetExceeded) {
+        return { _meta: META, applied: false, reason: result.reason, budgetExceeded: true, attempts: result.attempts, maxAttempts: result.maxAttempts, key: result.key };
       }
-      throw e;
+      return { _meta: META, applied: false, reason: result.reason, verify: result.verify || null };
     }
     // R25 (PRD §5): surface the running auto-fix acceptance rate after each
     // applied fix, so the closed loop reports its own success metric.
     let acceptance = null;
     try { acceptance = (0,fix_history/* fixAcceptanceRate */.XR)(ctx.sessionRoot); } catch { /* metric is best-effort */ }
-    return { _meta: META, applied: true, historyId: entry.id, file: f.file, backupPath: entry.backupPath, integrity: status, attemptOrdinal: entry.attemptOrdinal, acceptance };
+    const entry = result.written[0];
+    return {
+      // FR-305: verifiedFull distinguishes "every required leg (lint, tests)
+      // genuinely ran and passed" from "passed, but a required leg was
+      // skipped or unavailable" — verified:true alone conflates them.
+      _meta: META, applied: true, verified: true, verifiedFull: result.verifiedFull,
+      historyId: entry.historyId, file: entry.file, backupPath: entry.backupPath,
+      integrity: status, attemptOrdinal: entry.attemptOrdinal, acceptance,
+      verify: result.verify,
+    };
   },
 };