@clear-capabilities/agentic-security-scanner 0.162.0 → 0.163.0

package/src/capabilities/decide.js

@@ -0,0 +1,256 @@
+// Deterministic capability decisions (X-501.AC02, X-501.AC03).
+//
+// `decide(bound, action, ctx)` answers one question: does this task's bound
+// manifest permit this one action? The answer is a frozen
+// `{ decision, code, reason, kind, subject, taskId, manifestDigest }`:
+//
+//   - deny-by-default: the answer is `allow` only when a specific declared grant
+//     covers the action; every other path, including every error, is `deny`
+//   - deterministic: no clock, no randomness, no environment; the same bound
+//     manifest, action and context give the same answer (the filesystem is read
+//     only to resolve symbolic links and to look at an executable)
+//   - sanitized: `code` comes from the closed table in reasons.js and `reason` is
+//     the fixed sentence beside it; the one request-derived field, `subject`, is
+//     redacted and length-capped
+//   - fail-closed: an unknown action kind, a binding that does not match, an
+//     argument list that is not plain strings, a path that cannot be resolved,
+//     an interpreter that is not declared as one: all `deny`
+//
+// This is a POLICY decision. Whether the operating system then actually stops the
+// task from doing what the decision denied is the runner's job (runner.js), and
+// only the runner may claim enforcement. A hook or an in-process check that calls
+// this function explains; it does not enforce.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { detectSecretShapes } from './secrets.js';
+import { CAPABILITY_KINDS } from '../posture/assurance/contracts.js';
+import { reasonText, sanitizeSubject } from './reasons.js';
+import { lexicalPath, canonicalPath, isWithin } from './paths.js';
+import { normalizeHost, classifyAddress } from './address.js';
+import { deriveChild } from './manifest.js';
+
+const MAX_ARGS = 256;
+const MAX_ARG_LEN = 8192;
+
+// Executables that run code supplied elsewhere (their arguments, a script file,
+// standard input): shells, language runtimes, launchers and build drivers. A
+// shell allowlist cannot see through any of them, so each is refused unless the
+// manifest declares it as a scoped interpreter with its exact argument list.
+const INTERPRETER_NAMES = new Set([
+  'sh', 'bash', 'zsh', 'dash', 'ksh', 'csh', 'tcsh', 'fish', 'ash', 'busybox', 'env', 'xargs', 'nice', 'nohup',
+  'time', 'timeout', 'sudo', 'doas', 'su', 'ssh', 'osascript', 'launchctl', 'script', 'expect', 'tclsh', 'wish',
+  'awk', 'gawk', 'mawk', 'nawk', 'java', 'jshell', 'deno', 'bun', 'nodejs', 'swift', 'make', 'gmake',
+  'npm', 'npx', 'yarn', 'pnpm', 'pip', 'pip3', 'pipx', 'gem', 'bundle', 'cargo', 'go', 'gradle', 'mvn', 'watch',
+]);
+const INTERPRETER_FAMILY = /^(?:python|pypy|ruby|perl|php|lua|luajit|node|tclsh)[0-9.]*$/;
+
+/**
+ * What kind of executable this is. `interpreter` is true for a known shell or
+ * runtime by name, and for any file that starts with a `#!` line (a script,
+ * whatever it is called). A name is a hint, the shebang is the file's own word.
+ */
+export function classifyExecutable(realPath) {
+  const base = path.basename(realPath).toLowerCase();
+  if (INTERPRETER_NAMES.has(base) || INTERPRETER_FAMILY.test(base)) return { interpreter: true, via: 'name' };
+  let fd;
+  try {
+    fd = fs.openSync(realPath, 'r');
+    const buf = Buffer.alloc(2);
+    const n = fs.readSync(fd, buf, 0, 2, 0);
+    if (n === 2 && buf[0] === 0x23 && buf[1] === 0x21) return { interpreter: true, via: 'shebang' };
+  } catch { /* unreadable: handled by the caller's stat check */ } finally {
+    if (fd !== undefined) { try { fs.closeSync(fd); } catch { /* ignore */ } }
+  }
+  return { interpreter: false, via: null };
+}
+
+function result(bound, action, decision, code, subject) {
+  return Object.freeze({
+    decision, code, reason: reasonText(code), kind: typeof action?.kind === 'string' ? sanitizeSubject(action.kind, 40) : 'unknown',
+    subject: sanitizeSubject(subject), taskId: bound?.binding?.taskId ?? null, manifestDigest: bound?.binding?.digest ?? null,
+  });
+}
+
+function argsDigest(args) {
+  return crypto.createHash('sha256').update(JSON.stringify(args)).digest('hex').slice(0, 12);
+}
+
+// ---------------------------------------------------------------- filesystem
+
+function decideFilesystem(bound, action, ctx) {
+  const write = action.kind === 'filesystem-write';
+  const subject = typeof action.path === 'string' ? action.path : '(not a string)';
+  const lex = lexicalPath(action.path);
+  if (!lex.ok) return result(bound, action, 'deny', 'path-invalid', subject);
+  // Any parent-directory segment is refused outright. Lexical normalization of
+  // `link/..` disagrees with what the kernel does when `link` is a symlink, so
+  // a path containing one cannot be judged by its normalized form.
+  if (lex.dotdot) return result(bound, action, 'deny', 'path-traversal', subject);
+  const real = canonicalPath(lex.path);
+  if (!real) return result(bound, action, 'deny', 'path-invalid', subject);
+
+  for (const p of ctx.protectedPaths || []) {
+    const pl = lexicalPath(p);
+    if (!pl.ok) continue;
+    const pr = canonicalPath(pl.path) ?? pl.path;
+    if (isWithin(real, pr) || isWithin(lex.path, pl.path)) return result(bound, action, 'deny', 'protected-path', subject);
+  }
+  const fsGrants = bound.manifest.filesystem;
+  const roots = write ? fsGrants.write : [...fsGrants.read, ...fsGrants.write];
+  if (!roots.length) return result(bound, action, 'deny', 'no-grant', subject);
+  const lexicallyIn = roots.some((r) => isWithin(lex.path, r));
+  if (!lexicallyIn) return result(bound, action, 'deny', 'outside-roots', subject);
+  const really = roots.some((r) => isWithin(real, canonicalPath(r) ?? r));
+  if (!really) return result(bound, action, 'deny', 'symlink-escape', subject);
+  return result(bound, action, 'allow', 'allowed', subject);
+}
+
+// ---------------------------------------------------------------- commands
+
+function decideCommand(bound, action, ctx) {
+  const exe = action.executable;
+  const args = action.args === undefined ? [] : action.args;
+  const subjectBase = typeof exe === 'string' ? exe : '(not a string)';
+  const lexExe = lexicalPath(exe);
+  if (!lexExe.ok || lexExe.dotdot) return result(bound, action, 'deny', 'executable-not-absolute', subjectBase);
+  if (!Array.isArray(args) || args.length > MAX_ARGS || !args.every((a) => typeof a === 'string' && a.length <= MAX_ARG_LEN && !a.includes('\0'))) {
+    return result(bound, action, 'deny', 'args-invalid', `${subjectBase} (malformed arguments)`);
+  }
+  const subject = `${subjectBase} (${args.length} args, args sha256:${argsDigest(args)})`;
+
+  // Arguments are visible to every process on the host and to every descendant.
+  // A secret does not belong in one, whatever command it is handed to.
+  const canaries = (ctx.canaries || []).filter((c) => typeof c === 'string' && c.length >= 6);
+  for (const a of args) {
+    let secret = false;
+    try { secret = detectSecretShapes(a); } catch { secret = true; }
+    if (secret || canaries.some((c) => a.includes(c))) return result(bound, action, 'deny', 'secret-in-argument', subject);
+  }
+
+  let real; let st;
+  try { real = fs.realpathSync(lexExe.path); st = fs.statSync(real); } catch { return result(bound, action, 'deny', 'executable-unresolvable', subject); }
+  if (!st.isFile()) return result(bound, action, 'deny', 'executable-unresolvable', subject);
+  try { fs.accessSync(real, fs.constants.X_OK); } catch { return result(bound, action, 'deny', 'executable-unresolvable', subject); }
+
+  for (const w of bound.manifest.filesystem.write) {
+    if (isWithin(real, canonicalPath(w) ?? w)) return result(bound, action, 'deny', 'executable-in-writable-root', subject);
+  }
+
+  const entries = bound.manifest.commands.filter((c) => (canonicalPath(c.executable) ?? c.executable) === real);
+  if (!entries.length) return result(bound, action, 'deny', 'command-not-listed', subject);
+
+  const cls = classifyExecutable(real);
+  const matches = (e) => {
+    const v = e.args.values;
+    if (e.args.mode === 'any') return true;
+    if (e.args.mode === 'exact') return v.length === args.length && v.every((x, i) => x === args[i]);
+    return args.length >= v.length && v.every((x, i) => x === args[i]);
+  };
+  const argOk = entries.filter(matches);
+  if (!argOk.length) {
+    // An interpreter whose entries pin different arguments is the unpinned case.
+    if (cls.interpreter && !entries.some((e) => e.interpreter)) return result(bound, action, 'deny', 'interpreter-blocked', subject);
+    return result(bound, action, 'deny', 'args-not-permitted', subject);
+  }
+  if (cls.interpreter) {
+    const scoped = argOk.find((e) => e.interpreter === 'scoped');
+    if (!scoped) return result(bound, action, 'deny', 'interpreter-blocked', subject);
+    if (scoped.args.mode !== 'exact') return result(bound, action, 'deny', 'interpreter-args-unpinned', subject);
+  }
+  return result(bound, action, 'allow', 'allowed', subject);
+}
+
+// ---------------------------------------------------------------- network
+
+function hostMatches(entryHost, host) {
+  if (entryHost === host) return true;
+  if (!entryHost.startsWith('*.')) return false;
+  const base = entryHost.slice(2);
+  return host !== base && host.endsWith(`.${base}`);
+}
+
+function decideNetwork(bound, action) {
+  const h = normalizeHost(action.host);
+  const subject = typeof action.host === 'string' ? `${action.scheme ?? '?'}://${action.host}:${action.port ?? '?'}` : '(not a string)';
+  if (!h.ok) return result(bound, action, 'deny', 'host-invalid', subject);
+  if (!Number.isInteger(action.port) || action.port < 1 || action.port > 65535) return result(bound, action, 'deny', 'port-invalid', subject);
+  const scheme = action.scheme === undefined ? 'https' : action.scheme;
+  if (scheme !== 'http' && scheme !== 'https') return result(bound, action, 'deny', 'scheme-not-declared', subject);
+  const onHost = bound.manifest.network.filter((d) => hostMatches(d.host, h.host));
+  if (!onHost.length) return result(bound, action, 'deny', 'destination-not-declared', subject);
+  const onPort = onHost.filter((d) => d.port === action.port);
+  if (!onPort.length) return result(bound, action, 'deny', 'port-not-declared', subject);
+  const onScheme = onPort.filter((d) => d.schemes.includes(scheme));
+  if (!onScheme.length) return result(bound, action, 'deny', 'scheme-not-declared', subject);
+
+  // Address checks apply to a host NAME once it has been resolved. The caller
+  // (the proxy) resolves once, passes the addresses here and connects to those
+  // same addresses, so what is checked is what is connected to.
+  const resolved = Array.isArray(action.resolvedAddresses) ? action.resolvedAddresses : null;
+  if (h.kind === 'name' && resolved) {
+    if (!resolved.length) return result(bound, action, 'deny', 'dns-private-address', subject);
+    const verdicts = onScheme.map((d) => {
+      if (d.addresses && !resolved.every((a) => d.addresses.includes(a))) return 'dns-changed';
+      if (!d.allowPrivateResolution && resolved.some((a) => classifyAddress(a) !== 'public')) return 'dns-private-address';
+      return 'ok';
+    });
+    if (!verdicts.includes('ok')) return result(bound, action, 'deny', verdicts.includes('dns-changed') ? 'dns-changed' : 'dns-private-address', subject);
+  }
+  return result(bound, action, 'allow', 'allowed', subject);
+}
+
+// ---------------------------------------------------------------- tools, delegation
+
+function decideTool(bound, action) {
+  const subject = typeof action.tool === 'string' ? action.tool : '(not a string)';
+  if (typeof action.tool !== 'string' || !bound.manifest.tools.includes(action.tool)) return result(bound, action, 'deny', 'tool-not-declared', subject);
+  return result(bound, action, 'allow', 'allowed', subject);
+}
+
+function decideDelegation(bound, action) {
+  const d = bound.manifest.delegation;
+  const depth = Number.isInteger(action.depth) && action.depth >= 0 ? action.depth : 0;
+  const subject = `delegation at depth ${depth}`;
+  if (!d.allow) return result(bound, action, 'deny', 'delegation-not-allowed', subject);
+  if (depth >= d.maxDepth) return result(bound, action, 'deny', 'delegation-depth', subject);
+  if (action.request !== undefined) {
+    const child = deriveChild(bound.manifest, action.request);
+    if (!child.ok) return result(bound, action, 'deny', 'scope-expansion', subject);
+  }
+  return result(bound, action, 'allow', 'allowed', subject);
+}
+
+/**
+ * @param {{manifest: object, binding: object}} bound   from `bindManifest`
+ * @param {object} action  `{ kind, ... }`; kind is one of CAPABILITY_KINDS
+ * @param {object} ctx
+ * @param {{taskId:string, revision:string, policyVersion:number}} ctx.binding  what the caller believes it is acting for
+ * @param {string[]} [ctx.protectedPaths]  paths no task may touch, whatever the manifest says
+ * @param {string[]} [ctx.canaries]        values that must never appear in an argument
+ */
+export function decide(bound, action, ctx = {}) {
+  if (!bound || !bound.manifest || !bound.binding) return result(bound, action, 'deny', 'invalid-manifest', '(no manifest)');
+  const b = ctx.binding;
+  const bb = bound.binding;
+  if (!b || b.taskId !== bb.taskId || b.revision !== bb.revision || b.policyVersion !== bb.policyVersion) {
+    return result(bound, action, 'deny', 'binding-mismatch', '(binding)');
+  }
+  if (!action || typeof action !== 'object' || Array.isArray(action) || !CAPABILITY_KINDS.includes(action.kind)) {
+    return result(bound, action, 'deny', 'unknown-action', typeof action?.kind === 'string' ? action.kind : '(no kind)');
+  }
+  try {
+    switch (action.kind) {
+      case 'filesystem-read':
+      case 'filesystem-write': return decideFilesystem(bound, action, ctx);
+      case 'command': return decideCommand(bound, action, ctx);
+      case 'network': return decideNetwork(bound, action);
+      case 'tool': return decideTool(bound, action);
+      case 'delegation': return decideDelegation(bound, action);
+      default: return result(bound, action, 'deny', 'unknown-action', action.kind);
+    }
+  } catch {
+    // A decision never throws. An unexpected failure is a denial.
+    return result(bound, action, 'deny', 'invalid-manifest', '(decision failed)');
+  }
+}

package/src/capabilities/delegate.js

@@ -0,0 +1,69 @@
+// Delegation under the capability policy (X-505.AC02).
+//
+// A task that hands work to another agent gives it a CHILD manifest, and a child
+// can only be a subset of its parent. `delegate` is the one door:
+//
+//   1. the parent's own manifest must allow delegation at all, and the delegation
+//      depth is read from the manifest chain (every hop must carry a strictly
+//      lower `maxDepth`), never from a depth the requester claims
+//   2. the request is derived through `deriveChild`: any widening of roots,
+//      commands, destinations, tools, limits, delegation, revision or policy
+//      version is `SCOPE_EXPANSION` and yields NO manifest (no partial grant)
+//   3. tool names are compared exactly, so an alias (another case, a prefix, a
+//      namespaced spelling) is a different, undeclared tool and is refused
+//   4. a child task id is issued once: asking again with the same id is
+//      idempotent when the request is identical and refused when it differs, so
+//      a retry with changed instructions cannot swap in a wider grant
+//
+// What a child is told in prose does not matter to any of this: the manifest is
+// derived once, frozen, and bound to the child's own task id, revision, policy
+// version and digest.
+import { bindManifest, deriveChild } from './manifest.js';
+import { mediate } from './recovery.js';
+import { reasonText } from './reasons.js';
+import { digestOf } from '../posture/assurance/identity.js';
+
+/** Remembers which child ids were issued for which manifest digest. Held by the delegating controller. */
+export function createDelegationRegistry() {
+  const issued = new Map();
+  return Object.freeze({
+    get: (id) => issued.get(id) ?? null,
+    set: (id, digest) => { issued.set(id, digest); },
+    size: () => issued.size,
+  });
+}
+
+function refuse(code, base) {
+  return Object.freeze({
+    ok: false, status: 'blocked', code, reason: reasonText(code), child: null, errors: [],
+    decision: base?.decision ?? null, proposal: base?.proposal ?? null, missing: base?.missing ?? null,
+    attemptsRemaining: base?.attemptsRemaining ?? null,
+  });
+}
+
+/**
+ * @param {{manifest: object, binding: object}} parent   the delegating task's bound manifest
+ * @param {object} request     manifest-shaped, `taskId` required (see `deriveChild`)
+ * @param {object} o
+ * @param {{taskId:string,revision:string,policyVersion:number}} o.binding  identity the caller acts for
+ * @param {object} [o.registry]  from `createDelegationRegistry`
+ * @param {object} [o.guard]     denial guard (recovery.js)
+ */
+export function delegate(parent, request, { binding, registry, guard } = {}) {
+  // Depth comes from the manifest chain; the request cannot claim a shallower one.
+  const m = mediate(parent, { kind: 'delegation', depth: 0, request }, { binding }, { guard });
+  if (m.status !== 'ok') return refuse(m.decision.code, m);
+  const derived = deriveChild(parent.manifest, request);
+  if (!derived.ok) return Object.freeze({ ...refuse('scope-expansion', m), errors: derived.errors.map((e) => ({ code: e.code, path: e.path })) });
+  const bound = bindManifest(derived.manifest);
+  if (!bound.ok) return Object.freeze({ ...refuse('invalid-manifest', m), errors: bound.errors.map((e) => ({ code: e.code, path: e.path })) });
+  if (registry) {
+    const prior = registry.get(bound.bound.binding.taskId);
+    if (prior !== null && prior !== bound.bound.binding.digest) return refuse('scope-expansion', m);
+    registry.set(bound.bound.binding.taskId, bound.bound.binding.digest);
+  }
+  return Object.freeze({
+    ok: true, status: 'ok', code: null, reason: null, errors: [], decision: m.decision,
+    child: bound.bound, parentTaskId: parent.binding.taskId, requestDigest: digestOf(request),
+  });
+}

package/src/capabilities/egress.js

@@ -0,0 +1,20 @@
+// Manifest-aware egress decisions (X-501: manifests are consumed by the egress
+// policy). A call to a declared model endpoint must satisfy BOTH the task's
+// network grant and the operator's egress policy (egress/policy.js); either one
+// denying is a denial, and the result names which one. No payload is involved,
+// so the decision is as safe to log as any other.
+import { decide } from './decide.js';
+import { evaluateEgress } from '../egress/policy.js';
+
+export function evaluateManifestEgress(bound, binding, egressCtx = {}) {
+  let u;
+  try { u = new URL(String(egressCtx.endpoint)); } catch { u = null; }
+  if (!u) return Object.freeze({ allowed: false, by: 'capability-manifest', code: 'host-invalid' });
+  const port = u.port ? Number(u.port) : (u.protocol === 'http:' ? 80 : 443);
+  const scheme = u.protocol === 'http:' ? 'http' : 'https';
+  const d = decide(bound, { kind: 'network', host: u.hostname, port, scheme }, { binding });
+  if (d.decision !== 'allow') return Object.freeze({ allowed: false, by: 'capability-manifest', code: d.code });
+  const e = evaluateEgress(egressCtx);
+  if (!e.allowed) return Object.freeze({ allowed: false, by: 'egress-policy', code: 'egress-denied', policy: e });
+  return Object.freeze({ allowed: true, by: null, code: 'allowed', policy: e });
+}

package/src/capabilities/hook-advice.js

@@ -0,0 +1,50 @@
+// What a hook says about a tool use (X-505.AC01).
+//
+// The pre-edit, pre-bash and dispatch hooks, and the MCP tool gate, ask the SAME
+// function (`decide`) the runner asks. A hook's answer is advice: the record is
+// `hook-advisory`, `enforced` is always false, and a hook never blocks on it. The
+// runner is what stops a task; a hook only explains why it would.
+//
+// Tool names here are the names the HOST agent uses (`mcp__<server>__<tool>`,
+// `Task`, `Edit` ...), compared exactly. The MCP server's own gate sees the short
+// tool names. A manifest declares the spelling it means; there is no aliasing, so
+// `mcp__other__apply_fix` is not `apply_fix`.
+import { advise } from './records.js';
+
+const EDIT_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit']);
+const DELEGATE_TOOLS = new Set(['Task', 'Agent']);
+
+/** The capability action a host tool use amounts to, or null when this layer has no opinion. */
+export function actionForToolUse(evt) {
+  const tool = evt && (evt.tool_name || evt.toolName);
+  const input = (evt && evt.tool_input) || {};
+  if (typeof tool !== 'string') return null;
+  if (EDIT_TOOLS.has(tool)) {
+    const p = input.file_path ?? input.notebook_path;
+    return { kind: 'filesystem-write', path: typeof p === 'string' ? p : undefined };
+  }
+  if (tool === 'Bash') return { kind: 'command', command: typeof input.command === 'string' ? input.command : '' };
+  if (DELEGATE_TOOLS.has(tool)) return { kind: 'delegation', depth: 0 };
+  if (tool.startsWith('mcp__')) return { kind: 'tool', tool };
+  return null;
+}
+
+/**
+ * @param {{manifest:object,binding:object}} bound
+ * @param {object} evt   a PreToolUse event
+ * @param {{binding: object}} ctx  the identity the session claims
+ * @returns {{advisory:true, enforced:false, decision:string, code:string, lines:string[], record:object|null}|null}
+ */
+export function adviseToolUse(bound, evt, ctx) {
+  const action = actionForToolUse(evt);
+  if (!action) return null;
+  const a = advise(bound, action, ctx);
+  const tool = String(evt.tool_name || evt.toolName);
+  const lines = [];
+  if (a.decision !== 'allow') {
+    lines.push(`agentic-security capability advisory (not enforced): ${tool} -> ${a.decision} (${a.code})`);
+    lines.push(`  ${a.note}`);
+    if (action.kind === 'delegation') lines.push('  a delegated agent can only receive a subset of this task\'s capabilities (capabilities/delegate.js)');
+  }
+  return Object.freeze({ advisory: true, enforced: false, decision: a.decision, code: a.code, lines, record: a.record });
+}

package/src/capabilities/index.js

@@ -0,0 +1,32 @@
+// Public surface of the capability facility (X-501 to X-504). Consumers import
+// from here; nothing in the default scan or report path does.
+export {
+  MANIFEST_SCHEMA, MANIFEST_SCHEMA_VERSION, ARG_MODES, RESOURCE_RANGES,
+  validateManifest, bindManifest, manifestDigest, deriveChild,
+} from './manifest.js';
+export { decide, classifyExecutable } from './decide.js';
+export { REASONS, REASON_CODES, reasonText, sanitizeSubject } from './reasons.js';
+export { toCapabilityDecisionRecord, advise } from './records.js';
+export { redactOutbound, sanitizeLogText, destinationClass, denialRecord, recordNetworkDenial } from './outbound.js';
+export { startMediationProxy } from './proxy.js';
+export {
+  CAPABILITY_CONTROLS, probeCapabilityControls, requiredControlsFor, isAdvertisedBackend, platformStatements,
+  resetCapabilityProbeCache,
+} from './probes.js';
+export { buildCapabilityReport, REPORT_LIMITATIONS } from './report.js';
+export { runCapabilityTask } from './runner.js';
+export { evaluateManifestEgress } from './egress.js';
+// X-505 to X-508.
+export { TOOL_CAPABILITIES, toolCapabilityFor, isMutatingOrExternal } from './tool-registry.js';
+export { createToolGate, featureEnabledByOperator } from './tool-gate.js';
+export { delegate, createDelegationRegistry } from './delegate.js';
+export { actionForToolUse, adviseToolUse } from './hook-advice.js';
+export {
+  proposeChange, mediate, createDenialGuard, signPolicyGrant, applyPolicyChange, applyChangeToManifest, createPolicyLedger,
+  verifyLedgerEntries, DEFAULT_RETRY_LIMIT, MAX_RETRY_LIMIT,
+} from './recovery.js';
+export {
+  createReceiptRecorder, receiptsFromRun, verifyChainIntegrity, assessCompleteness, signReceiptChain, verifyReceiptEnvelope,
+  receiptReport, receiptDirectoryConflict, writeReceiptEnvelope, readReceiptEnvelope,
+} from './receipts.js';
+export { ATTACK_CLASSES, KNOWN_LIMITS, buildAttackCoverage, enforcedModeReleaseGate } from './attack-coverage.js';