@clear-capabilities/agentic-security-scanner 0.161.0 → 0.162.0

package/src/posture/assurance/verification-record.js

@@ -0,0 +1,258 @@
+// The one verification record (CORE-002; X-201 builds every surface on it).
+//
+// Shape: hypothesis id, commit, detector origin, oracle, attempt, outcome,
+// reason, evidence items + references, applicable scope, and a SEPARATE repair
+// status.
+//
+// Structural honesty rules, enforced by the validator (not by convention):
+//   1. The six outcomes are distinct: not-run, unsupported, inconclusive, error,
+//      refuted, confirmed. Nothing here collapses them to a boolean.
+//   2. Evidence kinds are distinct: observation, inference, independent
+//      adjudication, trusted runtime proof. Each kind constrains who may have
+//      produced it: a model can only ever produce an inference; trusted runtime
+//      proof only comes from a trusted runner; an adjudication only from a human
+//      or an independent verifier.
+//   3. `confirmed` needs referenced evidence of runtime proof or independent
+//      adjudication, so a model-generated verdict alone cannot yield it, and the
+//      record carries a `confirmationLevel` that must equal the level derived from
+//      its evidence ('runtime-confirmed' needs trusted-runtime-proof AND a runtime
+//      oracle). A forged level fails the derivation check.
+//   4. `refuted` needs an applicable (non-model) oracle, valid preconditions and
+//      proving evidence: a missing taint path is not refutation of an
+//      authorization or workflow claim.
+//   5. Repair status is a different axis from the outcome. `replay-verified`
+//      needs the id of the patched-negative verification record.
+
+import {
+  SCHEMA_VERSION, makeCtx, result, guardObject, checkHeader, checkFields, checkEnum, checkDigest,
+  checkCommit, checkString, checkId, isPlainObject,
+} from './schema-kit.js';
+import { semanticId, ID_PREFIXES } from './identity.js';
+
+export const VERIFICATION_SCHEMA = 'agentic-security/verification-record';
+
+export const VERIFICATION_OUTCOMES = Object.freeze(['not-run', 'unsupported', 'inconclusive', 'error', 'refuted', 'confirmed']);
+export const REPAIR_STATUSES = Object.freeze(['none', 'proposed', 'applied', 'replay-verified', 'rolled-back']);
+export const EVIDENCE_KINDS = Object.freeze(['observation', 'inference', 'independent-adjudication', 'trusted-runtime-proof']);
+export const EVIDENCE_PRODUCERS = Object.freeze(['model', 'tool', 'human', 'independent-verifier', 'trusted-runner']);
+export const ORACLE_KINDS = Object.freeze(['runtime-replay', 'differential', 'static-proof', 'model', 'human', 'none']);
+export const CONFIRMATION_LEVELS = Object.freeze(['runtime-confirmed', 'adjudicated', 'none']);
+
+const RUNTIME_ORACLES = ['runtime-replay', 'differential'];
+const APPLICABLE_FOR_REFUTATION = ['runtime-replay', 'differential', 'static-proof', 'human'];
+const NO_EXECUTION_OUTCOMES = ['not-run', 'unsupported'];
+
+const ALLOWED = [
+  'schema', 'schemaVersion', 'id', 'hypothesisId', 'commit', 'detectorOrigin', 'oracle', 'attempt', 'outcome', 'reason',
+  'evidence', 'evidenceRefs', 'scope', 'preconditions', 'confirmationLevel', 'repair', 'migration', 'createdAt',
+];
+const REQUIRED = [
+  'schema', 'schemaVersion', 'id', 'hypothesisId', 'commit', 'detectorOrigin', 'oracle', 'attempt', 'outcome', 'reason',
+  'evidence', 'evidenceRefs', 'scope', 'preconditions', 'confirmationLevel', 'repair',
+];
+
+// Fields that define WHAT was claimed and how it was checked. `createdAt` (a
+// clock) and `migration` (how the record was represented) are deliberately not
+// here, so neither can move an id.
+export const VERIFICATION_ID_FIELDS = Object.freeze([
+  'hypothesisId', 'commit', 'detectorOrigin', 'oracle', 'attempt', 'outcome', 'reason', 'evidence', 'evidenceRefs',
+  'scope', 'preconditions', 'confirmationLevel', 'repair',
+]);
+
+export function verificationRecordId(record) {
+  return semanticId(ID_PREFIXES.verification, record, VERIFICATION_ID_FIELDS);
+}
+
+/** The identity of the CLAIM (which hypothesis, at which commit, by which oracle, on which attempt), excluding its result. */
+export function verificationClaimKey(record) {
+  return semanticId('vclaim', record, ['hypothesisId', 'commit', 'oracle', 'attempt']);
+}
+
+function referencedEvidence(record) {
+  const refs = new Set(Array.isArray(record.evidenceRefs) ? record.evidenceRefs : []);
+  return (Array.isArray(record.evidence) ? record.evidence : []).filter(e => isPlainObject(e) && refs.has(e.id));
+}
+
+/** The confirmation level the evidence actually supports. Never read from the record's own claim. */
+export function deriveConfirmationLevel(record) {
+  if (!record || record.outcome !== 'confirmed') return 'none';
+  const ev = referencedEvidence(record);
+  const runtime = ev.some(e => e.kind === 'trusted-runtime-proof' && e.producer === 'trusted-runner');
+  if (runtime && RUNTIME_ORACLES.includes(record.oracle?.kind)) return 'runtime-confirmed';
+  const adjudicated = ev.some(e => e.kind === 'independent-adjudication' && ['human', 'independent-verifier'].includes(e.producer));
+  return adjudicated ? 'adjudicated' : 'none';
+}
+
+function validateEvidenceItem(ctx, e, i) {
+  const p = `evidence[${i}]`;
+  if (!isPlainObject(e)) { ctx.err('BAD_TYPE', p, 'evidence item must be an object'); return; }
+  for (const k of Object.keys(e)) {
+    if (!['id', 'kind', 'producer', 'digest', 'source'].includes(k)) ctx.err('UNKNOWN_FIELD', `${p}.${k}`, `field '${k}' is not part of an evidence item`);
+  }
+  checkString(ctx, `${p}.id`, e.id);
+  const kindOk = checkEnum(ctx, `${p}.kind`, e.kind, EVIDENCE_KINDS);
+  const prodOk = checkEnum(ctx, `${p}.producer`, e.producer, EVIDENCE_PRODUCERS);
+  checkDigest(ctx, `${p}.digest`, e.digest);
+  if (e.source !== undefined && e.source !== null) checkString(ctx, `${p}.source`, e.source);
+  if (!kindOk || !prodOk) return;
+  if (e.producer === 'model' && e.kind !== 'inference') {
+    ctx.err('RULE_VIOLATION', p, `a model-produced item can only be 'inference', not '${e.kind}'`);
+  }
+  if (e.kind === 'trusted-runtime-proof' && e.producer !== 'trusted-runner') {
+    ctx.err('RULE_VIOLATION', p, `'trusted-runtime-proof' can only be produced by a 'trusted-runner', not '${e.producer}'`);
+  }
+  if (e.kind === 'independent-adjudication' && !['human', 'independent-verifier'].includes(e.producer)) {
+    ctx.err('RULE_VIOLATION', p, `'independent-adjudication' can only be produced by a 'human' or 'independent-verifier', not '${e.producer}'`);
+  }
+  if (e.producer === 'trusted-runner' && !['trusted-runtime-proof', 'observation'].includes(e.kind)) {
+    ctx.err('RULE_VIOLATION', p, `a 'trusted-runner' produces 'trusted-runtime-proof' or 'observation', not '${e.kind}'`);
+  }
+}
+
+export function validateVerificationRecord(record) {
+  const g = guardObject(record);
+  const ctx = g.ctx;
+  if (!g.ok) return result(ctx);
+  if (!checkHeader(ctx, record, VERIFICATION_SCHEMA)) return result(ctx);
+  checkFields(ctx, record, ALLOWED, REQUIRED);
+
+  checkString(ctx, 'hypothesisId', record.hypothesisId);
+  checkCommit(ctx, 'commit', record.commit);
+
+  const origin = record.detectorOrigin;
+  if (!isPlainObject(origin)) ctx.err('BAD_TYPE', 'detectorOrigin', 'must be an object with a detector name');
+  else {
+    for (const k of Object.keys(origin)) if (!['detector', 'family', 'parser'].includes(k)) ctx.err('UNKNOWN_FIELD', `detectorOrigin.${k}`, 'not part of detectorOrigin');
+    checkString(ctx, 'detectorOrigin.detector', origin.detector);
+  }
+
+  const oracle = record.oracle;
+  let oracleKind = null;
+  if (oracle === null) oracleKind = 'none';
+  else if (!isPlainObject(oracle)) ctx.err('BAD_TYPE', 'oracle', 'must be an object or null');
+  else {
+    for (const k of Object.keys(oracle)) if (!['id', 'kind', 'version'].includes(k)) ctx.err('UNKNOWN_FIELD', `oracle.${k}`, 'not part of oracle');
+    checkString(ctx, 'oracle.id', oracle.id);
+    if (checkEnum(ctx, 'oracle.kind', oracle.kind, ORACLE_KINDS)) oracleKind = oracle.kind;
+  }
+
+  if (!Number.isInteger(record.attempt) || record.attempt < 0) ctx.err('BAD_TYPE', 'attempt', 'must be a non-negative integer');
+  const outcomeOk = checkEnum(ctx, 'outcome', record.outcome, VERIFICATION_OUTCOMES);
+  checkString(ctx, 'reason', record.reason);
+
+  // evidence items
+  const ids = new Set();
+  if (!Array.isArray(record.evidence)) ctx.err('BAD_TYPE', 'evidence', 'must be an array');
+  else {
+    record.evidence.forEach((e, i) => {
+      validateEvidenceItem(ctx, e, i);
+      if (isPlainObject(e) && typeof e.id === 'string') {
+        if (ids.has(e.id)) ctx.err('DUPLICATE_ID', `evidence[${i}].id`, `duplicate evidence id '${e.id}'`);
+        ids.add(e.id);
+      }
+    });
+  }
+  if (!Array.isArray(record.evidenceRefs)) ctx.err('BAD_TYPE', 'evidenceRefs', 'must be an array of evidence ids');
+  else {
+    const seen = new Set();
+    record.evidenceRefs.forEach((r, i) => {
+      if (!ids.has(r)) ctx.err('DANGLING_REF', `evidenceRefs[${i}]`, `evidence reference '${r}' does not resolve to an evidence item in this record`);
+      if (seen.has(r)) ctx.err('DUPLICATE_ID', `evidenceRefs[${i}]`, `evidence reference '${r}' listed twice`);
+      seen.add(r);
+    });
+  }
+
+  // scope
+  const scope = record.scope;
+  if (!isPlainObject(scope)) ctx.err('BAD_TYPE', 'scope', 'must be an object');
+  else {
+    for (const k of Object.keys(scope)) if (!['description', 'platform', 'backend'].includes(k)) ctx.err('UNKNOWN_FIELD', `scope.${k}`, 'not part of scope');
+    checkString(ctx, 'scope.description', scope.description);
+    checkString(ctx, 'scope.platform', scope.platform);
+    if (scope.backend !== undefined && scope.backend !== null) checkString(ctx, 'scope.backend', scope.backend);
+  }
+
+  // preconditions
+  const pre = record.preconditions;
+  if (!isPlainObject(pre) || typeof pre.valid !== 'boolean') ctx.err('BAD_TYPE', 'preconditions', 'must be an object with a boolean `valid`');
+
+  // repair: a separate axis
+  const repair = record.repair;
+  if (!isPlainObject(repair)) ctx.err('BAD_TYPE', 'repair', 'must be an object');
+  else {
+    for (const k of Object.keys(repair)) if (!['status', 'patchDigest', 'replayRecordId'].includes(k)) ctx.err('UNKNOWN_FIELD', `repair.${k}`, 'not part of repair');
+    if (checkEnum(ctx, 'repair.status', repair.status, REPAIR_STATUSES)) {
+      if (['applied', 'replay-verified', 'rolled-back'].includes(repair.status)) {
+        if (repair.patchDigest === undefined || repair.patchDigest === null) ctx.err('RULE_VIOLATION', 'repair.patchDigest', `repair status '${repair.status}' requires a patchDigest`);
+      }
+      if (repair.patchDigest !== undefined && repair.patchDigest !== null) checkDigest(ctx, 'repair.patchDigest', repair.patchDigest);
+      if (repair.status === 'replay-verified' && !(typeof repair.replayRecordId === 'string' && repair.replayRecordId.startsWith('vrec:'))) {
+        ctx.err('RULE_VIOLATION', 'repair.replayRecordId', `repair status 'replay-verified' requires the id of the patched-negative verification record`);
+      }
+    }
+  }
+
+  // confirmation level must be what the evidence supports
+  const levelOk = checkEnum(ctx, 'confirmationLevel', record.confirmationLevel, CONFIRMATION_LEVELS);
+  if (levelOk) {
+    const derived = deriveConfirmationLevel(record);
+    if (record.confirmationLevel !== derived) {
+      ctx.err('RULE_VIOLATION', 'confirmationLevel', `claimed '${record.confirmationLevel}' but the referenced evidence supports '${derived}'`);
+    }
+  }
+
+  // outcome rules
+  if (outcomeOk) {
+    const refEv = referencedEvidence(record);
+    const hasProof = refEv.some(e => ['trusted-runtime-proof', 'independent-adjudication'].includes(e.kind));
+    const attempt = record.attempt;
+    if (!NO_EXECUTION_OUTCOMES.includes(record.outcome) && Number.isInteger(attempt) && attempt < 1) {
+      ctx.err('RULE_VIOLATION', 'attempt', `outcome '${record.outcome}' requires attempt >= 1`);
+    }
+    if (NO_EXECUTION_OUTCOMES.includes(record.outcome)) {
+      if (Number.isInteger(attempt) && attempt !== 0) ctx.err('RULE_VIOLATION', 'attempt', `outcome '${record.outcome}' means nothing ran, so attempt must be 0`);
+      if (refEv.some(e => e.kind === 'trusted-runtime-proof')) ctx.err('RULE_VIOLATION', 'evidence', `outcome '${record.outcome}' cannot cite runtime proof: nothing executed`);
+    }
+    if (['confirmed', 'refuted'].includes(record.outcome)) {
+      if (record.commit === null) ctx.err('RULE_VIOLATION', 'commit', `outcome '${record.outcome}' must be bound to an exact commit`);
+      if (oracleKind === 'none') ctx.err('RULE_VIOLATION', 'oracle', `outcome '${record.outcome}' requires an oracle`);
+      if (oracleKind === 'model') ctx.err('RULE_VIOLATION', 'oracle', `a model oracle can never yield '${record.outcome}'`);
+      if (!hasProof) ctx.err('RULE_VIOLATION', 'evidenceRefs', `outcome '${record.outcome}' requires referenced trusted-runtime-proof or independent-adjudication evidence`);
+    }
+    if (record.outcome === 'confirmed' && record.confirmationLevel === 'none') {
+      ctx.err('RULE_VIOLATION', 'confirmationLevel', `a 'confirmed' record must carry a confirmation level above 'none'`);
+    }
+    if (record.outcome === 'refuted') {
+      if (oracleKind && !APPLICABLE_FOR_REFUTATION.includes(oracleKind)) ctx.err('RULE_VIOLATION', 'oracle', `oracle kind '${oracleKind}' is not applicable for refutation`);
+      if (!(isPlainObject(pre) && pre.valid === true)) ctx.err('RULE_VIOLATION', 'preconditions', `'refuted' requires valid preconditions: a check that could not run is not a refutation`);
+    }
+  }
+
+  checkId(ctx, record, verificationRecordId(record));
+  return result(ctx);
+}
+
+/** Build a complete, valid-by-construction record from the semantic fields; derives the level and the id. */
+export function buildVerificationRecord(fields) {
+  const rec = {
+    schema: VERIFICATION_SCHEMA,
+    schemaVersion: SCHEMA_VERSION,
+    hypothesisId: fields.hypothesisId,
+    commit: fields.commit ?? null,
+    detectorOrigin: fields.detectorOrigin,
+    oracle: fields.oracle ?? null,
+    attempt: fields.attempt ?? 0,
+    outcome: fields.outcome,
+    reason: fields.reason,
+    evidence: fields.evidence ?? [],
+    evidenceRefs: fields.evidenceRefs ?? (fields.evidence ?? []).map(e => e.id),
+    scope: fields.scope,
+    preconditions: fields.preconditions ?? { valid: false },
+    repair: fields.repair ?? { status: 'none' },
+  };
+  rec.confirmationLevel = deriveConfirmationLevel(rec);
+  if (fields.migration) rec.migration = fields.migration;
+  if (fields.createdAt) rec.createdAt = fields.createdAt;
+  rec.id = verificationRecordId(rec);
+  return rec;
+}

package/src/posture/attestation.js

@@ -143,6 +143,11 @@ export function computeRunAttestation({
     try {
       att.signature = signLastScan(digest);
       att.signatureScope = 'per-install-hmac';
+      // CORE-003.AC03: say plainly who vouches. A symmetric install HMAC can be
+      // produced by anyone who can verify it, so it is self-issued by
+      // construction and can never be third-party certification.
+      att.trustBasis = 'self-issued-local-key';
+      att.independentlyCertified = false;
     } catch { /* signing is best-effort; an unsigned attestation is still valid */ }
   }
   return att;

package/src/posture/autopilot.js

@@ -26,6 +26,8 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
+import { emitVerification } from './verification/emit.js';
+import { verificationFields } from './verification/projection.js';
 
 const SCHEMA = 'agentic-security/autopilot@1';
 
@@ -73,8 +75,15 @@ function _save(stateFile, state) {
  */
 export async function runAutopilot({
   stages = {}, stateFile = null, resume = true, apply = false,
-  onStage = () => {}, severities = ['critical', 'high'], maxFindings = Infinity,
+  onStage = () => {}, severities = ['critical', 'high'], maxFindings = Infinity, commit = null,
 } = {}) {
+  // X-201: every settled finding carries the one version-1 verification record, ADDITIVELY (`outcome`, `reason` and
+  // every other field are unchanged). The chain's own proof and re-verify stages run under the older sandbox path, so
+  // the record never says `confirmed` or `refuted` here: it records what was observed and what remains unproven.
+  const seal = (rec, finding, patch) => {
+    const e = emitVerification('autopilot', rec, { finding, patch: patch?.patch, commit });
+    if (e.ok) rec.verificationRecord = e.record;
+  };
   const required = ['scan'];
   for (const r of required) {
     if (typeof stages[r] !== 'function') return { ok: false, reason: `no ${r} stage supplied` };
@@ -138,6 +147,7 @@ export async function runAutopilot({
       if (rec.validation === 'refuted') {
         rec.outcome = 'NEEDS_REVIEW';
         rec.reason = 'an independent verifier refuted this finding; not fixed automatically';
+        seal(rec, f, null);
         results.push(rec); state.findings[key] = rec; _save(stateFile, state);
         onStage({ stage: 'validate', key, verdict: 'refuted' });
         continue;
@@ -149,6 +159,7 @@ export async function runAutopilot({
     if (!isProven) {
       rec.outcome = 'UNPROVEN';
       rec.reason = proved?.proofEvidence?.reason || 'no proof-of-concept demonstrated this finding';
+      seal(rec, f, null);
       results.push(rec); state.findings[key] = rec; _save(stateFile, state);
       continue;
     }
@@ -161,6 +172,7 @@ export async function runAutopilot({
     if (!patch || !patch.patch) {
       rec.outcome = 'NO_FIX';
       rec.reason = 'no patch was synthesised';
+      seal(rec, f, null);
       results.push(rec); state.findings[key] = rec; _save(stateFile, state);
       continue;
     }
@@ -171,6 +183,7 @@ export async function runAutopilot({
     if (typeof stages.verifyFix !== 'function') {
       rec.outcome = 'NEEDS_REVIEW';
       rec.reason = 'no verifyFix stage supplied — a patch that cannot be re-verified is never applied';
+      seal(rec, f, patch);
       results.push(rec); state.findings[key] = rec; _save(stateFile, state);
       continue;
     }
@@ -194,6 +207,7 @@ export async function runAutopilot({
         : (!rec.testsPass ? 'the project test suite fails with this patch'
           : (v?.reason || 'the patch did not re-verify'));
     }
+    seal(rec, f, patch);
     results.push(rec);
     state.findings[key] = rec;
     _save(stateFile, state);
@@ -203,6 +217,19 @@ export async function runAutopilot({
   return { ok: true, results, skipped, outOfScope, capped, summary: summarizeAutopilot(results, outOfScope, capped) };
 }
 
+/**
+ * X-206: the autopilot response as it is serialized for a caller. Every field of every result is kept (the native `outcome`
+ * vocabulary and its meaning are unchanged); a result that carries a verification record additionally gets `verificationView`, the
+ * shared projection every other interface shows for the same finding. Results without a record are returned as they were.
+ */
+export function serializeAutopilotResult(res) {
+  if (!res || !Array.isArray(res.results)) return res;
+  return {
+    ...res,
+    results: res.results.map((r) => (r && r.verificationRecord ? { ...r, ...verificationFields(r.verificationRecord, { replay: r.verificationReplay }) } : r)),
+  };
+}
+
 export function summarizeAutopilot(results, outOfScope = 0, capped = 0) {
   const byOutcome = Object.fromEntries(OUTCOMES.map(o => [o, 0]));
   for (const r of results) if (r.outcome in byOutcome) byOutcome[r.outcome]++;

package/src/posture/evidence-bundle.js

@@ -47,6 +47,61 @@ import * as crypto from 'node:crypto';
 
 export const BUNDLE_SCHEMA = 'agentic-security/finding-evidence@1';
 
+// ---- issuer and trust basis (CORE-003.AC03) --------------------------------
+//
+// A signature says WHO signed and nothing about whether anyone independent
+// vouches for them. This install generates its own key, so every bundle it
+// signs is SELF-ISSUED. The `issuance` block says so inside the signed bytes,
+// so a summariser cannot drop it, and the verifier reports it back. The only
+// trust basis this build can verify is the local one; a third-party basis needs
+// a trust-root policy that does not exist here, so an unknown basis is
+// REJECTED rather than being displayed as if it were certification.
+//
+// Backward compatible: `issuance` is absent from bundles signed before this
+// field existed. Those still verify exactly as before and are reported as
+// having NO DECLARED trust basis (not as trusted, not as invalid).
+export const TRUST_BASES = Object.freeze({
+  'self-issued-local-key': Object.freeze({
+    independentlyCertified: false,
+    statement:
+      'Signed by a key this install generated for itself. It proves the bundle is unmodified since ' +
+      'this key signed it. It is NOT independent third-party certification: whoever controls this ' +
+      'install controls the key.',
+  }),
+});
+
+/** SHA-256 of the SPKI DER of a public key: the stable identity of an issuer. */
+export function keyFingerprint(publicKeyPem) {
+  const der = crypto.createPublicKey(publicKeyPem).export({ type: 'spki', format: 'der' });
+  return crypto.createHash('sha256').update(der).digest('hex');
+}
+
+/** Issuance block for a locally generated key. */
+function buildLocalIssuance(publicKeyPem) {
+  const fp = keyFingerprint(publicKeyPem);
+  return {
+    issuer: { id: `local-install:${fp.slice(0, 16)}`, kind: 'local-install', keyFingerprint: fp },
+    trustBasis: 'self-issued-local-key',
+    independentlyCertified: false,
+    statement: TRUST_BASES['self-issued-local-key'].statement,
+  };
+}
+
+/** Group/world access to key material is a defect, reported by path. */
+export function keyPermissionIssues(dir = keyDir()) {
+  const p = keyPaths(dir);
+  const issues = [];
+  try {
+    const d = fs.statSync(dir).mode & 0o077;
+    if (d) issues.push(`${dir} is accessible to group/other (mode ${(fs.statSync(dir).mode & 0o777).toString(8)})`);
+  } catch { /* absent: nothing to report */ }
+  try {
+    const m = fs.statSync(p.privateKey).mode & 0o777;
+    if (m & 0o077) issues.push(`${p.privateKey} is accessible to group/other (mode ${m.toString(8)})`);
+  } catch { /* absent */ }
+  return issues;
+}
+
 /** Where the Ed25519 signing key lives. Mirrors integrity.js's key handling. */
 function keyDir() {
   const xdg = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
@@ -142,6 +197,9 @@ export function canonicalBytes(bundle) {
     engine: bundle.engine,
     proves: bundle.proves,
     doesNotProve: bundle.doesNotProve,
+    // Only when present, so the canonical bytes (and signatures) of every
+    // bundle signed before this field existed are unchanged.
+    ...(bundle.issuance !== undefined ? { issuance: bundle.issuance } : {}),
   };
   return Buffer.from(canonicalJson(signed), 'utf8');
 }
@@ -226,11 +284,17 @@ export function buildEvidenceBundle(finding, { engineVersion, rulesetVersion, bu
   };
 }
 
-/** Sign a bundle. Returns a new object; the input is not mutated. */
+/**
+ * Sign a bundle. Returns a new object; the input is not mutated. The issuer and
+ * trust basis are derived from the signing key and signed with the bundle; a
+ * caller cannot supply a stronger basis than the one this build can verify.
+ */
 export function signEvidenceBundle(bundle, privateKeyPem) {
-  const sig = crypto.sign(null, canonicalBytes(bundle), privateKeyPem);
+  const publicKeyPem = crypto.createPublicKey(privateKeyPem).export({ type: 'spki', format: 'pem' });
+  const withIssuance = { ...bundle, issuance: buildLocalIssuance(publicKeyPem) };
+  const sig = crypto.sign(null, canonicalBytes(withIssuance), privateKeyPem);
   return {
-    ...bundle,
+    ...withIssuance,
     signature: {
       algorithm: 'ed25519',
       canonicalisation: BUNDLE_SCHEMA,
@@ -256,7 +320,7 @@ export function signEvidenceBundle(bundle, privateKeyPem) {
 // what buildEvidenceBundle+signEvidenceBundle actually produce, or a
 // legitimate bundle would start failing verification.
 const BUNDLE_TOP_LEVEL_KEYS = new Set([
-  'schema', 'finding', 'evidence', 'engine', 'proves', 'doesNotProve', 'signature',
+  'schema', 'finding', 'evidence', 'engine', 'proves', 'doesNotProve', 'issuance', 'signature',
 ]);
 
 export function verifyEvidenceBundle(bundle, publicKeyPem) {
@@ -276,7 +340,29 @@ export function verifyEvidenceBundle(bundle, publicKeyPem) {
   } catch (e) {
     return { ok: false, reason: `verification error: ${e.message}` };
   }
-  return ok
-    ? { ok: true, reason: null }
-    : { ok: false, reason: 'signature does not match the bundle contents — it was modified after signing' };
+  if (!ok) return { ok: false, reason: 'signature does not match the bundle contents — it was modified after signing' };
+
+  // Trust basis. Checked AFTER the signature so the issuance block is already
+  // known to be unmodified.
+  if (bundle.issuance === undefined) {
+    return {
+      ok: true, reason: null, trustBasis: 'none-declared', independentlyCertified: false, issuer: null,
+      trustNote: 'This bundle predates issuer declarations: no trust basis is declared. Treat it as unattested provenance, not as certification.',
+    };
+  }
+  const iss = bundle.issuance;
+  const basis = iss && typeof iss === 'object' ? TRUST_BASES[iss.trustBasis] : undefined;
+  if (!basis) return { ok: false, reason: `unsupported trust basis: ${JSON.stringify(iss?.trustBasis ?? null)}` };
+  if (iss.independentlyCertified !== false) {
+    return { ok: false, reason: 'a self-issued bundle may not claim independent certification' };
+  }
+  let fp;
+  try { fp = keyFingerprint(publicKeyPem); } catch (e) { return { ok: false, reason: `verification error: ${e.message}` }; }
+  if (iss.issuer?.keyFingerprint !== fp) {
+    return { ok: false, reason: 'the declared issuer key does not match the key that verified the signature' };
+  }
+  return {
+    ok: true, reason: null, trustBasis: iss.trustBasis, independentlyCertified: false,
+    issuer: iss.issuer, trustNote: basis.statement,
+  };
 }

package/src/posture/execution-proof.js

@@ -8,6 +8,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { runConfined, sandboxAvailable, detectBackend } from '../sandbox/index.js';
 import { attachProofTier, proofTierOf } from './proof-tier.js';
+import { emitVerification } from './verification/emit.js';
 
 const PROOF_MARKER = 'PROVEN';
 
@@ -75,7 +76,16 @@ export const DEFAULT_PROOF_TIMEOUT_MS =
     ? Number(process.env.AGENTIC_SECURITY_PROOF_TIMEOUT_MS)
     : 45000;
 
-export async function proveFinding(finding, { timeoutMs = DEFAULT_PROOF_TIMEOUT_MS, force, files } = {}) {
+// X-201: the proof result also carries the one verification record, ADDITIVELY (`proofTier` and `proofEvidence` are
+// unchanged). A PoC run under this older sandbox path is not a trusted runner, so the record says `inconclusive` for a
+// run that demonstrated the effect and for one that did not; `confirmed` takes a trusted oracle adapter.
+export async function proveFinding(finding, opts = {}) {
+  const proved = await _proveFinding(finding, opts);
+  const emitted = emitVerification('execution-proof', proved, { finding: proved, commit: opts.commit ?? null });
+  return emitted.ok ? { ...proved, verificationRecord: emitted.record } : proved;
+}
+
+async function _proveFinding(finding, { timeoutMs = DEFAULT_PROOF_TIMEOUT_MS, force, files } = {}) {
   const poc = finding?.poc;
   if (!poc?.code) {
     return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: 'no proof-of-concept attached' }));

package/src/posture/fix-verify-loop.js

@@ -23,6 +23,7 @@ import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { verifyFix } from './fix-verify.js';
+import { emitVerification } from './verification/emit.js';
 
 const DEFAULT_TIMEOUT_MS = 120_000;
 
@@ -131,20 +132,32 @@ export async function verifyFixWithTests({
   runTests = true,
   testRunnerOverride,
   testTimeoutMs,
+  patchNegative,
+  assuranceConfig,
 } = {}) {
-  const scanLint = await verifyFix({ scanRoot, originalFindingStableId, files, depFileContents });
+  const scanLint = await verifyFix({ scanRoot, originalFindingStableId, files, depFileContents, patchNegative, assuranceConfig });
   const legs = {
     scan: { ok: scanLint.rescan?.ok ?? scanLint.ok, detail: scanLint.rescan ?? scanLint },
     lint: { ok: scanLint.lint?.ok ?? true, detail: scanLint.lint ?? null },
     tests: { ok: true, detail: null, skipped: true, reason: 'not-run' },
   };
-  if (!legs.scan.ok || !legs.lint.ok) {
-    return {
+  // X-201: the closed loop's own record (additive). It runs the detector, linter and project tests, never an exploit
+  // oracle, so it can say `not-run` or `error` and nothing stronger.
+  const withRecord = (res) => {
+    const e = emitVerification('fix-verify-loop', res, { originalFindingStableId, files, scanRoot });
+    return { ...res, verificationRecord: e.ok ? e.record : null };
+  };
+  // X-204: the patch-negative leg is present only when it was requested and its feature is on. A patch the oracle did not verify
+  // is never `verified-clean`, whatever the other legs say.
+  const pn = scanLint.patchNegative && scanLint.patchNegative.status !== 'disabled' ? scanLint.patchNegative : null;
+  if (pn) legs.patchNegative = { ok: pn.verifiedFix === true, detail: { status: pn.status, incompleteStep: pn.incompleteStep, failureCode: pn.failureCode, reason: pn.reason } };
+  if (!legs.scan.ok || !legs.lint.ok || (pn && !legs.patchNegative.ok)) {
+    return withRecord({
       ok: false,
       verdict: 'verification-failed',
       legs,
       summary: _summarize(legs, 'verification-failed'),
-    };
+    });
   }
   if (runTests) {
     const tests = runProjectTests(scanRoot, { runnerOverride: testRunnerOverride, timeoutMs: testTimeoutMs });
@@ -153,8 +166,8 @@ export async function verifyFixWithTests({
   const allOk = legs.scan.ok && legs.lint.ok && legs.tests.ok;
   const verdict = !allOk
     ? 'verification-failed'
-    : (legs.tests.skipped ? 'untested-but-passes' : 'verified-clean');
-  return { ok: allOk, verdict, legs, summary: _summarize(legs, verdict) };
+    : pn ? 'verified-fix' : (legs.tests.skipped ? 'untested-but-passes' : 'verified-clean');
+  return withRecord({ ok: allOk, verdict, legs, summary: _summarize(legs, verdict) });
 }
 
 function _summarize(legs, verdict) {
@@ -162,5 +175,6 @@ function _summarize(legs, verdict) {
   bits.push(`scan: ${legs.scan.ok ? 'pass' : 'fail'}`);
   bits.push(`lint: ${legs.lint.skipped ? 'skip' : legs.lint.ok ? 'pass' : 'fail'}`);
   bits.push(`tests: ${legs.tests.skipped ? 'skip' : legs.tests.ok ? 'pass' : 'fail'}`);
+  if (legs.patchNegative) bits.push(`patch-negative: ${legs.patchNegative.ok ? 'pass' : `fail (${legs.patchNegative.detail.incompleteStep})`}`);
   return `${verdict} (${bits.join(' · ')})`;
 }

package/src/posture/fix-verify.js

@@ -22,6 +22,7 @@ import { runFullScan } from '../engine.js';
 import { gateFixOutput } from './fix-honesty-gate.js';
 import { runProjectTests } from './test-runner.js';
 import { recordFixAttempt } from './fix-metrics.js';
+import { emitVerification, headCommit } from './verification/emit.js';
 
 const SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
 
@@ -187,6 +188,8 @@ export async function verifyFix({
   testTimeoutMs,
   recordMetrics = true,
   poc,
+  patchNegative,
+  assuranceConfig,
 } = {}) {
   // R5 (reporting half) — time each stage as it runs. Measured here rather
   // than inside each stage because only this function knows the boundaries of
@@ -269,7 +272,26 @@ export async function verifyFix({
   }
   _lap('honesty');
 
-  const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && pocOk && (honesty ? honesty.ok : true);
+  // X-204: patch-negative verification, only when the caller asked for it AND the `patch-negative-verification` feature is
+  // on. `patchNegative` is the requester's exploit scenario and functional cases ({ original, functional, commit?, ... }); the
+  // candidate `files` are the proposed diff. With the flag off, or no request, nothing here runs and every field below is
+  // exactly what it was before.
+  let pn = null;
+  if (patchNegative && typeof patchNegative === 'object') {
+    try {
+      const { verifyPatchNegative } = await import('./verification/patch-negative.js');
+      pn = await verifyPatchNegative({
+        hypothesisId: originalFindingStableId, ...patchNegative, patch: { files },
+        commit: patchNegative.commit ?? headCommit(scanRoot),
+      }, { config: assuranceConfig });
+    } catch (e) {
+      pn = { status: 'error', verifiedFix: false, incompleteStep: 'patch-negative', failureCode: 'harness-error', reason: `patch-negative verification failed to run: ${String(e?.message || e).slice(0, 200)}`, summary: '' };
+    }
+  }
+  const pnActive = pn !== null && pn.status !== 'disabled';
+  _lap('patchNegative');
+
+  const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && pocOk && (honesty ? honesty.ok : true) && (pnActive ? pn.verifiedFix === true : true);
 
   // FR-305 (assurance-hardening PRD): `ok` alone conflates "every leg
   // genuinely ran and passed" with "passed, but a required leg was skipped
@@ -311,6 +333,7 @@ export async function verifyFix({
       : pocLeg.status === 'no-longer-proven' ? 'poc:     PASS (ran against the patch and no longer demonstrates the vulnerability)'
       : `poc:     inconclusive — not counted either way (${pocLeg.reason || 'no detail reported'})`,
     // FR-305: never let a degraded pass read the same as a full one.
+    pnActive ? `patch-negative: ${pn.verifiedFix ? 'PASS (verified-fix)' : `FAIL - not verified-fix, incomplete step '${pn.incompleteStep}' (${pn.failureCode}): ${pn.reason}`}` : null,
     ok && !verifiedFull ? `NOTE:    PASSED, but NOT fully verified — ${degradedLegs.join('; ')}` : null,
   ].filter(Boolean).join('\n');
   // Persist the attempt so the distribution can be reported from real runs.
@@ -337,5 +360,17 @@ export async function verifyFix({
     });
   }
 
-  return { ok, verifiedFull, degradedLegs, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
+  // X-201: the one verification record, ADDITIVE. `ok` and every field above stay exactly as they were; the record
+  // says what was actually established (a static re-scan is not an exploit oracle, so without a PoC leg it is
+  // `not-run`, and nothing here can reach `confirmed`/`refuted`: that takes a trusted oracle adapter).
+  const emitted = emitVerification('fix-verify', { rescan, lint, tests, poc: pocLeg }, {
+    originalFindingStableId, files, scanRoot, finding: poc?.finding,
+  });
+  const verificationRecord = emitted.ok ? emitted.record : null;
+
+  return {
+    ok, verifiedFull, degradedLegs, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary, verificationRecord,
+    // additive, present only when patch-negative verification was requested (X-204)
+    ...(pn ? { patchNegative: pn, ...(pnActive ? { fixStatus: pn.verifiedFix ? 'verified-fix' : 'not-verified-fix' } : {}) } : {}),
+  };
 }