@clear-capabilities/agentic-security-scanner 0.160.0 → 0.162.0

package/dist/9560.index.js

@@ -637,12 +637,13 @@ __webpack_require__.a(__webpack_module__, async (__webpack_handle_async_dependen
 /* harmony import */ var _posture_integrity_js__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__(71130);
 /* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_10__ = __webpack_require__(31174);
 /* harmony import */ var _posture_cache_economics_js__WEBPACK_IMPORTED_MODULE_11__ = __webpack_require__(58752);
-/* harmony import */ var _redact_js__WEBPACK_IMPORTED_MODULE_15__ = __webpack_require__(83468);
+/* harmony import */ var _redact_js__WEBPACK_IMPORTED_MODULE_16__ = __webpack_require__(83468);
 /* harmony import */ var _report_index_js__WEBPACK_IMPORTED_MODULE_12__ = __webpack_require__(75917);
-/* harmony import */ var _posture_provenance_schema_js__WEBPACK_IMPORTED_MODULE_13__ = __webpack_require__(34594);
-/* harmony import */ var _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_14__ = __webpack_require__(20095);
-/* harmony import */ var _posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_16__ = __webpack_require__(79907);
-/* harmony import */ var _posture_cve_lookup_js__WEBPACK_IMPORTED_MODULE_17__ = __webpack_require__(71364);
+/* harmony import */ var _posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__ = __webpack_require__(51864);
+/* harmony import */ var _posture_provenance_schema_js__WEBPACK_IMPORTED_MODULE_14__ = __webpack_require__(34594);
+/* harmony import */ var _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_15__ = __webpack_require__(20095);
+/* harmony import */ var _posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_17__ = __webpack_require__(79907);
+/* harmony import */ var _posture_cve_lookup_js__WEBPACK_IMPORTED_MODULE_18__ = __webpack_require__(71364);
 var __webpack_async_dependencies__ = __webpack_handle_async_dependencies__([_report_index_js__WEBPACK_IMPORTED_MODULE_12__]);
 _report_index_js__WEBPACK_IMPORTED_MODULE_12__ = (__webpack_async_dependencies__.then ? (await __webpack_async_dependencies__)() : __webpack_async_dependencies__)[0];
 // MCP tool implementations — PRD Feature 2, hardened against the OWASP MCP
@@ -673,6 +674,8 @@ _report_index_js__WEBPACK_IMPORTED_MODULE_12__ = (__webpack_async_dependencies__
 
 
 
+// X-206: the one projection of the verification record, shared with the JSON report, the text report and the autopilot response.
+
 // Git-origin provenance (Finding Provenance M0/M1). Distinct from
 // `finding.provenance` (AI-authorship) and from an SCA entry's `provenance`
 // (Sigstore/SLSA attestation) — see report/index.js's import comment.
@@ -996,7 +999,7 @@ function _maybeOffload(sessionRoot, toolName, items) {
 //
 // Exported under the `_internals` convention this codebase already uses
 // (see posture/poc-inprocess.js). Not part of the MCP tool surface.
-const _internals = { _confine, isReservedWrite: _isReservedWritePath };
+const _internals = { _confine, isReservedWrite: _isReservedWritePath, checkMultiFileTargets: _checkMultiFileTargets, multiFilePlanDigest: _multiFilePlanDigest };
 
 const scan_diff = {
   name: 'scan_diff',
@@ -1057,7 +1060,7 @@ const scan_diff = {
     // Haskell and Nix results depend on imported modules and manifests, so the files asked about are scanned together
     // with their import closure (read from disk, bounded). Findings are still reported only for the requested files.
     const wantSet = new Set(Object.keys(fileContents));
-    const { withLanguageContext } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 15911));
+    const { withLanguageContext } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 52603));
     const lc = withLanguageContext(sessionRoot, fileContents, {});
     const result = await (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_10__/* .withStateWritesDisabled */ .Ao)(() =>
       runScan(sessionRoot, { network: false, fileContents: lc.fileContents, depFileContents: lc.depFileContents, deep: true, deepInCi: true }));
@@ -1085,7 +1088,7 @@ const scan_diff = {
     // scanning), left as-is rather than silently claimed fixed here.
     const findings = (0,_report_index_js__WEBPACK_IMPORTED_MODULE_12__.normalizeFindings)(result.scan)
       .filter(f => wantSet.has(String(f.file || '').replace(/\\/g, '/')) && (sevRank[f.severity] ?? 0) >= min)
-      .map(f => (0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactFinding */ .lE)({
+      .map(f => (0,_redact_js__WEBPACK_IMPORTED_MODULE_16__/* .redactFinding */ .lE)({
         id: f.id, severity: f.severity, file: f.file, line: f.line,
         title: f.vuln, cwe: f.cwe,
         description: f.description, remediation: f.remediation,
@@ -1148,7 +1151,7 @@ const query_taint = {
       const hay = [f.description, f.title, f.vuln, f.snippet, JSON.stringify(f.trace || '')].join(' ').toLowerCase();
       return hay.includes(srcL) && hay.includes(sinkL);
     });
-    const page = all.slice(off, off + lim).map(f => (0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactFinding */ .lE)({
+    const page = all.slice(off, off + lim).map(f => (0,_redact_js__WEBPACK_IMPORTED_MODULE_16__/* .redactFinding */ .lE)({
       id: f.id, severity: f.severity, file: f.file, line: f.line,
       title: f.title || f.vuln, description: f.description,
       trace: f.trace || null,
@@ -1186,7 +1189,7 @@ const explain_finding = {
     if (!scan) throw new Error(`No usable scan state (${status}).`);
     const f = _findById(scan, finding_id);
     if (!f) throw new Error(`Finding not found: ${finding_id}`);
-    const redacted = (0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactFinding */ .lE)({
+    const redacted = (0,_redact_js__WEBPACK_IMPORTED_MODULE_16__/* .redactFinding */ .lE)({
       id: f.id, severity: f.severity, file: f.file, line: f.line,
       title: f.title || f.vuln, cwe: f.cwe,
       description: f.description, remediation: f.remediation,
@@ -1243,17 +1246,164 @@ const explain_finding = {
       // logins/CODEOWNERS lines) through this MCP surface because this call
       // passed no options object at all, silently defeating their policy at
       // this one output boundary while report/index.js honoured it.
-      findingProvenance: f.findingProvenance ? (0,_posture_provenance_schema_js__WEBPACK_IMPORTED_MODULE_13__/* .redactFindingProvenance */ .As)(f.findingProvenance, {
+      findingProvenance: f.findingProvenance ? (0,_posture_provenance_schema_js__WEBPACK_IMPORTED_MODULE_14__/* .redactFindingProvenance */ .As)(f.findingProvenance, {
         pseudonymize: process.env.AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS === '1',
       }) : null,
+      // X-206: the same verification projection the JSON and text reports carry; absent when the finding has no record.
+      ...(f.verificationRecord && typeof f.verificationRecord === 'object'
+        ? { verificationRecord: f.verificationRecord, ...(0,_posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__/* .verificationFields */ .ze)(f.verificationRecord, { replay: f.verificationReplay }) }
+        : {}),
     };
   },
 };
 
+// FR-307/FR-1002/FR-1003: the high-impact-change approval gate (approval evidence, approver identity, separation of duties),
+// shared by the caller-patch branch and the multi-file plan branch so the two cannot drift. Returns a refusal result, or null
+// when the change is not high-impact or is properly approved.
+function _highImpactApprovalRefusal(ctx, materialClassification, fixMeta) {
+  if (!materialClassification.highImpactCategories.length) return null;
+  const cats = materialClassification.highImpactCategories.join(', ');
+  const approval = fixMeta && typeof fixMeta === 'object' ? fixMeta.approval : null;
+  const hasApprovalEvidence = !!(approval && typeof approval === 'object' &&
+    typeof approval.approvedBy === 'string' && approval.approvedBy.trim().length > 0 &&
+    typeof approval.reason === 'string' && approval.reason.trim().length > 0);
+  if (!hasApprovalEvidence) {
+    return {
+      _meta: META, applied: false,
+      reason: `high-impact change (${cats}) requires approval evidence — pass fixMeta.approval: {approvedBy, reason} — before it can be applied`,
+      materialClassification,
+    };
+  }
+  const approverRegistry = (0,_fix_approver_registry_js__WEBPACK_IMPORTED_MODULE_7__.loadApproverRegistry)(ctx.sessionRoot);
+  const requiredRoles = (0,_fix_approver_registry_js__WEBPACK_IMPORTED_MODULE_7__/* .requiredRolesFor */ .K)(approverRegistry, materialClassification.highImpactCategories);
+  const identityCheck = (0,_fix_approver_registry_js__WEBPACK_IMPORTED_MODULE_7__.verifyApprover)(approverRegistry, approval.approvedBy, requiredRoles);
+  if (!identityCheck.verified) {
+    return { _meta: META, applied: false, reason: `high-impact change (${cats}) approval rejected: ${identityCheck.reason}`, materialClassification };
+  }
+  // FR-1003: separation-of-duties, same no-op-unless-configured gate as apply-fix-service.js's own copy; see approver-registry.js.
+  const sodCheck = (0,_fix_approver_registry_js__WEBPACK_IMPORTED_MODULE_7__.checkSeparationOfDuties)(approverRegistry, fixMeta?.author, approval.approvedBy);
+  if (!sodCheck.ok) {
+    return { _meta: META, applied: false, reason: `high-impact change (${cats}) approval rejected: ${sodCheck.reason}`, materialClassification };
+  }
+  return null;
+}
+
+// ─── Multi-file plans (apply_fix with plan_digest) ───────────────────────────
+// A NixOS option fix can edit several files at once (every definition at the winning priority). apply_fix never accepts file
+// contents for this: it RECOMPUTES the plan from the signed finding and the live tree, and writes only if that plan's digest is
+// the one synthesize_fix returned. The digest binds the finding, every file path, the exact pre-image and the exact post-image
+// of each edit, so a changed tree, a changed finding, or an altered digest all refuse. The write itself is the language
+// lifecycle's all-or-nothing writeManyWithBackup (one backup per file, one history group, honest rollback).
+const MULTI_FILE_MAX = 8;
+const _sha256 = (t) => node_crypto__WEBPACK_IMPORTED_MODULE_3__.createHash('sha256').update(String(t), 'utf8').digest('hex');
+function _multiFilePlanDigest(finding, edits) {
+  const canon = edits.map((e) => ({ file: String(e.file), before: _sha256(e.before), after: _sha256(e.after) })).sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : 0));
+  return _sha256(JSON.stringify({ v: 'mf-plan/1', id: finding.id || null, stableId: finding.stableId || null, edits: canon }));
+}
+// Every file of a multi-file plan gets the SAME checks a single-file apply_fix target gets: root-relative lexical form,
+// confinement (no symlink leaf, no symlinked parent, no escape), reserved-write list, and existence. Returns {ok, reason, abs}.
+function _checkMultiFileTargets(sessionRoot, edits) {
+  if (!Array.isArray(edits) || edits.length < 2) return { ok: false, reason: 'a multi-file plan needs at least two edits' };
+  if (edits.length > MULTI_FILE_MAX) return { ok: false, reason: `a multi-file plan may edit at most ${MULTI_FILE_MAX} files` };
+  const rootReal = node_fs__WEBPACK_IMPORTED_MODULE_0__.realpathSync(node_path__WEBPACK_IMPORTED_MODULE_2__.resolve(sessionRoot));
+  const seen = new Set();
+  const abs = {};
+  for (const e of edits) {
+    const rel = e && e.file;
+    if (typeof rel !== 'string' || !rel || rel.includes('\0') || rel.includes('\\') || node_path__WEBPACK_IMPORTED_MODULE_2__.isAbsolute(rel) || rel.split('/').some((seg) => seg === '..' || seg === '.' || seg === '')) {
+      return { ok: false, reason: `path-escape refused: plan file "${node_path__WEBPACK_IMPORTED_MODULE_2__.isAbsolute(String(rel)) ? '(absolute path)' : String(rel).slice(0, 120)}" is not a clean root-relative path` };
+    }
+    if (seen.has(rel)) return { ok: false, reason: `the same file appears twice in the plan: ${rel}` };
+    seen.add(rel);
+    let real;
+    try { real = _confine(sessionRoot, rel, 'plan file'); }
+    catch (err) { return { ok: false, reason: `path-escape refused: ${String(err.message).split(rootReal).join('<root>')}` }; }
+    if (node_path__WEBPACK_IMPORTED_MODULE_2__.relative(rootReal, real).split(node_path__WEBPACK_IMPORTED_MODULE_2__.sep).join('/') !== rel) return { ok: false, reason: `path-escape refused: plan file "${rel}" resolves through a symbolic link` };
+    if (_isReservedWritePath(sessionRoot, real)) return { ok: false, reason: `reserved path refused: ${rel}` };
+    if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(real)) return { ok: false, reason: `plan file not found: ${rel}` };
+    abs[rel] = real;
+  }
+  return { ok: true, abs };
+}
+const _scrubRoot = (sessionRoot, text) => {
+  let out = String(text);
+  const roots = new Set([node_path__WEBPACK_IMPORTED_MODULE_2__.resolve(sessionRoot)]);
+  try { roots.add(node_fs__WEBPACK_IMPORTED_MODULE_0__.realpathSync(node_path__WEBPACK_IMPORTED_MODULE_2__.resolve(sessionRoot))); } catch { /* root vanished: the plain path is still scrubbed */ }
+  for (const r of roots) out = out.split(r).join('<root>');
+  return (0,_redact_js__WEBPACK_IMPORTED_MODULE_16__/* .redactString */ .rd)(out);
+};
+const _gateSummary = (g) => (g ? {
+  path: g.path ? g.path.ok : undefined, syntax: g.syntax ? g.syntax.ok : undefined,
+  rescan: g.rescan ? { ok: g.rescan.ok, originalGone: g.rescan.originalGone, newMediumOrHigher: g.rescan.newMediumOrHigher } : undefined,
+  effective: g.effective ? { ok: g.effective.ok, ran: g.effective.ran === true, detail: g.effective.detail } : undefined,
+  compile: g.compile ? { ran: g.compile.ran === true, ok: g.compile.ok } : undefined,
+} : null);
+
+async function _applyMultiFilePlan({ f, planDigest, dryRun, fixMeta, ctx, status }) {
+  const refuse = (reason, extra = {}) => ({ _meta: META, applied: false, multiFile: true, reason, ...extra });
+  if (typeof planDigest !== 'string' || !/^[0-9a-f]{64}$/.test(planDigest)) return refuse('plan_digest must be the 64-character hex digest returned by synthesize_fix');
+  if (!f.stableId) return refuse('finding has no stableId, so a plan cannot be verified against it');
+  const lc = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 52603));
+  if (lc.languageOfFinding(f) !== 'nix') return refuse('multi-file plans are produced for NixOS findings only');
+  const nf = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 57820));
+  const proj = lc.loadLanguageProject(ctx.sessionRoot);
+  const files = proj.files;
+  // The plan is derived here, from the signed finding and the live tree. Nothing the caller sends can supply file content.
+  const plan = nf.planNixFix(f, files);
+  if (!plan || plan.ok === false) return refuse(`no applicable plan: ${_scrubRoot(ctx.sessionRoot, (plan && plan.reason) || 'no deterministic fix')}`);
+  if (!Array.isArray(plan.edits) || plan.edits.length < 2) return refuse('this finding has a single-file plan; use apply_fix without plan_digest');
+  if (_multiFilePlanDigest(f, plan.edits) !== planDigest) {
+    return refuse('plan_digest does not match the plan computed now for this finding: the project files or the finding changed since synthesize_fix, or the digest was altered. Run synthesize_fix again and review the new plan.', { stale: true });
+  }
+  const targets = _checkMultiFileTargets(ctx.sessionRoot, plan.edits);
+  if (!targets.ok) return refuse(targets.reason);
+  const classification = (0,_posture_material_change_js__WEBPACK_IMPORTED_MODULE_6__/* .classifyFixMaterialRisk */ .kz)(Object.fromEntries(plan.edits.map((e) => [e.file, { before: e.before, after: e.after }])));
+  if (!dryRun) {
+    const approvalRefusal = _highImpactApprovalRefusal(ctx, classification, fixMeta);
+    if (approvalRefusal) return { ...approvalRefusal, multiFile: true };
+  }
+  // The verification gates (syntax, rescan with no new finding, effective value changed as intended) run inside the lifecycle,
+  // and the pre-write hook re-checks the digest of the VERIFIED edits and the targets immediately before the first byte is written.
+  const preWrite = (verifiedPlan) => {
+    const vedits = Array.isArray(verifiedPlan.edits) ? verifiedPlan.edits : [];
+    if (_multiFilePlanDigest(f, vedits) !== planDigest) return { ok: false, detail: 'the verified plan differs from the previewed plan' };
+    const again = _checkMultiFileTargets(ctx.sessionRoot, vedits);
+    return again.ok ? { ok: true } : { ok: false, detail: again.reason };
+  };
+  let res;
+  try { res = await nf.validateNixFix(f, { files, apply: !dryRun, root: ctx.sessionRoot, preWrite }); }
+  catch (e) { return refuse(`plan verification failed: ${_scrubRoot(ctx.sessionRoot, e.message)}`); }
+  const gates = _gateSummary(res.gates);
+  const touched = plan.edits.map((e) => e.file);
+  if (res.status === 'verified' && dryRun) {
+    return { _meta: META, applied: false, dryRun: true, verified: true, multiFile: true, files: touched, planDigest, gates, materialClassification: classification, diff: res.preview };
+  }
+  if (res.status === 'applied') {
+    let acceptance = null;
+    try { acceptance = (0,_posture_fix_history_js__WEBPACK_IMPORTED_MODULE_4__/* .fixAcceptanceRate */ .XR)(ctx.sessionRoot); } catch { /* best-effort */ }
+    const hist = Array.isArray(res.history) ? res.history : [];
+    const allRecorded = hist.length === touched.length && hist.every(Boolean);
+    return {
+      _meta: META, applied: true, verified: true, multiFile: true, files: touched, planDigest,
+      groupId: res.backup && res.backup.id, historyIds: hist.map((h) => (h ? h.id : null)),
+      ...(allRecorded ? {} : { warning: 'the files were written and backed up, but the fix history could not record every entry; restore with the group backup under .agentic-security/fix-backups' }),
+      gates, integrity: status, acceptance, materialClassification: classification,
+    };
+  }
+  // Blocked or failed: nothing is left changed unless rollbackIncomplete says otherwise.
+  const incomplete = res.rolledBack === false;
+  return {
+    _meta: META, applied: false, multiFile: true, files: touched,
+    reason: _scrubRoot(ctx.sessionRoot, res.reason || `plan not applied (${res.status})`),
+    gates,
+    ...(res.rolledBack !== undefined ? { rolledBack: res.rolledBack === true, rollbackIncomplete: incomplete, ...(incomplete ? { restoreManually: (res.rollbackFailed || []).map(String) } : {}) } : {}),
+  };
+}
+
 // ─── apply_fix ───────────────────────────────────────────────────────────────
 const apply_fix = {
   name: 'apply_fix',
-  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing. On success, `verified:true` means verification passed but `verifiedFull:true` is the honest signal that every required leg (lint when configured, tests when a runner exists) genuinely ran — a false `verifiedFull` with `verified:true` means the pass is real but degraded (see `verify.degradedLegs`), not a full verification.',
+  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing. On success, `verified:true` means verification passed but `verifiedFull:true` is the honest signal that every required leg (lint when configured, tests when a runner exists) genuinely ran — a false `verifiedFull` with `verified:true` means the pass is real but degraded (see `verify.degradedLegs`), not a full verification. MULTI-FILE NixOS FIX: when synthesize_fix returns `languageFix.planDigest` (an option defined in several files, edited together), pass it back as `plan_digest`. apply_fix then RECOMPUTES the plan itself from the signed finding and the live files, refuses unless its digest matches (so a changed tree, a changed finding or an altered digest all refuse; you never send file content), applies the same confinement, reserved-path, shadow and high-impact-approval checks to EVERY file, runs the verification gates (syntax, rescan with no new finding, the option resolves to the intended value on the patched configuration) before writing, and writes all files or none with one backup per file and one history group that `undo` reverts together. A rollback that could not complete is reported as `rollbackIncomplete` with the files to restore. `plan_digest` cannot be combined with `patch`.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -1261,6 +1411,7 @@ const apply_fix = {
       finding_id: { type: 'string', minLength: 1, maxLength: 256 },
       confirm: { type: 'boolean' },
       dry_run: { type: 'boolean' },
+      plan_digest: { type: 'string', minLength: 64, maxLength: 64 },
       patch: {
         type: 'object',
         additionalProperties: { type: 'string', maxLength: 500_000 },
@@ -1320,7 +1471,7 @@ const apply_fix = {
     },
     required: ['finding_id', 'confirm'],
   },
-  async handler({ finding_id, confirm, dry_run = false, patch = null, fixMeta = null }, ctx) {
+  async handler({ finding_id, confirm, dry_run = false, patch = null, fixMeta = null, plan_digest = null }, ctx) {
     if (confirm !== true) {
       return { _meta: META, applied: false, reason: 'apply_fix requires confirm: true.' };
     }
@@ -1334,6 +1485,15 @@ const apply_fix = {
       return { _meta: META, applied: false, reason: 'shadow findings cannot be auto-applied' };
     }
 
+    // Multi-file plan (a NixOS option defined in several files). The plan is recomputed here and bound by plan_digest; the
+    // caller can never supply file content on this path, and it cannot be combined with `patch`.
+    if (plan_digest !== null && plan_digest !== undefined) {
+      if (patch && typeof patch === 'object' && Object.keys(patch).length) {
+        return { _meta: META, applied: false, reason: 'plan_digest and patch cannot be combined: a multi-file plan is computed by the scanner, not supplied by the caller' };
+      }
+      return _applyMultiFilePlan({ f, planDigest: plan_digest, dryRun: dry_run === true, fixMeta, ctx, status });
+    }
+
     // #3 — verifier-approved patch path. When the caller supplies `patch` (a
     // files map, same shape as verify_fix), apply_fix re-runs the verifier
     // INLINE and writes only if it passes: the original finding's stableId is
@@ -1369,7 +1529,7 @@ const apply_fix = {
           // default. Normalized to the scan+lint verdict shape used below.
           const { verifyFixWithTests } = await __webpack_require__.e(/* import() */ 4113).then(__webpack_require__.bind(__webpack_require__, 64113));
           const t = await verifyFixWithTests({ scanRoot: ctx.sessionRoot, originalFindingStableId: f.stableId, files: _files });
-          verdict = { ok: t.ok, summary: t.summary, rescan: t.legs?.scan?.detail, lint: t.legs?.lint?.detail, tests: t.legs?.tests, testVerdict: t.verdict };
+          verdict = { ok: t.ok, summary: t.summary, rescan: t.legs?.scan?.detail, lint: t.legs?.lint?.detail, tests: t.legs?.tests, testVerdict: t.verdict, verificationRecord: t.verificationRecord ?? null };
         } else {
           const verifyFixCore = await getVerifyFixCore();
           verdict = await verifyFixCore({
@@ -1387,6 +1547,9 @@ const apply_fix = {
           _meta: META, applied: false,
           reason: `patch rejected by verifier: ${verdict.summary || verdict.rescan?.reason || 'did not verify'}`,
           verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok }, honesty: verdict.honesty || null },
+          // X-201: the same version-1 verification record every surface emits (additive; null when none could be formed).
+          verificationRecord: verdict.verificationRecord ?? null,
+          ...(0,_posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__/* .verificationFields */ .ze)(verdict.verificationRecord),
         };
       }
       // FR-307/FR-1002/D-0024: this caller-supplied-patch branch writes via
@@ -1407,41 +1570,10 @@ const apply_fix = {
       }
       const materialClassification = (0,_posture_material_change_js__WEBPACK_IMPORTED_MODULE_6__/* .classifyFixMaterialRisk */ .kz)(filesForMaterialClassification);
       if (dry_run) {
-        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, materialClassification };
-      }
-      if (materialClassification.highImpactCategories.length) {
-        const approval = fixMeta && typeof fixMeta === 'object' ? fixMeta.approval : null;
-        const hasApprovalEvidence = !!(approval && typeof approval === 'object' &&
-          typeof approval.approvedBy === 'string' && approval.approvedBy.trim().length > 0 &&
-          typeof approval.reason === 'string' && approval.reason.trim().length > 0);
-        if (!hasApprovalEvidence) {
-          return {
-            _meta: META, applied: false,
-            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) requires approval evidence — pass fixMeta.approval: {approvedBy, reason} — before it can be applied`,
-            materialClassification,
-          };
-        }
-        const approverRegistry = (0,_fix_approver_registry_js__WEBPACK_IMPORTED_MODULE_7__.loadApproverRegistry)(ctx.sessionRoot);
-        const requiredRoles = (0,_fix_approver_registry_js__WEBPACK_IMPORTED_MODULE_7__/* .requiredRolesFor */ .K)(approverRegistry, materialClassification.highImpactCategories);
-        const identityCheck = (0,_fix_approver_registry_js__WEBPACK_IMPORTED_MODULE_7__.verifyApprover)(approverRegistry, approval.approvedBy, requiredRoles);
-        if (!identityCheck.verified) {
-          return {
-            _meta: META, applied: false,
-            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${identityCheck.reason}`,
-            materialClassification,
-          };
-        }
-        // FR-1003: separation-of-duties, same no-op-unless-configured gate
-        // as apply-fix-service.js's own copy — see approver-registry.js.
-        const sodCheck = (0,_fix_approver_registry_js__WEBPACK_IMPORTED_MODULE_7__.checkSeparationOfDuties)(approverRegistry, fixMeta?.author, approval.approvedBy);
-        if (!sodCheck.ok) {
-          return {
-            _meta: META, applied: false,
-            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${sodCheck.reason}`,
-            materialClassification,
-          };
-        }
+        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, verificationRecord: verdict.verificationRecord ?? null, ...(0,_posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__/* .verificationFields */ .ze)(verdict.verificationRecord), materialClassification };
       }
+      const approvalRefusal = _highImpactApprovalRefusal(ctx, materialClassification, fixMeta);
+      if (approvalRefusal) return approvalRefusal;
       const written = [];
       try {
         for (const [rel, v] of Object.entries(confinedAbs)) {
@@ -1469,7 +1601,7 @@ const apply_fix = {
       }
       let acceptance = null;
       try { acceptance = (0,_posture_fix_history_js__WEBPACK_IMPORTED_MODULE_4__/* .fixAcceptanceRate */ .XR)(ctx.sessionRoot); } catch { /* best-effort */ }
-      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance, materialClassification };
+      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary, verificationRecord: verdict.verificationRecord ?? null, ...(0,_posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__/* .verificationFields */ .ze)(verdict.verificationRecord) }, acceptance, materialClassification };
     }
 
     if (typeof f.fix?.replacement !== 'string') {
@@ -1558,7 +1690,7 @@ const apply_fix = {
 // proceed with apply_fix.
 const verify_fix = {
   name: 'verify_fix',
-  description: 'Verify a proposed patch before applying. Re-scans the patched files in memory, runs the project linter, runs the project test suite, checks fix honesty (FULL/MITIGATION/WORKAROUND) when fixMeta is supplied, and re-runs the PoC when one exists. Returns { ok, rescan, lint, tests, honesty, poc, summary }. Does not write to the target project’s own files, but DOES append one record per attempt to .agentic-security/fix-metrics.jsonl for the measured fix-loop.',
+  description: 'Verify a proposed patch before applying. Re-scans the patched files in memory, runs the project linter, runs the project test suite, checks fix honesty (FULL/MITIGATION/WORKAROUND) when fixMeta is supplied, and re-runs the PoC when one exists. Returns { ok, rescan, lint, tests, honesty, poc, summary, verificationRecord } (verificationRecord is the shared version-1 record: outcome is one of not-run, unsupported, inconclusive, error, refuted, confirmed, and a static re-scan alone is never reported as confirmed; verificationView is the shared projection every interface shows for it, with state, scope, evidence ids, replay prerequisites and what was and was not verified). Does not write to the target project’s own files, but DOES append one record per attempt to .agentic-security/fix-metrics.jsonl for the measured fix-loop.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -1646,7 +1778,7 @@ const verify_fix = {
         _meta: META,
         ok: r.ok,
         rescan: { ok: r.rescan.ok, reason: r.rescan.reason, introduced: r.rescan.introduced || [] },
-        lint: { runner: r.lint.runner, ok: r.lint.ok, skipped: r.lint.skipped || false, output: (0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactString */ .rd)(r.lint.output || '').slice(0, 1500) },
+        lint: { runner: r.lint.runner, ok: r.lint.ok, skipped: r.lint.skipped || false, output: (0,_redact_js__WEBPACK_IMPORTED_MODULE_16__/* .redactString */ .rd)(r.lint.output || '').slice(0, 1500) },
         // verifyFix computes five legs, not two — tests/honesty/poc were
         // being silently dropped here, leaving an agent with no structured
         // way to see WHY verification failed when the failure was in one
@@ -1657,8 +1789,12 @@ const verify_fix = {
         // it can echo proof-harness detail derived from scanned source.
         tests: r.tests,
         honesty: r.honesty,
-        poc: r.poc ? { ...r.poc, reason: r.poc.reason ? (0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactString */ .rd)(r.poc.reason) : r.poc.reason } : r.poc,
+        poc: r.poc ? { ...r.poc, reason: r.poc.reason ? (0,_redact_js__WEBPACK_IMPORTED_MODULE_16__/* .redactString */ .rd)(r.poc.reason) : r.poc.reason } : r.poc,
         summary: r.summary,
+        // X-201: the one version-1 verification record (additive). It states what was actually established, e.g.
+        // `not-run` when no exploit oracle executed against the patch, never a bare pass/fail.
+        verificationRecord: r.verificationRecord ?? null,
+        ...(0,_posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__/* .verificationFields */ .ze)(r.verificationRecord),
       };
     } catch (e) {
       return { _meta: META, ok: false, reason: `verify_fix failed: ${e.message}` };
@@ -1672,7 +1808,7 @@ const verify_fix = {
 // sequence with the returned blob.
 const synthesize_fix = {
   name: 'synthesize_fix',
-  description: 'Return the stored fix replacement for a finding (replacement text + remediation + plan if the patch is too large). Read-only; never writes to disk. Use verify_fix → apply_fix to deploy.',
+  description: 'Return the stored fix replacement for a finding (replacement text + remediation + plan if the patch is too large). Read-only; never writes to disk. Use verify_fix → apply_fix to deploy. For a NixOS option defined in several files, `languageFix.multiFile` lists every file, `languageFix.edits` gives each file\'s before/after SHA-256 (no file content) and `languageFix.planDigest` is the value to pass to apply_fix as `plan_digest`; the preview is verified but nothing is written.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -1721,13 +1857,20 @@ const synthesize_fix = {
       // FULL / MITIGATION / WORKAROUND tier. It writes nothing; apply_fix re-verifies before anything lands.
       if (!autofix) {
         try {
-          const lc = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 15911));
+          const lc = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 52603));
           if (lc.languageOfFinding(f)) {
             const proj = lc.loadLanguageProject(ctx.sessionRoot);
             const prev = await lc.languageFixPreview(f, proj.files);
             languageFix = { status: prev.status, ok: prev.ok, label: prev.label || null, tier: prev.tier || null, reason: prev.reason || null, diff: prev.diff || null, explanation: prev.explanation || null, consequences: prev.consequences || [] };
-            // apply_fix writes ONE file; a fix that spans several files must go through the CLI lifecycle (atomic, grouped undo).
-            if (prev.ok && prev.edits) languageFix.multiFile = prev.edits.map((e) => e.file);
+            // A fix that spans several files is applied with apply_fix + plan_digest (atomic, one history group); see _applyMultiFilePlan.
+            if (prev.ok && prev.edits) {
+              languageFix.multiFile = prev.edits.map((e) => e.file);
+              // The digest binds finding + every file + exact pre/post image. Pass it to apply_fix as plan_digest; apply_fix
+              // recomputes the plan itself and refuses on any difference. No file content is ever sent back to apply_fix.
+              languageFix.planDigest = _multiFilePlanDigest(f, prev.edits);
+              languageFix.edits = prev.edits.map((e) => ({ file: e.file, beforeSha256: _sha256(e.before), afterSha256: _sha256(e.after) }));
+              languageFix.applyWith = { finding_id: f.id, confirm: true, plan_digest: languageFix.planDigest };
+            }
             else if (prev.ok) autofix = { deterministic: true, ruleId: f.rule || f.family || null, patch: prev.after, file: prev.file, label: prev.label || null, verified: true };
           }
         } catch { /* best-effort: the preview is advisory */ }
@@ -1994,7 +2137,7 @@ const append_agents_memory = {
     required: ['agent', 'body'],
   },
   async handler({ agent, body }, ctx) {
-    const r = (0,_posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_16__/* .appendAgentsMemory */ .eu)(ctx.sessionRoot, { agent, body });
+    const r = (0,_posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_17__/* .appendAgentsMemory */ .eu)(ctx.sessionRoot, { agent, body });
     return { _meta: META, ...r };
   },
 };
@@ -2010,7 +2153,7 @@ const read_agents_memory = {
     },
   },
   async handler({ full }, ctx) {
-    const body = (0,_posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_16__/* .readAgentsMemory */ .ox)(ctx.sessionRoot);
+    const body = (0,_posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_17__/* .readAgentsMemory */ .ox)(ctx.sessionRoot);
     if (!body) return { _meta: META, present: false };
     if (full) return { _meta: META, present: true, length: body.length, content: body };
     // Tail-only — same logic as summarizeForSession but inlined to avoid a
@@ -2054,7 +2197,7 @@ const query_triage_memory = {
     // they landed in, rather than hardcoding a field allowlist that could
     // miss one.
     let results;
-    try { results = JSON.parse((0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactString */ .rd)(JSON.stringify(raw))); }
+    try { results = JSON.parse((0,_redact_js__WEBPACK_IMPORTED_MODULE_16__/* .redactString */ .rd)(JSON.stringify(raw))); }
     catch { results = raw; }
     return {
       _meta: META,
@@ -2090,7 +2233,7 @@ const query_findings_memory = {
     // whole-structure redactString round-trip is applied rather than a
     // per-field allowlist that could miss one of the four shapes.
     let body;
-    try { body = JSON.parse((0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactString */ .rd)(JSON.stringify(raw))); }
+    try { body = JSON.parse((0,_redact_js__WEBPACK_IMPORTED_MODULE_16__/* .redactString */ .rd)(JSON.stringify(raw))); }
     catch { body = raw; }
     return { _meta: META, ...body };
   },
@@ -2112,7 +2255,7 @@ const lookup_cve = {
     required: ['cve'],
   },
   async handler({ cve }, _ctx) {
-    const r = (0,_posture_cve_lookup_js__WEBPACK_IMPORTED_MODULE_17__/* .lookupCve */ .x)(cve);
+    const r = (0,_posture_cve_lookup_js__WEBPACK_IMPORTED_MODULE_18__/* .lookupCve */ .x)(cve);
     return { _meta: META, ...r };
   },
 };
@@ -2217,7 +2360,7 @@ const apply_sca_upgrade = {
   },
 };
 
-const ALL_TOOLS = [scan_diff, query_taint, explain_finding, apply_fix, verify_fix, synthesize_fix, find_rule_module, append_scratchpad, read_scratchpad, append_agents_memory, read_agents_memory, lookup_cve, synthesize_sca_upgrade, apply_sca_upgrade, query_triage_memory, query_findings_memory, query_cache_telemetry, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_14__/* .dataflow_get_graph */ .HX, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_14__/* .dataflow_get_node */ .HI, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_14__/* .dataflow_get_edge */ .gC, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_14__/* .dataflow_get_flow */ .ri];
+const ALL_TOOLS = [scan_diff, query_taint, explain_finding, apply_fix, verify_fix, synthesize_fix, find_rule_module, append_scratchpad, read_scratchpad, append_agents_memory, read_agents_memory, lookup_cve, synthesize_sca_upgrade, apply_sca_upgrade, query_triage_memory, query_findings_memory, query_cache_telemetry, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_15__/* .dataflow_get_graph */ .HX, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_15__/* .dataflow_get_node */ .HI, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_15__/* .dataflow_get_edge */ .gC, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_15__/* .dataflow_get_flow */ .ri];
 
 __webpack_async_result__();
 } catch(e) { __webpack_async_result__(e); } });