@clear-capabilities/agentic-security-scanner 0.160.0 → 0.162.0

package/src/posture/assurance/schema-kit.js

@@ -0,0 +1,111 @@
+// Small validation primitives shared by the assurance evidence contracts
+// (CORE-002). Pure: no fs, no clock, no network. Every validator returns
+// `{ ok, errors }` where each error is `{ code, path, message }`; nothing throws
+// on bad input, because a validator that throws on hostile input is a denial of
+// service on whatever called it.
+
+export const ERROR_CODES = Object.freeze([
+  'NOT_AN_OBJECT', 'SCHEMA_MISMATCH', 'UNSUPPORTED_MAJOR', 'BAD_VERSION', 'MISSING_FIELD', 'UNKNOWN_FIELD',
+  'BAD_TYPE', 'UNKNOWN_ENUM', 'BAD_DIGEST', 'BAD_ID', 'ID_MISMATCH', 'DUPLICATE_ID', 'DANGLING_REF', 'RULE_VIOLATION',
+]);
+
+export const SUPPORTED_MAJOR = 1;
+export const SCHEMA_VERSION = '1.0.0';
+
+const SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
+const DIGEST = /^sha256:[0-9a-f]{64}$/;
+const COMMIT = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+
+export function makeCtx() {
+  const errors = [];
+  return {
+    errors,
+    err(code, path, message) { errors.push({ code, path, message }); },
+  };
+}
+
+export function isPlainObject(v) {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+
+export function isDigest(v) { return typeof v === 'string' && DIGEST.test(v); }
+export function isCommit(v) { return typeof v === 'string' && COMMIT.test(v); }
+export function isNonEmptyString(v) { return typeof v === 'string' && v.trim().length > 0; }
+
+/** Header check: `schema` must match and the major version must be supported. */
+export function checkHeader(ctx, rec, schemaName) {
+  if (rec.schema !== schemaName) {
+    ctx.err('SCHEMA_MISMATCH', 'schema', `expected schema '${schemaName}', got ${JSON.stringify(rec.schema)}`);
+    return false;
+  }
+  const m = typeof rec.schemaVersion === 'string' ? SEMVER.exec(rec.schemaVersion) : null;
+  if (!m) {
+    ctx.err('BAD_VERSION', 'schemaVersion', `schemaVersion must be a semantic version, got ${JSON.stringify(rec.schemaVersion)}`);
+    return false;
+  }
+  if (Number(m[1]) !== SUPPORTED_MAJOR) {
+    ctx.err('UNSUPPORTED_MAJOR', 'schemaVersion', `major version ${m[1]} is not supported (supported: ${SUPPORTED_MAJOR})`);
+    return false;
+  }
+  return true;
+}
+
+/** Closed world: any field outside `allowed` is rejected, never silently carried. */
+export function checkFields(ctx, rec, allowed, required) {
+  for (const k of Object.keys(rec)) {
+    if (!allowed.includes(k)) ctx.err('UNKNOWN_FIELD', k, `field '${k}' is not part of this schema`);
+  }
+  for (const k of required) {
+    if (rec[k] === undefined) ctx.err('MISSING_FIELD', k, `required field '${k}' is missing`);
+  }
+  // `createdAt` is informational and never enters an id; it must still be a string.
+  if (rec.createdAt !== undefined && typeof rec.createdAt !== 'string') ctx.err('BAD_TYPE', 'createdAt', 'must be a string');
+}
+
+export function checkEnum(ctx, path, value, allowed) {
+  if (typeof value !== 'string' || !allowed.includes(value)) {
+    ctx.err('UNKNOWN_ENUM', path, `${JSON.stringify(value)} is not one of: ${allowed.join(', ')}`);
+    return false;
+  }
+  return true;
+}
+
+export function checkDigest(ctx, path, value, { nullable = false } = {}) {
+  if (value === null && nullable) return true;
+  if (!isDigest(value)) { ctx.err('BAD_DIGEST', path, `must be 'sha256:' followed by 64 lowercase hex characters`); return false; }
+  return true;
+}
+
+export function checkCommit(ctx, path, value, { nullable = true } = {}) {
+  if (value === null && nullable) return true;
+  if (!isCommit(value)) { ctx.err('BAD_TYPE', path, 'must be a 40 or 64 character lowercase hex commit id'); return false; }
+  return true;
+}
+
+export function checkString(ctx, path, value) {
+  if (!isNonEmptyString(value)) { ctx.err('BAD_TYPE', path, 'must be a non-empty string'); return false; }
+  return true;
+}
+
+export function checkId(ctx, rec, expectedId) {
+  const prefix = expectedId.split(':')[0];
+  if (typeof rec.id !== 'string' || !rec.id.startsWith(`${prefix}:`)) {
+    ctx.err('BAD_ID', 'id', `id must start with '${prefix}:'`);
+  } else if (rec.id !== expectedId) {
+    ctx.err('ID_MISMATCH', 'id', `id does not match the record's semantic content (expected ${expectedId})`);
+  }
+}
+
+export function result(ctx) {
+  return { ok: ctx.errors.length === 0, errors: ctx.errors };
+}
+
+/** Reject non-object input with one typed error instead of throwing downstream. */
+export function guardObject(rec) {
+  const ctx = makeCtx();
+  if (!isPlainObject(rec)) {
+    ctx.err('NOT_AN_OBJECT', '', 'record must be a plain object');
+    return { ctx, ok: false };
+  }
+  return { ctx, ok: true };
+}

package/src/posture/assurance/verification-record.js

@@ -0,0 +1,258 @@
+// The one verification record (CORE-002; X-201 builds every surface on it).
+//
+// Shape: hypothesis id, commit, detector origin, oracle, attempt, outcome,
+// reason, evidence items + references, applicable scope, and a SEPARATE repair
+// status.
+//
+// Structural honesty rules, enforced by the validator (not by convention):
+//   1. The six outcomes are distinct: not-run, unsupported, inconclusive, error,
+//      refuted, confirmed. Nothing here collapses them to a boolean.
+//   2. Evidence kinds are distinct: observation, inference, independent
+//      adjudication, trusted runtime proof. Each kind constrains who may have
+//      produced it: a model can only ever produce an inference; trusted runtime
+//      proof only comes from a trusted runner; an adjudication only from a human
+//      or an independent verifier.
+//   3. `confirmed` needs referenced evidence of runtime proof or independent
+//      adjudication, so a model-generated verdict alone cannot yield it, and the
+//      record carries a `confirmationLevel` that must equal the level derived from
+//      its evidence ('runtime-confirmed' needs trusted-runtime-proof AND a runtime
+//      oracle). A forged level fails the derivation check.
+//   4. `refuted` needs an applicable (non-model) oracle, valid preconditions and
+//      proving evidence: a missing taint path is not refutation of an
+//      authorization or workflow claim.
+//   5. Repair status is a different axis from the outcome. `replay-verified`
+//      needs the id of the patched-negative verification record.
+
+import {
+  SCHEMA_VERSION, makeCtx, result, guardObject, checkHeader, checkFields, checkEnum, checkDigest,
+  checkCommit, checkString, checkId, isPlainObject,
+} from './schema-kit.js';
+import { semanticId, ID_PREFIXES } from './identity.js';
+
+export const VERIFICATION_SCHEMA = 'agentic-security/verification-record';
+
+export const VERIFICATION_OUTCOMES = Object.freeze(['not-run', 'unsupported', 'inconclusive', 'error', 'refuted', 'confirmed']);
+export const REPAIR_STATUSES = Object.freeze(['none', 'proposed', 'applied', 'replay-verified', 'rolled-back']);
+export const EVIDENCE_KINDS = Object.freeze(['observation', 'inference', 'independent-adjudication', 'trusted-runtime-proof']);
+export const EVIDENCE_PRODUCERS = Object.freeze(['model', 'tool', 'human', 'independent-verifier', 'trusted-runner']);
+export const ORACLE_KINDS = Object.freeze(['runtime-replay', 'differential', 'static-proof', 'model', 'human', 'none']);
+export const CONFIRMATION_LEVELS = Object.freeze(['runtime-confirmed', 'adjudicated', 'none']);
+
+const RUNTIME_ORACLES = ['runtime-replay', 'differential'];
+const APPLICABLE_FOR_REFUTATION = ['runtime-replay', 'differential', 'static-proof', 'human'];
+const NO_EXECUTION_OUTCOMES = ['not-run', 'unsupported'];
+
+const ALLOWED = [
+  'schema', 'schemaVersion', 'id', 'hypothesisId', 'commit', 'detectorOrigin', 'oracle', 'attempt', 'outcome', 'reason',
+  'evidence', 'evidenceRefs', 'scope', 'preconditions', 'confirmationLevel', 'repair', 'migration', 'createdAt',
+];
+const REQUIRED = [
+  'schema', 'schemaVersion', 'id', 'hypothesisId', 'commit', 'detectorOrigin', 'oracle', 'attempt', 'outcome', 'reason',
+  'evidence', 'evidenceRefs', 'scope', 'preconditions', 'confirmationLevel', 'repair',
+];
+
+// Fields that define WHAT was claimed and how it was checked. `createdAt` (a
+// clock) and `migration` (how the record was represented) are deliberately not
+// here, so neither can move an id.
+export const VERIFICATION_ID_FIELDS = Object.freeze([
+  'hypothesisId', 'commit', 'detectorOrigin', 'oracle', 'attempt', 'outcome', 'reason', 'evidence', 'evidenceRefs',
+  'scope', 'preconditions', 'confirmationLevel', 'repair',
+]);
+
+export function verificationRecordId(record) {
+  return semanticId(ID_PREFIXES.verification, record, VERIFICATION_ID_FIELDS);
+}
+
+/** The identity of the CLAIM (which hypothesis, at which commit, by which oracle, on which attempt), excluding its result. */
+export function verificationClaimKey(record) {
+  return semanticId('vclaim', record, ['hypothesisId', 'commit', 'oracle', 'attempt']);
+}
+
+function referencedEvidence(record) {
+  const refs = new Set(Array.isArray(record.evidenceRefs) ? record.evidenceRefs : []);
+  return (Array.isArray(record.evidence) ? record.evidence : []).filter(e => isPlainObject(e) && refs.has(e.id));
+}
+
+/** The confirmation level the evidence actually supports. Never read from the record's own claim. */
+export function deriveConfirmationLevel(record) {
+  if (!record || record.outcome !== 'confirmed') return 'none';
+  const ev = referencedEvidence(record);
+  const runtime = ev.some(e => e.kind === 'trusted-runtime-proof' && e.producer === 'trusted-runner');
+  if (runtime && RUNTIME_ORACLES.includes(record.oracle?.kind)) return 'runtime-confirmed';
+  const adjudicated = ev.some(e => e.kind === 'independent-adjudication' && ['human', 'independent-verifier'].includes(e.producer));
+  return adjudicated ? 'adjudicated' : 'none';
+}
+
+function validateEvidenceItem(ctx, e, i) {
+  const p = `evidence[${i}]`;
+  if (!isPlainObject(e)) { ctx.err('BAD_TYPE', p, 'evidence item must be an object'); return; }
+  for (const k of Object.keys(e)) {
+    if (!['id', 'kind', 'producer', 'digest', 'source'].includes(k)) ctx.err('UNKNOWN_FIELD', `${p}.${k}`, `field '${k}' is not part of an evidence item`);
+  }
+  checkString(ctx, `${p}.id`, e.id);
+  const kindOk = checkEnum(ctx, `${p}.kind`, e.kind, EVIDENCE_KINDS);
+  const prodOk = checkEnum(ctx, `${p}.producer`, e.producer, EVIDENCE_PRODUCERS);
+  checkDigest(ctx, `${p}.digest`, e.digest);
+  if (e.source !== undefined && e.source !== null) checkString(ctx, `${p}.source`, e.source);
+  if (!kindOk || !prodOk) return;
+  if (e.producer === 'model' && e.kind !== 'inference') {
+    ctx.err('RULE_VIOLATION', p, `a model-produced item can only be 'inference', not '${e.kind}'`);
+  }
+  if (e.kind === 'trusted-runtime-proof' && e.producer !== 'trusted-runner') {
+    ctx.err('RULE_VIOLATION', p, `'trusted-runtime-proof' can only be produced by a 'trusted-runner', not '${e.producer}'`);
+  }
+  if (e.kind === 'independent-adjudication' && !['human', 'independent-verifier'].includes(e.producer)) {
+    ctx.err('RULE_VIOLATION', p, `'independent-adjudication' can only be produced by a 'human' or 'independent-verifier', not '${e.producer}'`);
+  }
+  if (e.producer === 'trusted-runner' && !['trusted-runtime-proof', 'observation'].includes(e.kind)) {
+    ctx.err('RULE_VIOLATION', p, `a 'trusted-runner' produces 'trusted-runtime-proof' or 'observation', not '${e.kind}'`);
+  }
+}
+
+export function validateVerificationRecord(record) {
+  const g = guardObject(record);
+  const ctx = g.ctx;
+  if (!g.ok) return result(ctx);
+  if (!checkHeader(ctx, record, VERIFICATION_SCHEMA)) return result(ctx);
+  checkFields(ctx, record, ALLOWED, REQUIRED);
+
+  checkString(ctx, 'hypothesisId', record.hypothesisId);
+  checkCommit(ctx, 'commit', record.commit);
+
+  const origin = record.detectorOrigin;
+  if (!isPlainObject(origin)) ctx.err('BAD_TYPE', 'detectorOrigin', 'must be an object with a detector name');
+  else {
+    for (const k of Object.keys(origin)) if (!['detector', 'family', 'parser'].includes(k)) ctx.err('UNKNOWN_FIELD', `detectorOrigin.${k}`, 'not part of detectorOrigin');
+    checkString(ctx, 'detectorOrigin.detector', origin.detector);
+  }
+
+  const oracle = record.oracle;
+  let oracleKind = null;
+  if (oracle === null) oracleKind = 'none';
+  else if (!isPlainObject(oracle)) ctx.err('BAD_TYPE', 'oracle', 'must be an object or null');
+  else {
+    for (const k of Object.keys(oracle)) if (!['id', 'kind', 'version'].includes(k)) ctx.err('UNKNOWN_FIELD', `oracle.${k}`, 'not part of oracle');
+    checkString(ctx, 'oracle.id', oracle.id);
+    if (checkEnum(ctx, 'oracle.kind', oracle.kind, ORACLE_KINDS)) oracleKind = oracle.kind;
+  }
+
+  if (!Number.isInteger(record.attempt) || record.attempt < 0) ctx.err('BAD_TYPE', 'attempt', 'must be a non-negative integer');
+  const outcomeOk = checkEnum(ctx, 'outcome', record.outcome, VERIFICATION_OUTCOMES);
+  checkString(ctx, 'reason', record.reason);
+
+  // evidence items
+  const ids = new Set();
+  if (!Array.isArray(record.evidence)) ctx.err('BAD_TYPE', 'evidence', 'must be an array');
+  else {
+    record.evidence.forEach((e, i) => {
+      validateEvidenceItem(ctx, e, i);
+      if (isPlainObject(e) && typeof e.id === 'string') {
+        if (ids.has(e.id)) ctx.err('DUPLICATE_ID', `evidence[${i}].id`, `duplicate evidence id '${e.id}'`);
+        ids.add(e.id);
+      }
+    });
+  }
+  if (!Array.isArray(record.evidenceRefs)) ctx.err('BAD_TYPE', 'evidenceRefs', 'must be an array of evidence ids');
+  else {
+    const seen = new Set();
+    record.evidenceRefs.forEach((r, i) => {
+      if (!ids.has(r)) ctx.err('DANGLING_REF', `evidenceRefs[${i}]`, `evidence reference '${r}' does not resolve to an evidence item in this record`);
+      if (seen.has(r)) ctx.err('DUPLICATE_ID', `evidenceRefs[${i}]`, `evidence reference '${r}' listed twice`);
+      seen.add(r);
+    });
+  }
+
+  // scope
+  const scope = record.scope;
+  if (!isPlainObject(scope)) ctx.err('BAD_TYPE', 'scope', 'must be an object');
+  else {
+    for (const k of Object.keys(scope)) if (!['description', 'platform', 'backend'].includes(k)) ctx.err('UNKNOWN_FIELD', `scope.${k}`, 'not part of scope');
+    checkString(ctx, 'scope.description', scope.description);
+    checkString(ctx, 'scope.platform', scope.platform);
+    if (scope.backend !== undefined && scope.backend !== null) checkString(ctx, 'scope.backend', scope.backend);
+  }
+
+  // preconditions
+  const pre = record.preconditions;
+  if (!isPlainObject(pre) || typeof pre.valid !== 'boolean') ctx.err('BAD_TYPE', 'preconditions', 'must be an object with a boolean `valid`');
+
+  // repair: a separate axis
+  const repair = record.repair;
+  if (!isPlainObject(repair)) ctx.err('BAD_TYPE', 'repair', 'must be an object');
+  else {
+    for (const k of Object.keys(repair)) if (!['status', 'patchDigest', 'replayRecordId'].includes(k)) ctx.err('UNKNOWN_FIELD', `repair.${k}`, 'not part of repair');
+    if (checkEnum(ctx, 'repair.status', repair.status, REPAIR_STATUSES)) {
+      if (['applied', 'replay-verified', 'rolled-back'].includes(repair.status)) {
+        if (repair.patchDigest === undefined || repair.patchDigest === null) ctx.err('RULE_VIOLATION', 'repair.patchDigest', `repair status '${repair.status}' requires a patchDigest`);
+      }
+      if (repair.patchDigest !== undefined && repair.patchDigest !== null) checkDigest(ctx, 'repair.patchDigest', repair.patchDigest);
+      if (repair.status === 'replay-verified' && !(typeof repair.replayRecordId === 'string' && repair.replayRecordId.startsWith('vrec:'))) {
+        ctx.err('RULE_VIOLATION', 'repair.replayRecordId', `repair status 'replay-verified' requires the id of the patched-negative verification record`);
+      }
+    }
+  }
+
+  // confirmation level must be what the evidence supports
+  const levelOk = checkEnum(ctx, 'confirmationLevel', record.confirmationLevel, CONFIRMATION_LEVELS);
+  if (levelOk) {
+    const derived = deriveConfirmationLevel(record);
+    if (record.confirmationLevel !== derived) {
+      ctx.err('RULE_VIOLATION', 'confirmationLevel', `claimed '${record.confirmationLevel}' but the referenced evidence supports '${derived}'`);
+    }
+  }
+
+  // outcome rules
+  if (outcomeOk) {
+    const refEv = referencedEvidence(record);
+    const hasProof = refEv.some(e => ['trusted-runtime-proof', 'independent-adjudication'].includes(e.kind));
+    const attempt = record.attempt;
+    if (!NO_EXECUTION_OUTCOMES.includes(record.outcome) && Number.isInteger(attempt) && attempt < 1) {
+      ctx.err('RULE_VIOLATION', 'attempt', `outcome '${record.outcome}' requires attempt >= 1`);
+    }
+    if (NO_EXECUTION_OUTCOMES.includes(record.outcome)) {
+      if (Number.isInteger(attempt) && attempt !== 0) ctx.err('RULE_VIOLATION', 'attempt', `outcome '${record.outcome}' means nothing ran, so attempt must be 0`);
+      if (refEv.some(e => e.kind === 'trusted-runtime-proof')) ctx.err('RULE_VIOLATION', 'evidence', `outcome '${record.outcome}' cannot cite runtime proof: nothing executed`);
+    }
+    if (['confirmed', 'refuted'].includes(record.outcome)) {
+      if (record.commit === null) ctx.err('RULE_VIOLATION', 'commit', `outcome '${record.outcome}' must be bound to an exact commit`);
+      if (oracleKind === 'none') ctx.err('RULE_VIOLATION', 'oracle', `outcome '${record.outcome}' requires an oracle`);
+      if (oracleKind === 'model') ctx.err('RULE_VIOLATION', 'oracle', `a model oracle can never yield '${record.outcome}'`);
+      if (!hasProof) ctx.err('RULE_VIOLATION', 'evidenceRefs', `outcome '${record.outcome}' requires referenced trusted-runtime-proof or independent-adjudication evidence`);
+    }
+    if (record.outcome === 'confirmed' && record.confirmationLevel === 'none') {
+      ctx.err('RULE_VIOLATION', 'confirmationLevel', `a 'confirmed' record must carry a confirmation level above 'none'`);
+    }
+    if (record.outcome === 'refuted') {
+      if (oracleKind && !APPLICABLE_FOR_REFUTATION.includes(oracleKind)) ctx.err('RULE_VIOLATION', 'oracle', `oracle kind '${oracleKind}' is not applicable for refutation`);
+      if (!(isPlainObject(pre) && pre.valid === true)) ctx.err('RULE_VIOLATION', 'preconditions', `'refuted' requires valid preconditions: a check that could not run is not a refutation`);
+    }
+  }
+
+  checkId(ctx, record, verificationRecordId(record));
+  return result(ctx);
+}
+
+/** Build a complete, valid-by-construction record from the semantic fields; derives the level and the id. */
+export function buildVerificationRecord(fields) {
+  const rec = {
+    schema: VERIFICATION_SCHEMA,
+    schemaVersion: SCHEMA_VERSION,
+    hypothesisId: fields.hypothesisId,
+    commit: fields.commit ?? null,
+    detectorOrigin: fields.detectorOrigin,
+    oracle: fields.oracle ?? null,
+    attempt: fields.attempt ?? 0,
+    outcome: fields.outcome,
+    reason: fields.reason,
+    evidence: fields.evidence ?? [],
+    evidenceRefs: fields.evidenceRefs ?? (fields.evidence ?? []).map(e => e.id),
+    scope: fields.scope,
+    preconditions: fields.preconditions ?? { valid: false },
+    repair: fields.repair ?? { status: 'none' },
+  };
+  rec.confirmationLevel = deriveConfirmationLevel(rec);
+  if (fields.migration) rec.migration = fields.migration;
+  if (fields.createdAt) rec.createdAt = fields.createdAt;
+  rec.id = verificationRecordId(rec);
+  return rec;
+}

package/src/posture/attestation.js

@@ -143,6 +143,11 @@ export function computeRunAttestation({
     try {
       att.signature = signLastScan(digest);
       att.signatureScope = 'per-install-hmac';
+      // CORE-003.AC03: say plainly who vouches. A symmetric install HMAC can be
+      // produced by anyone who can verify it, so it is self-issued by
+      // construction and can never be third-party certification.
+      att.trustBasis = 'self-issued-local-key';
+      att.independentlyCertified = false;
     } catch { /* signing is best-effort; an unsigned attestation is still valid */ }
   }
   return att;

package/src/posture/autopilot.js

@@ -26,6 +26,8 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import { emitVerification } from './verification/emit.js';
+import { verificationFields } from './verification/projection.js';
 
 const SCHEMA = 'agentic-security/autopilot@1';
 
@@ -73,8 +75,15 @@ function _save(stateFile, state) {
  */
 export async function runAutopilot({
   stages = {}, stateFile = null, resume = true, apply = false,
-  onStage = () => {}, severities = ['critical', 'high'], maxFindings = Infinity,
+  onStage = () => {}, severities = ['critical', 'high'], maxFindings = Infinity, commit = null,
 } = {}) {
+  // X-201: every settled finding carries the one version-1 verification record, ADDITIVELY (`outcome`, `reason` and
+  // every other field are unchanged). The chain's own proof and re-verify stages run under the older sandbox path, so
+  // the record never says `confirmed` or `refuted` here: it records what was observed and what remains unproven.
+  const seal = (rec, finding, patch) => {
+    const e = emitVerification('autopilot', rec, { finding, patch: patch?.patch, commit });
+    if (e.ok) rec.verificationRecord = e.record;
+  };
   const required = ['scan'];
   for (const r of required) {
     if (typeof stages[r] !== 'function') return { ok: false, reason: `no ${r} stage supplied` };
@@ -138,6 +147,7 @@ export async function runAutopilot({
       if (rec.validation === 'refuted') {
         rec.outcome = 'NEEDS_REVIEW';
         rec.reason = 'an independent verifier refuted this finding; not fixed automatically';
+        seal(rec, f, null);
         results.push(rec); state.findings[key] = rec; _save(stateFile, state);
         onStage({ stage: 'validate', key, verdict: 'refuted' });
         continue;
@@ -149,6 +159,7 @@ export async function runAutopilot({
     if (!isProven) {
       rec.outcome = 'UNPROVEN';
       rec.reason = proved?.proofEvidence?.reason || 'no proof-of-concept demonstrated this finding';
+      seal(rec, f, null);
       results.push(rec); state.findings[key] = rec; _save(stateFile, state);
       continue;
     }
@@ -161,6 +172,7 @@ export async function runAutopilot({
     if (!patch || !patch.patch) {
       rec.outcome = 'NO_FIX';
       rec.reason = 'no patch was synthesised';
+      seal(rec, f, null);
       results.push(rec); state.findings[key] = rec; _save(stateFile, state);
       continue;
     }
@@ -171,6 +183,7 @@ export async function runAutopilot({
     if (typeof stages.verifyFix !== 'function') {
       rec.outcome = 'NEEDS_REVIEW';
       rec.reason = 'no verifyFix stage supplied — a patch that cannot be re-verified is never applied';
+      seal(rec, f, patch);
       results.push(rec); state.findings[key] = rec; _save(stateFile, state);
       continue;
     }
@@ -194,6 +207,7 @@ export async function runAutopilot({
         : (!rec.testsPass ? 'the project test suite fails with this patch'
           : (v?.reason || 'the patch did not re-verify'));
     }
+    seal(rec, f, patch);
     results.push(rec);
     state.findings[key] = rec;
     _save(stateFile, state);
@@ -203,6 +217,19 @@ export async function runAutopilot({
   return { ok: true, results, skipped, outOfScope, capped, summary: summarizeAutopilot(results, outOfScope, capped) };
 }
 
+/**
+ * X-206: the autopilot response as it is serialized for a caller. Every field of every result is kept (the native `outcome`
+ * vocabulary and its meaning are unchanged); a result that carries a verification record additionally gets `verificationView`, the
+ * shared projection every other interface shows for the same finding. Results without a record are returned as they were.
+ */
+export function serializeAutopilotResult(res) {
+  if (!res || !Array.isArray(res.results)) return res;
+  return {
+    ...res,
+    results: res.results.map((r) => (r && r.verificationRecord ? { ...r, ...verificationFields(r.verificationRecord, { replay: r.verificationReplay }) } : r)),
+  };
+}
+
 export function summarizeAutopilot(results, outOfScope = 0, capped = 0) {
   const byOutcome = Object.fromEntries(OUTCOMES.map(o => [o, 0]));
   for (const r of results) if (r.outcome in byOutcome) byOutcome[r.outcome]++;

package/src/posture/blast-radius.js

@@ -734,8 +734,12 @@ function buildNarrative(finding, signals) {
     ` (controls reducing cost: ${[...signals.controls].join(', ')})` : '';
   const line = finding.line || finding.source?.line || finding.sink?.line || 0;
 
+  // A dependency advisory (Hackage, Nix) carries no `vuln` text, and `vuln` also feeds finding identity, so it is not invented there: the
+  // narrative builds its own label from what the finding does state, and leaves out a location clause it has no location for.
+  const label = finding.vuln || finding.title || advisoryLabel(finding);
+  const where = finding.file ? ` on \`${finding.file}:${line}\`` : '';
   const narrative =
-    `${finding.vuln || finding.title} on \`${finding.file}:${line}\` ` +
+    `${label}${where} ` +
     `could ${dataAtRisk.includes('rce') ? 'lead to' : 'expose'} ${dataPhrase}. ` +
     `Context: ${indProfile.label} / ${jurStr}${controlsStr}. ` +
     `Estimated cost: best ${fmtMoney(total.low)} · likely ${fmtMoney(total.likely)} · worst ${fmtMoney(total.high)}. ` +
@@ -778,6 +782,16 @@ function buildNarrative(finding, signals) {
   };
 }
 
+/** A truthful label for a finding with no `vuln` or `title`: the advisory and package it names, else a plain "Finding". */
+function advisoryLabel(f) {
+  const id = f.osvId || f.advisory || (Array.isArray(f.ids) && f.ids[0]) || null;
+  const pkg = f.name ? `${f.name}${f.version ? ` ${f.version}` : ''}` : null;
+  if (id && pkg) return `Advisory ${id} in ${pkg}`;
+  if (id) return `Advisory ${id}`;
+  if (pkg) return `Vulnerable dependency ${pkg}`;
+  return 'Finding';
+}
+
 function describeDataAtRisk(dataAtRisk, userCount) {
   const n = userCount.toLocaleString();
   if (dataAtRisk.includes('rce'))         return 'full server compromise (remote code execution)';

package/src/posture/evidence-bundle.js

@@ -47,6 +47,61 @@ import * as crypto from 'node:crypto';
 
 export const BUNDLE_SCHEMA = 'agentic-security/finding-evidence@1';
 
+// ---- issuer and trust basis (CORE-003.AC03) --------------------------------
+//
+// A signature says WHO signed and nothing about whether anyone independent
+// vouches for them. This install generates its own key, so every bundle it
+// signs is SELF-ISSUED. The `issuance` block says so inside the signed bytes,
+// so a summariser cannot drop it, and the verifier reports it back. The only
+// trust basis this build can verify is the local one; a third-party basis needs
+// a trust-root policy that does not exist here, so an unknown basis is
+// REJECTED rather than being displayed as if it were certification.
+//
+// Backward compatible: `issuance` is absent from bundles signed before this
+// field existed. Those still verify exactly as before and are reported as
+// having NO DECLARED trust basis (not as trusted, not as invalid).
+export const TRUST_BASES = Object.freeze({
+  'self-issued-local-key': Object.freeze({
+    independentlyCertified: false,
+    statement:
+      'Signed by a key this install generated for itself. It proves the bundle is unmodified since ' +
+      'this key signed it. It is NOT independent third-party certification: whoever controls this ' +
+      'install controls the key.',
+  }),
+});
+
+/** SHA-256 of the SPKI DER of a public key: the stable identity of an issuer. */
+export function keyFingerprint(publicKeyPem) {
+  const der = crypto.createPublicKey(publicKeyPem).export({ type: 'spki', format: 'der' });
+  return crypto.createHash('sha256').update(der).digest('hex');
+}
+
+/** Issuance block for a locally generated key. */
+function buildLocalIssuance(publicKeyPem) {
+  const fp = keyFingerprint(publicKeyPem);
+  return {
+    issuer: { id: `local-install:${fp.slice(0, 16)}`, kind: 'local-install', keyFingerprint: fp },
+    trustBasis: 'self-issued-local-key',
+    independentlyCertified: false,
+    statement: TRUST_BASES['self-issued-local-key'].statement,
+  };
+}
+
+/** Group/world access to key material is a defect, reported by path. */
+export function keyPermissionIssues(dir = keyDir()) {
+  const p = keyPaths(dir);
+  const issues = [];
+  try {
+    const d = fs.statSync(dir).mode & 0o077;
+    if (d) issues.push(`${dir} is accessible to group/other (mode ${(fs.statSync(dir).mode & 0o777).toString(8)})`);
+  } catch { /* absent: nothing to report */ }
+  try {
+    const m = fs.statSync(p.privateKey).mode & 0o777;
+    if (m & 0o077) issues.push(`${p.privateKey} is accessible to group/other (mode ${m.toString(8)})`);
+  } catch { /* absent */ }
+  return issues;
+}
+
 /** Where the Ed25519 signing key lives. Mirrors integrity.js's key handling. */
 function keyDir() {
   const xdg = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
@@ -142,6 +197,9 @@ export function canonicalBytes(bundle) {
     engine: bundle.engine,
     proves: bundle.proves,
     doesNotProve: bundle.doesNotProve,
+    // Only when present, so the canonical bytes (and signatures) of every
+    // bundle signed before this field existed are unchanged.
+    ...(bundle.issuance !== undefined ? { issuance: bundle.issuance } : {}),
   };
   return Buffer.from(canonicalJson(signed), 'utf8');
 }
@@ -226,11 +284,17 @@ export function buildEvidenceBundle(finding, { engineVersion, rulesetVersion, bu
   };
 }
 
-/** Sign a bundle. Returns a new object; the input is not mutated. */
+/**
+ * Sign a bundle. Returns a new object; the input is not mutated. The issuer and
+ * trust basis are derived from the signing key and signed with the bundle; a
+ * caller cannot supply a stronger basis than the one this build can verify.
+ */
 export function signEvidenceBundle(bundle, privateKeyPem) {
-  const sig = crypto.sign(null, canonicalBytes(bundle), privateKeyPem);
+  const publicKeyPem = crypto.createPublicKey(privateKeyPem).export({ type: 'spki', format: 'pem' });
+  const withIssuance = { ...bundle, issuance: buildLocalIssuance(publicKeyPem) };
+  const sig = crypto.sign(null, canonicalBytes(withIssuance), privateKeyPem);
   return {
-    ...bundle,
+    ...withIssuance,
     signature: {
       algorithm: 'ed25519',
       canonicalisation: BUNDLE_SCHEMA,
@@ -256,7 +320,7 @@ export function signEvidenceBundle(bundle, privateKeyPem) {
 // what buildEvidenceBundle+signEvidenceBundle actually produce, or a
 // legitimate bundle would start failing verification.
 const BUNDLE_TOP_LEVEL_KEYS = new Set([
-  'schema', 'finding', 'evidence', 'engine', 'proves', 'doesNotProve', 'signature',
+  'schema', 'finding', 'evidence', 'engine', 'proves', 'doesNotProve', 'issuance', 'signature',
 ]);
 
 export function verifyEvidenceBundle(bundle, publicKeyPem) {
@@ -276,7 +340,29 @@ export function verifyEvidenceBundle(bundle, publicKeyPem) {
   } catch (e) {
     return { ok: false, reason: `verification error: ${e.message}` };
   }
-  return ok
-    ? { ok: true, reason: null }
-    : { ok: false, reason: 'signature does not match the bundle contents — it was modified after signing' };
+  if (!ok) return { ok: false, reason: 'signature does not match the bundle contents — it was modified after signing' };
+
+  // Trust basis. Checked AFTER the signature so the issuance block is already
+  // known to be unmodified.
+  if (bundle.issuance === undefined) {
+    return {
+      ok: true, reason: null, trustBasis: 'none-declared', independentlyCertified: false, issuer: null,
+      trustNote: 'This bundle predates issuer declarations: no trust basis is declared. Treat it as unattested provenance, not as certification.',
+    };
+  }
+  const iss = bundle.issuance;
+  const basis = iss && typeof iss === 'object' ? TRUST_BASES[iss.trustBasis] : undefined;
+  if (!basis) return { ok: false, reason: `unsupported trust basis: ${JSON.stringify(iss?.trustBasis ?? null)}` };
+  if (iss.independentlyCertified !== false) {
+    return { ok: false, reason: 'a self-issued bundle may not claim independent certification' };
+  }
+  let fp;
+  try { fp = keyFingerprint(publicKeyPem); } catch (e) { return { ok: false, reason: `verification error: ${e.message}` }; }
+  if (iss.issuer?.keyFingerprint !== fp) {
+    return { ok: false, reason: 'the declared issuer key does not match the key that verified the signature' };
+  }
+  return {
+    ok: true, reason: null, trustBasis: iss.trustBasis, independentlyCertified: false,
+    issuer: iss.issuer, trustNote: basis.statement,
+  };
 }

package/src/posture/execution-proof.js

@@ -8,6 +8,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { runConfined, sandboxAvailable, detectBackend } from '../sandbox/index.js';
 import { attachProofTier, proofTierOf } from './proof-tier.js';
+import { emitVerification } from './verification/emit.js';
 
 const PROOF_MARKER = 'PROVEN';
 
@@ -75,7 +76,16 @@ export const DEFAULT_PROOF_TIMEOUT_MS =
     ? Number(process.env.AGENTIC_SECURITY_PROOF_TIMEOUT_MS)
     : 45000;
 
-export async function proveFinding(finding, { timeoutMs = DEFAULT_PROOF_TIMEOUT_MS, force, files } = {}) {
+// X-201: the proof result also carries the one verification record, ADDITIVELY (`proofTier` and `proofEvidence` are
+// unchanged). A PoC run under this older sandbox path is not a trusted runner, so the record says `inconclusive` for a
+// run that demonstrated the effect and for one that did not; `confirmed` takes a trusted oracle adapter.
+export async function proveFinding(finding, opts = {}) {
+  const proved = await _proveFinding(finding, opts);
+  const emitted = emitVerification('execution-proof', proved, { finding: proved, commit: opts.commit ?? null });
+  return emitted.ok ? { ...proved, verificationRecord: emitted.record } : proved;
+}
+
+async function _proveFinding(finding, { timeoutMs = DEFAULT_PROOF_TIMEOUT_MS, force, files } = {}) {
   const poc = finding?.poc;
   if (!poc?.code) {
     return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: 'no proof-of-concept attached' }));