@clear-capabilities/agentic-security-scanner 0.150.1 → 0.151.0

package/dist/4113.index.js

@@ -1,8 +1,235 @@
 export const id = 4113;
-export const ids = [4113,2238,3526];
+export const ids = [4113,2238,7838];
 export const modules = {
 
-/***/ 2238:
+/***/ 27785:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   _u: () => (/* binding */ gateFixOutput)
+/* harmony export */ });
+/* unused harmony exports checkResidualHonesty, requireCitedEvidence, computeFixTier, checkMechanicalTierEvidence, _internals */
+// Deterministic honesty gates on fix / finding output (#7).
+//
+// The project's verification discipline (scanner/CLAUDE.md) exists because
+// several releases shipped broken or false because work was reported as done
+// without confirming the artifact changed. Two of those failure modes are
+// *textual* — they live in the prose an agent emits alongside a fix — and can
+// be caught deterministically, with no LLM and no network:
+//
+//   1. Hand-wave residual-risk prose. "The input is adequately handled",
+//      "future work", "tbd", "later" — vague assurances that claim safety
+//      without naming a concrete remaining vector. A residual you can't name
+//      is a residual you're guessing about; reject the guess.
+//
+//   2. An unbacked "this is a false positive / provably safe" verdict. Marking
+//      a finding safe is a coverage *reduction* — it must cite a `file:line`
+//      that shows why, exactly like the rules-override gate refuses to silently
+//      shrink coverage.
+//
+// Plus a conservative fix-tier classifier so a partial remediation can never be
+// labelled FULL: any workaround-only signal (rate-limit, docs, log-without-
+// reject) is WORKAROUND; anything short of (sink signature changed + all callers
+// routed + a discriminating test) is at most MITIGATION; only the full set with
+// no partial-sanitization caveat earns FULL.
+//
+// Pure functions, no side effects, no throwing — safe to call from a command,
+// a hook, or the MCP verify_fix path.
+
+// Vague-assurance phrases that a real residual must never hide behind. Matched
+// case-insensitively with word boundaries so "later" doesn't trip on
+// "collateral" and "tbd" doesn't trip on a longer token.
+const BANNED_RESIDUAL_PHRASES = Object.freeze([
+  'adequately handled',
+  'adequately handles',
+  'properly validated',
+  'properly handled',
+  'handled properly',
+  'handled safely',
+  'future work',
+  'more work needed',
+  'to be done',
+  'tbd',
+  'later',
+]);
+
+// A citation shaped like `file:line` — one or more non-space, non-colon chars,
+// a colon, then digits. Unanchored: it need only appear somewhere in the item.
+const CITATION_RE = /[^\s:]+:\d+/;
+
+// Verdicts that assert the finding is not real and therefore demand a citation.
+// Compared after normalizing separators (`_`/space → `-`) and lowercasing, so
+// FALSE_POSITIVE, false-positive, and "provably safe" all land here.
+const FP_VERDICTS = Object.freeze(new Set(['false-positive', 'provably-safe', 'safe']));
+
+function _escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/**
+ * Reject vague-assurance / hand-wave residual-risk prose.
+ *
+ * An empty or whitespace-only residual is ok — there is no residual to lie
+ * about. A non-empty residual is rejected when it contains any banned phrase;
+ * each match yields one violation naming the offending phrase.
+ *
+ * @param {string} residualText
+ * @returns {{ ok: boolean, violations: string[] }}
+ */
+function checkResidualHonesty(residualText) {
+  const text = typeof residualText === 'string' ? residualText : '';
+  if (text.trim() === '') return { ok: true, violations: [] };
+
+  const violations = [];
+  for (const phrase of BANNED_RESIDUAL_PHRASES) {
+    const re = new RegExp(`\\b${_escapeRe(phrase)}\\b`, 'i');
+    if (re.test(text)) {
+      violations.push(`vague-assurance phrase: "${phrase}"`);
+    }
+  }
+  return { ok: violations.length === 0, violations };
+}
+
+function _isCitation(item) {
+  if (typeof item === 'string') return CITATION_RE.test(item);
+  if (item && typeof item === 'object' && typeof item.location === 'string') {
+    return CITATION_RE.test(item.location);
+  }
+  return false;
+}
+
+function _normalizeVerdict(verdict) {
+  return String(verdict).trim().toLowerCase().replace(/[_\s]+/g, '-');
+}
+
+/**
+ * Require a file:line citation behind a "this is not real" verdict.
+ *
+ * For a false-positive / provably-safe / safe verdict (case-insensitive; also
+ * accepts FALSE_POSITIVE), at least one evidence item must be a `file:line`
+ * citation — either a string matching /[^\s:]+:\d+/ or an object
+ * `{ location: "file:line" }`. Any other verdict passes unconditionally.
+ *
+ * @param {string} verdict
+ * @param {Array|string|object} evidence
+ * @returns {{ ok: boolean, violations: string[] }}
+ */
+function requireCitedEvidence(verdict, evidence) {
+  if (typeof verdict !== 'string' || !FP_VERDICTS.has(_normalizeVerdict(verdict))) {
+    return { ok: true, violations: [] };
+  }
+  const items = Array.isArray(evidence)
+    ? evidence
+    : evidence == null
+      ? []
+      : [evidence];
+  if (items.some(_isCitation)) return { ok: true, violations: [] };
+  return {
+    ok: false,
+    violations: ['false-positive/safe verdict requires a file:line citation'],
+  };
+}
+
+/**
+ * Classify a fix into FULL | MITIGATION | WORKAROUND, conservative-first.
+ *
+ * @param {object} signals
+ * @param {boolean} signals.sinkSignatureChanged
+ * @param {boolean} signals.allCallersRouted
+ * @param {boolean} signals.testDiscriminates - a test that fails pre-fix, passes post-fix
+ * @param {boolean} [signals.rateLimitOnly]
+ * @param {boolean} [signals.docsOnly]
+ * @param {boolean} [signals.logOnlyNoReject]
+ * @param {boolean} [signals.partialSanitization]
+ * @returns {'FULL'|'MITIGATION'|'WORKAROUND'}
+ */
+function computeFixTier(signals) {
+  const s = signals && typeof signals === 'object' ? signals : {};
+  if (s.rateLimitOnly || s.docsOnly || s.logOnlyNoReject) return 'WORKAROUND';
+  const complete = s.sinkSignatureChanged && s.allCallersRouted && s.testDiscriminates;
+  if (s.partialSanitization || !complete) return 'MITIGATION';
+  return 'FULL';
+}
+
+/**
+ * FR-308: cross-check a fix-completeness TIER against MECHANICAL evidence,
+ * when any is available. `signals` (computeFixTier's input) is agent-
+ * self-reported — this module cannot compute sinkSignatureChanged /
+ * allCallersRouted / testDiscriminates itself (see the header above: "the
+ * gate can only run against claims the AGENT self-reports... nothing here
+ * is server-computable"). `pocLeg` is different: fix-verify.js's PoC leg is
+ * a REAL execution result (posture/CLAUDE.md's execution-proof tiers), not
+ * a claim. When it is available and shows the proof-of-concept STILL
+ * demonstrates the vulnerability against the patch, a self-reported FULL
+ * tier is not merely internally inconsistent — it is REFUTED by fact. This
+ * is the literal "a mitigation or workaround cannot be represented as a
+ * full fix" acceptance criterion, now backed by mechanical evidence where
+ * it exists rather than by self-report consistency alone.
+ *
+ * A `pocLeg` of `not-requested` or `inconclusive` carries no mechanical
+ * signal either way and is a no-op here — this check can only ever ADD a
+ * violation on real contrary evidence, never manufacture one from absence.
+ *
+ * @param {string} tier
+ * @param {{status: string, reason?: string}|null} pocLeg
+ * @returns {{ ok: boolean, violations: string[] }}
+ */
+function checkMechanicalTierEvidence(tier, pocLeg) {
+  if (!pocLeg || typeof pocLeg !== 'object') return { ok: true, violations: [] };
+  if (tier === 'FULL' && pocLeg.status === 'still-exploitable') {
+    return {
+      ok: false,
+      violations: [`tier 'FULL' is refuted by mechanical evidence: the proof-of-concept still demonstrates the vulnerability against the patch${pocLeg.reason ? ` (${pocLeg.reason})` : ''}`],
+    };
+  }
+  return { ok: true, violations: [] };
+}
+
+/**
+ * Compose the four gates for a single fix's output.
+ *
+ * ok = residual-honesty ok AND evidence-citation ok AND mechanical-tier-
+ * evidence ok, further constrained by the tier/residual consistency
+ * invariant:
+ *   - a FULL tier must NOT carry a residual (a full fix has nothing left);
+ *   - a non-FULL tier MUST document a residual (say what's still open).
+ *
+ * @param {{ residual?: string, verdict?: string, evidence?: any, signals?: object }} input
+ * @param {{ pocLeg?: object|null }} [mechanical] - FR-308: optional real
+ *   execution evidence (fix-verify.js's pocLeg) to cross-check the
+ *   self-reported tier against. Omitted entirely by any caller that has no
+ *   PoC leg to offer — this parameter never REQUIRES mechanical evidence,
+ *   it only USES it when present.
+ * @returns {{ ok: boolean, tier: string, violations: string[] }}
+ */
+function gateFixOutput({ residual, verdict, evidence, signals } = {}, { pocLeg = null } = {}) {
+  const tier = computeFixTier(signals);
+  const residualCheck = checkResidualHonesty(residual);
+  const evidenceCheck = requireCitedEvidence(verdict, evidence);
+  const mechanicalCheck = checkMechanicalTierEvidence(tier, pocLeg);
+
+  const violations = [...residualCheck.violations, ...evidenceCheck.violations, ...mechanicalCheck.violations];
+  let ok = residualCheck.ok && evidenceCheck.ok && mechanicalCheck.ok;
+
+  const residualEmpty = typeof residual !== 'string' || residual.trim() === '';
+  if (tier === 'FULL' && !residualEmpty) {
+    violations.push('FULL tier cannot carry a residual');
+    ok = false;
+  }
+  if (tier !== 'FULL' && residualEmpty) {
+    violations.push('non-FULL tier must document a residual');
+    ok = false;
+  }
+
+  return { ok, tier, violations };
+}
+
+const _internals = Object.freeze({ BANNED_RESIDUAL_PHRASES, CITATION_RE, FP_VERDICTS });
+
+
+/***/ }),
+
+/***/ 32238:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -12,9 +239,9 @@ export const modules = {
 /* harmony export */   sU: () => (/* binding */ loadFixAttempts)
 /* harmony export */ });
 /* unused harmony exports FIX_STAGES, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31174);
 // Time-to-validated-fix (R5, the reporting half).
 //
 // `verifyFix` already RUNS the stages and `test-runner.js` already times the
@@ -292,17 +519,20 @@ function renderFixAxes(sum) {
 
 /***/ }),
 
-/***/ 4113:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+/***/ 64113:
+/***/ ((__webpack_module__, __webpack_exports__, __webpack_require__) => {
 
+__webpack_require__.a(__webpack_module__, async (__webpack_handle_async_dependencies__, __webpack_async_result__) => { try {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   verifyFixWithTests: () => (/* binding */ verifyFixWithTests)
 /* harmony export */ });
 /* unused harmony export runProjectTests */
-/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _fix_verify_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(3526);
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(31421);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
+/* harmony import */ var _fix_verify_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(27838);
+var __webpack_async_dependencies__ = __webpack_handle_async_dependencies__([_fix_verify_js__WEBPACK_IMPORTED_MODULE_3__]);
+_fix_verify_js__WEBPACK_IMPORTED_MODULE_3__ = (__webpack_async_dependencies__.then ? (await __webpack_async_dependencies__)() : __webpack_async_dependencies__)[0];
 // Closed-loop fix verification (v0.68).
 //
 // Existing `fix-verify.js` does scan + lint. This module adds the third
@@ -470,412 +700,42 @@ function _summarize(legs, verdict) {
   return `${verdict} (${bits.join(' · ')})`;
 }
 
+__webpack_async_result__();
+} catch(e) { __webpack_async_result__(e); } });
 
 /***/ }),
 
-/***/ 3526:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+/***/ 27838:
+/***/ ((__webpack_module__, __webpack_exports__, __webpack_require__) => {
 
-// ESM COMPAT FLAG
+__webpack_require__.a(__webpack_module__, async (__webpack_handle_async_dependencies__, __webpack_async_result__) => { try {
 __webpack_require__.r(__webpack_exports__);
-
-// EXPORTS
-__webpack_require__.d(__webpack_exports__, {
-  runProjectLinter: () => (/* binding */ runProjectLinter),
-  verifyFix: () => (/* binding */ verifyFix),
-  verifyPatch: () => (/* binding */ verifyPatch)
-});
-
-// EXTERNAL MODULE: external "node:child_process"
-var external_node_child_process_ = __webpack_require__(1421);
-// EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __webpack_require__(3024);
-// EXTERNAL MODULE: external "node:path"
-var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 244 modules
-var engine = __webpack_require__(9753);
-;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
-// Deterministic honesty gates on fix / finding output (#7).
-//
-// The project's verification discipline (scanner/CLAUDE.md) exists because
-// several releases shipped broken or false because work was reported as done
-// without confirming the artifact changed. Two of those failure modes are
-// *textual* — they live in the prose an agent emits alongside a fix — and can
-// be caught deterministically, with no LLM and no network:
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   runProjectLinter: () => (/* binding */ runProjectLinter),
+/* harmony export */   verifyFix: () => (/* binding */ verifyFix),
+/* harmony export */   verifyPatch: () => (/* binding */ verifyPatch)
+/* harmony export */ });
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(31421);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(67198);
+/* harmony import */ var _fix_honesty_gate_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(27785);
+/* harmony import */ var _test_runner_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(35136);
+/* harmony import */ var _fix_metrics_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(32238);
+var __webpack_async_dependencies__ = __webpack_handle_async_dependencies__([_engine_js__WEBPACK_IMPORTED_MODULE_3__]);
+_engine_js__WEBPACK_IMPORTED_MODULE_3__ = (__webpack_async_dependencies__.then ? (await __webpack_async_dependencies__)() : __webpack_async_dependencies__)[0];
+// Closed-loop /fix verification (Sentinel-parity FR-L4-4, FR-L4-5).
 //
-//   1. Hand-wave residual-risk prose. "The input is adequately handled",
-//      "future work", "tbd", "later" — vague assurances that claim safety
-//      without naming a concrete remaining vector. A residual you can't name
-//      is a residual you're guessing about; reject the guess.
+// Given a candidate patch (the new file content + the finding stableId being
+// fixed), verify it:
 //
-//   2. An unbacked "this is a false positive / provably safe" verdict. Marking
-//      a finding safe is a coverage *reduction* — it must cite a `file:line`
-//      that shows why, exactly like the rules-override gate refuses to silently
-//      shrink coverage.
-//
-// Plus a conservative fix-tier classifier so a partial remediation can never be
-// labelled FULL: any workaround-only signal (rate-limit, docs, log-without-
-// reject) is WORKAROUND; anything short of (sink signature changed + all callers
-// routed + a discriminating test) is at most MITIGATION; only the full set with
-// no partial-sanitization caveat earns FULL.
-//
-// Pure functions, no side effects, no throwing — safe to call from a command,
-// a hook, or the MCP verify_fix path.
-
-// Vague-assurance phrases that a real residual must never hide behind. Matched
-// case-insensitively with word boundaries so "later" doesn't trip on
-// "collateral" and "tbd" doesn't trip on a longer token.
-const BANNED_RESIDUAL_PHRASES = Object.freeze([
-  'adequately handled',
-  'adequately handles',
-  'properly validated',
-  'properly handled',
-  'handled properly',
-  'handled safely',
-  'future work',
-  'more work needed',
-  'to be done',
-  'tbd',
-  'later',
-]);
-
-// A citation shaped like `file:line` — one or more non-space, non-colon chars,
-// a colon, then digits. Unanchored: it need only appear somewhere in the item.
-const CITATION_RE = /[^\s:]+:\d+/;
-
-// Verdicts that assert the finding is not real and therefore demand a citation.
-// Compared after normalizing separators (`_`/space → `-`) and lowercasing, so
-// FALSE_POSITIVE, false-positive, and "provably safe" all land here.
-const FP_VERDICTS = Object.freeze(new Set(['false-positive', 'provably-safe', 'safe']));
-
-function _escapeRe(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-/**
- * Reject vague-assurance / hand-wave residual-risk prose.
- *
- * An empty or whitespace-only residual is ok — there is no residual to lie
- * about. A non-empty residual is rejected when it contains any banned phrase;
- * each match yields one violation naming the offending phrase.
- *
- * @param {string} residualText
- * @returns {{ ok: boolean, violations: string[] }}
- */
-function checkResidualHonesty(residualText) {
-  const text = typeof residualText === 'string' ? residualText : '';
-  if (text.trim() === '') return { ok: true, violations: [] };
-
-  const violations = [];
-  for (const phrase of BANNED_RESIDUAL_PHRASES) {
-    const re = new RegExp(`\\b${_escapeRe(phrase)}\\b`, 'i');
-    if (re.test(text)) {
-      violations.push(`vague-assurance phrase: "${phrase}"`);
-    }
-  }
-  return { ok: violations.length === 0, violations };
-}
-
-function _isCitation(item) {
-  if (typeof item === 'string') return CITATION_RE.test(item);
-  if (item && typeof item === 'object' && typeof item.location === 'string') {
-    return CITATION_RE.test(item.location);
-  }
-  return false;
-}
-
-function _normalizeVerdict(verdict) {
-  return String(verdict).trim().toLowerCase().replace(/[_\s]+/g, '-');
-}
-
-/**
- * Require a file:line citation behind a "this is not real" verdict.
- *
- * For a false-positive / provably-safe / safe verdict (case-insensitive; also
- * accepts FALSE_POSITIVE), at least one evidence item must be a `file:line`
- * citation — either a string matching /[^\s:]+:\d+/ or an object
- * `{ location: "file:line" }`. Any other verdict passes unconditionally.
- *
- * @param {string} verdict
- * @param {Array|string|object} evidence
- * @returns {{ ok: boolean, violations: string[] }}
- */
-function requireCitedEvidence(verdict, evidence) {
-  if (typeof verdict !== 'string' || !FP_VERDICTS.has(_normalizeVerdict(verdict))) {
-    return { ok: true, violations: [] };
-  }
-  const items = Array.isArray(evidence)
-    ? evidence
-    : evidence == null
-      ? []
-      : [evidence];
-  if (items.some(_isCitation)) return { ok: true, violations: [] };
-  return {
-    ok: false,
-    violations: ['false-positive/safe verdict requires a file:line citation'],
-  };
-}
-
-/**
- * Classify a fix into FULL | MITIGATION | WORKAROUND, conservative-first.
- *
- * @param {object} signals
- * @param {boolean} signals.sinkSignatureChanged
- * @param {boolean} signals.allCallersRouted
- * @param {boolean} signals.testDiscriminates - a test that fails pre-fix, passes post-fix
- * @param {boolean} [signals.rateLimitOnly]
- * @param {boolean} [signals.docsOnly]
- * @param {boolean} [signals.logOnlyNoReject]
- * @param {boolean} [signals.partialSanitization]
- * @returns {'FULL'|'MITIGATION'|'WORKAROUND'}
- */
-function computeFixTier(signals) {
-  const s = signals && typeof signals === 'object' ? signals : {};
-  if (s.rateLimitOnly || s.docsOnly || s.logOnlyNoReject) return 'WORKAROUND';
-  const complete = s.sinkSignatureChanged && s.allCallersRouted && s.testDiscriminates;
-  if (s.partialSanitization || !complete) return 'MITIGATION';
-  return 'FULL';
-}
-
-/**
- * FR-308: cross-check a fix-completeness TIER against MECHANICAL evidence,
- * when any is available. `signals` (computeFixTier's input) is agent-
- * self-reported — this module cannot compute sinkSignatureChanged /
- * allCallersRouted / testDiscriminates itself (see the header above: "the
- * gate can only run against claims the AGENT self-reports... nothing here
- * is server-computable"). `pocLeg` is different: fix-verify.js's PoC leg is
- * a REAL execution result (posture/CLAUDE.md's execution-proof tiers), not
- * a claim. When it is available and shows the proof-of-concept STILL
- * demonstrates the vulnerability against the patch, a self-reported FULL
- * tier is not merely internally inconsistent — it is REFUTED by fact. This
- * is the literal "a mitigation or workaround cannot be represented as a
- * full fix" acceptance criterion, now backed by mechanical evidence where
- * it exists rather than by self-report consistency alone.
- *
- * A `pocLeg` of `not-requested` or `inconclusive` carries no mechanical
- * signal either way and is a no-op here — this check can only ever ADD a
- * violation on real contrary evidence, never manufacture one from absence.
- *
- * @param {string} tier
- * @param {{status: string, reason?: string}|null} pocLeg
- * @returns {{ ok: boolean, violations: string[] }}
- */
-function checkMechanicalTierEvidence(tier, pocLeg) {
-  if (!pocLeg || typeof pocLeg !== 'object') return { ok: true, violations: [] };
-  if (tier === 'FULL' && pocLeg.status === 'still-exploitable') {
-    return {
-      ok: false,
-      violations: [`tier 'FULL' is refuted by mechanical evidence: the proof-of-concept still demonstrates the vulnerability against the patch${pocLeg.reason ? ` (${pocLeg.reason})` : ''}`],
-    };
-  }
-  return { ok: true, violations: [] };
-}
-
-/**
- * Compose the four gates for a single fix's output.
- *
- * ok = residual-honesty ok AND evidence-citation ok AND mechanical-tier-
- * evidence ok, further constrained by the tier/residual consistency
- * invariant:
- *   - a FULL tier must NOT carry a residual (a full fix has nothing left);
- *   - a non-FULL tier MUST document a residual (say what's still open).
- *
- * @param {{ residual?: string, verdict?: string, evidence?: any, signals?: object }} input
- * @param {{ pocLeg?: object|null }} [mechanical] - FR-308: optional real
- *   execution evidence (fix-verify.js's pocLeg) to cross-check the
- *   self-reported tier against. Omitted entirely by any caller that has no
- *   PoC leg to offer — this parameter never REQUIRES mechanical evidence,
- *   it only USES it when present.
- * @returns {{ ok: boolean, tier: string, violations: string[] }}
- */
-function gateFixOutput({ residual, verdict, evidence, signals } = {}, { pocLeg = null } = {}) {
-  const tier = computeFixTier(signals);
-  const residualCheck = checkResidualHonesty(residual);
-  const evidenceCheck = requireCitedEvidence(verdict, evidence);
-  const mechanicalCheck = checkMechanicalTierEvidence(tier, pocLeg);
-
-  const violations = [...residualCheck.violations, ...evidenceCheck.violations, ...mechanicalCheck.violations];
-  let ok = residualCheck.ok && evidenceCheck.ok && mechanicalCheck.ok;
-
-  const residualEmpty = typeof residual !== 'string' || residual.trim() === '';
-  if (tier === 'FULL' && !residualEmpty) {
-    violations.push('FULL tier cannot carry a residual');
-    ok = false;
-  }
-  if (tier !== 'FULL' && residualEmpty) {
-    violations.push('non-FULL tier must document a residual');
-    ok = false;
-  }
-
-  return { ok, tier, violations };
-}
-
-const _internals = Object.freeze({ BANNED_RESIDUAL_PHRASES, CITATION_RE, FP_VERDICTS });
-
-;// CONCATENATED MODULE: ./src/posture/test-runner.js
-// R5 (partial, roadmap) — the project's own test suite as a verification
-// stage for `verifyFix()` (see `fix-verify.js`). Closes the gap where a
-// "verified" fix only proved a finding's stableId stopped firing — a patch
-// that deletes the feature entirely would satisfy that just as well as a
-// real fix. Running the project's own tests is the cheapest available check
-// that the application still works.
-//
-// Execution-safety note: this spawns the TARGET PROJECT's own test command
-// in the target project's own directory. That is deliberately NOT routed
-// through the R1 confinement sandbox (`../sandbox/`). That sandbox exists to
-// contain untrusted proof-of-concept exploit code the scanner itself
-// synthesizes — code nobody has vetted, being run for the first time. A
-// project's pre-existing test suite is the opposite case: it is the
-// project's own trusted source, already sitting on disk, and running it is
-// exactly what a human developer does by hand before trusting a fix.
-// Wrapping "npm test" / "pytest" / "go test" in the PoC sandbox's
-// syscall/network/filesystem restrictions would break the large majority of
-// real test suites (they bind local ports, spawn child processes, write temp
-// fixtures, etc.) for no corresponding security benefit.
-
-
-
-
-
-const DEFAULT_TIMEOUT_MS = 300_000;
-const NPM_PLACEHOLDER = /Error: no test specified/i;
-
-function _exists(scanRoot, rel) {
-  try { return external_node_fs_.existsSync(external_node_path_.join(scanRoot, rel)); } catch { return false; }
-}
-
-function _isDir(scanRoot, rel) {
-  try { return external_node_fs_.statSync(external_node_path_.join(scanRoot, rel)).isDirectory(); } catch { return false; }
-}
-
-function _binaryAvailable(cmd) {
-  try {
-    const r = (0,external_node_child_process_.spawnSync)(cmd, ['--version'], { timeout: 5_000, stdio: 'ignore' });
-    return !(r.error && r.error.code === 'ENOENT');
-  } catch {
-    return false;
-  }
-}
-
-// Detect the project's test command. Read-only — never spawns the actual
-// test run, only (optionally) a cheap `--version` probe to confirm a tool
-// like `pytest` is actually installed before committing to it. Returns
-// `null` when nothing detectable is found — most scanned repos will hit
-// this path, and that must not be treated as a failure by callers.
-function detectTestCommand(scanRoot) {
-  if (!scanRoot) return null;
-
-  // JS/TS — package.json with a real (non-placeholder) `scripts.test`.
-  let pkg = null;
-  try { pkg = JSON.parse(external_node_fs_.readFileSync(external_node_path_.join(scanRoot, 'package.json'), 'utf8')); } catch { pkg = null; }
-  const testScript = pkg && pkg.scripts && pkg.scripts.test;
-  if (testScript && !NPM_PLACEHOLDER.test(String(testScript))) {
-    if (_exists(scanRoot, 'pnpm-lock.yaml')) return { cmd: 'pnpm', args: ['test'], kind: 'pnpm' };
-    if (_exists(scanRoot, 'yarn.lock')) return { cmd: 'yarn', args: ['test'], kind: 'yarn' };
-    if (_exists(scanRoot, 'bun.lockb') || _exists(scanRoot, 'bun.lock')) return { cmd: 'bun', args: ['test'], kind: 'bun' };
-    return { cmd: 'npm', args: ['test', '--silent'], kind: 'npm' };
-  }
-
-  // Python — pytest.ini / pyproject.toml / tox.ini / a tests/ dir, and the
-  // `pytest` binary actually available. If pytest isn't installed we do NOT
-  // report a python test command — falling through lets a later language
-  // marker (e.g. go.mod in a polyglot repo) still be detected.
-  const pyMarker = _exists(scanRoot, 'pytest.ini') || _exists(scanRoot, 'pyproject.toml') ||
-    _exists(scanRoot, 'tox.ini') || _isDir(scanRoot, 'tests');
-  if (pyMarker && _binaryAvailable('pytest')) {
-    return { cmd: 'pytest', args: ['-q'], kind: 'pytest' };
-  }
-
-  // Go
-  if (_exists(scanRoot, 'go.mod')) {
-    return { cmd: 'go', args: ['test', './...'], kind: 'go' };
-  }
-
-  return null;
-}
-
-// Run the detected test command with a walltime budget. Always returns a
-// result object — never throws. Distinguishes four outcomes:
-//   - no detectable/runnable command  -> status: 'skipped'  (does NOT fail)
-//   - ran and exited 0                -> status: 'passed'
-//   - ran and exited non-zero         -> status: 'failed'
-//   - ran past the timeout budget     -> status: 'failed', timedOut: true
-function runProjectTests(scanRoot, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
-  const startedAt = Date.now();
-  const command = detectTestCommand(scanRoot);
-  if (!command) {
-    return {
-      status: 'skipped', passed: null, skipped: true,
-      reason: 'no-test-command-detected', exitCode: null, timedOut: false,
-      durationMs: Date.now() - startedAt,
-    };
-  }
-
-  let r;
-  try {
-    r = (0,external_node_child_process_.spawnSync)(command.cmd, command.args, {
-      cwd: scanRoot,
-      encoding: 'utf8',
-      timeout: timeoutMs,
-      env: { ...process.env, CI: '1' },
-    });
-  } catch (e) {
-    // The spawn call itself threw (rare — e.g. cwd vanished). Treat as
-    // "could not run", not "ran and failed".
-    return {
-      status: 'skipped', passed: null, skipped: true,
-      reason: `spawn-error: ${e.message}`, exitCode: null, timedOut: false,
-      durationMs: Date.now() - startedAt,
-    };
-  }
-  const durationMs = Date.now() - startedAt;
-
-  if (r.error && r.error.code === 'ENOENT') {
-    // The detected tool isn't actually installed on this machine. Not a
-    // test failure — the suite never ran.
-    return {
-      status: 'skipped', passed: null, skipped: true,
-      reason: `${command.kind}-not-installed`, exitCode: null, timedOut: false, durationMs,
-    };
-  }
-
-  if (r.status === null) {
-    // spawnSync sets status:null both on timeout-kill and on being killed by
-    // another signal; either way the run did not complete, which is a
-    // verification failure, never a skip — we asked for a result and the
-    // process was terminated before producing one.
-    return {
-      status: 'failed', passed: false, skipped: false,
-      reason: 'timed-out', exitCode: null, timedOut: true, durationMs,
-    };
-  }
-
-  return {
-    status: r.status === 0 ? 'passed' : 'failed',
-    passed: r.status === 0,
-    skipped: false,
-    reason: r.status === 0 ? null : 'test-failures',
-    exitCode: r.status,
-    timedOut: false,
-    durationMs,
-  };
-}
-
-// EXTERNAL MODULE: ./src/posture/fix-metrics.js
-var fix_metrics = __webpack_require__(2238);
-;// CONCATENATED MODULE: ./src/posture/fix-verify.js
-// Closed-loop /fix verification (Sentinel-parity FR-L4-4, FR-L4-5).
-//
-// Given a candidate patch (the new file content + the finding stableId being
-// fixed), verify it:
-//
-//   1. The original finding's stableId no longer fires on the patched file.
-//   2. No new findings at severity ≥ medium were introduced by the patch.
-//   3. The project's existing linter (when present) passes on the patched file.
-//   4. The project's own test suite (when detectable) still passes. This is
-//      the R5 gap-closer: a patch that silently deletes the feature would
-//      satisfy (1) and (2) just as well as a real fix — only running the
-//      tests catches that. See `test-runner.js` for detection + execution.
+//   1. The original finding's stableId no longer fires on the patched file.
+//   2. No new findings at severity ≥ medium were introduced by the patch.
+//   3. The project's existing linter (when present) passes on the patched file.
+//   4. The project's own test suite (when detectable) still passes. This is
+//      the R5 gap-closer: a patch that silently deletes the feature would
+//      satisfy (1) and (2) just as well as a real fix — only running the
+//      tests catches that. See `test-runner.js` for detection + execution.
 //
 // If any of those fail, the caller is expected to NOT apply the patch and
 // instead surface a "fix plan" — a numbered list of steps the engineer can
@@ -912,7 +772,7 @@ async function verifyPatch({
     // would mass-mark the rest of the project as remediated, then
     // `reintroduced` on the next real scan. The patched content is also not
     // committed, so there is no history to resolve provenance against anyway.
-    scan = await (0,engine/* runFullScan */.wW)({ fileContents, depFileContents, scanRoot, provenance: false }, () => {});
+    scan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_3__/* .runFullScan */ .wW)({ fileContents, depFileContents, scanRoot, provenance: false }, () => {});
   } catch (e) {
     return { ok: false, reason: 'rescan-failed', error: e.message };
   }
@@ -943,7 +803,7 @@ function runProjectLinter(scanRoot, filePaths) {
   if (!scanRoot || !Array.isArray(filePaths) || filePaths.length === 0) {
     return { ok: true, runner: 'none' };
   }
-  const has = (p) => { try { return external_node_fs_.existsSync(external_node_path_.join(scanRoot, p)); } catch { return false; } };
+  const has = (p) => { try { return node_fs__WEBPACK_IMPORTED_MODULE_1__.existsSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, p)); } catch { return false; } };
   // Pick the linter by config file present in the repo root.
   const jsFiles = filePaths.filter(f => /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(f));
   const pyFiles = filePaths.filter(f => /\.py$/i.test(f));
@@ -971,7 +831,7 @@ function runProjectLinter(scanRoot, filePaths) {
 function runLinter(cwd, cmd, args) {
   let r;
   try {
-    r = (0,external_node_child_process_.spawnSync)(cmd, args, { cwd, encoding: 'utf8', timeout: 60_000 });
+    r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)(cmd, args, { cwd, encoding: 'utf8', timeout: 60_000 });
   } catch (e) {
     return { ok: true, runner: cmd, skipped: true, reason: 'binary-missing', error: e.message };
   }
@@ -1023,8 +883,8 @@ function _candidateDiffersFromDisk(scanRoot, files) {
   for (const [rel, content] of Object.entries(files)) {
     if (typeof content !== 'string') continue;
     try {
-      const abs = external_node_path_.resolve(scanRoot, rel);
-      if (external_node_fs_.readFileSync(abs, 'utf8') !== content) return true;
+      const abs = node_path__WEBPACK_IMPORTED_MODULE_2__.resolve(scanRoot, rel);
+      if (node_fs__WEBPACK_IMPORTED_MODULE_1__.readFileSync(abs, 'utf8') !== content) return true;
     } catch {
       return true; // candidate file absent on disk -> definitely not applied
     }
@@ -1054,7 +914,7 @@ async function verifyFix({
   _lap('rescan');
   const lint = runProjectLinter(scanRoot, Object.keys(files || {}));
   _lap('lint');
-  const tests = runProjectTests(scanRoot, testTimeoutMs != null ? { timeoutMs: testTimeoutMs } : {});
+  const tests = (0,_test_runner_js__WEBPACK_IMPORTED_MODULE_5__/* .runProjectTests */ .I)(scanRoot, testTimeoutMs != null ? { timeoutMs: testTimeoutMs } : {});
   _lap('tests');
   // True when a candidate patch was supplied but has not been written, so the
   // suite necessarily ran against the pre-patch tree. Surfaced in the summary
@@ -1119,7 +979,7 @@ async function verifyFix({
      fixMeta.evidence !== undefined || fixMeta.signals !== undefined);
   let honesty = null;
   if (hasHonestyClaim) {
-    try { honesty = gateFixOutput(fixMeta, { pocLeg }); } catch { honesty = null; }
+    try { honesty = (0,_fix_honesty_gate_js__WEBPACK_IMPORTED_MODULE_4__/* .gateFixOutput */ ._u)(fixMeta, { pocLeg }); } catch { honesty = null; }
   }
   _lap('honesty');
 
@@ -1174,7 +1034,7 @@ async function verifyFix({
   // suite ran against the pre-patch tree, so its timing is real while its
   // verdict is about a different tree.
   if (recordMetrics && scanRoot) {
-    (0,fix_metrics/* recordFixAttempt */.I3)(scanRoot, {
+    (0,_fix_metrics_js__WEBPACK_IMPORTED_MODULE_6__/* .recordFixAttempt */ .I3)(scanRoot, {
       at: new Date().toISOString(),
       stableId: originalFindingStableId || null,
       ok,
@@ -1194,6 +1054,169 @@ async function verifyFix({
   return { ok, verifiedFull, degradedLegs, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
 }
 
+__webpack_async_result__();
+} catch(e) { __webpack_async_result__(e); } });
+
+/***/ }),
+
+/***/ 35136:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   I: () => (/* binding */ runProjectTests)
+/* harmony export */ });
+/* unused harmony export detectTestCommand */
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(31421);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
+// R5 (partial, roadmap) — the project's own test suite as a verification
+// stage for `verifyFix()` (see `fix-verify.js`). Closes the gap where a
+// "verified" fix only proved a finding's stableId stopped firing — a patch
+// that deletes the feature entirely would satisfy that just as well as a
+// real fix. Running the project's own tests is the cheapest available check
+// that the application still works.
+//
+// Execution-safety note: this spawns the TARGET PROJECT's own test command
+// in the target project's own directory. That is deliberately NOT routed
+// through the R1 confinement sandbox (`../sandbox/`). That sandbox exists to
+// contain untrusted proof-of-concept exploit code the scanner itself
+// synthesizes — code nobody has vetted, being run for the first time. A
+// project's pre-existing test suite is the opposite case: it is the
+// project's own trusted source, already sitting on disk, and running it is
+// exactly what a human developer does by hand before trusting a fix.
+// Wrapping "npm test" / "pytest" / "go test" in the PoC sandbox's
+// syscall/network/filesystem restrictions would break the large majority of
+// real test suites (they bind local ports, spawn child processes, write temp
+// fixtures, etc.) for no corresponding security benefit.
+
+
+
+
+
+const DEFAULT_TIMEOUT_MS = 300_000;
+const NPM_PLACEHOLDER = /Error: no test specified/i;
+
+function _exists(scanRoot, rel) {
+  try { return node_fs__WEBPACK_IMPORTED_MODULE_1__.existsSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, rel)); } catch { return false; }
+}
+
+function _isDir(scanRoot, rel) {
+  try { return node_fs__WEBPACK_IMPORTED_MODULE_1__.statSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, rel)).isDirectory(); } catch { return false; }
+}
+
+function _binaryAvailable(cmd) {
+  try {
+    const r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)(cmd, ['--version'], { timeout: 5_000, stdio: 'ignore' });
+    return !(r.error && r.error.code === 'ENOENT');
+  } catch {
+    return false;
+  }
+}
+
+// Detect the project's test command. Read-only — never spawns the actual
+// test run, only (optionally) a cheap `--version` probe to confirm a tool
+// like `pytest` is actually installed before committing to it. Returns
+// `null` when nothing detectable is found — most scanned repos will hit
+// this path, and that must not be treated as a failure by callers.
+function detectTestCommand(scanRoot) {
+  if (!scanRoot) return null;
+
+  // JS/TS — package.json with a real (non-placeholder) `scripts.test`.
+  let pkg = null;
+  try { pkg = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_1__.readFileSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, 'package.json'), 'utf8')); } catch { pkg = null; }
+  const testScript = pkg && pkg.scripts && pkg.scripts.test;
+  if (testScript && !NPM_PLACEHOLDER.test(String(testScript))) {
+    if (_exists(scanRoot, 'pnpm-lock.yaml')) return { cmd: 'pnpm', args: ['test'], kind: 'pnpm' };
+    if (_exists(scanRoot, 'yarn.lock')) return { cmd: 'yarn', args: ['test'], kind: 'yarn' };
+    if (_exists(scanRoot, 'bun.lockb') || _exists(scanRoot, 'bun.lock')) return { cmd: 'bun', args: ['test'], kind: 'bun' };
+    return { cmd: 'npm', args: ['test', '--silent'], kind: 'npm' };
+  }
+
+  // Python — pytest.ini / pyproject.toml / tox.ini / a tests/ dir, and the
+  // `pytest` binary actually available. If pytest isn't installed we do NOT
+  // report a python test command — falling through lets a later language
+  // marker (e.g. go.mod in a polyglot repo) still be detected.
+  const pyMarker = _exists(scanRoot, 'pytest.ini') || _exists(scanRoot, 'pyproject.toml') ||
+    _exists(scanRoot, 'tox.ini') || _isDir(scanRoot, 'tests');
+  if (pyMarker && _binaryAvailable('pytest')) {
+    return { cmd: 'pytest', args: ['-q'], kind: 'pytest' };
+  }
+
+  // Go
+  if (_exists(scanRoot, 'go.mod')) {
+    return { cmd: 'go', args: ['test', './...'], kind: 'go' };
+  }
+
+  return null;
+}
+
+// Run the detected test command with a walltime budget. Always returns a
+// result object — never throws. Distinguishes four outcomes:
+//   - no detectable/runnable command  -> status: 'skipped'  (does NOT fail)
+//   - ran and exited 0                -> status: 'passed'
+//   - ran and exited non-zero         -> status: 'failed'
+//   - ran past the timeout budget     -> status: 'failed', timedOut: true
+function runProjectTests(scanRoot, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
+  const startedAt = Date.now();
+  const command = detectTestCommand(scanRoot);
+  if (!command) {
+    return {
+      status: 'skipped', passed: null, skipped: true,
+      reason: 'no-test-command-detected', exitCode: null, timedOut: false,
+      durationMs: Date.now() - startedAt,
+    };
+  }
+
+  let r;
+  try {
+    r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)(command.cmd, command.args, {
+      cwd: scanRoot,
+      encoding: 'utf8',
+      timeout: timeoutMs,
+      env: { ...process.env, CI: '1' },
+    });
+  } catch (e) {
+    // The spawn call itself threw (rare — e.g. cwd vanished). Treat as
+    // "could not run", not "ran and failed".
+    return {
+      status: 'skipped', passed: null, skipped: true,
+      reason: `spawn-error: ${e.message}`, exitCode: null, timedOut: false,
+      durationMs: Date.now() - startedAt,
+    };
+  }
+  const durationMs = Date.now() - startedAt;
+
+  if (r.error && r.error.code === 'ENOENT') {
+    // The detected tool isn't actually installed on this machine. Not a
+    // test failure — the suite never ran.
+    return {
+      status: 'skipped', passed: null, skipped: true,
+      reason: `${command.kind}-not-installed`, exitCode: null, timedOut: false, durationMs,
+    };
+  }
+
+  if (r.status === null) {
+    // spawnSync sets status:null both on timeout-kill and on being killed by
+    // another signal; either way the run did not complete, which is a
+    // verification failure, never a skip — we asked for a result and the
+    // process was terminated before producing one.
+    return {
+      status: 'failed', passed: false, skipped: false,
+      reason: 'timed-out', exitCode: null, timedOut: true, durationMs,
+    };
+  }
+
+  return {
+    status: r.status === 0 ? 'passed' : 'failed',
+    passed: r.status === 0,
+    skipped: false,
+    reason: r.status === 0 ? null : 'test-failures',
+    exitCode: r.status,
+    timedOut: false,
+    durationMs,
+  };
+}
+
 
 /***/ })