@clear-capabilities/agentic-security-scanner 0.161.0 → 0.163.0

package/dist/9560.index.js

@@ -2,6 +2,2091 @@ export const id = 9560;
 export const ids = [9560,8218,9390,8752];
 export const modules = {
 
+/***/ 99405:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  e: () => (/* binding */ createToolGate)
+});
+
+// UNUSED EXPORTS: featureEnabledByOperator
+
+// EXTERNAL MODULE: ./src/posture/assurance/config.js
+var config = __webpack_require__(90385);
+// EXTERNAL MODULE: ./src/mcp/redact.js
+var redact = __webpack_require__(83468);
+// EXTERNAL MODULE: ./src/llm-validator/redact.js
+var llm_validator_redact = __webpack_require__(65388);
+;// CONCATENATED MODULE: ./src/capabilities/secrets.js
+// One secret scrubber for the capability layer: provider-shaped credentials
+// (mcp/redact.js, which is the list the scanner's own detector mirrors), then
+// assignment, bearer, connection-string and high-entropy-literal shapes
+// (llm-validator/redact.js). Pure. The count is of replacements made, so a
+// caller can ask "did this text carry a secret" without keeping the secret.
+
+
+
+/**
+ * True when the text carries a provider-shaped credential or a quoted credential
+ * assignment. The high-entropy-literal heuristic is deliberately NOT used here:
+ * an argument list is mostly paths and scripts, and refusing every long quoted
+ * path would make the policy unusable. Scrubbing for output and logs (below) is
+ * allowed to be broader than refusing an argument.
+ */
+function detectSecretShapes(text) {
+  return typeof text === 'string' && (0,redact/* redactSecretShapes */.Kb)(text).redactions > 0;
+}
+
+function secrets_scrubSecretText(text) {
+  if (typeof text !== 'string' || !text) return { text: typeof text === 'string' ? text : '', redactions: 0 };
+  const a = (0,redact/* redactSecretShapes */.Kb)(text);
+  let b;
+  try { b = (0,llm_validator_redact/* redactSecrets */.f)(a.text); } catch { return { text: '[unprintable]', redactions: a.redactions + 1 }; }
+  return { text: b.text, redactions: a.redactions + b.redactions };
+}
+
+;// CONCATENATED MODULE: ./src/capabilities/reasons.js
+// Policy reason codes (X-501.AC03). A decision carries a code from this closed
+// table and the fixed sentence beside it, never text built from the request. The
+// request (a path, an argument, a host) can carry attacker-chosen content, and a
+// decision is logged, put in receipts and shown to a worker, so nothing from the
+// request may reach the reason. The only request-derived field of a decision is
+// `subject`, which is sanitized and length-capped (`sanitizeSubject`).
+
+
+const REASONS = Object.freeze({
+  allowed: 'the action is inside the declared capability scope',
+  'no-grant': 'no capability of this kind is declared for the task',
+  'binding-mismatch': 'the request is not bound to this task, repository revision and policy version',
+  'unknown-action': 'the action kind is not recognized',
+  'invalid-manifest': 'the capability manifest is invalid',
+  'scope-expansion': 'the request would widen the capability scope granted by the parent task',
+  'path-invalid': 'the path is not an absolute, well-formed path',
+  'path-traversal': 'the path escapes the declared roots through parent-directory segments',
+  'symlink-escape': 'the path resolves outside the declared roots through a symbolic link',
+  'outside-roots': 'the path is outside every declared root',
+  'protected-path': 'the path is protected from tasks (keys, sealed labels, evidence, credentials)',
+  'executable-not-absolute': 'the executable must be an absolute path; names are not resolved through a search path',
+  'executable-unresolvable': 'the executable does not exist or is not a regular executable file',
+  'executable-in-writable-root': 'the executable lives in a writable root, so the task could replace it',
+  'command-not-listed': 'the executable is not a declared command',
+  'args-invalid': 'the argument list is not an array of plain strings within the size limits',
+  'args-not-permitted': 'the arguments are not permitted for this declared command',
+  'secret-in-argument': 'an argument contains secret material; arguments are visible to every process',
+  'interpreter-blocked': 'the executable is a shell or language interpreter and is not declared as a scoped interpreter',
+  'interpreter-args-unpinned': 'a scoped interpreter must be declared with its exact argument list',
+  'host-invalid': 'the destination host is not a well-formed host name or address',
+  'port-invalid': 'the destination port is not valid',
+  'destination-not-declared': 'the destination is not a declared network destination',
+  'port-not-declared': 'the destination host is declared but not on this port',
+  'scheme-not-declared': 'the destination is declared but not for this scheme',
+  'dns-private-address': 'the host name resolves to a loopback, private, link-local or metadata address that was not declared',
+  'dns-changed': 'the host name resolves to addresses outside the pinned set',
+  'payload-too-large': 'the outbound payload exceeds the mediated size limit',
+  'payload-uninspectable': 'the outbound payload is binary and cannot be filtered for secrets',
+  'tool-not-declared': 'the tool is not a declared tool action',
+  'delegation-not-allowed': 'the task is not allowed to delegate',
+  'delegation-depth': 'the delegation depth limit is reached',
+  'resource-limit-exceeded': 'the request exceeds a declared resource limit',
+  'tool-unclassified': 'the tool has no declared capability classification, so it cannot be checked and is refused',
+  'identity-missing': 'no current task identity is bound to this server, so a mutating or externally communicating tool is refused',
+  'identity-spoofed': 'the request names a task identity other than the one this server is bound to',
+  'retry-limit': 'the same action was denied the permitted number of times in this policy version and stays blocked',
+  'task-halted': 'the task reached its denial budget and is halted until an operator changes the policy',
+});
+
+const REASON_CODES = Object.freeze(Object.keys(REASONS));
+
+function reasonText(code) {
+  return Object.prototype.hasOwnProperty.call(REASONS, code) ? REASONS[code] : REASONS['unknown-action'];
+}
+
+/**
+ * The one request-derived field of a decision. Control characters are removed,
+ * secret-shaped material is redacted and the length is capped, so the field is
+ * safe to log and to show to the worker that made the request.
+ */
+function reasons_sanitizeSubject(value, max = 160) {
+  let s = typeof value === 'string' ? value : JSON.stringify(value) ?? '';
+  s = s.replace(/[\u0000-\u001f\u007f]/g, ' ');
+  try { s = secrets_scrubSecretText(s).text; } catch { s = '[unprintable]'; }
+  if (s.length > max) s = `${s.slice(0, max)}...`;
+  return s || '(empty)';
+}
+
+;// CONCATENATED MODULE: ./src/capabilities/tool-registry.js
+// The capability classification of every registered MCP tool (X-505.AC01).
+//
+// A tool that writes, runs a project command or reaches the network must say so,
+// and the gate (tool-gate.js) checks what it declares before the handler runs. A
+// tool that is not in this table is refused when the gate is active
+// (`tool-unclassified`), so adding a tool to the MCP registry without classifying
+// it fails closed and fails a test (test/capabilities/tools.test.js compares this
+// table with the registry in both directions).
+//
+//   effect    'read'      reads local state only
+//             'mutating'  writes project or agent state, or runs project code
+//             'external'  reaches, or may reach, the network through a package
+//                         manager or another tool the server process runs
+//   requires  the capability checks made before the handler:
+//               'tool'               the tool is a declared tool action
+//               'write:sessionRoot'  the session root is inside a declared write root
+//
+// What this table does NOT do: it does not route a tool's own file or network
+// activity through the capability runner. A tool runs in the MCP server process;
+// the decision is made at the tool boundary, so it is policy (`in-process-policy`),
+// never enforced isolation, and the report says so.
+const read = (note) => Object.freeze({ effect: 'read', requires: Object.freeze(['tool']), note });
+const mutating = (note, extra = []) => Object.freeze({ effect: 'mutating', requires: Object.freeze(['tool', 'write:sessionRoot', ...extra]), note });
+const external = (note, extra = []) => Object.freeze({ effect: 'external', requires: Object.freeze(['tool', ...extra]), note });
+
+const TOOL_CAPABILITIES = Object.freeze({
+  scan_diff: read('scans files in memory'),
+  query_taint: read('reads the last verified scan'),
+  explain_finding: read('reads the last verified scan'),
+  find_rule_module: read('reads scanner source names'),
+  read_scratchpad: read('reads the agent scratchpad'),
+  read_agents_memory: read('reads the continual-learning file'),
+  lookup_cve: read('reads the local advisory caches'),
+  query_triage_memory: read('reads past triage decisions'),
+  query_findings_memory: read('reads accumulated scan memory'),
+  query_cache_telemetry: read('reads the session transcript statistics'),
+  synthesize_fix: read('returns a stored patch'),
+  dataflow_get_graph: read('reads the signed graph artifact'),
+  dataflow_get_node: read('reads the signed graph artifact'),
+  dataflow_get_edge: read('reads the signed graph artifact'),
+  dataflow_get_flow: read('reads the signed graph artifact'),
+  invariant_scenario_export: read('builds a read-only scenario export from a supplied contract, confined to the session root'),
+  portfolio_progress: read('builds a read-only progress view from a portfolio store, ledger and optional inputs, confined to the session root'),
+  apply_fix: mutating('writes verified patches into the project'),
+  verify_fix: mutating('runs the project linter and tests and appends fix metrics'),
+  append_scratchpad: mutating('writes under the agent scratchpad'),
+  append_agents_memory: mutating('appends to the continual-learning file'),
+  synthesize_sca_upgrade: external('runs a package manager dry-run, which may reach a registry'),
+  apply_sca_upgrade: external('runs the package manager and the project tests and rewrites manifests', ['write:sessionRoot']),
+});
+
+function toolCapabilityFor(name) {
+  return typeof name === 'string' && Object.prototype.hasOwnProperty.call(TOOL_CAPABILITIES, name) ? TOOL_CAPABILITIES[name] : null;
+}
+
+/** Tools whose effect is not read-only: the ones that must always be checked. */
+function isMutatingOrExternal(name) {
+  const c = toolCapabilityFor(name);
+  return c ? c.effect !== 'read' : true; // an unclassified tool is treated as the riskiest
+}
+
+// EXTERNAL MODULE: external "node:crypto"
+var external_node_crypto_ = __webpack_require__(77598);
+// EXTERNAL MODULE: ./src/posture/evidence-bundle.js
+var evidence_bundle = __webpack_require__(98317);
+// EXTERNAL MODULE: ./src/sandbox/trust-domains.js
+var trust_domains = __webpack_require__(38832);
+// EXTERNAL MODULE: ./src/posture/assurance/identity.js
+var identity = __webpack_require__(41877);
+// EXTERNAL MODULE: external "node:path"
+var external_node_path_ = __webpack_require__(76760);
+// EXTERNAL MODULE: ./src/posture/assurance/schema-kit.js
+var schema_kit = __webpack_require__(53353);
+// EXTERNAL MODULE: external "node:fs"
+var external_node_fs_ = __webpack_require__(73024);
+;// CONCATENATED MODULE: ./src/capabilities/paths.js
+// Path handling for capability decisions (X-502). The OS boundary is what
+// actually blocks an access; these helpers only let a policy decision and a
+// pre-flight check agree with it about what a path names, including `..`
+// segments and symbolic links.
+
+
+
+const MAX_PATH = 4096;
+
+/**
+ * Lexical form of an absolute path: normalized, no trailing separator.
+ * `dotdot` reports whether the caller wrote a parent-directory segment, which
+ * is kept so a decision can say "traversal" rather than just "outside".
+ */
+function lexicalPath(p) {
+  if (typeof p !== 'string' || p.length === 0 || p.length > MAX_PATH || p.includes('\0')) return { ok: false };
+  if (!external_node_path_.isAbsolute(p)) return { ok: false };
+  const dotdot = p.split(external_node_path_.sep).includes('..');
+  let n = external_node_path_.normalize(p);
+  if (n.length > 1 && n.endsWith(external_node_path_.sep)) n = n.slice(0, -1);
+  return { ok: true, path: n, dotdot };
+}
+
+/**
+ * Canonical form: symbolic links resolved for the longest existing prefix, the
+ * not-yet-existing remainder appended lexically. This is what a write to a new
+ * file is judged by.
+ */
+function canonicalPath(p) {
+  const lex = lexicalPath(p);
+  if (!lex.ok) return null;
+  let head = lex.path;
+  const tail = [];
+  for (let i = 0; i < 4096; i++) {
+    try {
+      const real = external_node_fs_.realpathSync(head);
+      return tail.length ? external_node_path_.join(real, ...tail.reverse()) : real;
+    } catch (e) {
+      if (e.code !== 'ENOENT' && e.code !== 'ENOTDIR') return null;
+      const parent = external_node_path_.dirname(head);
+      if (parent === head) return null;
+      tail.push(external_node_path_.basename(head));
+      head = parent;
+    }
+  }
+  return null;
+}
+
+/** `child` equals `root` or lies beneath it. Both must already be normalized. */
+function isWithin(child, root) {
+  return child === root || child.startsWith(root.endsWith(external_node_path_.sep) ? root : root + external_node_path_.sep);
+}
+
+/** True when two normalized paths overlap in either direction. */
+function overlaps(a, b) {
+  return isWithin(a, b) || isWithin(b, a);
+}
+
+// EXTERNAL MODULE: external "node:net"
+var external_node_net_ = __webpack_require__(77030);
+;// CONCATENATED MODULE: ./src/capabilities/address.js
+// Host and address helpers for network policy (X-504). Pure.
+
+
+const LABEL = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+
+/**
+ * Canonical host: lower case, one trailing dot removed, IPv6 brackets removed.
+ * Returns `{ ok, host, kind }` with kind `ip4`, `ip6` or `name`. Numeric forms
+ * that are not a strict dotted quad (`2130706433`, `0x7f.1`, `127.1`) are
+ * rejected, because different parsers read them as different addresses and a
+ * policy must not be decided on a reading the connecting stack may not share.
+ */
+function address_normalizeHost(raw) {
+  if (typeof raw !== 'string') return { ok: false };
+  let h = raw.trim().toLowerCase();
+  if (h.startsWith('[') && h.endsWith(']')) h = h.slice(1, -1);
+  if (h.endsWith('.') && h.length > 1) h = h.slice(0, -1);
+  if (!h || h.length > 253 || /[^\x21-\x7e]/.test(h)) return { ok: false };
+  const family = external_node_net_.isIP(h);
+  if (family === 4) return { ok: true, host: h, kind: 'ip4' };
+  if (family === 6) return { ok: true, host: h, kind: 'ip6' };
+  const labels = h.split('.');
+  // A top-level label is never numeric; one that is (or starts 0x) is an address in disguise.
+  if (/^(?:0x[0-9a-f]*|[0-9]+)$/.test(labels[labels.length - 1])) return { ok: false };
+  if (!labels.every((l) => LABEL.test(l))) return { ok: false };
+  return { ok: true, host: h, kind: 'name' };
+}
+
+function v4Parts(ip) { return ip.split('.').map(Number); }
+
+function classifyV4(ip) {
+  const [a, b] = v4Parts(ip);
+  if (ip === '169.254.169.254') return 'metadata';
+  if (a === 127) return 'loopback';
+  if (a === 0) return 'unspecified';
+  if (a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 100 && b >= 64 && b <= 127)) return 'private';
+  if (a === 169 && b === 254) return 'link-local';
+  if (a >= 224 && a <= 239) return 'multicast';
+  if (a >= 240) return 'reserved';
+  return 'public';
+}
+
+/**
+ * Class of an address: loopback, private, link-local, metadata, unspecified,
+ * multicast, reserved or public. IPv4-mapped IPv6 is judged as the IPv4
+ * address it carries. Anything that is not an address is `invalid`.
+ */
+function address_classifyAddress(ip) {
+  const family = external_node_net_.isIP(ip);
+  if (family === 4) return classifyV4(ip);
+  if (family !== 6) return 'invalid';
+  const l = ip.toLowerCase();
+  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(l);
+  if (mapped) return classifyV4(mapped[1]);
+  const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(l);
+  if (hex) {
+    const hi = parseInt(hex[1], 16); const lo = parseInt(hex[2], 16);
+    return classifyV4(`${hi >> 8}.${hi & 255}.${lo >> 8}.${lo & 255}`);
+  }
+  if (l === '::1') return 'loopback';
+  if (l === '::') return 'unspecified';
+  if (l.startsWith('fd00:ec2::254')) return 'metadata';
+  const first = parseInt(l.split(':')[0] || '0', 16);
+  if ((first & 0xfe00) === 0xfc00) return 'private';
+  if ((first & 0xffc0) === 0xfe80) return 'link-local';
+  if ((first & 0xff00) === 0xff00) return 'multicast';
+  return 'public';
+}
+
+/** Non-public classes a host name must not resolve to unless declared. */
+function isNonPublicClass(cls) {
+  return cls !== 'public';
+}
+
+;// CONCATENATED MODULE: ./src/capabilities/manifest.js
+// Task capability manifests (X-501).
+//
+// A manifest is the complete statement of what one task may do: readable and
+// writable roots, structured commands, network destinations, tool actions,
+// resource limits and whether it may delegate. It is
+//
+//   deny-by-default   a section that is absent grants nothing; there is no
+//                     wildcard that means "everything", and no field whose
+//                     default is more permissive than its absence
+//   closed-world      an unknown field, an unknown schema version, a relative
+//                     path, a wildcard host with no domain behind it or a value
+//                     of the wrong type invalidates the whole manifest; nothing
+//                     is carried through, ignored or defaulted open
+//   bound             to a task id, an exact repository revision and a policy
+//                     version, carried as `binding` with the manifest digest, so
+//                     a grant made for one task, revision or policy version
+//                     cannot be replayed for another (decide.js checks it)
+//   monotonic         `deriveChild` builds a child manifest only from a subset
+//                     of the parent's grants; anything wider is `SCOPE_EXPANSION`
+//                     and no child manifest is produced
+//
+// Pure data except for `deriveChild`, which compares canonical (symlink-resolved)
+// paths so a link inside a granted root cannot widen a child.
+
+
+
+
+
+
+
+const MANIFEST_SCHEMA = 'agentic-security/capability-manifest';
+const MANIFEST_SCHEMA_VERSION = '1.0.0';
+const ARG_MODES = Object.freeze(['exact', 'prefix', 'any']);
+const NETWORK_SCHEMES = Object.freeze(['http', 'https']);
+const MAX_DELEGATION_DEPTH = 8;
+
+const MANIFEST_ALLOWED = [
+  'schema', 'schemaVersion', 'taskId', 'parentTaskId', 'repository', 'policyVersion', 'filesystem', 'commands',
+  'network', 'tools', 'resources', 'delegation', 'createdAt',
+];
+const MANIFEST_REQUIRED = ['schema', 'schemaVersion', 'taskId', 'repository', 'policyVersion'];
+
+// Resource limits a manifest can carry. The first three come straight from the
+// assurance config (same ranges), the file-size cap is enforced by the sandbox
+// prelude, and the last two are CARRIED but never claimed enforced: see
+// `RESOURCE_ENFORCEMENT` in runner.js.
+const RESOURCE_RANGES = Object.freeze({
+  timeoutMs: { min: config/* LIMITS */.b1.timeoutMs.min, max: config/* LIMITS */.b1.timeoutMs.max },
+  maxOutputBytes: { min: config/* LIMITS */.b1.maxOutputBytes.min, max: config/* LIMITS */.b1.maxOutputBytes.max },
+  maxFileSizeKb: { min: 1, max: 1_048_576 },
+  maxProcesses: { min: 1, max: 4096 },
+  maxMemoryMiB: { min: config/* LIMITS */.b1.maxMemoryMiB.min, max: config/* LIMITS */.b1.maxMemoryMiB.max },
+});
+
+const TOOL_NAME = /^[A-Za-z0-9_.:-]{1,80}$/;
+const MAX_LIST = 256;
+const MAX_ARGS = 256;
+const MAX_ARG_LEN = 8192;
+
+function checkPathList(ctx, where, list) {
+  if (list === undefined) return [];
+  if (!Array.isArray(list) || list.length > MAX_LIST) { ctx.err('BAD_TYPE', where, `must be an array of at most ${MAX_LIST} absolute paths`); return []; }
+  const out = [];
+  list.forEach((p, i) => {
+    const lex = lexicalPath(p);
+    if (!lex.ok) { ctx.err('BAD_PATH', `${where}[${i}]`, 'must be an absolute path without NUL bytes'); return; }
+    if (lex.dotdot) { ctx.err('BAD_PATH', `${where}[${i}]`, 'must not contain parent-directory segments'); return; }
+    if (lex.path === external_node_path_.sep) { ctx.err('BAD_PATH', `${where}[${i}]`, 'the filesystem root cannot be granted'); return; }
+    out.push(lex.path);
+  });
+  return [...new Set(out)].sort();
+}
+
+function checkCommands(ctx, list) {
+  if (list === undefined) return [];
+  if (!Array.isArray(list) || list.length > MAX_LIST) { ctx.err('BAD_TYPE', 'commands', `must be an array of at most ${MAX_LIST} entries`); return []; }
+  const out = [];
+  list.forEach((c, i) => {
+    const w = `commands[${i}]`;
+    if (!(0,schema_kit/* isPlainObject */.Qd)(c)) { ctx.err('BAD_TYPE', w, 'must be an object'); return; }
+    for (const k of Object.keys(c)) if (!['executable', 'args', 'interpreter'].includes(k)) ctx.err('UNKNOWN_FIELD', `${w}.${k}`, 'not part of a command entry');
+    const lex = lexicalPath(c.executable);
+    if (!lex.ok || lex.dotdot) { ctx.err('BAD_PATH', `${w}.executable`, 'must be an absolute path without parent-directory segments'); return; }
+    let args = { mode: 'exact', values: [] };
+    if (c.args !== undefined) {
+      if (!(0,schema_kit/* isPlainObject */.Qd)(c.args)) { ctx.err('BAD_TYPE', `${w}.args`, 'must be an object {mode, values}'); return; }
+      for (const k of Object.keys(c.args)) if (!['mode', 'values'].includes(k)) ctx.err('UNKNOWN_FIELD', `${w}.args.${k}`, 'not part of args');
+      if (!ARG_MODES.includes(c.args.mode)) { ctx.err('UNKNOWN_ENUM', `${w}.args.mode`, `must be one of: ${ARG_MODES.join(', ')}`); return; }
+      const values = c.args.values === undefined ? [] : c.args.values;
+      const okValues = Array.isArray(values) && values.length <= MAX_ARGS
+        && values.every((v) => typeof v === 'string' && v.length <= MAX_ARG_LEN && !v.includes('\0'));
+      if (!okValues) { ctx.err('BAD_TYPE', `${w}.args.values`, 'must be an array of plain strings within the size limits'); return; }
+      if (c.args.mode === 'any' && values.length) { ctx.err('RULE_VIOLATION', `${w}.args.values`, `mode 'any' takes no values`); return; }
+      args = { mode: c.args.mode, values: [...values] };
+    }
+    let interpreter = null;
+    if (c.interpreter !== undefined && c.interpreter !== null) {
+      if (c.interpreter !== 'scoped') { ctx.err('UNKNOWN_ENUM', `${w}.interpreter`, `must be 'scoped' when present`); return; }
+      if (args.mode !== 'exact') { ctx.err('RULE_VIOLATION', `${w}.interpreter`, `a scoped interpreter must pin its exact arguments (mode 'exact')`); return; }
+      interpreter = 'scoped';
+    }
+    out.push({ executable: lex.path, args, interpreter });
+  });
+  const key = (c) => `${c.executable}\0${c.args.mode}\0${JSON.stringify(c.args.values)}\0${c.interpreter}`;
+  const seen = new Map(out.map((c) => [key(c), c]));
+  return [...seen.values()].sort((a, b) => (key(a) < key(b) ? -1 : 1));
+}
+
+function checkNetwork(ctx, list) {
+  if (list === undefined) return [];
+  if (!Array.isArray(list) || list.length > MAX_LIST) { ctx.err('BAD_TYPE', 'network', `must be an array of at most ${MAX_LIST} entries`); return []; }
+  const out = [];
+  list.forEach((d, i) => {
+    const w = `network[${i}]`;
+    if (!(0,schema_kit/* isPlainObject */.Qd)(d)) { ctx.err('BAD_TYPE', w, 'must be an object'); return; }
+    for (const k of Object.keys(d)) if (!['host', 'port', 'schemes', 'allowPrivateResolution', 'addresses'].includes(k)) ctx.err('UNKNOWN_FIELD', `${w}.${k}`, 'not part of a network entry');
+    if (typeof d.host !== 'string') { ctx.err('BAD_TYPE', `${w}.host`, 'must be a string'); return; }
+    let wildcard = false;
+    let hostText = d.host;
+    if (hostText.startsWith('*.')) { wildcard = true; hostText = hostText.slice(2); }
+    const h = address_normalizeHost(hostText);
+    if (!h.ok) { ctx.err('BAD_TYPE', `${w}.host`, 'must be a host name, an IP address or a *.domain wildcard'); return; }
+    if (wildcard && (h.kind !== 'name' || h.host.split('.').length < 2)) {
+      ctx.err('RULE_VIOLATION', `${w}.host`, 'a wildcard needs a registrable domain behind it (*.example.com), never a bare suffix or an address');
+      return;
+    }
+    if (!Number.isInteger(d.port) || d.port < 1 || d.port > 65535) { ctx.err('BAD_TYPE', `${w}.port`, 'must be an integer from 1 to 65535; wildcard ports do not exist'); return; }
+    const schemes = d.schemes === undefined ? ['https'] : d.schemes;
+    if (!Array.isArray(schemes) || !schemes.length || !schemes.every((s) => NETWORK_SCHEMES.includes(s))) {
+      ctx.err('UNKNOWN_ENUM', `${w}.schemes`, `must be a non-empty subset of: ${NETWORK_SCHEMES.join(', ')}`); return;
+    }
+    if (d.allowPrivateResolution !== undefined && typeof d.allowPrivateResolution !== 'boolean') { ctx.err('BAD_TYPE', `${w}.allowPrivateResolution`, 'must be a boolean'); return; }
+    let addresses = null;
+    if (d.addresses !== undefined && d.addresses !== null) {
+      const ok = Array.isArray(d.addresses) && d.addresses.length > 0 && d.addresses.length <= 32
+        && d.addresses.every((a) => { const n = address_normalizeHost(a); return n.ok && n.kind !== 'name'; });
+      if (!ok) { ctx.err('BAD_TYPE', `${w}.addresses`, 'must be a non-empty array of IP addresses'); return; }
+      addresses = [...new Set(d.addresses.map((a) => address_normalizeHost(a).host))].sort();
+    }
+    out.push({
+      host: `${wildcard ? '*.' : ''}${h.host}`, port: d.port, schemes: [...new Set(schemes)].sort(),
+      allowPrivateResolution: d.allowPrivateResolution === true, addresses,
+    });
+  });
+  const key = (n) => JSON.stringify(n);
+  const seen = new Map(out.map((n) => [key(n), n]));
+  return [...seen.values()].sort((a, b) => (key(a) < key(b) ? -1 : 1));
+}
+
+function checkResources(ctx, r) {
+  if (r === undefined) return {};
+  if (!(0,schema_kit/* isPlainObject */.Qd)(r)) { ctx.err('BAD_TYPE', 'resources', 'must be an object'); return {}; }
+  const out = {};
+  for (const [k, v] of Object.entries(r)) {
+    const range = RESOURCE_RANGES[k];
+    if (!range) { ctx.err('UNKNOWN_FIELD', `resources.${k}`, 'not a known resource limit'); continue; }
+    if (!Number.isInteger(v) || v < range.min || v > range.max) { ctx.err('BAD_TYPE', `resources.${k}`, `must be an integer from ${range.min} to ${range.max}`); continue; }
+    out[k] = v;
+  }
+  return out;
+}
+
+function checkDelegation(ctx, d) {
+  if (d === undefined) return { allow: false, maxDepth: 0 };
+  if (!(0,schema_kit/* isPlainObject */.Qd)(d)) { ctx.err('BAD_TYPE', 'delegation', 'must be an object'); return { allow: false, maxDepth: 0 }; }
+  for (const k of Object.keys(d)) if (!['allow', 'maxDepth'].includes(k)) ctx.err('UNKNOWN_FIELD', `delegation.${k}`, 'not part of delegation');
+  if (typeof d.allow !== 'boolean') { ctx.err('BAD_TYPE', 'delegation.allow', 'must be a boolean'); return { allow: false, maxDepth: 0 }; }
+  const maxDepth = d.maxDepth === undefined ? (d.allow ? 1 : 0) : d.maxDepth;
+  if (!Number.isInteger(maxDepth) || maxDepth < 0 || maxDepth > MAX_DELEGATION_DEPTH) { ctx.err('BAD_TYPE', 'delegation.maxDepth', `must be an integer from 0 to ${MAX_DELEGATION_DEPTH}`); return { allow: false, maxDepth: 0 }; }
+  if (!d.allow && maxDepth !== 0) { ctx.err('RULE_VIOLATION', 'delegation.maxDepth', 'a task that may not delegate has depth 0'); return { allow: false, maxDepth: 0 }; }
+  if (d.allow && maxDepth === 0) { ctx.err('RULE_VIOLATION', 'delegation.maxDepth', 'a task that may delegate needs a depth of at least 1'); return { allow: false, maxDepth: 0 }; }
+  return { allow: d.allow, maxDepth };
+}
+
+/**
+ * Validate and normalize a manifest. Returns `{ ok, errors, manifest }`;
+ * `manifest` is the frozen normalized form and is present only when `ok`.
+ * Never throws.
+ */
+function manifest_validateManifest(m) {
+  const g = (0,schema_kit/* guardObject */.NW)(m);
+  const ctx = g.ctx;
+  if (!g.ok) return { ...(0,schema_kit/* result */.Ke)(ctx), manifest: null };
+  if (!(0,schema_kit/* checkHeader */.eb)(ctx, m, MANIFEST_SCHEMA)) return { ...(0,schema_kit/* result */.Ke)(ctx), manifest: null };
+  (0,schema_kit/* checkFields */.oA)(ctx, m, MANIFEST_ALLOWED, MANIFEST_REQUIRED);
+  (0,schema_kit/* checkString */.Em)(ctx, 'taskId', m.taskId);
+  if (m.parentTaskId !== undefined && m.parentTaskId !== null) (0,schema_kit/* checkString */.Em)(ctx, 'parentTaskId', m.parentTaskId);
+  if (!(0,schema_kit/* isPlainObject */.Qd)(m.repository)) ctx.err('BAD_TYPE', 'repository', 'must be an object {revision}');
+  else {
+    for (const k of Object.keys(m.repository)) if (k !== 'revision') ctx.err('UNKNOWN_FIELD', `repository.${k}`, 'not part of repository');
+    (0,schema_kit/* checkCommit */.su)(ctx, 'repository.revision', m.repository.revision ?? null, { nullable: false });
+  }
+  if (!Number.isInteger(m.policyVersion) || m.policyVersion < 1) ctx.err('BAD_TYPE', 'policyVersion', 'must be a positive integer');
+
+  let fsRead = []; let fsWrite = [];
+  if (m.filesystem !== undefined) {
+    if (!(0,schema_kit/* isPlainObject */.Qd)(m.filesystem)) ctx.err('BAD_TYPE', 'filesystem', 'must be an object {read, write}');
+    else {
+      for (const k of Object.keys(m.filesystem)) if (!['read', 'write'].includes(k)) ctx.err('UNKNOWN_FIELD', `filesystem.${k}`, 'not part of filesystem');
+      fsRead = checkPathList(ctx, 'filesystem.read', m.filesystem.read);
+      fsWrite = checkPathList(ctx, 'filesystem.write', m.filesystem.write);
+    }
+  }
+  const commands = checkCommands(ctx, m.commands);
+  const network = checkNetwork(ctx, m.network);
+  let tools = [];
+  if (m.tools !== undefined) {
+    if (!Array.isArray(m.tools) || m.tools.length > MAX_LIST || !m.tools.every((t) => typeof t === 'string' && TOOL_NAME.test(t))) {
+      ctx.err('BAD_TYPE', 'tools', `must be an array of tool names (${TOOL_NAME})`);
+    } else tools = [...new Set(m.tools)].sort();
+  }
+  const resources = checkResources(ctx, m.resources);
+  const delegation = checkDelegation(ctx, m.delegation);
+  if (ctx.errors.length) return { ...(0,schema_kit/* result */.Ke)(ctx), manifest: null };
+
+  const manifest = {
+    schema: MANIFEST_SCHEMA, schemaVersion: m.schemaVersion, taskId: m.taskId,
+    parentTaskId: m.parentTaskId ?? null,
+    repository: { revision: m.repository.revision }, policyVersion: m.policyVersion,
+    filesystem: { read: fsRead, write: fsWrite }, commands, network, tools, resources, delegation,
+  };
+  return { ok: true, errors: [], manifest: deepFreeze(manifest) };
+}
+
+function deepFreeze(o) {
+  if (o && typeof o === 'object' && !Object.isFrozen(o)) {
+    Object.freeze(o);
+    for (const v of Object.values(o)) deepFreeze(v);
+  }
+  return o;
+}
+
+/** Digest of the normalized manifest: the policy identity a receipt binds to. */
+function manifestDigest(manifest) {
+  return digestOf(manifest);
+}
+
+/**
+ * Validate and bind. The returned object is what every decision and the runner
+ * consume: the normalized manifest plus the binding it is valid for.
+ */
+function manifest_bindManifest(m) {
+  const v = manifest_validateManifest(m);
+  if (!v.ok) return { ok: false, errors: v.errors, bound: null };
+  const bound = {
+    manifest: v.manifest,
+    binding: Object.freeze({
+      taskId: v.manifest.taskId, revision: v.manifest.repository.revision,
+      policyVersion: v.manifest.policyVersion, digest: manifestDigest(v.manifest),
+    }),
+  };
+  return { ok: true, errors: [], bound: Object.freeze(bound) };
+}
+
+// ---------------------------------------------------------------- inheritance
+
+function canon(p) { return canonicalPath(p) ?? p; }
+
+function rootCovered(child, parentRoots) {
+  const c = canon(child);
+  return parentRoots.some((r) => {
+    const pr = canon(r);
+    return isWithin(c, pr) && isWithin(child, r);
+  });
+}
+
+function hostCovered(child, parent) {
+  if (child === parent) return true;
+  if (!parent.startsWith('*.')) return false;
+  const base = parent.slice(2);
+  const c = child.startsWith('*.') ? child.slice(2) : child;
+  return c !== base && c.endsWith(`.${base}`);
+}
+
+function networkCovered(c, p) {
+  if (!hostCovered(c.host, p.host) || c.port !== p.port) return false;
+  if (!c.schemes.every((s) => p.schemes.includes(s))) return false;
+  if (c.allowPrivateResolution && !p.allowPrivateResolution) return false;
+  if (p.addresses) { if (!c.addresses || !c.addresses.every((a) => p.addresses.includes(a))) return false; }
+  return true;
+}
+
+function commandCovered(c, p) {
+  if (canon(c.executable) !== canon(p.executable)) return false;
+  if (c.interpreter && !p.interpreter) return false;
+  const pv = p.args.values; const cv = c.args.values;
+  if (p.args.mode === 'any') return true;
+  if (p.args.mode === 'exact') return c.args.mode === 'exact' && cv.length === pv.length && cv.every((v, i) => v === pv[i]);
+  // parent prefix
+  return c.args.mode !== 'any' && cv.length >= pv.length && pv.every((v, i) => v === cv[i]);
+}
+
+/**
+ * Build a child task's manifest from a request, only if it is a subset of the
+ * parent's. Omitted repository, policy version and resource limits are
+ * inherited; anything else that is omitted is simply not granted. Returns
+ * `{ ok, errors, manifest }`; on any widening `ok` is false with
+ * `SCOPE_EXPANSION` errors and NO manifest, so there is no partial grant.
+ *
+ * @param {object} parent  a normalized manifest (from `validateManifest`/`bindManifest`)
+ * @param {object} request manifest-shaped; `taskId` required
+ */
+function deriveChild(parent, request) {
+  const errors = [];
+  const pv = manifest_validateManifest(parent);
+  if (!pv.ok) return { ok: false, errors: [{ code: 'RULE_VIOLATION', path: 'parent', message: 'the parent manifest is invalid' }], manifest: null };
+  const p = pv.manifest;
+  if (!(0,schema_kit/* isPlainObject */.Qd)(request)) return { ok: false, errors: [{ code: 'NOT_AN_OBJECT', path: '', message: 'request must be an object' }], manifest: null };
+
+  const merged = { ...request, schema: MANIFEST_SCHEMA, schemaVersion: request.schemaVersion ?? p.schemaVersion };
+  merged.parentTaskId = p.taskId;
+  if (request.parentTaskId !== undefined && request.parentTaskId !== null && request.parentTaskId !== p.taskId) {
+    errors.push({ code: 'SCOPE_EXPANSION', path: 'parentTaskId', message: 'a child names its actual parent' });
+  }
+  merged.repository = request.repository ?? { revision: p.repository.revision };
+  merged.policyVersion = request.policyVersion ?? p.policyVersion;
+  if (merged.repository?.revision !== p.repository.revision) errors.push({ code: 'SCOPE_EXPANSION', path: 'repository.revision', message: 'a child is bound to its parent\'s repository revision' });
+  if (merged.policyVersion !== p.policyVersion) errors.push({ code: 'SCOPE_EXPANSION', path: 'policyVersion', message: 'a child is bound to its parent\'s policy version' });
+  if (request.taskId === p.taskId) errors.push({ code: 'SCOPE_EXPANSION', path: 'taskId', message: 'a child has its own task id' });
+  // Inherit limits the parent set; the child may only lower them.
+  merged.resources = { ...(p.resources), ...((0,schema_kit/* isPlainObject */.Qd)(request.resources) ? request.resources : {}) };
+
+  const cv = manifest_validateManifest(merged);
+  if (!cv.ok) return { ok: false, errors: [...errors, ...cv.errors], manifest: null };
+  const c = cv.manifest;
+
+  const parentReadable = [...p.filesystem.read, ...p.filesystem.write];
+  c.filesystem.read.forEach((r, i) => { if (!rootCovered(r, parentReadable)) errors.push({ code: 'SCOPE_EXPANSION', path: `filesystem.read[${i}]`, message: 'not inside a root the parent may read' }); });
+  c.filesystem.write.forEach((r, i) => { if (!rootCovered(r, p.filesystem.write)) errors.push({ code: 'SCOPE_EXPANSION', path: `filesystem.write[${i}]`, message: 'not inside a root the parent may write' }); });
+  c.commands.forEach((cmd, i) => { if (!p.commands.some((pc) => commandCovered(cmd, pc))) errors.push({ code: 'SCOPE_EXPANSION', path: `commands[${i}]`, message: 'not covered by a command the parent may run' }); });
+  c.network.forEach((n, i) => { if (!p.network.some((pn) => networkCovered(n, pn))) errors.push({ code: 'SCOPE_EXPANSION', path: `network[${i}]`, message: 'not covered by a destination the parent may reach' }); });
+  c.tools.forEach((t, i) => { if (!p.tools.includes(t)) errors.push({ code: 'SCOPE_EXPANSION', path: `tools[${i}]`, message: 'not a tool the parent may use' }); });
+  for (const [k, v] of Object.entries(c.resources)) {
+    if (p.resources[k] !== undefined && v > p.resources[k]) errors.push({ code: 'SCOPE_EXPANSION', path: `resources.${k}`, message: 'higher than the parent limit' });
+  }
+  if (c.delegation.allow) {
+    if (!p.delegation.allow) errors.push({ code: 'SCOPE_EXPANSION', path: 'delegation.allow', message: 'the parent may not delegate' });
+    else if (c.delegation.maxDepth > p.delegation.maxDepth - 1) errors.push({ code: 'SCOPE_EXPANSION', path: 'delegation.maxDepth', message: 'must be lower than the parent depth' });
+  }
+  if (errors.length) return { ok: false, errors, manifest: null };
+  return { ok: true, errors: [], manifest: c };
+}
+
+// EXTERNAL MODULE: ./src/posture/assurance/contracts.js
+var contracts = __webpack_require__(49928);
+;// CONCATENATED MODULE: ./src/capabilities/decide.js
+// Deterministic capability decisions (X-501.AC02, X-501.AC03).
+//
+// `decide(bound, action, ctx)` answers one question: does this task's bound
+// manifest permit this one action? The answer is a frozen
+// `{ decision, code, reason, kind, subject, taskId, manifestDigest }`:
+//
+//   - deny-by-default: the answer is `allow` only when a specific declared grant
+//     covers the action; every other path, including every error, is `deny`
+//   - deterministic: no clock, no randomness, no environment; the same bound
+//     manifest, action and context give the same answer (the filesystem is read
+//     only to resolve symbolic links and to look at an executable)
+//   - sanitized: `code` comes from the closed table in reasons.js and `reason` is
+//     the fixed sentence beside it; the one request-derived field, `subject`, is
+//     redacted and length-capped
+//   - fail-closed: an unknown action kind, a binding that does not match, an
+//     argument list that is not plain strings, a path that cannot be resolved,
+//     an interpreter that is not declared as one: all `deny`
+//
+// This is a POLICY decision. Whether the operating system then actually stops the
+// task from doing what the decision denied is the runner's job (runner.js), and
+// only the runner may claim enforcement. A hook or an in-process check that calls
+// this function explains; it does not enforce.
+
+
+
+
+
+
+
+
+
+
+const decide_MAX_ARGS = 256;
+const decide_MAX_ARG_LEN = 8192;
+
+// Executables that run code supplied elsewhere (their arguments, a script file,
+// standard input): shells, language runtimes, launchers and build drivers. A
+// shell allowlist cannot see through any of them, so each is refused unless the
+// manifest declares it as a scoped interpreter with its exact argument list.
+const INTERPRETER_NAMES = new Set([
+  'sh', 'bash', 'zsh', 'dash', 'ksh', 'csh', 'tcsh', 'fish', 'ash', 'busybox', 'env', 'xargs', 'nice', 'nohup',
+  'time', 'timeout', 'sudo', 'doas', 'su', 'ssh', 'osascript', 'launchctl', 'script', 'expect', 'tclsh', 'wish',
+  'awk', 'gawk', 'mawk', 'nawk', 'java', 'jshell', 'deno', 'bun', 'nodejs', 'swift', 'make', 'gmake',
+  'npm', 'npx', 'yarn', 'pnpm', 'pip', 'pip3', 'pipx', 'gem', 'bundle', 'cargo', 'go', 'gradle', 'mvn', 'watch',
+]);
+const INTERPRETER_FAMILY = /^(?:python|pypy|ruby|perl|php|lua|luajit|node|tclsh)[0-9.]*$/;
+
+/**
+ * What kind of executable this is. `interpreter` is true for a known shell or
+ * runtime by name, and for any file that starts with a `#!` line (a script,
+ * whatever it is called). A name is a hint, the shebang is the file's own word.
+ */
+function classifyExecutable(realPath) {
+  const base = external_node_path_.basename(realPath).toLowerCase();
+  if (INTERPRETER_NAMES.has(base) || INTERPRETER_FAMILY.test(base)) return { interpreter: true, via: 'name' };
+  let fd;
+  try {
+    fd = external_node_fs_.openSync(realPath, 'r');
+    const buf = Buffer.alloc(2);
+    const n = external_node_fs_.readSync(fd, buf, 0, 2, 0);
+    if (n === 2 && buf[0] === 0x23 && buf[1] === 0x21) return { interpreter: true, via: 'shebang' };
+  } catch { /* unreadable: handled by the caller's stat check */ } finally {
+    if (fd !== undefined) { try { external_node_fs_.closeSync(fd); } catch { /* ignore */ } }
+  }
+  return { interpreter: false, via: null };
+}
+
+function result(bound, action, decision, code, subject) {
+  return Object.freeze({
+    decision, code, reason: reasonText(code), kind: typeof action?.kind === 'string' ? reasons_sanitizeSubject(action.kind, 40) : 'unknown',
+    subject: reasons_sanitizeSubject(subject), taskId: bound?.binding?.taskId ?? null, manifestDigest: bound?.binding?.digest ?? null,
+  });
+}
+
+function argsDigest(args) {
+  return external_node_crypto_.createHash('sha256').update(JSON.stringify(args)).digest('hex').slice(0, 12);
+}
+
+// ---------------------------------------------------------------- filesystem
+
+function decideFilesystem(bound, action, ctx) {
+  const write = action.kind === 'filesystem-write';
+  const subject = typeof action.path === 'string' ? action.path : '(not a string)';
+  const lex = lexicalPath(action.path);
+  if (!lex.ok) return result(bound, action, 'deny', 'path-invalid', subject);
+  // Any parent-directory segment is refused outright. Lexical normalization of
+  // `link/..` disagrees with what the kernel does when `link` is a symlink, so
+  // a path containing one cannot be judged by its normalized form.
+  if (lex.dotdot) return result(bound, action, 'deny', 'path-traversal', subject);
+  const real = canonicalPath(lex.path);
+  if (!real) return result(bound, action, 'deny', 'path-invalid', subject);
+
+  for (const p of ctx.protectedPaths || []) {
+    const pl = lexicalPath(p);
+    if (!pl.ok) continue;
+    const pr = canonicalPath(pl.path) ?? pl.path;
+    if (isWithin(real, pr) || isWithin(lex.path, pl.path)) return result(bound, action, 'deny', 'protected-path', subject);
+  }
+  const fsGrants = bound.manifest.filesystem;
+  const roots = write ? fsGrants.write : [...fsGrants.read, ...fsGrants.write];
+  if (!roots.length) return result(bound, action, 'deny', 'no-grant', subject);
+  const lexicallyIn = roots.some((r) => isWithin(lex.path, r));
+  if (!lexicallyIn) return result(bound, action, 'deny', 'outside-roots', subject);
+  const really = roots.some((r) => isWithin(real, canonicalPath(r) ?? r));
+  if (!really) return result(bound, action, 'deny', 'symlink-escape', subject);
+  return result(bound, action, 'allow', 'allowed', subject);
+}
+
+// ---------------------------------------------------------------- commands
+
+function decideCommand(bound, action, ctx) {
+  const exe = action.executable;
+  const args = action.args === undefined ? [] : action.args;
+  const subjectBase = typeof exe === 'string' ? exe : '(not a string)';
+  const lexExe = lexicalPath(exe);
+  if (!lexExe.ok || lexExe.dotdot) return result(bound, action, 'deny', 'executable-not-absolute', subjectBase);
+  if (!Array.isArray(args) || args.length > decide_MAX_ARGS || !args.every((a) => typeof a === 'string' && a.length <= decide_MAX_ARG_LEN && !a.includes('\0'))) {
+    return result(bound, action, 'deny', 'args-invalid', `${subjectBase} (malformed arguments)`);
+  }
+  const subject = `${subjectBase} (${args.length} args, args sha256:${argsDigest(args)})`;
+
+  // Arguments are visible to every process on the host and to every descendant.
+  // A secret does not belong in one, whatever command it is handed to.
+  const canaries = (ctx.canaries || []).filter((c) => typeof c === 'string' && c.length >= 6);
+  for (const a of args) {
+    let secret = false;
+    try { secret = detectSecretShapes(a); } catch { secret = true; }
+    if (secret || canaries.some((c) => a.includes(c))) return result(bound, action, 'deny', 'secret-in-argument', subject);
+  }
+
+  let real; let st;
+  try { real = external_node_fs_.realpathSync(lexExe.path); st = external_node_fs_.statSync(real); } catch { return result(bound, action, 'deny', 'executable-unresolvable', subject); }
+  if (!st.isFile()) return result(bound, action, 'deny', 'executable-unresolvable', subject);
+  try { external_node_fs_.accessSync(real, external_node_fs_.constants.X_OK); } catch { return result(bound, action, 'deny', 'executable-unresolvable', subject); }
+
+  for (const w of bound.manifest.filesystem.write) {
+    if (isWithin(real, canonicalPath(w) ?? w)) return result(bound, action, 'deny', 'executable-in-writable-root', subject);
+  }
+
+  const entries = bound.manifest.commands.filter((c) => (canonicalPath(c.executable) ?? c.executable) === real);
+  if (!entries.length) return result(bound, action, 'deny', 'command-not-listed', subject);
+
+  const cls = classifyExecutable(real);
+  const matches = (e) => {
+    const v = e.args.values;
+    if (e.args.mode === 'any') return true;
+    if (e.args.mode === 'exact') return v.length === args.length && v.every((x, i) => x === args[i]);
+    return args.length >= v.length && v.every((x, i) => x === args[i]);
+  };
+  const argOk = entries.filter(matches);
+  if (!argOk.length) {
+    // An interpreter whose entries pin different arguments is the unpinned case.
+    if (cls.interpreter && !entries.some((e) => e.interpreter)) return result(bound, action, 'deny', 'interpreter-blocked', subject);
+    return result(bound, action, 'deny', 'args-not-permitted', subject);
+  }
+  if (cls.interpreter) {
+    const scoped = argOk.find((e) => e.interpreter === 'scoped');
+    if (!scoped) return result(bound, action, 'deny', 'interpreter-blocked', subject);
+    if (scoped.args.mode !== 'exact') return result(bound, action, 'deny', 'interpreter-args-unpinned', subject);
+  }
+  return result(bound, action, 'allow', 'allowed', subject);
+}
+
+// ---------------------------------------------------------------- network
+
+function hostMatches(entryHost, host) {
+  if (entryHost === host) return true;
+  if (!entryHost.startsWith('*.')) return false;
+  const base = entryHost.slice(2);
+  return host !== base && host.endsWith(`.${base}`);
+}
+
+function decideNetwork(bound, action) {
+  const h = address_normalizeHost(action.host);
+  const subject = typeof action.host === 'string' ? `${action.scheme ?? '?'}://${action.host}:${action.port ?? '?'}` : '(not a string)';
+  if (!h.ok) return result(bound, action, 'deny', 'host-invalid', subject);
+  if (!Number.isInteger(action.port) || action.port < 1 || action.port > 65535) return result(bound, action, 'deny', 'port-invalid', subject);
+  const scheme = action.scheme === undefined ? 'https' : action.scheme;
+  if (scheme !== 'http' && scheme !== 'https') return result(bound, action, 'deny', 'scheme-not-declared', subject);
+  const onHost = bound.manifest.network.filter((d) => hostMatches(d.host, h.host));
+  if (!onHost.length) return result(bound, action, 'deny', 'destination-not-declared', subject);
+  const onPort = onHost.filter((d) => d.port === action.port);
+  if (!onPort.length) return result(bound, action, 'deny', 'port-not-declared', subject);
+  const onScheme = onPort.filter((d) => d.schemes.includes(scheme));
+  if (!onScheme.length) return result(bound, action, 'deny', 'scheme-not-declared', subject);
+
+  // Address checks apply to a host NAME once it has been resolved. The caller
+  // (the proxy) resolves once, passes the addresses here and connects to those
+  // same addresses, so what is checked is what is connected to.
+  const resolved = Array.isArray(action.resolvedAddresses) ? action.resolvedAddresses : null;
+  if (h.kind === 'name' && resolved) {
+    if (!resolved.length) return result(bound, action, 'deny', 'dns-private-address', subject);
+    const verdicts = onScheme.map((d) => {
+      if (d.addresses && !resolved.every((a) => d.addresses.includes(a))) return 'dns-changed';
+      if (!d.allowPrivateResolution && resolved.some((a) => address_classifyAddress(a) !== 'public')) return 'dns-private-address';
+      return 'ok';
+    });
+    if (!verdicts.includes('ok')) return result(bound, action, 'deny', verdicts.includes('dns-changed') ? 'dns-changed' : 'dns-private-address', subject);
+  }
+  return result(bound, action, 'allow', 'allowed', subject);
+}
+
+// ---------------------------------------------------------------- tools, delegation
+
+function decideTool(bound, action) {
+  const subject = typeof action.tool === 'string' ? action.tool : '(not a string)';
+  if (typeof action.tool !== 'string' || !bound.manifest.tools.includes(action.tool)) return result(bound, action, 'deny', 'tool-not-declared', subject);
+  return result(bound, action, 'allow', 'allowed', subject);
+}
+
+function decideDelegation(bound, action) {
+  const d = bound.manifest.delegation;
+  const depth = Number.isInteger(action.depth) && action.depth >= 0 ? action.depth : 0;
+  const subject = `delegation at depth ${depth}`;
+  if (!d.allow) return result(bound, action, 'deny', 'delegation-not-allowed', subject);
+  if (depth >= d.maxDepth) return result(bound, action, 'deny', 'delegation-depth', subject);
+  if (action.request !== undefined) {
+    const child = deriveChild(bound.manifest, action.request);
+    if (!child.ok) return result(bound, action, 'deny', 'scope-expansion', subject);
+  }
+  return result(bound, action, 'allow', 'allowed', subject);
+}
+
+/**
+ * @param {{manifest: object, binding: object}} bound   from `bindManifest`
+ * @param {object} action  `{ kind, ... }`; kind is one of CAPABILITY_KINDS
+ * @param {object} ctx
+ * @param {{taskId:string, revision:string, policyVersion:number}} ctx.binding  what the caller believes it is acting for
+ * @param {string[]} [ctx.protectedPaths]  paths no task may touch, whatever the manifest says
+ * @param {string[]} [ctx.canaries]        values that must never appear in an argument
+ */
+function decide_decide(bound, action, ctx = {}) {
+  if (!bound || !bound.manifest || !bound.binding) return result(bound, action, 'deny', 'invalid-manifest', '(no manifest)');
+  const b = ctx.binding;
+  const bb = bound.binding;
+  if (!b || b.taskId !== bb.taskId || b.revision !== bb.revision || b.policyVersion !== bb.policyVersion) {
+    return result(bound, action, 'deny', 'binding-mismatch', '(binding)');
+  }
+  if (!action || typeof action !== 'object' || Array.isArray(action) || !contracts/* CAPABILITY_KINDS */.bq.includes(action.kind)) {
+    return result(bound, action, 'deny', 'unknown-action', typeof action?.kind === 'string' ? action.kind : '(no kind)');
+  }
+  try {
+    switch (action.kind) {
+      case 'filesystem-read':
+      case 'filesystem-write': return decideFilesystem(bound, action, ctx);
+      case 'command': return decideCommand(bound, action, ctx);
+      case 'network': return decideNetwork(bound, action);
+      case 'tool': return decideTool(bound, action);
+      case 'delegation': return decideDelegation(bound, action);
+      default: return result(bound, action, 'deny', 'unknown-action', action.kind);
+    }
+  } catch {
+    // A decision never throws. An unexpected failure is a denial.
+    return result(bound, action, 'deny', 'invalid-manifest', '(decision failed)');
+  }
+}
+
+// EXTERNAL MODULE: external "node:http"
+var external_node_http_ = __webpack_require__(37067);
+// EXTERNAL MODULE: external "node:os"
+var external_node_os_ = __webpack_require__(48161);
+// EXTERNAL MODULE: ./src/sandbox/capabilities.js
+var capabilities = __webpack_require__(60450);
+// EXTERNAL MODULE: ./src/sandbox/supervise.js
+var supervise = __webpack_require__(74676);
+// EXTERNAL MODULE: ./src/sandbox/control-probes.js
+var control_probes = __webpack_require__(39899);
+// EXTERNAL MODULE: external "node:dns"
+var external_node_dns_ = __webpack_require__(40610);
+// EXTERNAL MODULE: ./src/egress/audit.js
+var audit = __webpack_require__(37355);
+;// CONCATENATED MODULE: ./src/capabilities/outbound.js
+// Outbound payload filtering and denial records (X-504.AC02, X-504.AC03).
+//
+// `redactOutbound` is the structured counterpart of egress/redact.js: that module
+// redacts prompt TEXT bound for a model endpoint, this one redacts a whole
+// request (URL, headers, body) bound for a declared network destination. It
+// reuses the same secret detector (`redactSecrets`), then adds what a request has
+// that prose does not: credentials in URL userinfo, secret-named query
+// parameters and header names, and secret-named keys in JSON and form bodies.
+// Exact canary values (and their URL-encoded and base64 forms) are removed
+// wherever they appear, which is what the canary fixtures assert.
+//
+// What it cannot do is look inside an encrypted tunnel. A CONNECT tunnel to a
+// declared https destination is opaque to the proxy; the control for that path is
+// that the task was never handed a secret to put in it (secret-free environment,
+// protected paths, no secrets in arguments), and the capability report says
+// `payloadFiltering: plaintext-http-only`.
+
+
+
+
+
+
+const PLACEHOLDER = '[REDACTED-SECRET]';
+const SECRET_NAME = /(?:^|[^a-z])(?:token|secret|passw(?:or)?d|api[-_]?key|apikey|auth(?:orization)?|credential|private[-_]?key|session|cookie|signature|sig|bearer)(?:[^a-z]|$)/i;
+const MAX_DEPTH = 32;
+
+function isSecretName(name) {
+  return typeof name === 'string' && SECRET_NAME.test(name);
+}
+
+/** The forms in which a canary value could travel: raw, URL-encoded, base64 and its URL-safe variant. */
+function canaryForms(canaries) {
+  const out = new Set();
+  for (const c of canaries || []) {
+    if (typeof c !== 'string' || c.length < 6) continue;
+    out.add(c);
+    out.add(encodeURIComponent(c));
+    const b64 = Buffer.from(c, 'utf8').toString('base64');
+    out.add(b64);
+    out.add(b64.replace(/=+$/, ''));
+    out.add(b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, ''));
+  }
+  return [...out].filter((x) => x.length >= 6);
+}
+
+function scrubText(text, forms, stats) {
+  let out = String(text);
+  for (const f of forms) {
+    if (out.includes(f)) { out = out.split(f).join(PLACEHOLDER); stats.canary += 1; }
+  }
+  const r = scrubSecretText(out);
+  if (r.redactions > 0) { stats.secrets += r.redactions; out = r.text; }
+  return out;
+}
+
+function walk(value, forms, stats, depth = 0) {
+  if (depth > MAX_DEPTH) { stats.truncated = true; return PLACEHOLDER; }
+  if (typeof value === 'string') return scrubText(value, forms, stats);
+  if (Array.isArray(value)) return value.map((v) => walk(v, forms, stats, depth + 1));
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      const key = scrubText(k, forms, stats);
+      if (isSecretName(k) && (typeof v === 'string' || typeof v === 'number')) { out[key] = PLACEHOLDER; stats.keys += 1; }
+      else out[key] = walk(v, forms, stats, depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
+
+function scrubParams(params, forms, stats) {
+  const out = new URLSearchParams();
+  for (const [k, v] of params) {
+    if (isSecretName(k) && v !== '') { out.append(scrubText(k, forms, stats), PLACEHOLDER); stats.keys += 1; }
+    else out.append(scrubText(k, forms, stats), scrubText(v, forms, stats));
+  }
+  return out;
+}
+
+/**
+ * Filter a request before it leaves.
+ * @param {{url?: string, headers?: object, body?: string|Buffer|object, contentType?: string}} req
+ * @param {{canaries?: string[]}} [opts]
+ * @returns {{url: string|null, headers: object, body: string|null, redactions: number,
+ *            categories: {userinfo:number, secrets:number, keys:number, canary:number}, uninspectable: boolean}}
+ *   `uninspectable` is true for a binary body, which is returned untouched and
+ *   must not be sent by a caller that requires filtering.
+ */
+function outbound_redactOutbound(req = {}, opts = {}) {
+  const forms = canaryForms(opts.canaries);
+  const stats = { secrets: 0, keys: 0, canary: 0, userinfo: 0, truncated: false };
+  let url = null;
+  if (typeof req.url === 'string') {
+    try {
+      const u = new URL(req.url);
+      if (u.username || u.password) { stats.userinfo += 1; u.username = ''; u.password = ''; }
+      u.search = scrubParams(u.searchParams, forms, stats).toString();
+      u.pathname = u.pathname.split('/').map((seg) => scrubText(decodeURIComponent(seg), forms, stats)).map(encodeURIComponent).join('/');
+      u.hash = '';
+      url = u.toString();
+    } catch {
+      url = scrubText(req.url.replace(/\/\/[^/@\s]*@/, '//'), forms, stats);
+    }
+  }
+  const headers = {};
+  for (const [name, raw] of Object.entries(req.headers || {})) {
+    const values = Array.isArray(raw) ? raw : [raw];
+    const cleaned = values.map((v) => {
+      if (isSecretName(name)) { stats.keys += 1; return PLACEHOLDER; }
+      return scrubText(String(v), forms, stats);
+    });
+    headers[name.toLowerCase()] = Array.isArray(raw) ? cleaned : cleaned[0];
+  }
+  let body = null;
+  let uninspectable = false;
+  if (req.body !== undefined && req.body !== null) {
+    const ct = String(req.contentType || headers['content-type'] || '').toLowerCase();
+    if (Buffer.isBuffer(req.body) && req.body.includes(0)) {
+      uninspectable = true; body = req.body;
+    } else if (typeof req.body === 'object' && !Buffer.isBuffer(req.body)) {
+      body = JSON.stringify(walk(req.body, forms, stats));
+    } else {
+      const text = Buffer.isBuffer(req.body) ? req.body.toString('utf8') : String(req.body);
+      if (ct.includes('json')) {
+        try { body = JSON.stringify(walk(JSON.parse(text), forms, stats)); } catch { body = scrubText(text, forms, stats); }
+      } else if (ct.includes('x-www-form-urlencoded')) {
+        body = scrubParams(new URLSearchParams(text), forms, stats).toString();
+      } else body = scrubText(text, forms, stats);
+    }
+  }
+  const categories = { userinfo: stats.userinfo, secrets: stats.secrets, keys: stats.keys, canary: stats.canary };
+  return {
+    url, headers, body, categories, uninspectable,
+    redactions: stats.userinfo + stats.secrets + stats.keys + stats.canary,
+  };
+}
+
+/** Log-safe text: canary values and secret shapes removed. Never used to build a decision reason. */
+function sanitizeLogText(text, canaries = []) {
+  let out = typeof text === 'string' ? text : JSON.stringify(text) ?? '';
+  for (const f of canaryForms(canaries)) out = out.split(f).join(PLACEHOLDER);
+  // Provider-shaped credentials only. The high-entropy-literal heuristic is for
+  // payloads, where over-redaction is acceptable; here it would rewrite ordinary
+  // quoted paths in a task's output.
+  return redactSecretShapes(out).text;
+}
+
+// ---------------------------------------------------------------- denial records
+
+/** Class of a destination for the audit trail: an address class, or `hostname`. */
+function destinationClass(host) {
+  const h = normalizeHost(host);
+  if (!h.ok) return 'invalid';
+  if (h.kind === 'name') return h.host === 'localhost' || h.host.endsWith('.localhost') ? 'loopback' : 'hostname';
+  return classifyAddress(h.host);
+}
+
+/**
+ * What a denied egress leaves behind: the destination CLASS, a short digest of
+ * the host (a host name can itself carry data, so it is never stored), the port,
+ * the scheme and the policy code. No path, query, header or body, ever.
+ */
+function outbound_denialRecord({ taskId, host, port, scheme, code }) {
+  const h = normalizeHost(host);
+  const digest = crypto.createHash('sha256').update(h.ok ? h.host : String(host)).digest('hex').slice(0, 12);
+  return Object.freeze({
+    taskId: taskId ?? null, outcome: 'deny', code, destinationClass: destinationClass(host),
+    hostDigest: digest, port: Number.isInteger(port) ? port : null, scheme: scheme === 'http' || scheme === 'https' ? scheme : null,
+  });
+}
+
+/**
+ * Append a denial to the existing tamper-evident egress audit chain
+ * (egress/audit.js). The chain records provider, purpose, outcome and reason, so
+ * the destination class is carried as the provider and the policy code as the
+ * reason; nothing else is passed in.
+ */
+function outbound_recordNetworkDenial(scanRoot, record) {
+  if (!scanRoot || !record) return;
+  recordEgressCall({
+    scanRoot,
+    decision: {
+      allowed: false, decision: 'deny', reason: record.code, provider: record.destinationClass,
+      policySource: 'capability-manifest', purpose: 'capability-network',
+    },
+    ctx: {},
+  });
+}
+
+;// CONCATENATED MODULE: ./src/capabilities/proxy.js
+// The mediated network boundary (X-504.AC01, X-504.AC03).
+//
+// The runner starts one of these per task that declares network destinations and
+// opens exactly its loopback port in the sandbox profile. Everything else is
+// closed by the operating system: DNS, every other loopback port, every remote
+// address, every unix socket. A child, a descendant or an interpreter that
+// ignores the proxy settings and opens a socket itself is refused by the kernel,
+// not by this file; this file decides what the ONE open door lets through.
+//
+// Per request:
+//   1. the destination is checked against the bound manifest (`decide`, kind
+//      'network') before any name is resolved
+//   2. the name is resolved ONCE, in this process (the sandbox cannot resolve),
+//      the resolved addresses are checked (a declared name that resolves to a
+//      loopback, private, link-local or metadata address is refused unless the
+//      entry says so; a pinned address set must match), and the connection goes to
+//      the address that was checked, so a name that changes between check and
+//      connect cannot redirect the connection
+//   3. plaintext HTTP is buffered (bounded), filtered with `redactOutbound`, and
+//      forwarded; a binary body that cannot be inspected is refused
+//   4. HTTPS is an opaque CONNECT tunnel, allowed only to a destination declared
+//      for the https scheme. Its payload is NOT inspected and the report says so.
+//   5. a redirect is returned to the client unchanged and never followed here, so
+//      the next hop arrives as a new request and meets step 1 again
+//
+// A denial records the destination class, a digest of the host, the port and the
+// policy code. It never records a path, header, body or the host name itself.
+
+
+
+
+
+
+
+const HOP_BY_HOP = new Set([
+  'connection', 'proxy-connection', 'proxy-authorization', 'proxy-authenticate', 'keep-alive', 'te', 'trailer',
+  'transfer-encoding', 'upgrade', 'content-length',
+]);
+const MAX_RECORDS = 1000;
+
+async function defaultResolve(host) {
+  const rows = await dns.promises.lookup(host, { all: true });
+  return rows.map((r) => r.address);
+}
+
+/**
+ * @param {object} o
+ * @param {{manifest: object, binding: object}} o.bound
+ * @param {string[]} [o.canaries]
+ * @param {(host:string)=>Promise<string[]>} [o.resolve]   test seam for name resolution
+ * @param {number} [o.maxRequestBytes]
+ * @param {string} [o.scanRoot]   when set, denials are appended to the egress audit chain
+ * @param {number} [o.connectTimeoutMs]
+ */
+async function proxy_startMediationProxy({
+  bound, canaries = [], resolve = defaultResolve, maxRequestBytes = 1024 * 1024, scanRoot = null, connectTimeoutMs = 8000,
+}) {
+  const records = [];
+  const sockets = new Set();
+  const stats = { allowed: 0, denied: 0, redactions: 0, bytesForwarded: 0 };
+  const ctx = { binding: bound.binding, canaries };
+
+  const note = (outcome, code, host, port, scheme) => {
+    const rec = denialRecord({ taskId: bound.binding.taskId, host, port, scheme, code });
+    const entry = { ...rec, outcome };
+    if (records.length < MAX_RECORDS) records.push(entry);
+    if (outcome === 'deny') { stats.denied += 1; recordNetworkDenial(scanRoot, rec); } else stats.allowed += 1;
+  };
+
+  // Decide on the declared destination, resolve, decide again on the addresses.
+  async function authorize(rawHost, port, scheme) {
+    const first = decide(bound, { kind: 'network', host: rawHost, port, scheme }, ctx);
+    if (first.decision !== 'allow') return { ok: false, code: first.code };
+    const h = normalizeHost(rawHost);
+    let addresses;
+    if (h.kind === 'name') {
+      try { addresses = await resolve(h.host); } catch { addresses = []; }
+      if (!Array.isArray(addresses) || !addresses.every((a) => net.isIP(a))) addresses = [];
+    } else addresses = [h.host];
+    const second = decide(bound, { kind: 'network', host: rawHost, port, scheme, resolvedAddresses: addresses }, ctx);
+    if (second.decision !== 'allow') return { ok: false, code: second.code };
+    return { ok: true, address: addresses[0], host: h.host };
+  }
+
+  function deny(res, code) {
+    if (res.headersSent) { res.destroy(); return; }
+    const body = JSON.stringify({ blocked: true, code });
+    res.writeHead(403, { 'content-type': 'application/json', 'content-length': Buffer.byteLength(body), connection: 'close' });
+    res.end(body);
+  }
+
+  const server = http.createServer((req, res) => {
+    handle(req, res).catch(() => deny(res, 'invalid-manifest'));
+  });
+  server.on('connection', (s) => { sockets.add(s); s.on('close', () => sockets.delete(s)); });
+  server.keepAliveTimeout = 1000;
+
+  async function handle(req, res) {
+    let target;
+    try { target = new URL(req.url); } catch { target = null; }
+    if (!target || target.protocol !== 'http:') {
+      // An origin-form request is a client talking to the proxy as if it were a
+      // server; an https:// absolute URI is a client that skipped CONNECT.
+      note('deny', 'destination-not-declared', req.headers.host || '', 0, null);
+      return deny(res, 'destination-not-declared');
+    }
+    const port = target.port ? Number(target.port) : 80;
+    const auth = await authorize(target.hostname, port, 'http');
+    if (!auth.ok) { note('deny', auth.code, target.hostname, port, 'http'); return deny(res, auth.code); }
+
+    const chunks = []; let size = 0; let tooBig = false;
+    await new Promise((done) => {
+      req.on('data', (c) => { size += c.length; if (size > maxRequestBytes) { tooBig = true; req.destroy(); done(); } else chunks.push(c); });
+      req.on('end', done); req.on('error', done); req.on('close', done);
+    });
+    if (tooBig) { note('deny', 'payload-too-large', target.hostname, port, 'http'); return deny(res, 'payload-too-large'); }
+    const body = chunks.length ? Buffer.concat(chunks) : null;
+    const filtered = redactOutbound({ url: req.url, headers: req.headers, body, contentType: req.headers['content-type'] }, { canaries });
+    if (filtered.uninspectable) { note('deny', 'payload-uninspectable', target.hostname, port, 'http'); return deny(res, 'payload-uninspectable'); }
+    stats.redactions += filtered.redactions;
+
+    const out = {};
+    for (const [k, v] of Object.entries(filtered.headers)) if (!HOP_BY_HOP.has(k) && k !== 'host') out[k] = v;
+    out.host = target.port ? `${target.hostname}:${target.port}` : target.hostname;
+    out.connection = 'close';
+    if (filtered.body !== null) out['content-length'] = Buffer.byteLength(filtered.body);
+    const fu = new URL(filtered.url);
+    const upstream = http.request({
+      host: auth.address, port, method: req.method, path: `${fu.pathname}${fu.search}`, headers: out, setHost: false,
+      timeout: connectTimeoutMs, agent: false,
+    });
+    note('allow', 'allowed', target.hostname, port, 'http');
+    upstream.on('timeout', () => upstream.destroy(new Error('timeout')));
+    upstream.on('error', () => deny(res, 'destination-not-declared'));
+    upstream.on('response', (up) => {
+      const headers = {};
+      for (const [k, v] of Object.entries(up.headers)) if (!HOP_BY_HOP.has(k)) headers[k] = v;
+      headers.connection = 'close';
+      res.writeHead(up.statusCode || 502, headers);
+      up.on('data', (c) => { stats.bytesForwarded += c.length; });
+      up.pipe(res);
+    });
+    if (filtered.body !== null) upstream.write(filtered.body);
+    upstream.end();
+  }
+
+  server.on('connect', (req, client, head) => {
+    sockets.add(client); client.on('close', () => sockets.delete(client));
+    client.on('error', () => client.destroy());
+    (async () => {
+      const m = /^(\[[0-9a-fA-F:.]+\]|[^:\s]+):(\d{1,5})$/.exec(req.url || '');
+      if (!m) { note('deny', 'host-invalid', '', 0, 'https'); client.end('HTTP/1.1 403 Forbidden\r\nconnection: close\r\n\r\n'); return; }
+      const port = Number(m[2]);
+      const auth = await authorize(m[1], port, 'https');
+      if (!auth.ok) { note('deny', auth.code, m[1], port, 'https'); client.end('HTTP/1.1 403 Forbidden\r\nconnection: close\r\n\r\n'); return; }
+      const upstream = net.connect({ host: auth.address, port, timeout: connectTimeoutMs });
+      sockets.add(upstream); upstream.on('close', () => sockets.delete(upstream));
+      upstream.on('timeout', () => upstream.destroy());
+      upstream.on('error', () => { client.destroy(); });
+      client.on('close', () => upstream.destroy());
+      upstream.on('connect', () => {
+        note('allow', 'allowed', m[1], port, 'https');
+        client.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+        if (head && head.length) upstream.write(head);
+        upstream.pipe(client); client.pipe(upstream);
+      });
+    })().catch(() => client.destroy());
+  });
+
+  await new Promise((resolveListen, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolveListen); });
+  const port = server.address().port;
+  return {
+    port,
+    url: `http://127.0.0.1:${port}`,
+    records,
+    stats,
+    async close() {
+      for (const s of sockets) { try { s.destroy(); } catch { /* ignore */ } }
+      await new Promise((r) => server.close(() => r()));
+    },
+  };
+}
+
+;// CONCATENATED MODULE: ./src/capabilities/probes.js
+// Active probes for the controls capability enforcement depends on (X-502, X-503,
+// X-504), and the platform status that follows from them.
+//
+// The sandbox already probes write confinement, read denial of named host paths,
+// environment scrubbing, the no-network default, tree termination and the
+// file-size limit (sandbox/control-probes.js). Capability enforcement needs three
+// more, each established the same way: an attack through the real backend that
+// must fail, paired with a positive control that must succeed, so a probe that
+// cannot succeed cannot pass for a working control.
+//
+//   fs-read-confinement   a canary outside every declared root is unreadable by
+//                         the task, by a descendant, through a symbolic link
+//                         planted inside a readable root and through `..`; the
+//                         same canary IS readable once its directory is declared
+//   fs-multi-root-write   several declared write roots are writable, a read-only
+//                         root and an undeclared directory are not
+//   network-mediation     a declared destination is reachable through the
+//                         mediation proxy, an undeclared one is refused by the
+//                         proxy, and a direct socket to either is refused by the
+//                         operating system
+//
+// Nothing here asserts an outcome on a platform it did not run on. On the
+// namespace backend (Linux) the new controls are `unsupported`, because that
+// backend does not implement them, and the inherited probes run for real where a
+// Linux host exists. No state is ever inherited from another platform.
+
+
+
+
+
+
+
+
+
+
+
+
+
+const CAPABILITY_CONTROLS = Object.freeze(['fs-read-confinement', 'fs-multi-root-write', 'network-mediation']);
+
+const NODE = process.execPath;
+const ZERO_REV = '0'.repeat(40);
+const proved = (evidence) => ({ state: 'proved', evidence });
+const notProved = (reason) => ({ state: 'not-proved', reason });
+const unsupported = (reason) => ({ state: 'unsupported', reason });
+
+function mk(prefix) { return fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), prefix))); }
+function rm(p) { try { fs.rmSync(p, { recursive: true, force: true }); } catch { /* best effort */ } }
+const token = (p) => `${p}-${crypto.randomBytes(8).toString('hex')}`;
+
+async function probeFsRead(backend) {
+  if (backend !== 'userspace') return unsupported(`read confinement to declared roots is not implemented on the ${backend} backend`);
+  const root = mk('agsec-cap-r-'); const ro = mk('agsec-cap-ro-'); const outside = mk('agsec-cap-out-');
+  try {
+    const okTok = token('READABLE'); const secTok = token('SEALED');
+    fs.writeFileSync(path.join(ro, 'r.txt'), okTok);
+    fs.writeFileSync(path.join(outside, 's.txt'), secTok);
+    fs.symlinkSync(path.join(outside, 's.txt'), path.join(ro, 'link'));
+    const run = (script, readRoots) => runConfinedSupervised(['/bin/sh', '-c', script], { root, readRoots, timeoutMs: 8000, graceMs: 300 });
+    const pos = await run(`cat '${ro}/r.txt'`, [ro]);
+    if (!pos.stdout.includes(okTok)) return notProved(`positive control failed: a file inside a declared root was not readable (${pos.status})`);
+    const open = await run(`cat '${outside}/s.txt'`, [ro, outside]);
+    if (!open.stdout.includes(secTok)) return notProved('positive control failed: the canary was not readable even when its directory was declared');
+    const attempts = {
+      direct: `cat '${outside}/s.txt'`,
+      'symbolic link': `cat '${ro}/link'`,
+      traversal: `cat '${ro}/../${path.basename(outside)}/s.txt'`,
+      descendant: `sh -c "cat '${outside}/s.txt'"; ( cat '${outside}/s.txt' ) 2>&1`,
+    };
+    for (const [name, script] of Object.entries(attempts)) {
+      const r = await run(`${script}; true`, [ro]);
+      if (r.stdout.includes(secTok)) return notProved(`the canary outside every declared root was readable (${name})`);
+    }
+    return proved('declared roots readable; canary unreadable directly, through a link, through .., and from a descendant; readable once declared');
+  } finally { rm(root); rm(ro); rm(outside); }
+}
+
+async function probeMultiWrite(backend) {
+  if (backend !== 'userspace') return unsupported(`several declared write roots are not implemented on the ${backend} backend`);
+  const root = mk('agsec-cap-w-'); const w1 = mk('agsec-cap-w1-'); const w2 = mk('agsec-cap-w2-');
+  const ro = mk('agsec-cap-wro-'); const outside = mk('agsec-cap-wout-');
+  try {
+    const script = [`echo a > '${w1}/f'`, `echo b > '${w2}/f'`, `echo c > '${ro}/f'`, `echo d > '${outside}/f'`, 'true'].join('; ');
+    await runConfinedSupervised(['/bin/sh', '-c', script], { root, readRoots: [ro], writeRoots: [w1, w2], timeoutMs: 8000, graceMs: 300 });
+    if (!fs.existsSync(path.join(w1, 'f')) || !fs.existsSync(path.join(w2, 'f'))) return notProved('positive control failed: a declared write root was not writable');
+    if (fs.existsSync(path.join(ro, 'f'))) return notProved('a root declared read-only was writable');
+    if (fs.existsSync(path.join(outside, 'f'))) return notProved('an undeclared directory was writable');
+    return proved('both declared write roots writable; the read-only root and an undeclared directory were not');
+  } finally { rm(root); rm(w1); rm(w2); rm(ro); rm(outside); }
+}
+
+function listener(label) {
+  const state = { connections: 0 };
+  const server = http.createServer((req, res) => { res.writeHead(200, { 'content-type': 'text/plain' }); res.end(label); });
+  server.on('connection', () => { state.connections += 1; });
+  return new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => resolve({ server, state, port: server.address().port }));
+  });
+}
+
+async function probeNetworkMediation(backend) {
+  if (backend !== 'userspace') return unsupported(`mediated network access is not implemented on the ${backend} backend (its network namespace has no path to a proxy)`);
+  const root = mk('agsec-cap-n-');
+  let a; let b; let proxy;
+  try {
+    a = await listener('A'); b = await listener('B');
+    const built = bindManifest({
+      schema: 'agentic-security/capability-manifest', schemaVersion: '1.0.0', taskId: 'probe-network', repository: { revision: ZERO_REV }, policyVersion: 1,
+      network: [{ host: '127.0.0.1', port: a.port, schemes: ['http'] }],
+    });
+    if (!built.ok) return notProved('probe manifest was invalid');
+    proxy = await startMediationProxy({ bound: built.bound });
+    const script = `
+const http=require('http'),net=require('net');
+const via=(p)=>new Promise(r=>{const q=http.request({host:'127.0.0.1',port:${proxy.port},method:'GET',path:'http://127.0.0.1:'+p+'/',headers:{host:'127.0.0.1:'+p},agent:false},res=>{let b='';res.on('data',d=>b+=d);res.on('end',()=>r({s:res.statusCode,b}))});q.on('error',e=>r({e:e.code}));q.setTimeout(4000,()=>q.destroy());q.end()});
+const direct=(p)=>new Promise(r=>{const s=net.connect(p,'127.0.0.1');s.on('connect',()=>{s.destroy();r({connected:true})});s.on('error',e=>r({e:e.code}));setTimeout(()=>r({e:'TIMEOUT'}),2500)});
+(async()=>{console.log(JSON.stringify({pa:await via(${a.port}),pb:await via(${b.port}),da:await direct(${a.port}),db:await direct(${b.port})}))})();`;
+    const r = await runConfinedSupervised([NODE, '-e', script], {
+      root, readRoots: [NODE], networkProxyPort: proxy.port, timeoutMs: 15000, graceMs: 300,
+    });
+    let out;
+    try { out = JSON.parse(String(r.stdout).trim().split('\n').pop()); } catch { return notProved(`positive control failed: the probe client did not report (${r.status})`); }
+    if (!(out.pa && out.pa.s === 200 && out.pa.b === 'A')) return notProved('positive control failed: a declared destination was not reachable through the proxy');
+    if (!(out.pb && out.pb.s === 403)) return notProved('an undeclared destination was not refused by the proxy');
+    if (out.da?.connected || out.db?.connected) return notProved('a direct socket bypassed the proxy');
+    if (b.state.connections !== 0) return notProved('the undeclared listener saw a connection');
+    if (a.state.connections !== 1) return notProved(`the declared listener saw ${a.state.connections} connections; only the proxied request should have arrived`);
+    return proved('declared destination reachable only through the proxy; undeclared refused by the proxy; direct sockets refused by the operating system');
+  } finally {
+    if (proxy) await proxy.close();
+    for (const l of [a, b]) if (l) await new Promise((res) => l.server.close(() => res()));
+    rm(root);
+  }
+}
+
+const _cache = new Map();
+function resetCapabilityProbeCache() { _cache.clear(); }
+
+async function measure(backend, force) {
+  const base = await probeControls({ force });
+  const controls = { ...base.controls };
+  if (backend === 'disabled') {
+    for (const c of CAPABILITY_CONTROLS) controls[c] = { state: 'unavailable', reason: 'no confinement backend works on this host' };
+  } else {
+    const run = async (name, fn) => {
+      try { controls[name] = await fn(); } catch (e) { controls[name] = notProved(`probe threw: ${String(e.message).split('\n')[0]}`); }
+    };
+    await run('fs-read-confinement', () => probeFsRead(backend));
+    await run('fs-multi-root-write', () => probeMultiWrite(backend));
+    await run('network-mediation', () => probeNetworkMediation(backend));
+  }
+  return controls;
+}
+
+/**
+ * Probe every control capability enforcement uses, on the active backend.
+ * @param {object} [o]
+ * @param {string} [o.force]   backend override (same meaning as runConfined's)
+ * @param {object} [o.probes]  per-control overrides (test seam). An override can only
+ *                             be used to make a control LESS proved in a test; a run
+ *                             still goes through the real backend.
+ */
+async function probes_probeCapabilityControls({ force, probes = {} } = {}) {
+  const backend = detectBackend({ force });
+  if (!_cache.has(backend)) _cache.set(backend, await measure(backend, force));
+  const controls = { ..._cache.get(backend) };
+  // Overrides replace one control's result after the real measurement; the run
+  // itself still goes through the real backend.
+  for (const [name, fn] of Object.entries(probes)) controls[name] = await fn();
+  const states = Object.fromEntries(Object.entries(controls).sort().map(([k, v]) => [k, v.state]));
+  return {
+    platform: process.platform, backend, controls,
+    probeDigest: digestOf({ platform: process.platform, backend, states }),
+  };
+}
+
+/** Controls this manifest actually depends on; a control it never uses cannot block it. */
+function probes_requiredControlsFor(manifest) {
+  const req = ['write-confinement', 'read-denial', 'fs-read-confinement', 'fs-multi-root-write', 'env-scrub', 'tree-termination', 'file-size-limit', 'network'];
+  if (manifest.network.length) req.push('network-mediation');
+  return req;
+}
+
+/**
+ * Whether this platform and backend are one the product ADVERTISES for enforced
+ * mode. Taken from the feature table in the assurance config (Linux only), and
+ * the only advertised backend is the kernel-namespace one. The macOS userspace
+ * backend can be proved on a host by the probes above, and is still not
+ * advertised: it is development-host evidence, not an enforced backend.
+ */
+function isAdvertisedBackend(backend, platform = process.platform) {
+  return FEATURES['capability-enforcement'].platforms.includes(platform) && backend === 'namespace';
+}
+
+/** Standing platform statements. Nothing here is measured; it states what has and has not been evidenced. */
+function platformStatements() {
+  return Object.freeze({
+    linux: {
+      backend: 'namespace', status: 'unverified',
+      note: 'advertised for enforced mode, but the control probes in this module have not run on a Linux host from this workspace. Several controls are not implemented on the namespace backend (read confinement to declared roots, several write roots, mediated network, supervised tree termination), so enforced mode is blocked there until they are implemented and the sandbox-linux job shows them proved. Process-count caps are never claimed.',
+    },
+    darwin: {
+      backend: 'userspace', status: 'host-proved-not-advertised',
+      note: 'the active probes can prove the controls on a macOS host, and tasks can run there for development only when the caller opts in; macOS is not an advertised enforced backend.',
+    },
+    win32: { backend: null, status: 'unsupported', note: 'no isolation backend exists on Windows.' },
+  });
+}
+
+
+
+;// CONCATENATED MODULE: ./src/capabilities/recovery.js
+// Explicit policy recovery (X-506).
+//
+// A denied task does not talk its way out of a denial and does not retry until
+// something gives. The only way a denial turns into a permission is a policy
+// change that
+//
+//   is OPERATOR-ONLY   the grant is an Ed25519 signature over the exact change;
+//                      the signing key lives in the signer domain, which a worker
+//                      cannot read (sandbox/trust-domains.js, the protected key
+//                      directory), so a worker cannot mint one and a forged
+//                      signature fails verification
+//   is BOUND           the signature covers the digest of the manifest it
+//                      changes AND the digest of the manifest it produces, the
+//                      task and both policy versions, so it is not a blank
+//                      cheque and cannot be replayed on another task or version
+//   is BOUNDED         a short validity window, a single use (nonce), and a
+//                      finite number of changes per task
+//   is RECORDED        every applied change is an entry in a hash-chained ledger
+//   creates a NEW VERSION  the policy version rises by one. Every earlier binding
+//                      is then stale (`binding-mismatch`) and every receipt for
+//                      the earlier digest is superseded (receipts.js)
+//
+// A denial itself returns `blocked`, the missing capability and a proposed
+// manifest change for a human to review (`proposeChange`). The proposal is data:
+// applying it needs the operator grant above. Repeated denials of one action hit
+// a finite limit and stay blocked (`createDenialGuard`); no path in this module
+// turns a denial into an allow, falls back to unrestricted execution or loops.
+
+
+
+
+
+
+
+
+
+
+
+
+const GRANT_SCHEMA = 'agentic-security/policy-grant';
+const LEDGER_SCHEMA = 'agentic-security/policy-ledger';
+const DEFAULT_RETRY_LIMIT = 3;
+const MAX_RETRY_LIMIT = 10;
+const DEFAULT_TASK_DENIAL_BUDGET = 20;
+const MAX_TASK_DENIAL_BUDGET = 100;
+const MAX_GRANT_TTL_MS = (/* unused pure expression or super */ null && (60 * 60 * 1000));
+const DEFAULT_MAX_CHANGES = 5;
+const MAX_TRACKED = 1000;
+const GENESIS = '0'.repeat(64);
+
+const sha = (v) => external_node_crypto_.createHash('sha256').update(typeof v === 'string' ? v : (0,evidence_bundle/* canonicalJson */.dj)(v)).digest('hex');
+const clean = (s) => typeof s === 'string' && !/[\u0000-\u001f\u007f]/.test(s) && !detectSecretShapes(s);
+
+// ---------------------------------------------------------------- proposals
+
+// Codes that name a structural refusal. A proposal for any of these would be an
+// invitation to widen the boundary around keys, labels, links and secrets.
+const NOT_PROPOSABLE = new Set([
+  'binding-mismatch', 'unknown-action', 'invalid-manifest', 'scope-expansion', 'path-invalid', 'path-traversal',
+  'symlink-escape', 'protected-path', 'executable-not-absolute', 'executable-unresolvable', 'executable-in-writable-root',
+  'args-invalid', 'secret-in-argument', 'host-invalid', 'port-invalid', 'dns-private-address', 'dns-changed',
+  'payload-too-large', 'payload-uninspectable', 'resource-limit-exceeded', 'retry-limit', 'task-halted', 'identity-spoofed',
+  'identity-missing', 'tool-unclassified', 'allowed', 'delegation-depth',
+]);
+
+function unproposable(decision, why) {
+  return Object.freeze({
+    proposable: false, why, missing: Object.freeze({ capability: decision.kind, code: decision.code, detail: decision.subject }),
+    selfGrantable: false, requiresOperatorGrant: true, change: null,
+  });
+}
+
+/**
+ * The missing capability and a reviewable manifest change for one denial. The
+ * change is the NARROWEST addition that would allow exactly this action (an exact
+ * path, an exact argument array, one host and port). It is a proposal: a worker
+ * can read it and cannot apply it.
+ */
+function proposeChange(bound, action, decision) {
+  const base = { kind: decision?.kind ?? 'unknown', code: decision?.code ?? 'unknown-action', subject: decision?.subject ?? '' };
+  if (!decision || decision.decision === 'allow') return unproposable({ ...base, code: 'allowed' }, 'the action was allowed; there is nothing to propose');
+  if (NOT_PROPOSABLE.has(decision.code)) return unproposable(decision, `${reasonText(decision.code)}; no manifest change is proposed for this refusal`);
+  let add = null; let risk = 'scope-addition';
+  const a = action || {};
+  switch (a.kind) {
+    case 'filesystem-read':
+    case 'filesystem-write':
+      if (typeof a.path === 'string' && clean(a.path)) add = { filesystem: { [a.kind === 'filesystem-write' ? 'write' : 'read']: [a.path] } };
+      break;
+    case 'command':
+      if (typeof a.executable === 'string' && clean(a.executable) && (a.args ?? []).every((x) => typeof x === 'string' && clean(x))) {
+        const entry = { executable: a.executable, args: { mode: 'exact', values: [...(a.args ?? [])] } };
+        if (decision.code === 'interpreter-blocked' || decision.code === 'interpreter-args-unpinned') { entry.interpreter = 'scoped'; risk = 'interpreter'; }
+        add = { commands: [entry] };
+      }
+      break;
+    case 'network':
+      // A literal loopback, private, link-local or metadata address is never offered as a destination.
+      if (typeof a.host === 'string' && clean(a.host) && Number.isInteger(a.port) && (() => {
+        const h = address_normalizeHost(a.host);
+        return h.ok && (h.kind === 'name' || address_classifyAddress(h.host) === 'public');
+      })()) {
+        add = { network: [{ host: a.host, port: a.port, schemes: [a.scheme === 'http' ? 'http' : 'https'] }] };
+      }
+      break;
+    case 'tool':
+      // Only a tool this build knows can be proposed; an unknown name is not a capability.
+      if (typeof a.tool === 'string' && toolCapabilityFor(a.tool)) add = { tools: [a.tool] };
+      break;
+    case 'delegation':
+      if (decision.code === 'delegation-not-allowed') add = { delegation: { allow: true, maxDepth: 1 } };
+      break;
+    default: break;
+  }
+  if (!add) return unproposable(decision, 'the request cannot be turned into a safe manifest addition');
+  const change = Object.freeze({ add });
+  return Object.freeze({
+    proposable: true, why: null, risk,
+    missing: Object.freeze({ capability: decision.kind, code: decision.code, detail: decision.subject }),
+    selfGrantable: false, requiresOperatorGrant: true,
+    nextPolicyVersion: bound.binding.policyVersion + 1,
+    change, changeDigest: (0,identity/* digestOf */.ol)(change),
+    review: `Add to task ${reasons_sanitizeSubject(bound.binding.taskId, 80)} at policy version ${bound.binding.policyVersion + 1}: ${reasons_sanitizeSubject(JSON.stringify(add), 300)}`,
+  });
+}
+
+// ---------------------------------------------------------------- denial guard
+
+function actionKey(binding, action) {
+  const a = action && typeof action === 'object' ? action : {};
+  const material = { kind: a.kind ?? null, path: a.path ?? null, executable: a.executable ?? null, args: Array.isArray(a.args) ? a.args : null, host: a.host ?? null, port: a.port ?? null, scheme: a.scheme ?? null, tool: a.tool ?? null };
+  return sha({ taskId: binding?.taskId ?? null, policyVersion: binding?.policyVersion ?? null, material });
+}
+
+/**
+ * Bounded denial handling. `admit` is asked BEFORE the policy is evaluated; once
+ * an action has been denied `retryLimit` times in one policy version, or the task
+ * has been denied `taskBudget` times in all, the answer is a fixed refusal and the
+ * action is not even evaluated again. A new policy version starts a new count (the
+ * operator changed something, so a retry is no longer the same request).
+ */
+function createDenialGuard({ retryLimit = DEFAULT_RETRY_LIMIT, taskBudget = DEFAULT_TASK_DENIAL_BUDGET } = {}) {
+  const rl = Number.isInteger(retryLimit) && retryLimit >= 1 ? Math.min(retryLimit, MAX_RETRY_LIMIT) : DEFAULT_RETRY_LIMIT;
+  const tb = Number.isInteger(taskBudget) && taskBudget >= 1 ? Math.min(taskBudget, MAX_TASK_DENIAL_BUDGET) : DEFAULT_TASK_DENIAL_BUDGET;
+  const perAction = new Map();
+  const perTask = new Map();
+  const taskKey = (b) => `${b?.taskId ?? 'unbound'}@${b?.policyVersion ?? 0}`;
+  return Object.freeze({
+    retryLimit: rl, taskBudget: tb,
+    admit(binding, action) {
+      const t = perTask.get(taskKey(binding)) ?? 0;
+      if (t >= tb || perAction.size >= MAX_TRACKED) return { admit: false, code: 'task-halted' };
+      if ((perAction.get(actionKey(binding, action)) ?? 0) >= rl) return { admit: false, code: 'retry-limit' };
+      return { admit: true, code: null };
+    },
+    record(binding, action) {
+      const k = actionKey(binding, action);
+      const n = (perAction.get(k) ?? 0) + 1;
+      perAction.set(k, n);
+      perTask.set(taskKey(binding), (perTask.get(taskKey(binding)) ?? 0) + 1);
+      return { attempts: n, remaining: Math.max(0, rl - n), exhausted: n >= rl };
+    },
+    stats(binding) { return { taskDenials: perTask.get(taskKey(binding)) ?? 0, trackedActions: perAction.size }; },
+  });
+}
+
+/**
+ * One mediated decision with recovery semantics. The result is either the policy
+ * allowing the action, or `blocked`; there is no third outcome, no retry inside
+ * this function and no fallback.
+ */
+function mediate(bound, action, ctx, { guard } = {}) {
+  const binding = ctx?.binding;
+  if (guard) {
+    const adm = guard.admit(binding, action);
+    if (!adm.admit) {
+      const decision = Object.freeze({
+        decision: 'deny', code: adm.code, reason: reasonText(adm.code), kind: typeof action?.kind === 'string' ? reasons_sanitizeSubject(action.kind, 40) : 'unknown',
+        subject: '(action not re-evaluated)', taskId: bound?.binding?.taskId ?? null, manifestDigest: bound?.binding?.digest ?? null,
+      });
+      return Object.freeze({ status: 'blocked', blocked: true, decision, ...proposalFields(unproposable(decision, reasonText(adm.code))), attemptsRemaining: 0, exhausted: true });
+    }
+  }
+  const decision = decide_decide(bound, action, ctx);
+  if (decision.decision === 'allow') return Object.freeze({ status: 'ok', blocked: false, decision, proposal: null, missing: null, attemptsRemaining: null, exhausted: false });
+  const counted = guard ? guard.record(binding, action) : null;
+  const proposal = counted?.exhausted ? unproposable(decision, `${reasonText('retry-limit')}`) : proposeChange(bound, action, decision);
+  return Object.freeze({
+    status: 'blocked', blocked: true, decision, ...proposalFields(proposal),
+    attemptsRemaining: counted ? counted.remaining : null, exhausted: counted ? counted.exhausted : false,
+  });
+}
+
+function proposalFields(p) { return { proposal: p, missing: p.missing }; }
+
+// ---------------------------------------------------------------- operator grants
+
+function assertSigner(domain) {
+  if (!mayDo(domain, RESOURCES.SIGNING_KEY, 'read')) {
+    throw Object.assign(new Error(`the ${String(domain)} domain may not sign a policy grant`), { code: 'domain-denied' });
+  }
+}
+
+const ADD_KEYS = (/* unused pure expression or super */ null && (['filesystem', 'commands', 'network', 'tools', 'delegation']));
+
+/** Apply an add-only change to a normalized manifest; the result is validated and bound at the next policy version. */
+function applyChangeToManifest(manifest, change) {
+  if (!change || typeof change !== 'object' || Array.isArray(change) || Object.keys(change).some((k) => k !== 'add')) return { ok: false, code: 'change-invalid', bound: null };
+  const add = change.add;
+  if (!add || typeof add !== 'object' || Array.isArray(add) || Object.keys(add).length === 0 || Object.keys(add).some((k) => !ADD_KEYS.includes(k))) return { ok: false, code: 'change-invalid', bound: null };
+  const next = JSON.parse(JSON.stringify(manifest));
+  next.policyVersion = manifest.policyVersion + 1;
+  if (add.filesystem) {
+    if (typeof add.filesystem !== 'object' || Object.keys(add.filesystem).some((k) => !['read', 'write'].includes(k))) return { ok: false, code: 'change-invalid', bound: null };
+    next.filesystem.read = [...next.filesystem.read, ...(add.filesystem.read ?? [])];
+    next.filesystem.write = [...next.filesystem.write, ...(add.filesystem.write ?? [])];
+  }
+  if (add.commands) next.commands = [...next.commands, ...add.commands];
+  if (add.network) next.network = [...next.network, ...add.network];
+  if (add.tools) next.tools = [...next.tools, ...add.tools];
+  if (add.delegation) next.delegation = add.delegation;
+  const b = bindManifest(next);
+  return b.ok ? { ok: true, code: null, bound: b.bound } : { ok: false, code: 'change-invalid', bound: null, errors: b.errors };
+}
+
+/**
+ * Operator side. Signs a grant for ONE change to ONE manifest. Refuses unless the
+ * caller declares the signer domain; a worker or target cannot sign (and in any
+ * case does not hold the key).
+ */
+function signPolicyGrant({ domain, privateKeyPem, bound, change, operator, reason, now = new Date(), ttlMs = 15 * 60 * 1000, nonce }) {
+  assertSigner(domain);
+  const applied = applyChangeToManifest(bound.manifest, change);
+  if (!applied.ok) throw Object.assign(new Error('the change is not a valid add-only manifest change'), { code: applied.code });
+  const ttl = Math.min(Math.max(1, ttlMs), MAX_GRANT_TTL_MS);
+  const payload = {
+    schema: GRANT_SCHEMA, taskId: bound.binding.taskId,
+    fromPolicyVersion: bound.binding.policyVersion, fromDigest: bound.binding.digest,
+    toPolicyVersion: applied.bound.binding.policyVersion, toDigest: applied.bound.binding.digest,
+    operator: sanitizeSubject(operator, 80), reason: sanitizeSubject(reason, 200),
+    issuedAt: now.toISOString(), expiresAt: new Date(now.getTime() + ttl).toISOString(),
+    nonce: nonce ?? crypto.randomBytes(12).toString('hex'),
+  };
+  const publicKeyPem = crypto.createPublicKey(privateKeyPem).export({ type: 'spki', format: 'pem' });
+  const issuance = {
+    issuer: { id: `local-install:${keyFingerprint(publicKeyPem).slice(0, 16)}`, kind: 'local-install', keyFingerprint: keyFingerprint(publicKeyPem) },
+    trustBasis: 'self-issued-local-key', independentlyCertified: false, statement: TRUST_BASES['self-issued-local-key'].statement,
+  };
+  const sig = crypto.sign(null, Buffer.from(canonicalJson({ payload, issuance }), 'utf8'), privateKeyPem);
+  return Object.freeze({ payload, issuance, signature: { algorithm: 'ed25519', value: sig.toString('base64') } });
+}
+
+function verifyGrant(grant, publicKeyPem) {
+  if (!grant || typeof grant !== 'object' || !grant.payload || !grant.signature || grant.payload.schema !== GRANT_SCHEMA) return { ok: false, code: 'grant-invalid' };
+  if (Object.keys(grant).some((k) => !['payload', 'issuance', 'signature'].includes(k))) return { ok: false, code: 'grant-invalid' };
+  if (grant.signature.algorithm !== 'ed25519' || typeof grant.signature.value !== 'string') return { ok: false, code: 'grant-invalid' };
+  if (!publicKeyPem) return { ok: false, code: 'grant-unsigned' };
+  let ok = false;
+  try { ok = crypto.verify(null, Buffer.from(canonicalJson({ payload: grant.payload, issuance: grant.issuance }), 'utf8'), publicKeyPem, Buffer.from(grant.signature.value, 'base64')); } catch { ok = false; }
+  if (!ok) return { ok: false, code: 'grant-signature-invalid' };
+  const iss = grant.issuance;
+  if (!iss || !TRUST_BASES[iss.trustBasis] || iss.independentlyCertified !== false || iss.issuer?.keyFingerprint !== keyFingerprint(publicKeyPem)) return { ok: false, code: 'grant-issuer-invalid' };
+  return { ok: true, code: null };
+}
+
+// ---------------------------------------------------------------- ledger
+
+/** A hash-chained record of every applied policy change. Held by the controller, never by a worker. */
+function createPolicyLedger({ maxChanges = DEFAULT_MAX_CHANGES } = {}) {
+  const max = Number.isInteger(maxChanges) && maxChanges >= 1 ? Math.min(maxChanges, 50) : DEFAULT_MAX_CHANGES;
+  const entries = [];
+  const nonces = new Set();
+  const current = new Map(); // taskId -> {policyVersion, digest}
+  const head = () => (entries.length ? entries[entries.length - 1].hash : GENESIS);
+  return {
+    maxChanges: max,
+    entries: () => entries.map((e) => ({ ...e })),
+    changesFor: (taskId) => entries.filter((e) => e.taskId === taskId).length,
+    nonceUsed: (n) => nonces.has(n),
+    /** Seed the current policy of a task (the first bound manifest). */
+    register(bound) { if (!current.has(bound.binding.taskId)) current.set(bound.binding.taskId, { policyVersion: bound.binding.policyVersion, digest: bound.binding.digest }); },
+    current: (taskId) => current.get(taskId) ?? null,
+    isCurrent: (binding) => { const c = current.get(binding?.taskId); return !!c && c.policyVersion === binding.policyVersion && c.digest === binding.digest; },
+    append(entry) {
+      const body = { seq: entries.length, prev: head(), ...entry };
+      const full = { ...body, hash: sha(body) };
+      entries.push(Object.freeze(full));
+      nonces.add(entry.nonce);
+      current.set(entry.taskId, { policyVersion: entry.toPolicyVersion, digest: entry.toDigest });
+      return full;
+    },
+    verify() { return verifyLedgerEntries(entries); },
+  };
+}
+
+function verifyLedgerEntries(list) {
+  let prev = GENESIS;
+  for (let i = 0; i < list.length; i++) {
+    const { hash, ...body } = list[i];
+    if (body.seq !== i || body.prev !== prev || sha(body) !== hash) return { ok: false, breakAt: i };
+    prev = hash;
+  }
+  return { ok: true, breakAt: null, head: prev };
+}
+
+// ---------------------------------------------------------------- applying a grant
+
+/**
+ * Apply an operator grant to a task's policy. Returns the NEW bound manifest (a
+ * new policy version), the ledger entry and the re-run preflight. On any refusal
+ * `ok` is false, `bound` is null and the old policy is untouched.
+ *
+ * @param {object} o
+ * @param {{manifest:object,binding:object}} o.bound   the current policy
+ * @param {object} o.change                            the proposed `{add}`
+ * @param {object} o.grant                             from `signPolicyGrant`
+ * @param {string} o.publicKeyPem                      the operator's public key
+ * @param {object} o.ledger                            from `createPolicyLedger`
+ * @param {Date}   [o.now]
+ * @param {object} [o.deniedAction]                    re-decided under the new policy
+ * @param {object} [o.probeReport]                     injected probe report (default: probe this host)
+ */
+async function applyPolicyChange({ bound, change, grant, publicKeyPem, ledger, now = new Date(), deniedAction, probeReport, ctxExtra = {} }) {
+  const refuse = (code) => ({ ok: false, code, reason: `policy change refused: ${code}`, bound: null, entry: null, preflight: null });
+  if (!bound?.manifest || !bound?.binding || !ledger) return refuse('invalid-input');
+  const v = verifyGrant(grant, publicKeyPem);
+  if (!v.ok) return refuse(v.code);
+  const p = grant.payload;
+  const issued = Date.parse(p.issuedAt); const expires = Date.parse(p.expiresAt);
+  if (!Number.isFinite(issued) || !Number.isFinite(expires) || expires - issued > MAX_GRANT_TTL_MS || expires <= issued) return refuse('grant-window-invalid');
+  if (now.getTime() < issued) return refuse('grant-not-yet-valid');
+  if (now.getTime() >= expires) return refuse('grant-expired');
+  const b = bound.binding;
+  if (p.taskId !== b.taskId) return refuse('grant-wrong-task');
+  if (p.fromPolicyVersion !== b.policyVersion || p.fromDigest !== b.digest) return refuse('grant-stale');
+  ledger.register(bound);
+  if (!ledger.isCurrent(b)) return refuse('grant-stale');
+  if (ledger.nonceUsed(p.nonce)) return refuse('grant-replayed');
+  if (ledger.changesFor(b.taskId) >= ledger.maxChanges) return refuse('change-limit');
+  const applied = applyChangeToManifest(bound.manifest, change);
+  if (!applied.ok) return refuse(applied.code);
+  if (applied.bound.binding.digest !== p.toDigest || applied.bound.binding.policyVersion !== p.toPolicyVersion) return refuse('grant-change-mismatch');
+
+  const entry = ledger.append({
+    taskId: b.taskId, operator: p.operator, reason: p.reason, nonce: p.nonce,
+    fromPolicyVersion: b.policyVersion, fromDigest: b.digest, toPolicyVersion: p.toPolicyVersion, toDigest: p.toDigest,
+    changeDigest: digestOf(change), at: now.toISOString(),
+  });
+
+  // Rerun what the change can affect: the manifest itself, the controls the new
+  // manifest depends on, and the action that was denied.
+  const nb = applied.bound;
+  const pr = probeReport || await probeCapabilityControls({});
+  const required = requiredControlsFor(nb.manifest);
+  const unmet = unmetControls(pr, required);
+  const valid = validateManifest(nb.manifest).ok;
+  const redecision = deniedAction ? decide(nb, deniedAction, { binding: nb.binding, ...ctxExtra }) : null;
+  const preflight = {
+    manifestValid: valid, requiredControls: required, unmet,
+    redecision: redecision ? { decision: redecision.decision, code: redecision.code } : null,
+    ready: valid && unmet.length === 0 && (!redecision || redecision.decision === 'allow'),
+  };
+  return {
+    ok: true, code: null, reason: 'policy changed; a new policy version was created', bound: nb, entry, preflight,
+    supersedes: { policyVersion: b.policyVersion, digest: b.digest },
+  };
+}
+
+;// CONCATENATED MODULE: ./src/capabilities/records.js
+// Capability decisions as CORE-002 records, and the advisory (hook) view.
+//
+// A policy decision (decide.js) becomes an `agentic-security/capability-decision`
+// record. The record schema already carries the honesty rule this module relies
+// on: only runner or proxy mediation, naming a backend and the digest of an
+// active probe, may claim `enforced`. `enforced` here is true only when the
+// runner says the backend is an advertised one and every required control was
+// proved; a development-host run is recorded as a runner-mediated decision with
+// `enforced: false`.
+
+
+
+
+
+/**
+ * @param {object} d            a decision from `decide`
+ * @param {object} o
+ * @param {'runner'|'proxy'|'in-process-policy'|'hook-advisory'|'none'} o.mediation
+ * @param {boolean} o.enforced
+ * @param {string|null} o.backend
+ * @param {string|null} o.probeDigest
+ * @returns {{ok: boolean, record: object|null, errors: object[]}}
+ */
+function toCapabilityDecisionRecord(d, { mediation, enforced, backend = null, probeDigest = null }) {
+  const rec = {
+    schema: 'agentic-security/capability-decision', schemaVersion: schema_kit/* SCHEMA_VERSION */.f$,
+    taskId: d.taskId ?? 'unbound', capability: d.kind, subject: reasons_sanitizeSubject(d.subject, 200),
+    decision: d.decision, mediation, enforced: enforced === true, backend,
+    ...(probeDigest ? { probeDigest } : {}),
+    reason: `${d.code}: ${d.reason}`,
+  };
+  rec.id = (0,contracts/* capabilityDecisionId */.A9)(rec);
+  const v = (0,contracts/* validateCapabilityDecision */.f_)(rec);
+  return v.ok ? { ok: true, record: Object.freeze(rec), errors: [] } : { ok: false, record: null, errors: v.errors };
+}
+
+/**
+ * What a hook may say about an action. The same policy answer, labelled as
+ * advice: mediation `hook-advisory` and never enforced, however the manifest
+ * reads. A shell command string is not an action the policy can parse, so it is
+ * reported as unsupported for enforcement and left to the runner's structured
+ * execution.
+ */
+function advise(bound, action, ctx) {
+  if (action && action.kind === 'command' && typeof action.command === 'string') {
+    return Object.freeze({
+      advisory: true, enforced: false, decision: 'unsupported', code: 'interpreter-blocked',
+      note: 'a shell command string cannot be mediated; run it as an executable and an argument array through the capability runner',
+      record: null,
+    });
+  }
+  const d = decide(bound, action, ctx);
+  const r = toCapabilityDecisionRecord(d, { mediation: 'hook-advisory', enforced: false, backend: null });
+  return Object.freeze({
+    advisory: true, enforced: false, decision: d.decision, code: d.code,
+    note: 'advice only: a hook response explains a decision, it does not enforce one', record: r.ok ? r.record : null,
+  });
+}
+
+;// CONCATENATED MODULE: ./src/capabilities/tool-gate.js
+// The MCP tool gate (X-505.AC01, X-505.AC03).
+//
+// Every tool call is checked against the SAME decision function the runner and
+// the hooks use (`decide`), for the CURRENT task identity, before its handler
+// runs. The identity is the one the operator bound to the server; nothing the
+// calling agent sends can change it: tool arguments are closed schemas, and an
+// identity named in the request metadata is compared with the bound one and
+// refused when it differs (`identity-spoofed`).
+//
+//   no policy, feature off   the gate is inactive: behaviour is exactly what it
+//                            was before this module existed
+//   feature on, no policy    read tools pass; a mutating or externally
+//                            communicating tool is refused (`identity-missing`),
+//                            because there is no task to check it for
+//   policy bound             every tool is checked: it must be a declared tool
+//                            action (deny by default), a mutating one must also
+//                            have the session root inside a declared write root,
+//                            and a tool missing from the classification table is
+//                            refused (`tool-unclassified`)
+//
+// A denial is synchronous and final for that call: no prompt, no waiting, no
+// retry inside the gate. It carries the missing capability and a reviewable
+// proposed change (recovery.js); repeated denials hit the finite limit there.
+//
+// This is POLICY at the tool boundary. The tool then runs in the MCP server
+// process, so the decision is recorded as `in-process-policy` and never
+// `enforced`; the runner is the only enforcement layer.
+
+
+
+
+
+
+const FEATURE = 'capability-enforcement';
+const MAX_KEPT = 500;
+
+function synthetic(bound, kind, code, subject) {
+  return Object.freeze({
+    decision: 'deny', code, reason: reasonText(code), kind, subject: reasons_sanitizeSubject(subject),
+    taskId: bound?.binding?.taskId ?? null, manifestDigest: bound?.binding?.digest ?? null,
+  });
+}
+
+/** Whether the OPERATOR enabled the feature (environment only; a project file can never enable it). */
+function featureEnabledByOperator(env = process.env) {
+  try { return (0,config.resolveAssuranceConfig)({ env }).features?.[FEATURE]?.enabled === true; } catch { return false; }
+}
+
+/**
+ * @param {object} o
+ * @param {string} o.sessionRoot
+ * @param {{bound: object, binding: object}|null} [o.policy]  the task's bound manifest and the identity it acts for
+ * @param {object} [o.guard]    denial guard (default: a fresh one with the default limits)
+ * @param {object} [o.env]
+ */
+function createToolGate({ sessionRoot, policy = null, guard, env = process.env } = {}) {
+  let current = policy && policy.bound && policy.binding ? { bound: policy.bound, binding: policy.binding } : null;
+  const denialGuard = guard || createDenialGuard();
+  const kept = [];
+
+  function record(decision) {
+    const r = toCapabilityDecisionRecord(decision, { mediation: 'in-process-policy', enforced: false, backend: null });
+    if (r.ok) { kept.push(r.record); if (kept.length > MAX_KEPT) kept.shift(); }
+    return r.ok ? r.record : null;
+  }
+
+  function refused(d) {
+    return Object.freeze({
+      allowed: false, blocked: true, code: d.code, reason: d.reason, decision: d,
+      missing: Object.freeze({ capability: 'tool', code: d.code, detail: d.subject }),
+      proposal: null, attemptsRemaining: null, exhausted: false, record: record(d),
+    });
+  }
+
+  function blockedResult(m, extra = {}) {
+    return Object.freeze({
+      allowed: false, blocked: true, code: m.decision.code, reason: m.decision.reason, decision: m.decision, missing: m.missing,
+      proposal: m.proposal, attemptsRemaining: m.attemptsRemaining, exhausted: m.exhausted, record: record(m.decision), ...extra,
+    });
+  }
+
+  const self = {
+    /** The gate is active when a policy is bound or the operator turned the feature on. */
+    active: () => current !== null || featureEnabledByOperator(env),
+    hasPolicy: () => current !== null,
+    /** Operator-side: replace the bound policy (a new policy version, a different task). Stale bindings are then refused. */
+    update(next) { current = next && next.bound && next.binding ? { bound: next.bound, binding: next.binding } : null; },
+    decisions: () => kept.slice(),
+    guard: denialGuard,
+
+    /**
+     * @param {string} name   the tool the agent asked for
+     * @param {{claimedTaskId?: string}} [req]   identity claimed in the request, if any
+     */
+    check(name, { claimedTaskId } = {}) {
+      if (!self.active()) return Object.freeze({ allowed: true, skipped: true, decision: null });
+      if (!current) {
+        if (!isMutatingOrExternal(name)) return Object.freeze({ allowed: true, skipped: true, decision: null });
+        return refused(synthetic(null, 'tool', 'identity-missing', String(name)));
+      }
+      const { bound, binding } = current;
+      if (claimedTaskId !== undefined && claimedTaskId !== binding.taskId) {
+        return refused(synthetic(bound, 'tool', 'identity-spoofed', `${String(name)} (claimed task ${reasons_sanitizeSubject(claimedTaskId, 60)})`));
+      }
+      const cap = toolCapabilityFor(name);
+      if (!cap) return refused(synthetic(bound, 'tool', 'tool-unclassified', String(name)));
+      const ctx = { binding };
+      const decisions = [];
+      for (const req of cap.requires) {
+        const action = req === 'tool' ? { kind: 'tool', tool: name } : { kind: 'filesystem-write', path: sessionRoot };
+        const m = mediate(bound, action, ctx, { guard: denialGuard });
+        if (m.status !== 'ok') return blockedResult(m, { checked: decisions.length });
+        decisions.push(m.decision); record(m.decision);
+      }
+      return Object.freeze({ allowed: true, skipped: false, decision: decisions[0], decisions });
+    },
+  };
+  return Object.freeze(self);
+}
+
+
+/***/ }),
+
 /***/ 69390:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
@@ -335,6 +2420,179 @@ const dataflow_get_flow = {
 };
 
 
+/***/ }),
+
+/***/ 82407:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   _: () => (/* binding */ makeInvariantTools)
+/* harmony export */ });
+/* harmony import */ var _posture_invariants_export_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(90145);
+/* harmony import */ var _posture_assurance_config_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(90385);
+/* harmony import */ var _redact_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(83468);
+// invariant-tools.js: the MCP surface for bounded business-logic scenarios (X-407.AC03).
+//
+// One READ-ONLY tool, `invariant_scenario_export`: build the reproducible scenario package for a reviewer-supplied contract and a
+// disposable fixture directory that both live inside the session root. It runs nothing and writes nothing. The same function
+// the CLI calls (`posture/invariants/export.js` `exportFromFiles`) does the work, so the two surfaces cannot disagree.
+//
+// Guarantees, each with a test:
+//   - paths are confined to the session root by the server's own `_confine` (passed in; this file never resolves a path itself);
+//   - the export carries no tenant secret: scenarios holding secret-looking content are withheld, the fixture source is never
+//     included, and the serialized result is checked once more with the server's own secret-shape redactor, which BLOCKS the
+//     result rather than editing it (an edited scenario is a different scenario);
+//   - it never claims exhaustive correctness: every export carries the bounded-sample statement;
+//   - gated behind the `invariant-scenarios` feature (off by default, operator-only): with it off the tool reports it is
+//     disabled and builds nothing.
+// The factory shape (rather than importing `_confine` from tools.js) avoids a cycle between this file and the registry.
+
+
+
+
+const MAX_RESPONSE_BYTES = 1_500_000;
+
+function makeInvariantTools({ confine, META }) {
+  const invariant_scenario_export = {
+    name: 'invariant_scenario_export',
+    description: 'Export the bounded stateful scenarios for one executable business-logic invariant as a reproducible package: scenario documents with content digests, the pinned fixture digest, replay manifests (when a commit is given), the bounds applied and the scenario families that could not be built. Read-only: runs nothing. The fixture source and any secret-looking content are never included, and the package states that it is a bounded sample, not a proof of correctness. Requires the invariant-scenarios feature (off by default).',
+    inputSchema: {
+      type: 'object',
+      additionalProperties: false,
+      properties: {
+        invariant_file: { type: 'string', minLength: 1, maxLength: 512 },
+        fixture_dir: { type: 'string', minLength: 1, maxLength: 512 },
+        ledger_file: { type: 'string', minLength: 1, maxLength: 512 },
+        commit: { type: 'string', pattern: '^[0-9a-f]{40}([0-9a-f]{24})?$' },
+        seed: { type: 'integer', minimum: 0, maximum: 4294967295 },
+        bounds: {
+          type: 'object', additionalProperties: false,
+          properties: {
+            actors: { type: 'integer', minimum: 1, maximum: 4 }, depth: { type: 'integer', minimum: 1, maximum: 12 }, requests: { type: 'integer', minimum: 1, maximum: 16 },
+            scenarios: { type: 'integer', minimum: 1, maximum: 6 }, timeBudgetMs: { type: 'integer', minimum: 1, maximum: 8000 },
+          },
+        },
+      },
+      required: ['invariant_file', 'fixture_dir'],
+    },
+    async handler(args, ctx) {
+      let invariantPath; let fixturePath; let ledgerPath;
+      try {
+        invariantPath = confine(ctx.sessionRoot, args.invariant_file, 'invariant_file');
+        fixturePath = confine(ctx.sessionRoot, args.fixture_dir, 'fixture_dir');
+        if (args.ledger_file) ledgerPath = confine(ctx.sessionRoot, args.ledger_file, 'ledger_file');
+      } catch (e) {
+        return { _meta: META, ok: false, status: 'rejected', reason: `path refused: ${String(e.message).replace(ctx.sessionRoot, '<root>')}` };
+      }
+      const config = (0,_posture_assurance_config_js__WEBPACK_IMPORTED_MODULE_1__.resolveAssuranceConfig)({ scanRoot: ctx.sessionRoot, env: process.env });
+      const r = (0,_posture_invariants_export_js__WEBPACK_IMPORTED_MODULE_0__/* .exportFromFiles */ .iF)({ invariantPath, fixturePath, ledgerPath, commit: args.commit, seed: args.seed, bounds: args.bounds, config });
+      if (r.status !== 'ok') return { _meta: META, ok: false, status: r.status, reason: String(r.reason || '').replace(ctx.sessionRoot, '<root>').slice(0, 400), withheld: r.withheld ?? [] };
+      const text = JSON.stringify(r.export);
+      if ((0,_redact_js__WEBPACK_IMPORTED_MODULE_2__/* .redactSecretShapes */ .Kb)(text).redactions > 0) return { _meta: META, ok: false, status: 'blocked', reason: 'the export contains secret-shaped content and was not returned; an edited scenario would be a different scenario' };
+      if (text.length > MAX_RESPONSE_BYTES) return { _meta: META, ok: false, status: 'blocked', reason: 'the export is too large for one response; lower the bounds' };
+      return { _meta: META, ok: true, status: 'ok', export: r.export, withheld: r.withheld };
+    },
+  };
+  return { invariant_scenario_export };
+}
+
+
+/***/ }),
+
+/***/ 99027:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   _: () => (/* binding */ makePortfolioTools)
+/* harmony export */ });
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var _posture_assurance_config_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(90385);
+/* harmony import */ var _posture_portfolio_work_units_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(90987);
+/* harmony import */ var _posture_portfolio_scheduler_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(34563);
+/* harmony import */ var _posture_portfolio_progress_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(67439);
+/* harmony import */ var _posture_portfolio_wording_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(9886);
+/* harmony import */ var _redact_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(83468);
+// portfolio-tools.js: the MCP surface for portfolio progress and review queues (X-707).
+//
+// One READ-ONLY tool, `portfolio_progress`: the coverage-aware progress view of a durable portfolio store that lives inside the session
+// root. It reads the store (verified; a corrupt store is an error, never a reset), the scheduler ledger beside it, and optionally a
+// budgets file and a findings file, and writes nothing. The same function the CLI calls (`posture/portfolio/progress.js`
+// `buildProgressView`) does the work, so the two surfaces cannot disagree.
+//
+// Guarantees, each with a test:
+//   - paths are confined to the session root by the server's own `_confine` (passed in; this file never resolves a path itself);
+//   - the view separates verified, blocked/failed/stale, coverage, budget and pending review, keeps stale workers visible, and never
+//     states that the portfolio passed (a finished controller is reported as finished);
+//   - the serialized result is checked with the server's secret-shape redactor and BLOCKED rather than edited if anything would change;
+//   - gated behind the `portfolio-assurance` feature (off by default): with it off the tool answers `status: 'disabled'` and reads nothing.
+// The factory shape (rather than importing `_confine` from tools.js) avoids a cycle between this file and the registry.
+
+
+
+
+
+
+
+
+const MAX_RESPONSE_BYTES = 1_500_000;
+const MAX_INPUT_BYTES = 8 * 1024 * 1024;
+
+function readJson(file) {
+  const st = node_fs__WEBPACK_IMPORTED_MODULE_0__.lstatSync(file);
+  if (st.isSymbolicLink() || !st.isFile() || st.size > MAX_INPUT_BYTES) throw new Error('not a regular JSON file within the size limit');
+  return JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(file, 'utf8'));
+}
+
+function makePortfolioTools({ confine, META }) {
+  const portfolio_progress = {
+    name: 'portfolio_progress',
+    description: 'Show the progress of a resumable multi-repository portfolio audit as a coverage-aware view: verified units, blocked/failed/stale units, per-repository coverage, remaining budget, pending human review, worker liveness (stale workers stay visible) and, when a findings file is given, aggregate findings deduplicated by stable identity with per-repository/environment evidence and separate affected releases. A finished controller is reported as finished, never as passed. Read-only; paths must be inside the session root. Disabled unless the portfolio-assurance feature is on.',
+    inputSchema: {
+      type: 'object',
+      additionalProperties: false,
+      properties: {
+        store_file: { type: 'string', minLength: 1, maxLength: 512 },
+        budgets_file: { type: 'string', minLength: 1, maxLength: 512 },
+        findings_file: { type: 'string', minLength: 1, maxLength: 512 },
+        blocking_severity: { type: 'string', enum: ['info', 'low', 'medium', 'high', 'critical'] },
+        now: { type: 'integer', minimum: 0 },
+      },
+      required: ['store_file'],
+    },
+    async handler(args, ctx) {
+      const config = (0,_posture_assurance_config_js__WEBPACK_IMPORTED_MODULE_1__.resolveAssuranceConfig)({ scanRoot: ctx.sessionRoot, env: process.env });
+      const gate = (0,_posture_assurance_config_js__WEBPACK_IMPORTED_MODULE_1__/* .featureStatus */ .FX)(config, _posture_portfolio_wording_js__WEBPACK_IMPORTED_MODULE_5__/* .FEATURE_ID */ .DU);
+      if (gate.status !== 'ok') return { _meta: META, ok: false, status: gate.status, reason: `portfolio progress is not available: ${gate.reason ?? gate.code}` };
+      let storePath; let budgetsPath; let findingsPath;
+      try {
+        storePath = confine(ctx.sessionRoot, args.store_file, 'store_file');
+        if (args.budgets_file) budgetsPath = confine(ctx.sessionRoot, args.budgets_file, 'budgets_file');
+        if (args.findings_file) findingsPath = confine(ctx.sessionRoot, args.findings_file, 'findings_file');
+      } catch (e) {
+        return { _meta: META, ok: false, status: 'rejected', reason: `path refused: ${String(e.message).replace(ctx.sessionRoot, '<root>')}` };
+      }
+      let store; let ledger; let budgets = null; let findings = null;
+      try {
+        store = (0,_posture_portfolio_work_units_js__WEBPACK_IMPORTED_MODULE_2__/* .readStore */ .uz)(storePath);
+        if (!store) return { _meta: META, ok: false, status: 'rejected', reason: 'no portfolio store at that path' };
+        ledger = (0,_posture_portfolio_scheduler_js__WEBPACK_IMPORTED_MODULE_3__/* .readLedger */ .SC)(storePath);
+        if (budgetsPath) budgets = readJson(budgetsPath);
+        if (findingsPath) findings = readJson(findingsPath);
+      } catch (e) {
+        return { _meta: META, ok: false, status: 'blocked', reason: `the store or an input failed verification: ${String(e.code ?? e.message).slice(0, 200)}` };
+      }
+      const r = (0,_posture_portfolio_progress_js__WEBPACK_IMPORTED_MODULE_4__/* .buildProgressView */ .TJ)({ store, ledger, budgets, now: Number.isInteger(args.now) ? args.now : Date.now(), findings, blockingSeverity: args.blocking_severity });
+      if (!r.ok) return { _meta: META, ok: false, status: 'rejected', reason: r.errors.map((e) => e.message).join('; ').slice(0, 400) };
+      const text = JSON.stringify(r.view);
+      if ((0,_redact_js__WEBPACK_IMPORTED_MODULE_6__/* .redactSecretShapes */ .Kb)(text).redactions > 0) return { _meta: META, ok: false, status: 'blocked', reason: 'the view contains secret-shaped content and was not returned' };
+      if (text.length > MAX_RESPONSE_BYTES) return { _meta: META, ok: false, status: 'blocked', reason: 'the view is too large for one response' };
+      return { _meta: META, ok: true, status: 'ok', view: r.view };
+    },
+  };
+  return { portfolio_progress };
+}
+
+
 /***/ }),
 
 /***/ 27438:
@@ -350,8 +2608,9 @@ __webpack_require__.a(__webpack_module__, async (__webpack_handle_async_dependen
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
 /* harmony import */ var node_url__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(73136);
 /* harmony import */ var _tools_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(14054);
-/* harmony import */ var _validate_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(61211);
+/* harmony import */ var _validate_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(61211);
 /* harmony import */ var _audit_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(69390);
+/* harmony import */ var _capabilities_tool_gate_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(99405);
 var __webpack_async_dependencies__ = __webpack_handle_async_dependencies__([_tools_js__WEBPACK_IMPORTED_MODULE_4__]);
 _tools_js__WEBPACK_IMPORTED_MODULE_4__ = (__webpack_async_dependencies__.then ? (await __webpack_async_dependencies__)() : __webpack_async_dependencies__)[0];
 // MCP server core — JSON-RPC 2.0 handler for the Model Context Protocol.
@@ -372,6 +2631,8 @@ _tools_js__WEBPACK_IMPORTED_MODULE_4__ = (__webpack_async_dependencies__.then ?
 
 
 
+// X-505: tool calls are checked against the capability policy before a handler runs.
+
 
 const PROTOCOL_VERSION = '2025-03-26';
 const SERVER_NAME = 'agentic-security';
@@ -399,7 +2660,7 @@ const TOOLS_BY_NAME = Object.fromEntries(_tools_js__WEBPACK_IMPORTED_MODULE_4__/
 function _codeFingerprint() {
   try {
     const here = node_path__WEBPACK_IMPORTED_MODULE_2__.dirname((0,node_url__WEBPACK_IMPORTED_MODULE_3__.fileURLToPath)(import.meta.url));
-    const files = ['server.js', 'tools.js', 'dataflow-tools.js', 'stdio.js', 'audit.js', 'validate.js', 'redact.js'];
+    const files = ['server.js', 'tools.js', 'dataflow-tools.js', 'invariant-tools.js', 'portfolio-tools.js', 'stdio.js', 'audit.js', 'validate.js', 'redact.js'];
     const h = node_crypto__WEBPACK_IMPORTED_MODULE_1__.createHash('sha256');
     for (const f of files) {
       try { h.update(f); h.update(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(here, f))); } catch {}
@@ -419,8 +2680,12 @@ function _ok(id, result) {
   return { jsonrpc: '2.0', id, result };
 }
 
-function createServer({ sessionRoot = process.cwd() } = {}) {
+// `capabilityPolicy` is `{ bound, binding }`, supplied by the operator from the
+// capability manifest facility. Absent, and with the `capability-enforcement`
+// feature off, the gate is inactive and behaviour is unchanged.
+function createServer({ sessionRoot = process.cwd(), capabilityPolicy = null } = {}) {
   const ctx = { sessionRoot };
+  const gate = (0,_capabilities_tool_gate_js__WEBPACK_IMPORTED_MODULE_6__/* .createToolGate */ .e)({ sessionRoot, policy: capabilityPolicy });
 
   async function handleRequest(msg) {
     if (!msg || typeof msg !== 'object') return _err(null, -32600, 'Invalid Request');
@@ -473,7 +2738,22 @@ function createServer({ sessionRoot = process.cwd() } = {}) {
           (0,_audit_js__WEBPACK_IMPORTED_MODULE_5__.auditCall)({ sessionRoot, tool: name, args, outcome: 'rejected', reason: 'unknown-tool' });
           return _err(id, -32602, `Unknown tool: ${name}`);
         }
-        try { (0,_validate_js__WEBPACK_IMPORTED_MODULE_6__/* .validate */ .t)(tool.inputSchema, args); }
+        // X-505: the capability check, for the task identity bound to this server.
+        // An identity named in the request metadata can only be compared with it.
+        const gated = gate.check(name, { claimedTaskId: msg.params?._meta?.taskId });
+        if (!gated.allowed) {
+          (0,_audit_js__WEBPACK_IMPORTED_MODULE_5__.auditCall)({ sessionRoot, tool: name, args, outcome: 'rejected', reason: `capability-denied: ${gated.code}` });
+          const p = gated.proposal;
+          return _ok(id, {
+            content: [{ type: 'text', text: JSON.stringify({
+              blocked: true, code: gated.code, reason: gated.reason, missing: gated.missing,
+              proposedChange: p && p.proposable ? { review: p.review, change: p.change, nextPolicyVersion: p.nextPolicyVersion, requiresOperatorGrant: true } : null,
+              attemptsRemaining: gated.attemptsRemaining, exhausted: gated.exhausted,
+            }, null, 2) }],
+            isError: true,
+          });
+        }
+        try { (0,_validate_js__WEBPACK_IMPORTED_MODULE_7__/* .validate */ .t)(tool.inputSchema, args); }
         catch (e) {
           (0,_audit_js__WEBPACK_IMPORTED_MODULE_5__.auditCall)({ sessionRoot, tool: name, args, outcome: 'rejected', reason: `invalid-args: ${e.message}` });
           return _ok(id, {
@@ -503,7 +2783,7 @@ function createServer({ sessionRoot = process.cwd() } = {}) {
     }
   }
 
-  return { handleRequest, sessionRoot };
+  return { handleRequest, sessionRoot, capabilityGate: gate };
 }
 
 // NOTE: no default-singleton export. Callers must use createServer({...})
@@ -637,12 +2917,16 @@ __webpack_require__.a(__webpack_module__, async (__webpack_handle_async_dependen
 /* harmony import */ var _posture_integrity_js__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__(71130);
 /* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_10__ = __webpack_require__(31174);
 /* harmony import */ var _posture_cache_economics_js__WEBPACK_IMPORTED_MODULE_11__ = __webpack_require__(58752);
-/* harmony import */ var _redact_js__WEBPACK_IMPORTED_MODULE_15__ = __webpack_require__(83468);
+/* harmony import */ var _redact_js__WEBPACK_IMPORTED_MODULE_19__ = __webpack_require__(83468);
 /* harmony import */ var _report_index_js__WEBPACK_IMPORTED_MODULE_12__ = __webpack_require__(75917);
-/* harmony import */ var _posture_provenance_schema_js__WEBPACK_IMPORTED_MODULE_13__ = __webpack_require__(34594);
-/* harmony import */ var _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_14__ = __webpack_require__(20095);
-/* harmony import */ var _posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_16__ = __webpack_require__(79907);
-/* harmony import */ var _posture_cve_lookup_js__WEBPACK_IMPORTED_MODULE_17__ = __webpack_require__(71364);
+/* harmony import */ var _posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__ = __webpack_require__(51864);
+/* harmony import */ var _lineage_deployment_projection_js__WEBPACK_IMPORTED_MODULE_14__ = __webpack_require__(73596);
+/* harmony import */ var _posture_provenance_schema_js__WEBPACK_IMPORTED_MODULE_15__ = __webpack_require__(34594);
+/* harmony import */ var _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_16__ = __webpack_require__(20095);
+/* harmony import */ var _invariant_tools_js__WEBPACK_IMPORTED_MODULE_17__ = __webpack_require__(82407);
+/* harmony import */ var _portfolio_tools_js__WEBPACK_IMPORTED_MODULE_18__ = __webpack_require__(99027);
+/* harmony import */ var _posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_20__ = __webpack_require__(79907);
+/* harmony import */ var _posture_cve_lookup_js__WEBPACK_IMPORTED_MODULE_21__ = __webpack_require__(71364);
 var __webpack_async_dependencies__ = __webpack_handle_async_dependencies__([_report_index_js__WEBPACK_IMPORTED_MODULE_12__]);
 _report_index_js__WEBPACK_IMPORTED_MODULE_12__ = (__webpack_async_dependencies__.then ? (await __webpack_async_dependencies__)() : __webpack_async_dependencies__)[0];
 // MCP tool implementations — PRD Feature 2, hardened against the OWASP MCP
@@ -673,12 +2957,17 @@ _report_index_js__WEBPACK_IMPORTED_MODULE_12__ = (__webpack_async_dependencies__
 
 
 
+// X-206: the one projection of the verification record, shared with the JSON report, the text report and the autopilot response.
+
+
 // Git-origin provenance (Finding Provenance M0/M1). Distinct from
 // `finding.provenance` (AI-authorship) and from an SCA entry's `provenance`
 // (Sigstore/SLSA attestation) — see report/index.js's import comment.
 
 
 
+
+
 // Lazy-loaded: these transitively pull in npm packages (@babel/core and
 // friends) that aren't available in the plugin-cache install path
 // (no node_modules). Deferring keeps the MCP server bootable everywhere;
@@ -1085,7 +3374,7 @@ const scan_diff = {
     // scanning), left as-is rather than silently claimed fixed here.
     const findings = (0,_report_index_js__WEBPACK_IMPORTED_MODULE_12__.normalizeFindings)(result.scan)
       .filter(f => wantSet.has(String(f.file || '').replace(/\\/g, '/')) && (sevRank[f.severity] ?? 0) >= min)
-      .map(f => (0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactFinding */ .lE)({
+      .map(f => (0,_redact_js__WEBPACK_IMPORTED_MODULE_19__/* .redactFinding */ .lE)({
         id: f.id, severity: f.severity, file: f.file, line: f.line,
         title: f.vuln, cwe: f.cwe,
         description: f.description, remediation: f.remediation,
@@ -1148,7 +3437,7 @@ const query_taint = {
       const hay = [f.description, f.title, f.vuln, f.snippet, JSON.stringify(f.trace || '')].join(' ').toLowerCase();
       return hay.includes(srcL) && hay.includes(sinkL);
     });
-    const page = all.slice(off, off + lim).map(f => (0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactFinding */ .lE)({
+    const page = all.slice(off, off + lim).map(f => (0,_redact_js__WEBPACK_IMPORTED_MODULE_19__/* .redactFinding */ .lE)({
       id: f.id, severity: f.severity, file: f.file, line: f.line,
       title: f.title || f.vuln, description: f.description,
       trace: f.trace || null,
@@ -1186,7 +3475,7 @@ const explain_finding = {
     if (!scan) throw new Error(`No usable scan state (${status}).`);
     const f = _findById(scan, finding_id);
     if (!f) throw new Error(`Finding not found: ${finding_id}`);
-    const redacted = (0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactFinding */ .lE)({
+    const redacted = (0,_redact_js__WEBPACK_IMPORTED_MODULE_19__/* .redactFinding */ .lE)({
       id: f.id, severity: f.severity, file: f.file, line: f.line,
       title: f.title || f.vuln, cwe: f.cwe,
       description: f.description, remediation: f.remediation,
@@ -1243,9 +3532,17 @@ const explain_finding = {
       // logins/CODEOWNERS lines) through this MCP surface because this call
       // passed no options object at all, silently defeating their policy at
       // this one output boundary while report/index.js honoured it.
-      findingProvenance: f.findingProvenance ? (0,_posture_provenance_schema_js__WEBPACK_IMPORTED_MODULE_13__/* .redactFindingProvenance */ .As)(f.findingProvenance, {
+      findingProvenance: f.findingProvenance ? (0,_posture_provenance_schema_js__WEBPACK_IMPORTED_MODULE_15__/* .redactFindingProvenance */ .As)(f.findingProvenance, {
         pseudonymize: process.env.AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS === '1',
       }) : null,
+      // X-206: the same verification projection the JSON and text reports carry; absent when the finding has no record.
+      ...(f.verificationRecord && typeof f.verificationRecord === 'object'
+        ? { verificationRecord: f.verificationRecord, ...(0,_posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__/* .verificationFields */ .ze)(f.verificationRecord, { replay: f.verificationReplay }) }
+        : {}),
+      // X-307: the same boundary projection the JSON and text reports carry; absent when the finding has no context.
+      ...(f.boundaryContext && typeof f.boundaryContext === 'object'
+        ? (0,_lineage_deployment_projection_js__WEBPACK_IMPORTED_MODULE_14__/* .boundaryFields */ .Q)(f.boundaryContext)
+        : {}),
     };
   },
 };
@@ -1323,7 +3620,7 @@ const _scrubRoot = (sessionRoot, text) => {
   const roots = new Set([node_path__WEBPACK_IMPORTED_MODULE_2__.resolve(sessionRoot)]);
   try { roots.add(node_fs__WEBPACK_IMPORTED_MODULE_0__.realpathSync(node_path__WEBPACK_IMPORTED_MODULE_2__.resolve(sessionRoot))); } catch { /* root vanished: the plain path is still scrubbed */ }
   for (const r of roots) out = out.split(r).join('<root>');
-  return (0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactString */ .rd)(out);
+  return (0,_redact_js__WEBPACK_IMPORTED_MODULE_19__/* .redactString */ .rd)(out);
 };
 const _gateSummary = (g) => (g ? {
   path: g.path ? g.path.ok : undefined, syntax: g.syntax ? g.syntax.ok : undefined,
@@ -1522,7 +3819,7 @@ const apply_fix = {
           // default. Normalized to the scan+lint verdict shape used below.
           const { verifyFixWithTests } = await __webpack_require__.e(/* import() */ 4113).then(__webpack_require__.bind(__webpack_require__, 64113));
           const t = await verifyFixWithTests({ scanRoot: ctx.sessionRoot, originalFindingStableId: f.stableId, files: _files });
-          verdict = { ok: t.ok, summary: t.summary, rescan: t.legs?.scan?.detail, lint: t.legs?.lint?.detail, tests: t.legs?.tests, testVerdict: t.verdict };
+          verdict = { ok: t.ok, summary: t.summary, rescan: t.legs?.scan?.detail, lint: t.legs?.lint?.detail, tests: t.legs?.tests, testVerdict: t.verdict, verificationRecord: t.verificationRecord ?? null };
         } else {
           const verifyFixCore = await getVerifyFixCore();
           verdict = await verifyFixCore({
@@ -1540,6 +3837,9 @@ const apply_fix = {
           _meta: META, applied: false,
           reason: `patch rejected by verifier: ${verdict.summary || verdict.rescan?.reason || 'did not verify'}`,
           verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok }, honesty: verdict.honesty || null },
+          // X-201: the same version-1 verification record every surface emits (additive; null when none could be formed).
+          verificationRecord: verdict.verificationRecord ?? null,
+          ...(0,_posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__/* .verificationFields */ .ze)(verdict.verificationRecord),
         };
       }
       // FR-307/FR-1002/D-0024: this caller-supplied-patch branch writes via
@@ -1560,7 +3860,7 @@ const apply_fix = {
       }
       const materialClassification = (0,_posture_material_change_js__WEBPACK_IMPORTED_MODULE_6__/* .classifyFixMaterialRisk */ .kz)(filesForMaterialClassification);
       if (dry_run) {
-        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, materialClassification };
+        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, verificationRecord: verdict.verificationRecord ?? null, ...(0,_posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__/* .verificationFields */ .ze)(verdict.verificationRecord), materialClassification };
       }
       const approvalRefusal = _highImpactApprovalRefusal(ctx, materialClassification, fixMeta);
       if (approvalRefusal) return approvalRefusal;
@@ -1591,7 +3891,7 @@ const apply_fix = {
       }
       let acceptance = null;
       try { acceptance = (0,_posture_fix_history_js__WEBPACK_IMPORTED_MODULE_4__/* .fixAcceptanceRate */ .XR)(ctx.sessionRoot); } catch { /* best-effort */ }
-      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance, materialClassification };
+      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary, verificationRecord: verdict.verificationRecord ?? null, ...(0,_posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__/* .verificationFields */ .ze)(verdict.verificationRecord) }, acceptance, materialClassification };
     }
 
     if (typeof f.fix?.replacement !== 'string') {
@@ -1680,7 +3980,7 @@ const apply_fix = {
 // proceed with apply_fix.
 const verify_fix = {
   name: 'verify_fix',
-  description: 'Verify a proposed patch before applying. Re-scans the patched files in memory, runs the project linter, runs the project test suite, checks fix honesty (FULL/MITIGATION/WORKAROUND) when fixMeta is supplied, and re-runs the PoC when one exists. Returns { ok, rescan, lint, tests, honesty, poc, summary }. Does not write to the target project’s own files, but DOES append one record per attempt to .agentic-security/fix-metrics.jsonl for the measured fix-loop.',
+  description: 'Verify a proposed patch before applying. Re-scans the patched files in memory, runs the project linter, runs the project test suite, checks fix honesty (FULL/MITIGATION/WORKAROUND) when fixMeta is supplied, and re-runs the PoC when one exists. Returns { ok, rescan, lint, tests, honesty, poc, summary, verificationRecord } (verificationRecord is the shared version-1 record: outcome is one of not-run, unsupported, inconclusive, error, refuted, confirmed, and a static re-scan alone is never reported as confirmed; verificationView is the shared projection every interface shows for it, with state, scope, evidence ids, replay prerequisites and what was and was not verified). Does not write to the target project’s own files, but DOES append one record per attempt to .agentic-security/fix-metrics.jsonl for the measured fix-loop.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -1768,7 +4068,7 @@ const verify_fix = {
         _meta: META,
         ok: r.ok,
         rescan: { ok: r.rescan.ok, reason: r.rescan.reason, introduced: r.rescan.introduced || [] },
-        lint: { runner: r.lint.runner, ok: r.lint.ok, skipped: r.lint.skipped || false, output: (0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactString */ .rd)(r.lint.output || '').slice(0, 1500) },
+        lint: { runner: r.lint.runner, ok: r.lint.ok, skipped: r.lint.skipped || false, output: (0,_redact_js__WEBPACK_IMPORTED_MODULE_19__/* .redactString */ .rd)(r.lint.output || '').slice(0, 1500) },
         // verifyFix computes five legs, not two — tests/honesty/poc were
         // being silently dropped here, leaving an agent with no structured
         // way to see WHY verification failed when the failure was in one
@@ -1779,8 +4079,12 @@ const verify_fix = {
         // it can echo proof-harness detail derived from scanned source.
         tests: r.tests,
         honesty: r.honesty,
-        poc: r.poc ? { ...r.poc, reason: r.poc.reason ? (0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactString */ .rd)(r.poc.reason) : r.poc.reason } : r.poc,
+        poc: r.poc ? { ...r.poc, reason: r.poc.reason ? (0,_redact_js__WEBPACK_IMPORTED_MODULE_19__/* .redactString */ .rd)(r.poc.reason) : r.poc.reason } : r.poc,
         summary: r.summary,
+        // X-201: the one version-1 verification record (additive). It states what was actually established, e.g.
+        // `not-run` when no exploit oracle executed against the patch, never a bare pass/fail.
+        verificationRecord: r.verificationRecord ?? null,
+        ...(0,_posture_verification_projection_js__WEBPACK_IMPORTED_MODULE_13__/* .verificationFields */ .ze)(r.verificationRecord),
       };
     } catch (e) {
       return { _meta: META, ok: false, reason: `verify_fix failed: ${e.message}` };
@@ -2123,7 +4427,7 @@ const append_agents_memory = {
     required: ['agent', 'body'],
   },
   async handler({ agent, body }, ctx) {
-    const r = (0,_posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_16__/* .appendAgentsMemory */ .eu)(ctx.sessionRoot, { agent, body });
+    const r = (0,_posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_20__/* .appendAgentsMemory */ .eu)(ctx.sessionRoot, { agent, body });
     return { _meta: META, ...r };
   },
 };
@@ -2139,7 +4443,7 @@ const read_agents_memory = {
     },
   },
   async handler({ full }, ctx) {
-    const body = (0,_posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_16__/* .readAgentsMemory */ .ox)(ctx.sessionRoot);
+    const body = (0,_posture_agents_memory_js__WEBPACK_IMPORTED_MODULE_20__/* .readAgentsMemory */ .ox)(ctx.sessionRoot);
     if (!body) return { _meta: META, present: false };
     if (full) return { _meta: META, present: true, length: body.length, content: body };
     // Tail-only — same logic as summarizeForSession but inlined to avoid a
@@ -2183,7 +4487,7 @@ const query_triage_memory = {
     // they landed in, rather than hardcoding a field allowlist that could
     // miss one.
     let results;
-    try { results = JSON.parse((0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactString */ .rd)(JSON.stringify(raw))); }
+    try { results = JSON.parse((0,_redact_js__WEBPACK_IMPORTED_MODULE_19__/* .redactString */ .rd)(JSON.stringify(raw))); }
     catch { results = raw; }
     return {
       _meta: META,
@@ -2219,7 +4523,7 @@ const query_findings_memory = {
     // whole-structure redactString round-trip is applied rather than a
     // per-field allowlist that could miss one of the four shapes.
     let body;
-    try { body = JSON.parse((0,_redact_js__WEBPACK_IMPORTED_MODULE_15__/* .redactString */ .rd)(JSON.stringify(raw))); }
+    try { body = JSON.parse((0,_redact_js__WEBPACK_IMPORTED_MODULE_19__/* .redactString */ .rd)(JSON.stringify(raw))); }
     catch { body = raw; }
     return { _meta: META, ...body };
   },
@@ -2241,7 +4545,7 @@ const lookup_cve = {
     required: ['cve'],
   },
   async handler({ cve }, _ctx) {
-    const r = (0,_posture_cve_lookup_js__WEBPACK_IMPORTED_MODULE_17__/* .lookupCve */ .x)(cve);
+    const r = (0,_posture_cve_lookup_js__WEBPACK_IMPORTED_MODULE_21__/* .lookupCve */ .x)(cve);
     return { _meta: META, ...r };
   },
 };
@@ -2346,7 +4650,12 @@ const apply_sca_upgrade = {
   },
 };
 
-const ALL_TOOLS = [scan_diff, query_taint, explain_finding, apply_fix, verify_fix, synthesize_fix, find_rule_module, append_scratchpad, read_scratchpad, append_agents_memory, read_agents_memory, lookup_cve, synthesize_sca_upgrade, apply_sca_upgrade, query_triage_memory, query_findings_memory, query_cache_telemetry, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_14__/* .dataflow_get_graph */ .HX, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_14__/* .dataflow_get_node */ .HI, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_14__/* .dataflow_get_edge */ .gC, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_14__/* .dataflow_get_flow */ .ri];
+// X-407: read-only scenario export; the factory takes this file's confinement so the two modules do not import each other.
+const { invariant_scenario_export } = (0,_invariant_tools_js__WEBPACK_IMPORTED_MODULE_17__/* .makeInvariantTools */ ._)({ confine: _confine, META });
+// X-707: read-only portfolio progress view, same factory shape.
+const { portfolio_progress } = (0,_portfolio_tools_js__WEBPACK_IMPORTED_MODULE_18__/* .makePortfolioTools */ ._)({ confine: _confine, META });
+
+const ALL_TOOLS = [scan_diff, query_taint, explain_finding, apply_fix, verify_fix, synthesize_fix, find_rule_module, append_scratchpad, read_scratchpad, append_agents_memory, read_agents_memory, lookup_cve, synthesize_sca_upgrade, apply_sca_upgrade, query_triage_memory, query_findings_memory, query_cache_telemetry, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_16__/* .dataflow_get_graph */ .HX, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_16__/* .dataflow_get_node */ .HI, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_16__/* .dataflow_get_edge */ .gC, _dataflow_tools_js__WEBPACK_IMPORTED_MODULE_16__/* .dataflow_get_flow */ .ri, invariant_scenario_export, portfolio_progress];
 
 __webpack_async_result__();
 } catch(e) { __webpack_async_result__(e); } });