@clear-capabilities/agentic-security-scanner 0.161.0 → 0.163.0

package/src/posture/verification/patch-negative.js

@@ -0,0 +1,226 @@
+// Patch-negative verification (X-204).
+//
+// A re-scan that no longer fires proves the DETECTOR went quiet; a cosmetic edit can do that. A repair is `verified-fix` here
+// only when three things are shown, each by an executed oracle run in an equivalent disposable environment:
+//
+//   1. original-positive   the original revision reproduces the exploit        (oracle outcome: confirmed)
+//   2. patched-negative    the patched revision no longer does, same oracle    (oracle outcome: refuted)
+//   3. functional-regression  declared legitimate behaviour is intact on the patched revision, with the same expectations
+//      holding on the original first (a baseline), so a wrong expectation is reported rather than blamed on the patch.
+//
+// All four runs (the baseline is one) go through `replayManifest`, so each is pinned by commit, fixture hash, patch hash,
+// toolchain, oracle version and inputs, executes inside the trust boundary, and issues a verifier receipt. The result is then
+// handed to `promotePatch`, which re-derives the diff and revision from the proposal and refuses any receipt that does not
+// match them. `verified-fix` needs the promotion; nothing else grants it.
+//
+// A failure never degrades to a vague "not verified": it names the SPECIFIC step that is incomplete and a typed failure code:
+//   original-not-reproduced      the original did not reproduce under the oracle (nothing to fix, or the scenario is wrong)
+//   patched-still-exploitable    the exploit still works on the patched revision
+//   patched-build-broken         the patched revision did not load or its benign control failed
+//   patched-negative-inconclusive the patched run decided nothing
+//   functional-omitted           no functional check was supplied
+//   functional-baseline-invalid  the declared expectations do not hold on the ORIGINAL revision
+//   functional-regression-detected the patched revision behaves differently from the declared expectations
+//   oracle-changed               the oracle, its version or its inputs differ between the original and patched runs
+//   revision-unbound             no exact commit: a verdict cannot be tied to a revision
+//   prerequisite-unmet           a toolchain, feature or isolation prerequisite is missing; resumable where stated
+//   environment-mismatch         the runs were not in equivalent environments
+//   promotion-refused            the receipts do not match the exact proposed diff and revision
+//
+// The behaviour check is the functional-regression oracle by default. A requester may name `business-state` as `functional.oracleId`
+// (X-406, `invariants/repair.js`): the same two runs and the same expectation, with an authorized-workflow scenario as the declared
+// case, and `promotePatch` then requires the functional receipts to come from that oracle class instead.
+//
+// Scope, stated so no caller overclaims: the exploit scenario and the functional cases are the REQUESTER's; this verifies the
+// declared scenario and cases, not that the patch is correct elsewhere. Linux is not claimed (the oracle platform statements
+// stay `unverified`). Receipts are valid inside this process only (see patch-promotion.js).
+import { digestOf } from '../assurance/identity.js';
+import { isCommit, isPlainObject } from '../assurance/schema-kit.js';
+import { resolveAssuranceConfig, featureStatus } from '../assurance/config.js';
+import { createReplayManifest, replayManifest } from '../replay/replay.js';
+import * as registry from '../oracles/registry.js';
+import { promotePatch } from './patch-promotion.js';
+import { appendRepairRecord, recordPromotion, verificationRepairFor, withRepairStatus } from './repair-records.js';
+
+const PATCH_NEGATIVE_FEATURE = 'patch-negative-verification';
+const FUNCTIONAL_ORACLE = 'functional-regression';
+// The check that behaviour is preserved is normally the functional-regression oracle. A requester may name `business-state`
+// instead (X-406): the same two runs, the same expectation (refuted), with an authorized-workflow scenario as the declared case.
+const FUNCTIONAL_ORACLES = Object.freeze([FUNCTIONAL_ORACLE, 'business-state']);
+
+const STEPS = Object.freeze(['original-positive', 'patched-negative', 'functional-baseline', 'functional-regression']);
+
+const ROLE_OF_STEP = Object.freeze({ 'original-positive': 'original', 'patched-negative': 'patched', 'functional-baseline': 'functionalBaseline', 'functional-regression': 'functional' });
+const EXPECTED = Object.freeze({ 'original-positive': 'confirmed', 'patched-negative': 'refuted', 'functional-baseline': 'refuted', 'functional-regression': 'refuted' });
+
+const stepResult = (step, status, extra = {}) => ({ step, status, expected: EXPECTED[step], outcome: null, code: null, reason: null, recordId: null, receiptDigest: null, ...extra });
+
+function replayCode(run) {
+  const first = (run.errors || [])[0];
+  if (!first) return 'manifest-rejected';
+  if (first.code === 'ORACLE_MISMATCH') return 'oracle-changed';
+  if (first.code === 'HASH_MISMATCH') return 'content-hash-mismatch';
+  return 'manifest-rejected';
+}
+
+function classify(step, run) {
+  if (run.status === 'rejected') return { status: 'incomplete', code: replayCode(run), reason: (run.errors || []).map((e) => e.message).join('; ').slice(0, 300) || 'the replay manifest was rejected' };
+  if (run.status === 'awaiting-prerequisites') {
+    const resumable = (run.prerequisites || []).every((p) => p.resumable);
+    return { status: 'incomplete', code: 'prerequisite-unmet', outcome: run.outcome ?? null, resumable, reason: `${(run.prerequisites || []).map((p) => `${p.kind} ${p.id} (${p.state})`).join('; ') || 'a prerequisite is unmet'}; nothing was executed${resumable ? ' (resumable)' : ''}` };
+  }
+  const outcome = run.outcome;
+  const observed = run.receipt?.observed || {};
+  // a business-state run reports its control flow under `preconditions`: a control flow that no longer works is a broken revision
+  const loadBroken = observed.targetLoaded === false || observed.benignCompleted === false || observed.preconditions?.controlRan === false || observed.preconditions?.controlDurableEffect === false;
+  if (outcome === 'error') return { status: 'incomplete', code: 'harness-error', reason: String(run.record?.reason || 'the oracle run failed').slice(0, 300), outcome };
+  if (outcome === EXPECTED[step]) return { status: 'passed', code: null, reason: run.record?.reason ?? null, outcome };
+  const reason = String(run.record?.reason || '').slice(0, 300);
+  switch (step) {
+    case 'original-positive':
+      return { status: 'failed', code: 'original-not-reproduced', reason: `the original revision did not reproduce the exploit (outcome '${outcome}'): ${reason}`, outcome };
+    case 'patched-negative':
+      if (outcome === 'confirmed') return { status: 'failed', code: 'patched-still-exploitable', reason: `the exploit still works on the patched revision: ${reason}`, outcome };
+      return loadBroken
+        ? { status: 'failed', code: 'patched-build-broken', reason: `the patched revision did not load or its benign control failed: ${reason}`, outcome }
+        : { status: 'failed', code: 'patched-negative-inconclusive', reason: `the patched run decided nothing (outcome '${outcome}'): ${reason}`, outcome };
+    case 'functional-baseline':
+      return { status: 'failed', code: 'functional-baseline-invalid', reason: `the declared functional expectations do not hold on the original revision (outcome '${outcome}'): ${reason}`, outcome };
+    default:
+      if (outcome === 'confirmed') return { status: 'failed', code: 'functional-regression-detected', reason: `the patched revision behaves differently from the declared expectations: ${reason}`, outcome };
+      return loadBroken
+        ? { status: 'failed', code: 'patched-build-broken', reason: `the patched revision did not load for the functional check: ${reason}`, outcome }
+        : { status: 'failed', code: 'functional-inconclusive', reason: `the functional check decided nothing (outcome '${outcome}'): ${reason}`, outcome };
+  }
+}
+
+function summaryOf(steps, verified, incomplete, code) {
+  const label = (s) => ({ passed: 'PASS', failed: 'FAIL', incomplete: 'INCOMPLETE', 'not-run': 'not run' })[s.status];
+  const lines = steps.map((s) => `${s.step}: ${label(s)}${s.code ? ` (${s.code})` : ''}${s.reason && s.status !== 'passed' ? ` - ${s.reason}` : ''}`);
+  lines.push(verified
+    ? 'verified-fix: the exploit reproduced on the original revision, did not reproduce on the patched revision, and the declared functional cases still hold. Only the declared scenario and cases were exercised.'
+    : `NOT verified-fix: incomplete step '${incomplete}'${code ? ` (${code})` : ''}.`);
+  return lines.join('\n');
+}
+
+/**
+ * Run the three-part patch-negative verification for one proposed patch. Never throws.
+ *
+ * @param {object} req
+ * @param {string} req.hypothesisId   the finding's stable id
+ * @param {string} req.commit         exact revision the patch is proposed against (40 or 64 hex)
+ * @param {object} req.original       { files, entry, oracleId, inputs, budgets? } the exploit scenario on the original files
+ * @param {object} req.patch          { files } the proposed diff: the new content of each changed file
+ * @param {object} [req.patched]      { oracleId?, inputs?, entry? }: must equal the original's; anything else is `oracle-changed`
+ * @param {object} [req.functional]   { inputs, budgets? } for the functional-regression oracle; omitting it prevents verified-fix
+ * @param {object} [req.pinnedOracle] { id, version, logicDigest } the oracle identity the requester recorded earlier
+ * @param {object[]} [req.ledger]     earlier repair records to extend
+ * @param {object} [o] { config, runOptions } config is the assurance config; runOptions go to the oracle runner (test seams)
+ */
+export async function verifyPatchNegative(req, o = {}) {
+  const config = o.config || resolveAssuranceConfig({ env: process.env });
+  const gate = featureStatus(config, PATCH_NEGATIVE_FEATURE);
+  const steps = STEPS.map((s) => stepResult(s, 'not-run', { reason: 'not reached' }));
+  const base = {
+    status: 'not-verified-fix', verifiedFix: false, incompleteStep: null, failureCode: null, reason: null, steps,
+    patchDigest: null, promotion: null, receipts: null, records: {}, verificationRecord: null, repairRecords: Array.isArray(req?.ledger) ? req.ledger : [], summary: '',
+  };
+  if (gate.status !== 'ok') {
+    return { ...base, status: 'disabled', incompleteStep: 'feature-gate', failureCode: gate.code || 'disabled', reason: `${PATCH_NEGATIVE_FEATURE} is not available: ${gate.reason}`, summary: `patch-negative verification did not run: ${gate.reason}` };
+  }
+  const refuse = (step, code, reason, extra = {}) => {
+    const rejected = req && isPlainObject(req.patch) && isPlainObject(req.patch.files) && Object.keys(req.patch.files).length && typeof req.hypothesisId === 'string'
+      ? ledgerFor(base.repairRecords, req, base.patchDigest ?? digestOf(req.patch.files), { rejected: { step, code, reason } }) : { records: base.repairRecords };
+    return { ...base, ...extra, patchDigest: req?.patch?.files ? digestOf(req.patch.files) : null, incompleteStep: step, failureCode: code, reason, repairRecords: rejected.records, summary: summaryOf(steps, false, step, code) };
+  };
+
+  // ---- shape and preconditions that need no execution
+  const patchFiles = req?.patch?.files;
+  if (!isPlainObject(req) || typeof req.hypothesisId !== 'string' || !req.hypothesisId || !isPlainObject(req.original) || !isPlainObject(req.original.files)
+    || typeof req.original.entry !== 'string' || typeof req.original.oracleId !== 'string' || !isPlainObject(req.original.inputs)
+    || !isPlainObject(patchFiles) || Object.keys(patchFiles).length === 0) {
+    return refuse('input-validation', 'bad-request', 'a request needs a hypothesis id, the original files, entry, oracle and inputs, and a non-empty patch');
+  }
+  if (!isCommit(req.commit)) return refuse('input-validation', 'revision-unbound', 'no exact commit was given: a verdict cannot be tied to a revision');
+  const original = req.original;
+  const oracle = registry.getOracle(original.oracleId);
+  if (!oracle) return refuse('input-validation', 'unknown-oracle', `the exploit oracle '${String(original.oracleId).slice(0, 60)}' is not registered`);
+  if (oracle.id === FUNCTIONAL_ORACLE) return refuse('input-validation', 'bad-request', 'the exploit oracle cannot be the functional-regression oracle');
+  const patched = isPlainObject(req.patched) ? req.patched : {};
+  if ((patched.oracleId !== undefined && patched.oracleId !== original.oracleId) || (patched.inputs !== undefined && digestOf(patched.inputs) !== digestOf(original.inputs)) || (patched.entry !== undefined && patched.entry !== original.entry)) {
+    return refuse('oracle-consistency', 'oracle-changed', 'the patched run names a different oracle, entry or inputs than the original run: a changed oracle cannot show the exploit is closed');
+  }
+  const pin = req.pinnedOracle;
+  if (pin !== undefined && (!isPlainObject(pin) || pin.id !== oracle.id || pin.version !== oracle.version || pin.logicDigest !== oracle.logicDigest)) {
+    return refuse('oracle-consistency', 'oracle-changed', 'the oracle differs from the identity the requester pinned (id, version or logic digest)');
+  }
+  const fn = req.functional;
+  if (!isPlainObject(fn) || !isPlainObject(fn.inputs)) {
+    return refuse('functional-regression', 'functional-omitted', 'no functional regression check was supplied: a patch that was never checked for behaviour cannot be a verified fix');
+  }
+  const functionalOracle = fn.oracleId === undefined ? FUNCTIONAL_ORACLE : fn.oracleId;
+  if (!FUNCTIONAL_ORACLES.includes(functionalOracle)) {
+    return refuse('input-validation', 'bad-request', `the functional check oracle must be one of ${FUNCTIONAL_ORACLES.join(', ')}`);
+  }
+
+  const patchDigest = digestOf(patchFiles);
+  base.patchDigest = patchDigest;
+  let ledger = ledgerFor(base.repairRecords, req, patchDigest, {}).records; // proposed
+  const common = { hypothesisId: req.hypothesisId, commit: req.commit };
+  const plan = [
+    ['original-positive', { oracleId: original.oracleId, entry: original.entry, inputs: original.inputs, patchFiles: null, budgets: original.budgets }],
+    ['patched-negative', { oracleId: original.oracleId, entry: original.entry, inputs: original.inputs, patchFiles, budgets: original.budgets }],
+    ['functional-baseline', { oracleId: functionalOracle, entry: original.entry, inputs: fn.inputs, patchFiles: null, budgets: fn.budgets }],
+    ['functional-regression', { oracleId: functionalOracle, entry: original.entry, inputs: fn.inputs, patchFiles, budgets: fn.budgets }],
+  ];
+  const runs = {};
+  let failed = null;
+  for (const [i, [step, spec]] of plan.entries()) {
+    if (failed) continue;
+    let run;
+    try {
+      const manifest = createReplayManifest({ ...common, fixtureFiles: original.files, patchFiles: spec.patchFiles, oracleId: spec.oracleId, entry: spec.entry, inputs: spec.inputs, budgets: spec.budgets || {}, expected: { outcome: EXPECTED[step] } });
+      run = await replayManifest({ manifest, fixtureFiles: original.files, patchFiles: spec.patchFiles }, { config: o.config || config, runOptions: o.runOptions });
+    } catch (e) {
+      run = { status: 'rejected', errors: [{ code: 'RUN_FAILED', message: String(e?.message || e).slice(0, 200) }] };
+    }
+    const c = classify(step, run);
+    steps[i] = stepResult(step, c.status, { ...c, recordId: run.record?.id ?? null, receiptDigest: run.receipt?.receiptDigest ?? null });
+    if (run.executed && run.receipt) runs[ROLE_OF_STEP[step]] = run;
+    if (c.status !== 'passed') failed = { step, ...c };
+  }
+  base.records = Object.fromEntries(Object.entries(runs).map(([k, r]) => [k, r.record]));
+  if (failed) {
+    ledger = ledgerFor(ledger, req, patchDigest, { rejected: { step: failed.step, code: failed.code, reason: failed.reason } }).records;
+    const original0 = base.records.original ? withRepairStatus(base.records.original, verificationRepairFor(ledger, req.hypothesisId, patchDigest)) : null;
+    return { ...base, incompleteStep: failed.step, failureCode: failed.code, reason: failed.reason, resumable: failed.resumable ?? false, repairRecords: ledger, verificationRecord: original0, summary: summaryOf(steps, false, failed.step, failed.code) };
+  }
+
+  // ---- the receipts must match the exact proposed diff and revision before anything is promoted
+  const receipts = Object.fromEntries(Object.entries(runs).map(([k, r]) => [k, r.receipt]));
+  const promotion = promotePatch({ proposal: { hypothesisId: req.hypothesisId, revision: req.commit, originalFiles: original.files, patchFiles, functionalOracle }, receipts });
+  if (!promotion.ok) {
+    const envBroken = promotion.reasons.some((r) => r.code === 'environment-mismatch');
+    const code = envBroken ? 'environment-mismatch' : promotion.reasons.some((r) => r.code === 'oracle-changed') ? 'oracle-changed' : 'promotion-refused';
+    const step = envBroken ? 'environment-equivalence' : code === 'oracle-changed' ? 'oracle-consistency' : 'promotion';
+    const reason = promotion.reasons.map((r) => r.message).join('; ').slice(0, 400);
+    ledger = ledgerFor(ledger, req, patchDigest, { rejected: { step, code, reason } }).records;
+    return { ...base, promotion, incompleteStep: step, failureCode: code, reason, repairRecords: ledger, verificationRecord: base.records.original ? withRepairStatus(base.records.original, verificationRepairFor(ledger, req.hypothesisId, patchDigest)) : null, summary: summaryOf(steps, false, step, code) };
+  }
+  const promoted = recordPromotion(ledger, promotion, { verificationRecordId: base.records.patched?.id ?? null });
+  ledger = promoted.records;
+  const verificationRecord = withRepairStatus(base.records.original, verificationRepairFor(ledger, req.hypothesisId, patchDigest, base.records.patched?.id));
+  return {
+    ...base, status: 'verified-fix', verifiedFix: true, promotion, receipts, repairRecords: ledger, verificationRecord,
+    reason: 'verified', summary: summaryOf(steps, true, null, null),
+  };
+}
+
+// The ledger for one verification: always starts with a `proposed` record, and records a rejection when verification stopped.
+function ledgerFor(records, req, patchDigest, { rejected } = {}) {
+  let list = Array.isArray(records) ? records : [];
+  const fields = { hypothesisId: req.hypothesisId, revision: isCommit(req.commit) ? req.commit : null, diffDigest: patchDigest };
+  if (!list.some((r) => r.hypothesisId === fields.hypothesisId && r.diffDigest === patchDigest)) list = appendRepairRecord(list, { ...fields, kind: 'proposed', reason: 'a patch was proposed for verification' }).records;
+  if (rejected) list = appendRepairRecord(list, { ...fields, kind: 'rejected', step: rejected.step, reason: `${rejected.code}: ${String(rejected.reason || '').slice(0, 300)}` }).records;
+  return { records: list };
+}

package/src/posture/verification/patch-promotion.js

@@ -0,0 +1,113 @@
+// Promoting a patch on independent verifier receipts (X-204.AC03).
+//
+// A patch may be PROMOTED (made eligible to be applied) only after the verifier domain has issued receipts for the exact
+// diff it is being asked to promote, at the exact revision it was proposed against:
+//
+//   original            the original files reproduce the exploit          -> confirmed
+//   patched             original files with the proposed diff applied     -> refuted
+//   functionalBaseline  the functional expectations on the original files -> refuted (no regression)
+//   functional          the same expectations on the patched files        -> refuted (no regression)
+//
+// Every receipt is checked against the PROPOSAL, not against itself: the digest of the files a receipt covers must equal the
+// digest this module recomputes from the proposed diff, and the commit it was issued for must be the proposal's revision. A
+// receipt for a different diff, a different revision or a different hypothesis does not promote, and neither does a receipt
+// the verifier did not issue (a copy, a hand-built object, a receipt whose content was edited: `isIssuedReceipt` is true only
+// for the frozen object `runOracle` itself created).
+//
+// What this proves and what it does not: the receipts are unsigned objects valid inside the verifier's own process. A receipt
+// that crossed a process boundary (JSON) is no longer an issued receipt and cannot promote; carrying promotion across
+// processes needs a signing domain, which belongs to the signer, not to this module. Receipts show that the declared scenario
+// and the declared functional cases behaved as stated; they do not show the patch is correct beyond them.
+import { digestOf } from '../assurance/identity.js';
+import { isCommit, isPlainObject } from '../assurance/schema-kit.js';
+import { isIssuedReceipt } from '../oracles/oracle.js';
+
+const PROMOTION_ROLES = Object.freeze(['original', 'patched', 'functionalBaseline', 'functional']);
+// The oracle class the behaviour-preservation runs must come from. Default `functional-regression`; a proposal may name
+// `business-state` (X-406: an authorized-workflow scenario as the declared case). Nothing else is accepted.
+const FUNCTIONAL_CLASSES = Object.freeze({ 'functional-regression': 'functional-regression', 'business-state': 'business-state' });
+
+const ISSUED_PROMOTIONS = new WeakSet();
+
+/** True only for a result `promotePatch` itself returned with `ok: true`. A copy or a hand-built object is not. */
+export function isIssuedPromotion(p) { return isPlainObject(p) && ISSUED_PROMOTIONS.has(p); }
+
+// What each receipt role must have settled to.
+const EXPECTED_OUTCOME = Object.freeze({ original: 'confirmed', patched: 'refuted', functionalBaseline: 'refuted', functional: 'refuted' });
+
+const same = (a, b) => digestOf(a ?? null) === digestOf(b ?? null);
+
+/**
+ * @param {object} args
+ * @param {object} args.proposal  { hypothesisId, revision, originalFiles, patchFiles, functionalOracle? }
+ * @param {object} args.receipts  { original, patched, functionalBaseline, functional }, each issued by runOracle
+ * @returns {{ ok: boolean, diffDigest: string|null, revision: string|null, reasons: {code,role,message}[], receiptDigests: object }}
+ */
+export function promotePatch({ proposal, receipts } = {}) {
+  const reasons = [];
+  const why = (code, role, message) => reasons.push({ code, role, message });
+  const out = (extra = {}) => {
+    const result = { ok: reasons.length === 0, diffDigest: null, revision: null, hypothesisId: null, reasons, receiptDigests: {}, ...extra };
+    result.ok = reasons.length === 0;
+    if (result.ok) ISSUED_PROMOTIONS.add(result);
+    return result;
+  };
+
+  if (!isPlainObject(proposal) || typeof proposal.hypothesisId !== 'string' || !proposal.hypothesisId
+    || !isPlainObject(proposal.originalFiles) || !isPlainObject(proposal.patchFiles) || Object.keys(proposal.patchFiles).length === 0) {
+    why('bad-proposal', null, 'a proposal needs a hypothesis id, the original files and a non-empty diff');
+    return out();
+  }
+  if (!isCommit(proposal.revision)) {
+    why('revision-unbound', null, 'a promotion is bound to one exact 40 or 64 character commit; none was given');
+    return out();
+  }
+  const functionalClass = proposal.functionalOracle === undefined ? 'functional-regression' : FUNCTIONAL_CLASSES[proposal.functionalOracle];
+  if (!functionalClass) {
+    why('bad-proposal', null, 'the functional check oracle must be functional-regression or business-state');
+    return out();
+  }
+  const diffDigest = digestOf(proposal.patchFiles);
+  const originalDigest = digestOf(proposal.originalFiles);
+  const patchedDigest = digestOf({ ...proposal.originalFiles, ...proposal.patchFiles });
+  const wantFiles = { original: originalDigest, functionalBaseline: originalDigest, patched: patchedDigest, functional: patchedDigest };
+  const base = { diffDigest, revision: proposal.revision, hypothesisId: proposal.hypothesisId };
+
+  const given = isPlainObject(receipts) ? receipts : {};
+  const digests = {};
+  for (const role of PROMOTION_ROLES) {
+    const r = given[role];
+    if (!r) { why('receipt-missing', role, `no ${role} receipt was supplied`); continue; }
+    if (!isIssuedReceipt(r) || r.issuedBy !== 'verifier' || r.schema !== 'agentic-security/oracle-receipt') {
+      why('receipt-not-issued', role, `the ${role} receipt was not issued by the verifier domain (a copy or constructed receipt is not valid)`);
+      continue;
+    }
+    digests[role] = r.receiptDigest;
+    if (r.request.hypothesisId !== proposal.hypothesisId) why('receipt-hypothesis', role, `the ${role} receipt is for a different hypothesis`);
+    if (r.request.commit !== proposal.revision) why('receipt-revision', role, `the ${role} receipt was issued for a different revision than the proposal`);
+    if (r.request.filesDigest !== wantFiles[role]) why('receipt-diff', role, `the ${role} receipt covers different content than the exact proposed diff on the original revision`);
+    if (r.settled.outcome !== EXPECTED_OUTCOME[role]) why('receipt-outcome', role, `the ${role} receipt settled '${r.settled.outcome}', not '${EXPECTED_OUTCOME[role]}'`);
+    if (role !== 'original' && r.settled.outcome === 'refuted' && r.settled.preconditionsHeld !== true) why('receipt-preconditions', role, `the ${role} receipt did not prove its preconditions`);
+  }
+  if (reasons.length) return out({ ...base, receiptDigests: digests });
+
+  const { original, patched, functionalBaseline, functional } = given;
+  // the exploit oracle is the SAME oracle on the SAME inputs for both revisions
+  if (!same(original.oracle, patched.oracle) || original.request.inputsDigest !== patched.request.inputsDigest || original.request.entry !== patched.request.entry) {
+    why('oracle-changed', 'patched', 'the patched-negative run did not use the same oracle, entry and inputs as the original-positive run');
+  }
+  // the functional check is one oracle on one set of inputs for both revisions
+  if (!same(functionalBaseline.oracle, functional.oracle) || functionalBaseline.request.inputsDigest !== functional.request.inputsDigest) {
+    why('oracle-changed', 'functional', 'the functional check on the patched revision did not use the same oracle and cases as its baseline');
+  }
+  if (functional.oracle.class !== functionalClass) why('oracle-changed', 'functional', `the functional check is not a ${functionalClass} oracle`);
+  if (original.oracle.class === 'functional-regression') why('oracle-changed', 'original', 'the exploit oracle must not be the functional-regression oracle');
+  // equivalent disposable environments: one sanitized environment identity across every run
+  const envDigest = digestOf(original.environment);
+  for (const role of PROMOTION_ROLES) {
+    if (digestOf(given[role].environment) !== envDigest) why('environment-mismatch', role, `the ${role} run executed in a different environment than the original run`);
+  }
+  // four runs are four distinct receipts: one receipt cannot be presented in two roles
+  if (new Set(Object.values(digests)).size !== PROMOTION_ROLES.length) why('receipt-reused', null, 'the same receipt was presented in more than one role');
+  return out({ ...base, receiptDigests: digests });
+}

package/src/posture/verification/projection.js

@@ -0,0 +1,183 @@
+// One projection of the verification record for every interface (X-206).
+//
+// The CLI JSON report, the MCP tools, the human-readable report and the autopilot response all show the SAME verification of
+// the SAME finding. They do that by calling this one module: nothing else renders, summarises or re-derives a state, a scope,
+// an evidence id or a replay prerequisite. A surface that formats its own text would eventually disagree with the others,
+// which is the defect this file exists to prevent.
+//
+// Rules the projection keeps:
+//   - It is a VIEW. It reads a validated version-1 record (`assurance/verification-record.js`) and invents nothing: an
+//     invalid record yields `{ ok: false, errors }`, never a guessed state.
+//   - Nothing the record holds is dropped. Every record field has a counterpart in the view (the test enumerates them), so a
+//     richer consumer loses nothing and a legacy consumer keeps its own boolean view under `legacy`.
+//   - The text never labels a partial result "safe" or "fixed". It states what the check established and what it did not,
+//     in words chosen per state, and a repair is described by its own separate status.
+//   - Output is deterministic: no clock, no randomness, a fixed key order and sorted prerequisites.
+import { validateVerificationRecord } from '../assurance/verification-record.js';
+import { toLegacyVerificationView } from '../assurance/migrations.js';
+import { isPlainObject } from '../assurance/schema-kit.js';
+import { trustedNegativeDenominator } from '../oracles/scenario-classes.js';
+
+export const VIEW_SCHEMA = 'agentic-security/verification-view';
+const VIEW_VERSION = '1.0.0';
+
+const RUNTIME_ORACLE_KINDS = ['runtime-replay', 'differential'];
+
+// What a reader is told for each state. Chosen so no partial state reads as a pass: only `confirmed` and `refuted` say anything
+// was decided, and both are limited to the declared scenario.
+const STATE_LABEL = Object.freeze({
+  confirmed: 'CONFIRMED (the declared scenario reproduced the effect)',
+  refuted: 'NOT REPRODUCED (the declared scenario did not reproduce the effect)',
+  inconclusive: 'INCONCLUSIVE (nothing was decided)',
+  'not-run': 'NOT RUN (no check was executed)',
+  unsupported: 'UNSUPPORTED (no applicable check exists here)',
+  error: 'ERROR (the check failed to run)',
+});
+
+const REPAIR_LINE = Object.freeze({
+  none: 'no patch is recorded for this finding',
+  proposed: 'a patch was proposed; it has not been replay-verified',
+  applied: 'a patch was applied; its effect has not been replay-verified',
+  'replay-verified': 'a patch was replay-verified against the declared scenario and functional cases only',
+  'rolled-back': 'a patch was rolled back',
+});
+
+function verifiedStatement(rec) {
+  const how = rec.oracle ? `oracle '${rec.oracle.id}'${rec.oracle.version ? ` v${rec.oracle.version}` : ''}` : 'no oracle';
+  const at = rec.commit ? ` at commit ${rec.commit.slice(0, 12)}` : ' without an exact commit';
+  switch (rec.outcome) {
+    case 'confirmed': return `${how} reproduced the effect${at}, within: ${rec.scope.description}`;
+    case 'refuted': return `${how} ran with valid preconditions and did not reproduce the effect${at}, within: ${rec.scope.description}`;
+    case 'inconclusive': return `nothing was established${rec.attempt > 0 ? ` (${how} ran but did not decide)` : ''}`;
+    case 'not-run': return 'nothing was established; no check was executed';
+    case 'unsupported': return 'nothing was established; no applicable check exists in this environment';
+    default: return 'nothing was established; the check did not complete';
+  }
+}
+
+function untestedStatements(rec) {
+  const out = [];
+  if (rec.outcome === 'confirmed' || rec.outcome === 'refuted') {
+    out.push('behaviour outside the declared scenario and inputs');
+    if (rec.outcome === 'refuted') out.push('other inputs and code paths that could still reach the same effect');
+  } else if (rec.outcome === 'inconclusive') {
+    out.push('whether the effect is reachable: the check did not decide');
+  } else {
+    out.push('the hypothesis itself: it has not been exercised');
+  }
+  if (rec.repair.status !== 'replay-verified') out.push('the effect of any proposed patch under a trusted exploit-negative replay');
+  if (rec.confirmationLevel === 'none' && rec.outcome !== 'confirmed') out.push('independent adjudication: none is recorded');
+  return out;
+}
+
+/**
+ * The replay prerequisites for this record. Derived ones come from the record itself, so every surface computes the same
+ * list. Typed prerequisites a replay attempt reported (`replay/replay.js`) are merged in by id.
+ */
+function replayPrerequisites(rec, supplied) {
+  const items = new Map();
+  items.set('exact-commit', {
+    id: 'exact-commit', state: rec.commit ? 'met' : 'unmet',
+    detail: rec.commit ? 'the record is bound to one exact commit' : 'no exact commit is recorded; a replay cannot be pinned',
+  });
+  const runtime = !!rec.oracle && RUNTIME_ORACLE_KINDS.includes(rec.oracle.kind);
+  items.set('runtime-oracle', {
+    id: 'runtime-oracle', state: runtime ? 'met' : 'unmet',
+    detail: runtime ? `oracle '${rec.oracle.id}' is a runtime oracle` : 'no runtime oracle produced this record, so there is nothing to replay',
+  });
+  items.set('execution-boundary', {
+    id: 'execution-boundary', state: 'declared',
+    detail: `recorded on ${rec.scope.platform}${rec.scope.backend ? ` (${rec.scope.backend} backend)` : ''}; a replay needs an equivalent host`,
+  });
+  for (const p of Array.isArray(supplied) ? supplied : []) {
+    if (!isPlainObject(p) || typeof p.id !== 'string' || !p.id) continue;
+    const state = ['met', 'unmet', 'declared'].includes(p.state) ? p.state : 'unmet';
+    const item = { id: p.kind ? `${p.kind}:${p.id}` : p.id, state, detail: typeof p.reason === 'string' && p.reason ? p.reason.slice(0, 200) : 'reported by the replay attempt' };
+    if (typeof p.resumable === 'boolean') item.resumable = p.resumable;
+    items.set(item.id, item);
+  }
+  const list = [...items.values()].sort((a, b) => a.id.localeCompare(b.id));
+  const replayable = runtime && !!rec.commit && !['not-run', 'unsupported'].includes(rec.outcome) && !list.some((p) => p.state === 'unmet');
+  return { replayable, prerequisites: list };
+}
+
+function textLines(view) {
+  const lines = [];
+  lines.push(`Verification: ${STATE_LABEL[view.state]}`);
+  lines.push(`  Record: ${view.recordId}${view.oracle ? `  oracle: ${view.oracle.id}${view.oracle.version ? `@${view.oracle.version}` : ''}` : '  oracle: none'}`);
+  lines.push(`  Scope: ${view.scope.description} [${view.scope.platform}${view.scope.backend ? `/${view.scope.backend}` : ''}]`);
+  lines.push(`  Verified: ${view.summary.verified}`);
+  lines.push(`  Not verified: ${view.summary.untested.join('; ')}`);
+  lines.push(`  Repair: ${REPAIR_LINE[view.repair.status]}`);
+  lines.push(`  Reason: ${view.reason}`);
+  lines.push(`  Evidence: ${view.evidenceIds.length ? view.evidenceIds.join(', ') : 'none'}`);
+  lines.push(`  Replay prerequisites: ${view.replay.prerequisites.map((p) => `${p.id} (${p.state})`).join(', ')}${view.replay.replayable ? '' : ' [not replayable as recorded]'}`);
+  return lines;
+}
+
+/**
+ * Project a version-1 verification record.
+ *
+ * @param {object} record  a record from `emitVerification` / `runOracle`
+ * @param {object} [o]
+ * @param {object[]} [o.replay]  typed prerequisites a replay attempt reported (`attempt.prerequisites`)
+ * @returns {{ ok: boolean, view: object|null, errors: object[] }} never throws
+ */
+export function projectVerification(record, o = {}) {
+  try {
+    const v = validateVerificationRecord(record);
+    if (!v.ok) return { ok: false, view: null, errors: v.errors };
+    const replay = replayPrerequisites(record, o.replay);
+    const view = {
+      schema: VIEW_SCHEMA, schemaVersion: VIEW_VERSION,
+      recordId: record.id, recordSchemaVersion: record.schemaVersion,
+      hypothesisId: record.hypothesisId, commit: record.commit, detectorOrigin: record.detectorOrigin,
+      oracle: record.oracle, attempt: record.attempt,
+      state: record.outcome, reason: record.reason,
+      confirmationLevel: record.confirmationLevel, preconditions: record.preconditions,
+      scope: record.scope, repair: record.repair,
+      evidence: record.evidence.map((e) => ({ id: e.id, kind: e.kind, producer: e.producer, digest: e.digest, source: e.source ?? null })),
+      evidenceIds: record.evidence.map((e) => e.id),
+      referencedEvidenceIds: [...record.evidenceRefs],
+      replay,
+      summary: { verified: verifiedStatement(record), untested: untestedStatements(record) },
+      legacy: toLegacyVerificationView(record),
+      migration: record.migration ?? null, createdAt: record.createdAt ?? null,
+    };
+    view.text = textLines(view);
+    return { ok: true, view, errors: [] };
+  } catch (e) {
+    return { ok: false, view: null, errors: [{ code: 'RULE_VIOLATION', path: '', message: `verification projection failed: ${String(e?.message || e).slice(0, 160)}` }] };
+  }
+}
+
+/**
+ * The fields every surface adds to an output that carries a verification record. The key is `verificationView`, NOT
+ * `verification`: a finding's `verification` field is the producer/verifier separation record
+ * (`posture/verification-separation.js`) and keeps its meaning. ADDITIVE: an output without a record gets
+ * `{}` and is byte-identical to what it was. A record that does not validate is reported, not dropped and not guessed.
+ */
+export function verificationFields(record, o = {}) {
+  if (!isPlainObject(record)) return {};
+  const p = projectVerification(record, o);
+  return p.ok ? { verificationView: p.view } : { verificationView: null, verificationViewErrors: p.errors };
+}
+
+/**
+ * The trusted-negative accounting for a set of verification records, for every interface that summarises a run
+ * (`oracles/scenario-classes.js` owns the rule): only a decided result of an executed oracle of an advertised non-taint class,
+ * with proven preconditions and trusted runtime proof, is counted. Every other record is listed with why it was left out, so an
+ * unsupported or unrun case can never read as "checked and clean". Records that are not valid are reported as excluded.
+ */
+export function verificationCoverage(records) {
+  const list = (Array.isArray(records) ? records : []).filter(isPlainObject);
+  const valid = list.filter((r) => validateVerificationRecord(r).ok);
+  const d = trustedNegativeDenominator(valid);
+  const invalid = list.length - valid.length;
+  const excluded = [...d.excluded, ...Array.from({ length: invalid }, () => ({ id: null, outcome: null, reason: 'malformed' }))];
+  const reasons = {};
+  for (const e of excluded) reasons[e.reason] = (reasons[e.reason] || 0) + 1;
+  const why = Object.entries(reasons).sort(([a], [b]) => a.localeCompare(b)).map(([k, n]) => `${k}: ${n}`).join(', ');
+  const lines = [`Trusted non-taint verification: ${d.denominator} decided (${d.trustedNegatives} not reproduced, ${d.trustedPositives} confirmed) of ${list.length} record(s); ${excluded.length} not counted${excluded.length ? ` (${why})` : ''}`];
+  return { schema: 'agentic-security/verification-coverage', schemaVersion: '1.0.0', total: list.length, denominator: d.denominator, trustedNegatives: d.trustedNegatives, trustedPositives: d.trustedPositives, excluded, lines };
+}