@clear-capabilities/agentic-security-scanner 0.161.0 → 0.163.0

package/src/posture/assurance/rollout.js

@@ -0,0 +1,200 @@
+// Staged rollout policy for the assurance features (REL-002.AC01).
+//
+// Every feature in config.js is off by default. This module is the policy that says
+// how a feature moves from "exists in the code" to "an operator may rely on it":
+//
+//   offline-fixtures  ->  shadow-canary  ->  opt-in-supported
+//
+//   offline-fixtures  The feature runs against recorded fixtures in tests only. No real target.
+//   shadow-canary     It may run beside the existing behaviour on real input, but its result is
+//                     RECORDED, never used: no verdict, exit code or report line changes. A canary is a
+//                     named, bounded subset an operator chose.
+//   opt-in-supported  An operator enabled it (config.js), the platform is supported, and every gate for
+//                     the stage is met. Only here may a result change an outcome.
+//
+// A stage is entered only by `promote`, one step at a time, and only when every documented gate of
+// the stage being entered has evidence that matches the gate's own declared reference. There is no
+// way to skip a stage, to promote a feature the kill switch has stopped, or to promote on a gate
+// that is merely "not failing". Nothing here runs a suite or measures anything: it judges evidence a
+// caller supplies, and a gate that names a suite only accepts evidence for THAT suite.
+//
+// The ledger is append-only history plus a current position. `rollback` (rollback.js) moves the
+// position back to the last known-good entry and appends; it never rewrites or removes history.
+
+import { FEATURES, featureStatus } from './config.js';
+
+const ROLLOUT_LEDGER_SCHEMA = 'agentic-security/rollout-ledger@1';
+export const STAGES = Object.freeze(['offline-fixtures', 'shadow-canary', 'opt-in-supported']);
+
+export const STAGE_MEANING = Object.freeze({
+  'offline-fixtures': 'Runs against recorded fixtures in tests only; no real target is touched.',
+  'shadow-canary': 'May run beside existing behaviour on real input or a named canary subset; results are recorded and never used, so no verdict, exit code or report line changes.',
+  'opt-in-supported': 'An operator enabled it, the platform is supported and every gate is met; only here may a result change an outcome.',
+});
+
+// Gate evidence kinds. `suite` names a closure step (scripts/release-closure.mjs) whose recorded result is
+// the evidence; `measurement` and `review` name an artifact a person or a bench produced.
+const suite = (id, closureStep, statement) => ({ id, kind: 'suite', closureStep, statement });
+const measure = (id, statement) => ({ id, kind: 'measurement', statement });
+const review = (id, statement) => ({ id, kind: 'review', statement });
+
+// The suite that proves each feature's offline behaviour.
+const FEATURE_SUITE = Object.freeze({
+  'verification-oracles': 'verification',
+  'patch-negative-verification': 'verification',
+  'deployment-boundaries': 'deployment',
+  'invariant-scenarios': 'invariants',
+  'capability-enforcement': 'capabilities',
+  'model-routing': 'routing',
+  'portfolio-assurance': 'portfolio',
+});
+
+// What each feature must show before opt-in. Feature specific, and quoted from the PRD's own targets
+// (section 5) rather than invented here.
+const OPT_IN_SPECIFIC = Object.freeze({
+  'verification-oracles': [measure('oracle-conformance', 'Every advertised adapter passes positive, negative, inconclusive and tamper controls (verification-conformance-gate); unavailable prerequisites are reported unsupported')],
+  'patch-negative-verification': [measure('repair-evidence-triple', 'Every advertised verified fix carries original-positive, patched-negative and functional-regression evidence bound to the exact environment, patch and oracle')],
+  'deployment-boundaries': [measure('paired-ablation', 'A frozen contextual ablation shows additional confirmed defects or fewer false positives with unchanged scoring, and no lost baseline defect')],
+  'invariant-scenarios': [review('contract-approval-path', 'Invariant contracts are approved by an authorized reviewer, never by the generator that proposed them')],
+  'capability-enforcement': [measure('backend-probes', 'Every mandatory canary-secret and escape fixture is blocked on the advertised backend with zero canary leakage; macOS stays supervise-only')],
+  'model-routing': [measure('promotion-thresholds', 'At least 200 paired adjudicated tasks overall and 30 per promoted stratum, lower 95% quality bound above -0.02, median cost 20% lower or quality 0.05 higher at no higher median cost, p95 latency within 1.2x')],
+  'portfolio-assurance': [measure('interrupted-run-convergence', 'Interrupted, duplicate-delivery and incremental runs converge to a fresh scoped result with no double-counted progress')],
+});
+
+/** The documented gates for entering `stage` with `feature`. Pure and frozen. */
+export function gatesFor(feature, stage) {
+  if (!FEATURES[feature] || !STAGES.includes(stage)) return null;
+  const own = FEATURE_SUITE[feature];
+  if (stage === 'offline-fixtures') {
+    return [
+      suite('fixtures-green', own, `The ${own} suite passes against recorded fixtures`),
+      suite('default-off-unchanged', 'foundation', 'With the feature disabled, scan and report behaviour is unchanged (configuration and kill-switch tests)'),
+    ];
+  }
+  if (stage === 'shadow-canary') {
+    return [
+      suite('fixtures-green', own, `The ${own} suite still passes at the commit being promoted`),
+      measure('shadow-no-outcome-change', 'A recorded shadow run on real input changed no verdict, exit code or report line'),
+      suite('rollback-rehearsed', 'release-closure-suite', 'Rollback was rehearsed and restored known-good behaviour without erasing evidence'),
+    ];
+  }
+  return [
+    suite('fixtures-green', own, `The ${own} suite passes at the commit being promoted`),
+    suite('compatibility-holds', 'compat-nix', 'Existing Haskell/Nix and core-language behaviour is unchanged'),
+    suite('documentation-current', 'documentation-suite', 'Scope, examples and the policy card for this feature are published and drift-checked'),
+    review('canary-record', 'A shadow-canary record exists with no unresolved incident'),
+    ...(OPT_IN_SPECIFIC[feature] || []),
+  ];
+}
+
+/** Every feature's documented gates, for documentation and drift checks. */
+export function describeRollout() {
+  return Object.keys(FEATURES).map((feature) => ({
+    feature, risk: FEATURES[feature].risk, platforms: [...FEATURES[feature].platforms],
+    stages: STAGES.map((stage) => ({ stage, meaning: STAGE_MEANING[stage], gates: gatesFor(feature, stage) })),
+  }));
+}
+
+// ---------------------------------------------------------------- ledger
+
+const DIGEST = /^(?:sha256:)?[0-9a-f]{64}$/;
+
+export function newLedger() {
+  const features = {};
+  for (const id of Object.keys(FEATURES)) {
+    features[id] = { stage: 'offline-fixtures', policyVersion: 1, history: [{ seq: 0, event: 'init', from: null, to: 'offline-fixtures', policyVersion: 1, knownGood: true, evidence: null }] };
+  }
+  return { schema: ROLLOUT_LEDGER_SCHEMA, features };
+}
+
+const clone = (x) => JSON.parse(JSON.stringify(x));
+
+/**
+ * Judge supplied evidence against the gates for entering `target`.
+ * evidence: { [gateId]: { met: true, ref, digest } }. `ref` must equal the gate's own reference
+ * (a suite gate accepts only its closure step id); `digest` must be a sha256.
+ * -> { ok, unmet: [{ gate, reason }] }
+ */
+export function evaluateGates(feature, target, evidence = {}) {
+  const gates = gatesFor(feature, target);
+  if (!gates) return { ok: false, unmet: [{ gate: null, reason: `unknown feature '${feature}' or stage '${target}'` }] };
+  const unmet = [];
+  for (const g of gates) {
+    const e = evidence?.[g.id];
+    if (!e || e.met !== true) { unmet.push({ gate: g.id, reason: 'no evidence that the gate is met' }); continue; }
+    if (typeof e.digest !== 'string' || !DIGEST.test(e.digest)) { unmet.push({ gate: g.id, reason: 'evidence carries no sha256 digest' }); continue; }
+    if (g.kind === 'suite' && e.ref !== g.closureStep) { unmet.push({ gate: g.id, reason: `evidence is for '${e.ref}', not the required suite '${g.closureStep}'` }); continue; }
+    if (g.kind !== 'suite' && (typeof e.ref !== 'string' || !e.ref.trim())) { unmet.push({ gate: g.id, reason: 'evidence names no artifact' }); continue; }
+  }
+  return { ok: unmet.length === 0, unmet };
+}
+
+/**
+ * Build gate evidence from recorded closure steps (id, state, log.sha256). Only a step in state
+ * `pass` produces evidence; an unsupported, incomplete or failed step produces none.
+ */
+export function evidenceFromSteps(steps = []) {
+  const out = {};
+  for (const s of steps) {
+    if (s?.state !== 'pass' || !/^[0-9a-f]{64}$/.test(s.log?.sha256 || '')) continue;
+    out[`step:${s.id}`] = { met: true, ref: s.id, digest: s.log.sha256 };
+  }
+  return out;
+}
+
+/** Fill suite-gate evidence for `feature`/`target` from closure-step evidence; other kinds come from `extra`. */
+export function assembleEvidence(feature, target, stepEvidence = {}, extra = {}) {
+  const out = { ...extra };
+  for (const g of gatesFor(feature, target) || []) {
+    if (g.kind === 'suite' && stepEvidence[`step:${g.closureStep}`]) out[g.id] = stepEvidence[`step:${g.closureStep}`];
+  }
+  return out;
+}
+
+/**
+ * Move one feature up one stage. Returns a NEW ledger; the input is never mutated.
+ * Refuses: an unknown feature, skipping a stage, standing still, any unmet gate, and a feature the
+ * kill switch has stopped (config given) or an unsupported platform for opt-in.
+ */
+export function promote(ledger, feature, evidence, { config = null } = {}) {
+  const cur = ledger?.features?.[feature];
+  if (!cur) return { ok: false, ledger, blockers: [{ gate: null, reason: `unknown feature '${feature}'` }] };
+  const at = STAGES.indexOf(cur.stage);
+  if (at === STAGES.length - 1) return { ok: false, ledger, blockers: [{ gate: null, reason: 'already at the final stage' }] };
+  const target = STAGES[at + 1];
+  const blockers = [];
+  if (config) {
+    const st = featureStatus(config, feature);
+    if (st.code === 'kill-switch') blockers.push({ gate: null, reason: `the kill switch is set (${st.reason}); a stopped feature is not promoted` });
+    if (target === 'opt-in-supported' && st.code === 'platform-unsupported') blockers.push({ gate: null, reason: st.reason });
+  }
+  const g = evaluateGates(feature, target, evidence);
+  blockers.push(...g.unmet);
+  if (blockers.length) return { ok: false, ledger, blockers };
+  const next = clone(ledger);
+  const f = next.features[feature];
+  // Monotonic over the whole history: a version number is never reused after a rollback, so a record
+  // produced under a rolled-back policy can never be mistaken for one produced under a later policy.
+  const policyVersion = Math.max(...cur.history.map((h) => h.policyVersion)) + 1;
+  f.history.push({ seq: f.history.length, event: 'promote', from: cur.stage, to: target, policyVersion, knownGood: true, evidence: clone(evidence) });
+  f.stage = target; f.policyVersion = policyVersion;
+  return { ok: true, ledger: next, blockers: [] };
+}
+
+/**
+ * How a feature behaves given its configuration AND its stage. Below opt-in a feature that an operator
+ * enabled still only runs in the stage's mode, and says so.
+ *   'off'          disabled, killed, invalid or unsupported: inert
+ *   'fixtures'     offline-fixtures: the code path is fixtures-only; a real run is refused
+ *   'shadow'       shadow-canary: run, record, never change an outcome
+ *   'active'       opt-in-supported: results may change an outcome
+ */
+export function effectiveMode(config, ledger, feature) {
+  const st = featureStatus(config, feature);
+  if (st.status !== 'ok') return { mode: 'off', stage: ledger?.features?.[feature]?.stage ?? null, reason: st.reason, code: st.code };
+  const stage = ledger?.features?.[feature]?.stage;
+  if (!stage) return { mode: 'off', stage: null, reason: 'the feature has no rollout record, so it has not passed any gate', code: 'no-rollout-record' };
+  if (stage === 'offline-fixtures') return { mode: 'fixtures', stage, reason: 'enabled, but the feature has not passed the shadow-canary gates; it runs against fixtures only', code: 'below-stage' };
+  if (stage === 'shadow-canary') return { mode: 'shadow', stage, reason: 'enabled, but at shadow-canary: results are recorded and never change an outcome', code: 'below-stage' };
+  return { mode: 'active', stage, reason: 'enabled at opt-in-supported', code: null };
+}

package/src/posture/assurance/schema-kit.js

@@ -0,0 +1,111 @@
+// Small validation primitives shared by the assurance evidence contracts
+// (CORE-002). Pure: no fs, no clock, no network. Every validator returns
+// `{ ok, errors }` where each error is `{ code, path, message }`; nothing throws
+// on bad input, because a validator that throws on hostile input is a denial of
+// service on whatever called it.
+
+export const ERROR_CODES = Object.freeze([
+  'NOT_AN_OBJECT', 'SCHEMA_MISMATCH', 'UNSUPPORTED_MAJOR', 'BAD_VERSION', 'MISSING_FIELD', 'UNKNOWN_FIELD',
+  'BAD_TYPE', 'UNKNOWN_ENUM', 'BAD_DIGEST', 'BAD_ID', 'ID_MISMATCH', 'DUPLICATE_ID', 'DANGLING_REF', 'RULE_VIOLATION',
+]);
+
+export const SUPPORTED_MAJOR = 1;
+export const SCHEMA_VERSION = '1.0.0';
+
+const SEMVER = /^(\d+)\.(\d+)\.(\d+)$/;
+const DIGEST = /^sha256:[0-9a-f]{64}$/;
+const COMMIT = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;
+
+export function makeCtx() {
+  const errors = [];
+  return {
+    errors,
+    err(code, path, message) { errors.push({ code, path, message }); },
+  };
+}
+
+export function isPlainObject(v) {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+
+export function isDigest(v) { return typeof v === 'string' && DIGEST.test(v); }
+export function isCommit(v) { return typeof v === 'string' && COMMIT.test(v); }
+export function isNonEmptyString(v) { return typeof v === 'string' && v.trim().length > 0; }
+
+/** Header check: `schema` must match and the major version must be supported. */
+export function checkHeader(ctx, rec, schemaName) {
+  if (rec.schema !== schemaName) {
+    ctx.err('SCHEMA_MISMATCH', 'schema', `expected schema '${schemaName}', got ${JSON.stringify(rec.schema)}`);
+    return false;
+  }
+  const m = typeof rec.schemaVersion === 'string' ? SEMVER.exec(rec.schemaVersion) : null;
+  if (!m) {
+    ctx.err('BAD_VERSION', 'schemaVersion', `schemaVersion must be a semantic version, got ${JSON.stringify(rec.schemaVersion)}`);
+    return false;
+  }
+  if (Number(m[1]) !== SUPPORTED_MAJOR) {
+    ctx.err('UNSUPPORTED_MAJOR', 'schemaVersion', `major version ${m[1]} is not supported (supported: ${SUPPORTED_MAJOR})`);
+    return false;
+  }
+  return true;
+}
+
+/** Closed world: any field outside `allowed` is rejected, never silently carried. */
+export function checkFields(ctx, rec, allowed, required) {
+  for (const k of Object.keys(rec)) {
+    if (!allowed.includes(k)) ctx.err('UNKNOWN_FIELD', k, `field '${k}' is not part of this schema`);
+  }
+  for (const k of required) {
+    if (rec[k] === undefined) ctx.err('MISSING_FIELD', k, `required field '${k}' is missing`);
+  }
+  // `createdAt` is informational and never enters an id; it must still be a string.
+  if (rec.createdAt !== undefined && typeof rec.createdAt !== 'string') ctx.err('BAD_TYPE', 'createdAt', 'must be a string');
+}
+
+export function checkEnum(ctx, path, value, allowed) {
+  if (typeof value !== 'string' || !allowed.includes(value)) {
+    ctx.err('UNKNOWN_ENUM', path, `${JSON.stringify(value)} is not one of: ${allowed.join(', ')}`);
+    return false;
+  }
+  return true;
+}
+
+export function checkDigest(ctx, path, value, { nullable = false } = {}) {
+  if (value === null && nullable) return true;
+  if (!isDigest(value)) { ctx.err('BAD_DIGEST', path, `must be 'sha256:' followed by 64 lowercase hex characters`); return false; }
+  return true;
+}
+
+export function checkCommit(ctx, path, value, { nullable = true } = {}) {
+  if (value === null && nullable) return true;
+  if (!isCommit(value)) { ctx.err('BAD_TYPE', path, 'must be a 40 or 64 character lowercase hex commit id'); return false; }
+  return true;
+}
+
+export function checkString(ctx, path, value) {
+  if (!isNonEmptyString(value)) { ctx.err('BAD_TYPE', path, 'must be a non-empty string'); return false; }
+  return true;
+}
+
+export function checkId(ctx, rec, expectedId) {
+  const prefix = expectedId.split(':')[0];
+  if (typeof rec.id !== 'string' || !rec.id.startsWith(`${prefix}:`)) {
+    ctx.err('BAD_ID', 'id', `id must start with '${prefix}:'`);
+  } else if (rec.id !== expectedId) {
+    ctx.err('ID_MISMATCH', 'id', `id does not match the record's semantic content (expected ${expectedId})`);
+  }
+}
+
+export function result(ctx) {
+  return { ok: ctx.errors.length === 0, errors: ctx.errors };
+}
+
+/** Reject non-object input with one typed error instead of throwing downstream. */
+export function guardObject(rec) {
+  const ctx = makeCtx();
+  if (!isPlainObject(rec)) {
+    ctx.err('NOT_AN_OBJECT', '', 'record must be a plain object');
+    return { ctx, ok: false };
+  }
+  return { ctx, ok: true };
+}

package/src/posture/assurance/verification-record.js

@@ -0,0 +1,258 @@
+// The one verification record (CORE-002; X-201 builds every surface on it).
+//
+// Shape: hypothesis id, commit, detector origin, oracle, attempt, outcome,
+// reason, evidence items + references, applicable scope, and a SEPARATE repair
+// status.
+//
+// Structural honesty rules, enforced by the validator (not by convention):
+//   1. The six outcomes are distinct: not-run, unsupported, inconclusive, error,
+//      refuted, confirmed. Nothing here collapses them to a boolean.
+//   2. Evidence kinds are distinct: observation, inference, independent
+//      adjudication, trusted runtime proof. Each kind constrains who may have
+//      produced it: a model can only ever produce an inference; trusted runtime
+//      proof only comes from a trusted runner; an adjudication only from a human
+//      or an independent verifier.
+//   3. `confirmed` needs referenced evidence of runtime proof or independent
+//      adjudication, so a model-generated verdict alone cannot yield it, and the
+//      record carries a `confirmationLevel` that must equal the level derived from
+//      its evidence ('runtime-confirmed' needs trusted-runtime-proof AND a runtime
+//      oracle). A forged level fails the derivation check.
+//   4. `refuted` needs an applicable (non-model) oracle, valid preconditions and
+//      proving evidence: a missing taint path is not refutation of an
+//      authorization or workflow claim.
+//   5. Repair status is a different axis from the outcome. `replay-verified`
+//      needs the id of the patched-negative verification record.
+
+import {
+  SCHEMA_VERSION, makeCtx, result, guardObject, checkHeader, checkFields, checkEnum, checkDigest,
+  checkCommit, checkString, checkId, isPlainObject,
+} from './schema-kit.js';
+import { semanticId, ID_PREFIXES } from './identity.js';
+
+export const VERIFICATION_SCHEMA = 'agentic-security/verification-record';
+
+export const VERIFICATION_OUTCOMES = Object.freeze(['not-run', 'unsupported', 'inconclusive', 'error', 'refuted', 'confirmed']);
+export const REPAIR_STATUSES = Object.freeze(['none', 'proposed', 'applied', 'replay-verified', 'rolled-back']);
+export const EVIDENCE_KINDS = Object.freeze(['observation', 'inference', 'independent-adjudication', 'trusted-runtime-proof']);
+export const EVIDENCE_PRODUCERS = Object.freeze(['model', 'tool', 'human', 'independent-verifier', 'trusted-runner']);
+export const ORACLE_KINDS = Object.freeze(['runtime-replay', 'differential', 'static-proof', 'model', 'human', 'none']);
+export const CONFIRMATION_LEVELS = Object.freeze(['runtime-confirmed', 'adjudicated', 'none']);
+
+const RUNTIME_ORACLES = ['runtime-replay', 'differential'];
+const APPLICABLE_FOR_REFUTATION = ['runtime-replay', 'differential', 'static-proof', 'human'];
+const NO_EXECUTION_OUTCOMES = ['not-run', 'unsupported'];
+
+const ALLOWED = [
+  'schema', 'schemaVersion', 'id', 'hypothesisId', 'commit', 'detectorOrigin', 'oracle', 'attempt', 'outcome', 'reason',
+  'evidence', 'evidenceRefs', 'scope', 'preconditions', 'confirmationLevel', 'repair', 'migration', 'createdAt',
+];
+const REQUIRED = [
+  'schema', 'schemaVersion', 'id', 'hypothesisId', 'commit', 'detectorOrigin', 'oracle', 'attempt', 'outcome', 'reason',
+  'evidence', 'evidenceRefs', 'scope', 'preconditions', 'confirmationLevel', 'repair',
+];
+
+// Fields that define WHAT was claimed and how it was checked. `createdAt` (a
+// clock) and `migration` (how the record was represented) are deliberately not
+// here, so neither can move an id.
+export const VERIFICATION_ID_FIELDS = Object.freeze([
+  'hypothesisId', 'commit', 'detectorOrigin', 'oracle', 'attempt', 'outcome', 'reason', 'evidence', 'evidenceRefs',
+  'scope', 'preconditions', 'confirmationLevel', 'repair',
+]);
+
+export function verificationRecordId(record) {
+  return semanticId(ID_PREFIXES.verification, record, VERIFICATION_ID_FIELDS);
+}
+
+/** The identity of the CLAIM (which hypothesis, at which commit, by which oracle, on which attempt), excluding its result. */
+export function verificationClaimKey(record) {
+  return semanticId('vclaim', record, ['hypothesisId', 'commit', 'oracle', 'attempt']);
+}
+
+function referencedEvidence(record) {
+  const refs = new Set(Array.isArray(record.evidenceRefs) ? record.evidenceRefs : []);
+  return (Array.isArray(record.evidence) ? record.evidence : []).filter(e => isPlainObject(e) && refs.has(e.id));
+}
+
+/** The confirmation level the evidence actually supports. Never read from the record's own claim. */
+export function deriveConfirmationLevel(record) {
+  if (!record || record.outcome !== 'confirmed') return 'none';
+  const ev = referencedEvidence(record);
+  const runtime = ev.some(e => e.kind === 'trusted-runtime-proof' && e.producer === 'trusted-runner');
+  if (runtime && RUNTIME_ORACLES.includes(record.oracle?.kind)) return 'runtime-confirmed';
+  const adjudicated = ev.some(e => e.kind === 'independent-adjudication' && ['human', 'independent-verifier'].includes(e.producer));
+  return adjudicated ? 'adjudicated' : 'none';
+}
+
+function validateEvidenceItem(ctx, e, i) {
+  const p = `evidence[${i}]`;
+  if (!isPlainObject(e)) { ctx.err('BAD_TYPE', p, 'evidence item must be an object'); return; }
+  for (const k of Object.keys(e)) {
+    if (!['id', 'kind', 'producer', 'digest', 'source'].includes(k)) ctx.err('UNKNOWN_FIELD', `${p}.${k}`, `field '${k}' is not part of an evidence item`);
+  }
+  checkString(ctx, `${p}.id`, e.id);
+  const kindOk = checkEnum(ctx, `${p}.kind`, e.kind, EVIDENCE_KINDS);
+  const prodOk = checkEnum(ctx, `${p}.producer`, e.producer, EVIDENCE_PRODUCERS);
+  checkDigest(ctx, `${p}.digest`, e.digest);
+  if (e.source !== undefined && e.source !== null) checkString(ctx, `${p}.source`, e.source);
+  if (!kindOk || !prodOk) return;
+  if (e.producer === 'model' && e.kind !== 'inference') {
+    ctx.err('RULE_VIOLATION', p, `a model-produced item can only be 'inference', not '${e.kind}'`);
+  }
+  if (e.kind === 'trusted-runtime-proof' && e.producer !== 'trusted-runner') {
+    ctx.err('RULE_VIOLATION', p, `'trusted-runtime-proof' can only be produced by a 'trusted-runner', not '${e.producer}'`);
+  }
+  if (e.kind === 'independent-adjudication' && !['human', 'independent-verifier'].includes(e.producer)) {
+    ctx.err('RULE_VIOLATION', p, `'independent-adjudication' can only be produced by a 'human' or 'independent-verifier', not '${e.producer}'`);
+  }
+  if (e.producer === 'trusted-runner' && !['trusted-runtime-proof', 'observation'].includes(e.kind)) {
+    ctx.err('RULE_VIOLATION', p, `a 'trusted-runner' produces 'trusted-runtime-proof' or 'observation', not '${e.kind}'`);
+  }
+}
+
+export function validateVerificationRecord(record) {
+  const g = guardObject(record);
+  const ctx = g.ctx;
+  if (!g.ok) return result(ctx);
+  if (!checkHeader(ctx, record, VERIFICATION_SCHEMA)) return result(ctx);
+  checkFields(ctx, record, ALLOWED, REQUIRED);
+
+  checkString(ctx, 'hypothesisId', record.hypothesisId);
+  checkCommit(ctx, 'commit', record.commit);
+
+  const origin = record.detectorOrigin;
+  if (!isPlainObject(origin)) ctx.err('BAD_TYPE', 'detectorOrigin', 'must be an object with a detector name');
+  else {
+    for (const k of Object.keys(origin)) if (!['detector', 'family', 'parser'].includes(k)) ctx.err('UNKNOWN_FIELD', `detectorOrigin.${k}`, 'not part of detectorOrigin');
+    checkString(ctx, 'detectorOrigin.detector', origin.detector);
+  }
+
+  const oracle = record.oracle;
+  let oracleKind = null;
+  if (oracle === null) oracleKind = 'none';
+  else if (!isPlainObject(oracle)) ctx.err('BAD_TYPE', 'oracle', 'must be an object or null');
+  else {
+    for (const k of Object.keys(oracle)) if (!['id', 'kind', 'version'].includes(k)) ctx.err('UNKNOWN_FIELD', `oracle.${k}`, 'not part of oracle');
+    checkString(ctx, 'oracle.id', oracle.id);
+    if (checkEnum(ctx, 'oracle.kind', oracle.kind, ORACLE_KINDS)) oracleKind = oracle.kind;
+  }
+
+  if (!Number.isInteger(record.attempt) || record.attempt < 0) ctx.err('BAD_TYPE', 'attempt', 'must be a non-negative integer');
+  const outcomeOk = checkEnum(ctx, 'outcome', record.outcome, VERIFICATION_OUTCOMES);
+  checkString(ctx, 'reason', record.reason);
+
+  // evidence items
+  const ids = new Set();
+  if (!Array.isArray(record.evidence)) ctx.err('BAD_TYPE', 'evidence', 'must be an array');
+  else {
+    record.evidence.forEach((e, i) => {
+      validateEvidenceItem(ctx, e, i);
+      if (isPlainObject(e) && typeof e.id === 'string') {
+        if (ids.has(e.id)) ctx.err('DUPLICATE_ID', `evidence[${i}].id`, `duplicate evidence id '${e.id}'`);
+        ids.add(e.id);
+      }
+    });
+  }
+  if (!Array.isArray(record.evidenceRefs)) ctx.err('BAD_TYPE', 'evidenceRefs', 'must be an array of evidence ids');
+  else {
+    const seen = new Set();
+    record.evidenceRefs.forEach((r, i) => {
+      if (!ids.has(r)) ctx.err('DANGLING_REF', `evidenceRefs[${i}]`, `evidence reference '${r}' does not resolve to an evidence item in this record`);
+      if (seen.has(r)) ctx.err('DUPLICATE_ID', `evidenceRefs[${i}]`, `evidence reference '${r}' listed twice`);
+      seen.add(r);
+    });
+  }
+
+  // scope
+  const scope = record.scope;
+  if (!isPlainObject(scope)) ctx.err('BAD_TYPE', 'scope', 'must be an object');
+  else {
+    for (const k of Object.keys(scope)) if (!['description', 'platform', 'backend'].includes(k)) ctx.err('UNKNOWN_FIELD', `scope.${k}`, 'not part of scope');
+    checkString(ctx, 'scope.description', scope.description);
+    checkString(ctx, 'scope.platform', scope.platform);
+    if (scope.backend !== undefined && scope.backend !== null) checkString(ctx, 'scope.backend', scope.backend);
+  }
+
+  // preconditions
+  const pre = record.preconditions;
+  if (!isPlainObject(pre) || typeof pre.valid !== 'boolean') ctx.err('BAD_TYPE', 'preconditions', 'must be an object with a boolean `valid`');
+
+  // repair: a separate axis
+  const repair = record.repair;
+  if (!isPlainObject(repair)) ctx.err('BAD_TYPE', 'repair', 'must be an object');
+  else {
+    for (const k of Object.keys(repair)) if (!['status', 'patchDigest', 'replayRecordId'].includes(k)) ctx.err('UNKNOWN_FIELD', `repair.${k}`, 'not part of repair');
+    if (checkEnum(ctx, 'repair.status', repair.status, REPAIR_STATUSES)) {
+      if (['applied', 'replay-verified', 'rolled-back'].includes(repair.status)) {
+        if (repair.patchDigest === undefined || repair.patchDigest === null) ctx.err('RULE_VIOLATION', 'repair.patchDigest', `repair status '${repair.status}' requires a patchDigest`);
+      }
+      if (repair.patchDigest !== undefined && repair.patchDigest !== null) checkDigest(ctx, 'repair.patchDigest', repair.patchDigest);
+      if (repair.status === 'replay-verified' && !(typeof repair.replayRecordId === 'string' && repair.replayRecordId.startsWith('vrec:'))) {
+        ctx.err('RULE_VIOLATION', 'repair.replayRecordId', `repair status 'replay-verified' requires the id of the patched-negative verification record`);
+      }
+    }
+  }
+
+  // confirmation level must be what the evidence supports
+  const levelOk = checkEnum(ctx, 'confirmationLevel', record.confirmationLevel, CONFIRMATION_LEVELS);
+  if (levelOk) {
+    const derived = deriveConfirmationLevel(record);
+    if (record.confirmationLevel !== derived) {
+      ctx.err('RULE_VIOLATION', 'confirmationLevel', `claimed '${record.confirmationLevel}' but the referenced evidence supports '${derived}'`);
+    }
+  }
+
+  // outcome rules
+  if (outcomeOk) {
+    const refEv = referencedEvidence(record);
+    const hasProof = refEv.some(e => ['trusted-runtime-proof', 'independent-adjudication'].includes(e.kind));
+    const attempt = record.attempt;
+    if (!NO_EXECUTION_OUTCOMES.includes(record.outcome) && Number.isInteger(attempt) && attempt < 1) {
+      ctx.err('RULE_VIOLATION', 'attempt', `outcome '${record.outcome}' requires attempt >= 1`);
+    }
+    if (NO_EXECUTION_OUTCOMES.includes(record.outcome)) {
+      if (Number.isInteger(attempt) && attempt !== 0) ctx.err('RULE_VIOLATION', 'attempt', `outcome '${record.outcome}' means nothing ran, so attempt must be 0`);
+      if (refEv.some(e => e.kind === 'trusted-runtime-proof')) ctx.err('RULE_VIOLATION', 'evidence', `outcome '${record.outcome}' cannot cite runtime proof: nothing executed`);
+    }
+    if (['confirmed', 'refuted'].includes(record.outcome)) {
+      if (record.commit === null) ctx.err('RULE_VIOLATION', 'commit', `outcome '${record.outcome}' must be bound to an exact commit`);
+      if (oracleKind === 'none') ctx.err('RULE_VIOLATION', 'oracle', `outcome '${record.outcome}' requires an oracle`);
+      if (oracleKind === 'model') ctx.err('RULE_VIOLATION', 'oracle', `a model oracle can never yield '${record.outcome}'`);
+      if (!hasProof) ctx.err('RULE_VIOLATION', 'evidenceRefs', `outcome '${record.outcome}' requires referenced trusted-runtime-proof or independent-adjudication evidence`);
+    }
+    if (record.outcome === 'confirmed' && record.confirmationLevel === 'none') {
+      ctx.err('RULE_VIOLATION', 'confirmationLevel', `a 'confirmed' record must carry a confirmation level above 'none'`);
+    }
+    if (record.outcome === 'refuted') {
+      if (oracleKind && !APPLICABLE_FOR_REFUTATION.includes(oracleKind)) ctx.err('RULE_VIOLATION', 'oracle', `oracle kind '${oracleKind}' is not applicable for refutation`);
+      if (!(isPlainObject(pre) && pre.valid === true)) ctx.err('RULE_VIOLATION', 'preconditions', `'refuted' requires valid preconditions: a check that could not run is not a refutation`);
+    }
+  }
+
+  checkId(ctx, record, verificationRecordId(record));
+  return result(ctx);
+}
+
+/** Build a complete, valid-by-construction record from the semantic fields; derives the level and the id. */
+export function buildVerificationRecord(fields) {
+  const rec = {
+    schema: VERIFICATION_SCHEMA,
+    schemaVersion: SCHEMA_VERSION,
+    hypothesisId: fields.hypothesisId,
+    commit: fields.commit ?? null,
+    detectorOrigin: fields.detectorOrigin,
+    oracle: fields.oracle ?? null,
+    attempt: fields.attempt ?? 0,
+    outcome: fields.outcome,
+    reason: fields.reason,
+    evidence: fields.evidence ?? [],
+    evidenceRefs: fields.evidenceRefs ?? (fields.evidence ?? []).map(e => e.id),
+    scope: fields.scope,
+    preconditions: fields.preconditions ?? { valid: false },
+    repair: fields.repair ?? { status: 'none' },
+  };
+  rec.confirmationLevel = deriveConfirmationLevel(rec);
+  if (fields.migration) rec.migration = fields.migration;
+  if (fields.createdAt) rec.createdAt = fields.createdAt;
+  rec.id = verificationRecordId(rec);
+  return rec;
+}

package/src/posture/attestation.js

@@ -143,6 +143,11 @@ export function computeRunAttestation({
     try {
       att.signature = signLastScan(digest);
       att.signatureScope = 'per-install-hmac';
+      // CORE-003.AC03: say plainly who vouches. A symmetric install HMAC can be
+      // produced by anyone who can verify it, so it is self-issued by
+      // construction and can never be third-party certification.
+      att.trustBasis = 'self-issued-local-key';
+      att.independentlyCertified = false;
     } catch { /* signing is best-effort; an unsigned attestation is still valid */ }
   }
   return att;