@clear-capabilities/agentic-security-scanner 0.172.0 → 0.173.0

package/dist/6579.index.js

@@ -0,0 +1,271 @@
+export const id = 6579;
+export const ids = [6579];
+export const modules = {
+
+/***/ 56579:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  buildViews: () => (/* binding */ buildViews),
+  renderHtml: () => (/* binding */ renderHtml),
+  renderText: () => (/* binding */ renderText)
+});
+
+// UNUSED EXPORTS: buildCanonicalFindings
+
+// EXTERNAL MODULE: external "node:crypto"
+var external_node_crypto_ = __webpack_require__(77598);
+;// CONCATENATED MODULE: ./src/posture/assurance/release-verdict.js
+// The release verdict (E7-08): a deterministic function from a release package to one of three answers, with every reason in plain words.
+//
+//   not_deployable   a condition the policy treats as blocking is present: an unfinished scan, files that were not scanned, an analyzer that timed out or failed,
+//                    a fix that was claimed and not verified, an open finding that is proven exploitable, an open high or critical finding
+//   needs_review     nothing blocks, but something is unknown and a person has to decide: a signal the context analysis could not settle, runtime evidence that
+//                    came from a different build, a finding of unproven exploitability that is high or critical
+//   deployable       none of the above. This is NOT a statement that the release is safe; it says no blocking or unknown condition was found in the evidence the package holds
+//
+// The word "safe" is never produced. The verdict is a function of the package alone (no clock, no environment), so the same package gives the same verdict and the same
+// reasons in the same order, and a stated verdict that differs from the one recomputed here is refused (`verifyStatedVerdict`).
+//
+// WHAT COUNTS AS A BLOCKER is the policy below, not a judgement made per release. Waived findings (a waiver the package lists as honoured) do not block but are listed.
+const SEV_BLOCK = new Set(['critical', 'high']);
+
+const asArray = (v) => (Array.isArray(v) ? v : []);
+const by = (pkg, kind) => asArray(pkg && pkg.evidence).filter((e) => e && e.ref && e.ref.kind === kind);
+
+/**
+ * @param {object} pkg a release package
+ * @param {{waivedIds?:string[]}} [opts] finding ids covered by an honoured waiver
+ * @returns {{verdict:'not_deployable'|'needs_review'|'deployable', blockers:{code:string, message:string, evidence:string[]}[], unknowns:{code:string, message:string, evidence:string[]}[], waived:string[], statement:string}}
+ */
+function releaseVerdict(pkg, { waivedIds = [] } = {}) {
+  const blockers = []; const unknowns = [];
+  const block = (code, message, evidence = []) => blockers.push({ code, message, evidence });
+  const unk = (code, message, evidence = []) => unknowns.push({ code, message, evidence });
+  const waived = new Set(waivedIds);
+
+  // ---- the scan itself
+  const health = by(pkg, 'scan-health')[0];
+  if (!health) block('NO_SCAN_HEALTH', 'the package holds no scan health, so nothing says the scan finished');
+  else {
+    const h = health.payload || {}; const ev = [health.ref.digest];
+    if (h.status !== 'complete') block('SCAN_INCOMPLETE', `the scan did not finish cleanly (status ${JSON.stringify(h.status ?? 'unknown')}): ${asArray(h.conditions).join('; ') || 'no reason was recorded'}`, ev);
+    const f = h.files || {};
+    if (Number.isFinite(f.expected) && Number.isFinite(f.scanned) && f.scanned < f.expected) block('FILES_NOT_SCANNED', `${f.expected - f.scanned} of ${f.expected} files were not scanned`, ev);
+    else if (Number.isFinite(f.unanalysed) ? f.unanalysed > 0 : (Number.isFinite(f.skipped) && f.skipped > 0)) block('FILES_SKIPPED', `${Number.isFinite(f.unanalysed) ? f.unanalysed : f.skipped} file(s) were skipped (too large or too dense to analyse)`, ev);
+    if (Number.isFinite(f.timedOut) && f.timedOut > 0) block('FILES_TIMED_OUT', `${f.timedOut} file(s) exceeded the per-file analysis time`, ev);
+    const a = h.analyzers || {};
+    if (Number.isFinite(a.timedOut) && a.timedOut > 0) block('ANALYZER_TIMED_OUT', `${a.timedOut} analyzer(s) timed out, so what they would have found is not in this result`, ev);
+    if (Number.isFinite(a.failed) && a.failed > 0 && !(Number.isFinite(a.timedOut) && a.failed === a.timedOut)) block('ANALYZER_FAILED', `${a.failed} analyzer(s) failed, so what they would have found is not in this result`, ev);
+    if (h.deepAnalysis && Array.isArray(h.deepAnalysis.incomplete) && h.deepAnalysis.incomplete.length) unk('DEEP_ANALYSIS_INCOMPLETE', `deep analysis stopped short: ${h.deepAnalysis.incomplete.map((x) => `${x.reason} x${x.count}`).join(', ')}`, ev);
+  }
+
+  // ---- findings and fixes
+  const fixes = by(pkg, 'fix-verification');
+  const fixFor = (id) => fixes.filter((x) => x.payload && (x.payload.findingStableId === id || x.payload.findingId === id));
+  for (const e of by(pkg, 'finding')) {
+    const f = e.payload || {}; const id = e.ref.payloadId || f.stableId || f.id; const ev = [e.ref.digest];
+    const triage = f.triage && f.triage.state;
+    const falsePositive = triage === 'false_positive' || f.falsePositive === true;
+    const myFixes = fixFor(id); const fixed = myFixes.find((x) => x.payload.verifiedFull === true);
+    if (waived.has(id)) continue;
+    if (falsePositive) {
+      if (!(f.triage && f.triage.by && f.triage.reason)) unk('FALSE_POSITIVE_UNJUSTIFIED', `finding ${id} is marked a false positive without a named person and a reason`, ev);
+      continue;
+    }
+    for (const x of myFixes) if (x.payload.verifiedFull !== true) block('FIX_NOT_VERIFIED', `a fix for ${id} is claimed but was not fully verified (${asArray(x.payload.degradedLegs).map((d) => (typeof d === 'string' ? d : d && d.leg)).filter(Boolean).join(', ') || 'checks did not all pass'})`, [...ev, x.ref.digest]);
+    if (fixed) continue;
+    const sev = String(f.severity || 'info'); const tier = typeof f.proofTier === 'string' ? f.proofTier : 'unproven';
+    const ci = f.contextIntelligence && (f.contextIntelligence.counterexample && f.contextIntelligence.counterexample.state || f.contextIntelligence.state);
+    if (tier === 'execution-proven') block('PROVEN_OPEN_FINDING', `finding ${id} (${sev}) is proven exploitable and is open`, ev);
+    else if (SEV_BLOCK.has(sev)) {
+      if (ci === 'unresolved' || ci === 'plausible') unk('CONTEXT_SIGNAL_UNSETTLED', `finding ${id} (${sev}) rests on a context signal the analysis could not settle (${ci}); a person has to decide whether it is real`, ev);
+      else block('OPEN_HIGH_FINDING', `finding ${id} is open at severity ${sev}`, ev);
+    } else if (ci === 'unresolved' || ci === 'plausible') unk('CONTEXT_SIGNAL_UNSETTLED', `finding ${id} rests on a context signal the analysis could not settle (${ci})`, ev);
+  }
+
+  // ---- runtime evidence from another build
+  for (const e of by(pkg, 'runtime-explanation')) {
+    const edges = asArray(e.payload && e.payload.runtime && e.payload.runtime.edges); const bad = edges.filter((x) => Number(x.mismatchedRecords) > 0);
+    if (bad.length) unk('RUNTIME_BUILD_MISMATCH', `runtime records for ${bad.length} edge(s) of ${e.ref.payloadId || 'a finding'} came from a different build than the one released, so they say nothing about this release and are not counted as corroboration`, [e.ref.digest]);
+    const miss = asArray(e.payload && e.payload.runtime && e.payload.runtime.missingObservations);
+    if (!bad.length && miss.length && e.payload.compare && e.payload.compare.state !== 'corroborated') unk('RUNTIME_NOT_CORROBORATED', `runtime evidence for ${e.ref.payloadId || 'a finding'} does not corroborate the path: ${miss[0]}`, [e.ref.digest]);
+  }
+
+  blockers.sort((a, b) => (a.code + a.message < b.code + b.message ? -1 : 1)); unknowns.sort((a, b) => (a.code + a.message < b.code + b.message ? -1 : 1));
+  const verdict = blockers.length ? 'not_deployable' : unknowns.length ? 'needs_review' : 'deployable';
+  const statement = verdict === 'deployable'
+    ? 'No blocking or unknown condition was found in the evidence this package holds. That is not a statement that the release is safe.'
+    : verdict === 'needs_review' ? `Nothing blocks the release, but ${unknowns.length} thing(s) are unknown and a person has to decide.` : `${blockers.length} condition(s) block the release.`;
+  return { verdict, blockers, unknowns, waived: [...waived].sort(), statement };
+}
+
+/** Is the verdict a package states the one its own contents give? @returns {{ok:boolean, stated:string|null, computed:string, message:string|null}} */
+function verifyStatedVerdict(pkg, opts) {
+  const computed = releaseVerdict(pkg, opts).verdict;
+  const decisions = asArray(pkg && pkg.policy && pkg.policy.decisions);
+  const d = decisions.find((x) => x && x.id === 'release-verdict');
+  const stated = d ? d.outcome : null;
+  if (stated === null) return { ok: false, stated, computed, message: 'the package states no release verdict' };
+  if (stated !== computed) return { ok: false, stated, computed, message: `the package states "${stated}" but its own contents give "${computed}"` };
+  return { ok: true, stated, computed, message: null };
+}
+
+;// CONCATENATED MODULE: ./src/report/perspectives.js
+// Three views of one release (E7-07): what a developer needs, what a CISO needs, what an auditor needs, all built from the SAME canonical list of findings so they
+// cannot disagree.
+//
+//   developer  where the problem is, why it is one, how to fix it, and whether a fix was verified
+//   CISO       what is proven and what is not, what changed since the previous release, how risky and how complete
+//   auditor    for each assertion and each unknown, the evidence it rests on (by digest) and why anything is unknown; the issuer and what the signature does not prove
+//
+// One list, three projections. `canonicalFindings` is computed once from the release package; every view only selects and arranges its fields, and each entry
+// carries the same finding id, status, evidence hash and confidence wherever it appears. Nothing is recomputed per view.
+//
+// The package is DATA from a repository we do not control: every string is escaped before it reaches HTML, the page loads nothing from anywhere and runs no script, and a
+// content security policy says so.
+
+
+
+const esc = (v) => String(v ?? '').replace(/[&<>"'`]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;', '`': '&#96;' }[c]));
+const sevRank = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
+
+function confidenceOf(f) {
+  if (typeof f.confidence === 'number') return f.confidence >= 0.8 ? 'high' : f.confidence >= 0.5 ? 'medium' : 'low';
+  return typeof f.confidenceTier === 'string' ? f.confidenceTier : 'unknown';
+}
+
+/**
+ * @param {object} pkg a release package (E7-03). It is assumed to have been verified by the caller; the views carry `verification` as the caller states it.
+ * @param {{previous?:object, ranking?:object, verification?:{ok:boolean, errors?:object[]}}} opts `previous` is the previous release's package; `ranking` is a result of rankFleetExposure
+ */
+function buildCanonicalFindings(pkg) {
+  const entries = Array.isArray(pkg && pkg.evidence) ? pkg.evidence : [];
+  const byKind = (k) => entries.filter((e) => e.ref && e.ref.kind === k);
+  const fixes = byKind('fix-verification');
+  const out = [];
+  for (const e of byKind('finding')) {
+    const f = e.payload || {};
+    const id = e.ref.payloadId || f.stableId || f.id;
+    const fixesFor = fixes.filter((x) => x.payload && (x.payload.findingStableId === id || x.payload.findingId === id || x.payload.findingId === f.id) );
+    const fix = fixesFor.find((x) => x.payload.verifiedFull === true) || fixesFor[0] || null;
+    const status = !fix ? 'open' : fix.payload.verifiedFull === true ? 'fix-verified' : 'fix-unverified';
+    out.push({
+      id, evidenceHash: e.ref.digest, status, confidence: confidenceOf(f), severity: f.severity || 'info', proofTier: typeof f.proofTier === 'string' ? f.proofTier : 'unproven',
+      where: { file: f.file ?? null, line: Number.isInteger(f.line) ? f.line : null }, title: f.vuln || f.title || 'finding', cwe: f.cwe || null,
+      why: f.description || f.reason || null, how: f.remediation || null,
+      fix: fix ? { evidenceHash: fix.ref.digest, verifiedFull: fix.payload.verifiedFull === true, completeness: fix.payload.fixCompleteness || null, degradedLegs: Array.isArray(fix.payload.degradedLegs) ? fix.payload.degradedLegs.map((d) => (typeof d === 'string' ? d : d && d.leg) ).filter(Boolean) : [] } : null,
+    });
+  }
+  return out.sort((a, b) => (sevRank[b.severity] - sevRank[a.severity]) || (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+}
+
+function buildViews(pkg, { previous = null, ranking = null, verification = null } = {}) {
+  const findings = buildCanonicalFindings(pkg);
+  const packageDigest = `sha256:${(0,external_node_crypto_.createHash)('sha256').update(JSON.stringify(pkg && pkg.lineageOrder || [])).digest('hex')}`;
+  const prev = previous ? buildCanonicalFindings(previous) : null;
+  const prevById = prev ? new Map(prev.map((f) => [f.id, f])) : null;
+  const ids = new Set(findings.map((f) => f.id));
+  const change = prev ? {
+    new: findings.filter((f) => !prevById.has(f.id)).map((f) => f.id),
+    resolved: prev.filter((f) => !ids.has(f.id)).map((f) => f.id),
+    statusChanged: findings.filter((f) => prevById.has(f.id) && prevById.get(f.id).status !== f.status).map((f) => ({ id: f.id, from: prevById.get(f.id).status, to: f.status })),
+    unchanged: findings.filter((f) => prevById.has(f.id) && prevById.get(f.id).status === f.status).length,
+  } : null;
+  const rankById = ranking ? new Map(ranking.ranked.map((r) => [r.id, r])) : null;
+  const tier = (t) => findings.filter((f) => f.proofTier === t).length;
+  const completeness = pkg && pkg.completeness ? { verdict: pkg.completeness.verdict, scanStatus: pkg.completeness.scanStatus, conditions: pkg.completeness.conditions || [] } : { verdict: 'unknown', scanStatus: 'unknown', conditions: [] };
+  const unknowns = [];
+  if (completeness.verdict !== 'complete') for (const c of completeness.conditions.length ? completeness.conditions : ['the scan did not report that it finished']) unknowns.push({ about: 'scan completeness', reason: c, evidence: pkg.completeness && pkg.completeness.source ? [pkg.completeness.source] : [] });
+  for (const a of (pkg && pkg.assertions) || []) if (a.status !== 'supported') unknowns.push({ about: a.text, reason: a.reason || `the assertion is ${a.status}`, evidence: a.evidence || [] });
+  for (const f of findings) if (f.proofTier !== 'execution-proven') unknowns.push({ about: `exploitability of ${f.id}`, reason: `proof tier is ${f.proofTier}: it has not been shown to be exploitable`, evidence: [f.evidenceHash] });
+
+  const developer = findings.map((f) => ({ id: f.id, evidenceHash: f.evidenceHash, status: f.status, confidence: f.confidence, severity: f.severity, where: f.where, why: f.why, how: f.how, title: f.title, cwe: f.cwe, fix: f.fix }));
+  const verdict = releaseVerdict(pkg);
+  const ciso = {
+    verdict: { verdict: verdict.verdict, statement: verdict.statement, blockers: verdict.blockers.map((b) => b.message), unknowns: verdict.unknowns.map((u) => u.message) },
+    verified: verification ? verification.ok === true : null,
+    scan: completeness,
+    proven: { executionProven: tier('execution-proven'), taintProven: tier('taint-proven'), unproven: findings.length - tier('execution-proven') - tier('taint-proven'), total: findings.length },
+    bySeverity: Object.fromEntries(['critical', 'high', 'medium', 'low', 'info'].map((s) => [s, findings.filter((f) => f.severity === s).length])),
+    fixes: { verified: findings.filter((f) => f.status === 'fix-verified').length, unverified: findings.filter((f) => f.status === 'fix-unverified').length, open: findings.filter((f) => f.status === 'open').length },
+    changeSinceLast: change,
+    risk: ranking ? { byPriority: ranking.summary.byPriority, incompleteCoverage: ranking.summary.incompleteCoverage, top: ranking.ranked.slice(0, 5).map((r) => ({ id: r.id, priority: r.priority, rule: r.rule })) } : null,
+    findings: findings.map((f) => ({ id: f.id, evidenceHash: f.evidenceHash, status: f.status, confidence: f.confidence, severity: f.severity, proofTier: f.proofTier, priority: rankById && rankById.get(f.id) ? rankById.get(f.id).priority : null })),
+  };
+  const auditor = {
+    package: { lineageDigest: packageDigest, snapshot: pkg && pkg.snapshot ? { commit: pkg.snapshot.commit, immutable: pkg.snapshot.immutable, digest: pkg.snapshot.digest } : null },
+    issuer: pkg && pkg.issuance ? { trustBasis: pkg.issuance.trustBasis, independentlyCertified: pkg.issuance.independentlyCertified, keyFingerprint: pkg.issuance.issuer && pkg.issuance.issuer.keyFingerprint } : null,
+    verification: verification ? { ok: verification.ok === true, errors: (verification.errors || []).map((e) => `${e.code}: ${e.message}`) } : { ok: null, errors: ['no verification was performed by this view'] },
+    proves: pkg && pkg.proves || null, doesNotProve: pkg && pkg.doesNotProve || null,
+    assertions: ((pkg && pkg.assertions) || []).map((a) => ({ id: a.id, text: a.text, status: a.status, evidence: a.evidence || [], reason: a.reason || null })),
+    unknowns,
+    findings: findings.map((f) => ({ id: f.id, evidenceHash: f.evidenceHash, status: f.status, confidence: f.confidence, proofTier: f.proofTier, fixEvidence: f.fix ? f.fix.evidenceHash : null })),
+    policyDecisions: (pkg && pkg.policy && pkg.policy.decisions) || [],
+  };
+  return { canonical: findings, developer, ciso, auditor };
+}
+
+// ---- text ------------------------------------------------------------------------------------------------------------------------
+
+function renderText(views, view = 'all') {
+  const L = [];
+  const dev = () => { L.push('DEVELOPER VIEW'); for (const f of views.developer) { L.push(`  [${f.severity}] ${f.title}  ${f.where.file ?? '?'}:${f.where.line ?? '?'}  id=${f.id}  status=${f.status}  confidence=${f.confidence}  evidence=${f.evidenceHash.slice(0, 19)}`); if (f.why) L.push(`      why: ${String(f.why).slice(0, 300)}`); if (f.how) L.push(`      fix: ${String(f.how).slice(0, 300)}`); if (f.fix) L.push(`      fix check: ${f.fix.verifiedFull ? 'verified' : 'not fully verified'}${f.fix.degradedLegs.length ? ` (not passed: ${f.fix.degradedLegs.join(', ')})` : ''}`); } if (!views.developer.length) L.push('  no findings'); };
+  const ciso = () => { const c = views.ciso; L.push('CISO VIEW'); L.push(`  release verdict: ${c.verdict.verdict}. ${c.verdict.statement}`); for (const b of c.verdict.blockers) L.push(`    blocks: ${b}`); for (const u of c.verdict.unknowns) L.push(`    unknown: ${u}`); L.push(`  scan: ${c.scan.verdict} (${c.scan.scanStatus})${c.scan.conditions.length ? ' - ' + c.scan.conditions.join('; ') : ''}`); L.push(`  proven: ${c.proven.executionProven} executed, ${c.proven.taintProven} taint path, ${c.proven.unproven} unproven, of ${c.proven.total}`); L.push(`  fixes: ${c.fixes.verified} verified, ${c.fixes.unverified} unverified, ${c.fixes.open} open`); if (c.changeSinceLast) L.push(`  since last release: ${c.changeSinceLast.new.length} new, ${c.changeSinceLast.resolved.length} resolved, ${c.changeSinceLast.statusChanged.length} changed status`); else L.push('  since last release: no previous release was supplied'); if (c.risk) L.push(`  risk: ${JSON.stringify(c.risk.byPriority)}; ${c.risk.incompleteCoverage} with incomplete coverage`); L.push(`  verification: ${c.verified === null ? 'not performed here' : c.verified ? 'signature and contents verified' : 'FAILED'}`); };
+  const aud = () => { const a = views.auditor; L.push('AUDITOR VIEW'); L.push(`  snapshot: ${a.package.snapshot ? `${a.package.snapshot.commit ?? 'no commit'} (${a.package.snapshot.immutable ? 'immutable' : 'NOT immutable'})` : 'none'}`); L.push(`  issuer: ${a.issuer ? `${a.issuer.trustBasis}, independently certified: ${a.issuer.independentlyCertified}` : 'none'}`); L.push(`  verification: ${a.verification.ok === null ? 'not performed here' : a.verification.ok ? 'ok' : 'FAILED: ' + a.verification.errors.join('; ')}`); for (const x of a.assertions) L.push(`  assertion ${x.id} [${x.status}]: ${x.text}  evidence=${x.evidence.map((d) => d.slice(0, 19)).join(',') || 'none'}`); for (const u of a.unknowns) L.push(`  unknown: ${u.about} - ${u.reason}`); L.push(`  does not prove: ${a.doesNotProve}`); };
+  if (view === 'developer' || view === 'all') dev();
+  if (view === 'ciso' || view === 'all') ciso();
+  if (view === 'auditor' || view === 'all') aud();
+  return L.join('\n') + '\n';
+}
+
+// ---- html ------------------------------------------------------------------------------------------------------------------------
+
+/** One self-contained page, no script, nothing loaded from elsewhere. Every value is escaped. */
+function renderHtml(views, { title = 'Release assurance report' } = {}) {
+  const c = views.ciso; const a = views.auditor;
+  const row = (f, cols) => `<tr data-finding="${esc(f.id)}" data-evidence="${esc(f.evidenceHash)}" data-status="${esc(f.status)}" data-confidence="${esc(f.confidence)}">${cols.map((x) => `<td>${x}</td>`).join('')}</tr>`;
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; img-src data:">
+<title>${esc(title)}</title>
+<style>
+:root{--bg:#fff;--fg:#1a1a1a;--muted:#555;--line:#d0d0d0;--bad:#a40000;--ok:#0a6b2b}
+@media (prefers-color-scheme: dark){:root{--bg:#14161a;--fg:#e8e8e8;--muted:#a0a0a0;--line:#3a3d44;--bad:#ff8080;--ok:#6fd48e}}
+body{background:var(--bg);color:var(--fg);font:15px/1.5 system-ui,sans-serif;margin:0 auto;max-width:72rem;padding:1rem 16px}
+h1,h2{line-height:1.2}table{border-collapse:collapse;width:100%;overflow-wrap:anywhere}th,td{border:1px solid var(--line);padding:.35rem .5rem;text-align:left;vertical-align:top}
+code{font-family:ui-monospace,monospace;font-size:.9em}.muted{color:var(--muted)}.bad{color:var(--bad)}.ok{color:var(--ok)}details{margin:1rem 0}summary{cursor:pointer;font-weight:600}
+</style></head><body>
+<h1>${esc(title)}</h1>
+<p class="muted">Snapshot ${esc(a.package.snapshot ? a.package.snapshot.commit : 'none')} (${a.package.snapshot && a.package.snapshot.immutable ? 'immutable' : 'not immutable'}). Verification: <span class="${a.verification.ok === true ? 'ok' : 'bad'}">${esc(a.verification.ok === null ? 'not performed by this page' : a.verification.ok ? 'passed' : 'FAILED')}</span>.</p>
+<details open><summary>Developer: where, why, how to fix</summary>
+<table><thead><tr><th>Finding</th><th>Where</th><th>Why</th><th>How to fix</th><th>Status</th><th>Confidence</th></tr></thead><tbody>
+${views.developer.map((f) => row(f, [`<code>${esc(f.id)}</code> ${esc(f.title)}<br><span class="muted">${esc(f.severity)}${f.cwe ? ' ' + esc(f.cwe) : ''}</span>`, `<code>${esc(f.where.file ?? '?')}:${esc(f.where.line ?? '?')}</code>`, esc(f.why ?? ''), esc(f.how ?? ''), esc(f.status), esc(f.confidence)])).join('\n') || '<tr><td colspan="6">No findings.</td></tr>'}
+</tbody></table></details>
+<details open><summary>CISO: what is proven, what changed, risk and coverage</summary>
+<p><strong>Release verdict: ${esc(c.verdict.verdict)}.</strong> ${esc(c.verdict.statement)}</p>
+<ul>${c.verdict.blockers.map((b) => `<li class="bad">Blocks: ${esc(b)}</li>`).join('')}${c.verdict.unknowns.map((u) => `<li>Unknown: ${esc(u)}</li>`).join('')}</ul>
+<p>Scan: <strong>${esc(c.scan.verdict)}</strong> (${esc(c.scan.scanStatus)}). ${c.scan.conditions.map((x) => esc(x)).join('; ')}</p>
+<p>Proven: ${esc(c.proven.executionProven)} by execution, ${esc(c.proven.taintProven)} by a taint path, ${esc(c.proven.unproven)} unproven, of ${esc(c.proven.total)}. Fixes: ${esc(c.fixes.verified)} verified, ${esc(c.fixes.unverified)} unverified, ${esc(c.fixes.open)} open.</p>
+<p>${c.changeSinceLast ? `Since the previous release: ${esc(c.changeSinceLast.new.length)} new, ${esc(c.changeSinceLast.resolved.length)} resolved, ${esc(c.changeSinceLast.statusChanged.length)} changed status.` : 'No previous release was supplied, so no change is reported.'}</p>
+<table><thead><tr><th>Finding</th><th>Severity</th><th>Proof</th><th>Priority</th><th>Status</th><th>Confidence</th></tr></thead><tbody>
+${c.findings.map((f) => row(f, [`<code>${esc(f.id)}</code>`, esc(f.severity), esc(f.proofTier), esc(f.priority ?? 'not ranked'), esc(f.status), esc(f.confidence)])).join('\n') || '<tr><td colspan="6">No findings.</td></tr>'}
+</tbody></table></details>
+<details open><summary>Auditor: evidence behind each statement, and what is unknown</summary>
+<p>Issuer: ${esc(a.issuer ? a.issuer.trustBasis : 'none')}; independently certified: ${esc(a.issuer ? a.issuer.independentlyCertified : 'n/a')}.</p>
+<p class="muted">Proves: ${esc(a.proves)}<br>Does not prove: ${esc(a.doesNotProve)}</p>
+<table><thead><tr><th>Finding</th><th>Evidence hash</th><th>Fix evidence</th><th>Status</th><th>Confidence</th></tr></thead><tbody>
+${a.findings.map((f) => row(f, [`<code>${esc(f.id)}</code>`, `<code>${esc(f.evidenceHash)}</code>`, `<code>${esc(f.fixEvidence ?? 'none')}</code>`, esc(f.status), esc(f.confidence)])).join('\n') || '<tr><td colspan="5">No findings.</td></tr>'}
+</tbody></table>
+<h2>Assertions</h2><ul>${a.assertions.map((x) => `<li><strong>${esc(x.status)}</strong>: ${esc(x.text)} <span class="muted">(${x.evidence.length ? x.evidence.map((d) => `<code>${esc(d)}</code>`).join(', ') : 'no evidence cited'}${x.reason ? '; ' + esc(x.reason) : ''})</span></li>`).join('') || '<li>None.</li>'}</ul>
+<h2>Unknowns</h2><ul>${a.unknowns.map((u) => `<li>${esc(u.about)}: ${esc(u.reason)}</li>`).join('') || '<li>None.</li>'}</ul>
+</details></body></html>
+`;
+}
+
+
+/***/ })
+
+};

package/dist/6745.index.js

@@ -0,0 +1,305 @@
+export const id = 6745;
+export const ids = [6745];
+export const modules = {
+
+/***/ 96745:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   formatFixProof: () => (/* binding */ formatFixProof),
+/* harmony export */   verifyFixWithProof: () => (/* binding */ verifyFixWithProof)
+/* harmony export */ });
+/* harmony import */ var _states_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(58355);
+/* harmony import */ var _orchestrator_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(84817);
+/* harmony import */ var _runner_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1595);
+/* harmony import */ var _reproducer_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(82034);
+// Verified remediation, extended with exploit replay. This EXTENDS the fix-verify vocabulary (`verifiedFull`,
+// `degradedLegs`); it does not define a competing meaning of "verified".
+//
+//   1. pre-patch: the original exploit must be EXPLOIT_CONFIRMED (3/3 + independent replay) on the unpatched code;
+//   2. the candidate patch is overlaid on the imported sources and the SAME exploit is replayed;
+//   3. the patched replay must COMPLETE in every attempt and the oracle must not fire in any: BLOCKED.
+//      An attempt that did not complete (timeout, build failure, no environment) is inconclusive, never "blocked";
+//   4. static legs (re-scan, lint, tests, honesty) come from `verifyFix`, passed in so they are not re-implemented;
+//   5. FIX_VERIFIED only when 1-4 hold and the static verification had no degraded leg.
+
+
+
+
+
+async function verifyFixWithProof({ finding, reproducer, files, scanRoot, revision = null, policy = {}, staticVerification = null, siblings = null, signal, deps = {} } = {}) {
+  const t0 = Date.now();
+  const attemptFn = deps.attemptFn ?? _runner_js__WEBPACK_IMPORTED_MODULE_2__/* .runAttempt */ .Tm;
+  const patchHash = (0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .sha256 */ .sc)((0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .canonicalize */ .dw)(files || {}));
+  const legs = { prePatch: null, postPatch: null, regression: staticVerification ? { ok: !!staticVerification.ok, verifiedFull: !!staticVerification.verifiedFull } : { status: 'not-run' }, rescan: staticVerification?.rescan ?? { status: 'not-run' } };
+  const out = (extra) => ({ schema: 'agentic-security/fix-proof', version: 1, findingId: finding?.stableId ?? finding?.id ?? null, patchHash, reproducerDigest: (0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .reproducerDigest */ .we)(reproducer), legs, durationMs: Date.now() - t0, ...extra });
+
+  const pre = await (0,_orchestrator_js__WEBPACK_IMPORTED_MODULE_1__/* .proveFinding */ .kO)({ finding, revision, reproducer, policy, signal, deps, sourceRoot: scanRoot });
+  legs.prePatch = { state: pre.state, outcome: pre.outcome, completeness: pre.completeness };
+  if (pre.state !== 'EXPLOIT_CONFIRMED') {
+    return out({ state: pre.state, verified: false, completeness: 'INCOMPLETE', incompleteStep: 'pre-patch-exploit', reason: `the original exploit was not confirmed before the patch (${pre.outcome}); a fix cannot be proven against an exploit that does not reproduce` });
+  }
+
+  const attempts = Math.max(1, Math.min(10, policy.attempts ?? 3));
+  const results = [];
+  for (let i = 0; i < attempts; i++) {
+    if (signal?.aborted) break;
+    results.push(await attemptFn(structuredClone(reproducer), { limits: { timeoutMs: policy.timeoutMs }, signal, sourceRoot: scanRoot, overlay: files, requireContainer: policy.requireContainer, force: policy.force }));
+  }
+  const completed = results.filter((r) => r.status === 'completed' && !r.oracle?.inconclusive);
+  const fired = completed.filter((r) => r.oracle?.fired).length;
+  legs.postPatch = { attempts: results.length, completed: completed.length, exploitSucceeded: fired, statuses: results.map((r) => r.status) };
+
+  if (fired > 0) return out({ state: 'EXPLOIT_CONFIRMED', verified: false, completeness: 'FULL', incompleteStep: 'post-patch-exploit', reason: 'the exploit still succeeds against the patched code' });
+  if (completed.length < results.length || results.length === 0) {
+    return out({ state: 'EXPLOIT_CONFIRMED', verified: false, completeness: 'INCOMPLETE', incompleteStep: 'post-patch-replay', reason: 'the patched replay did not complete in every attempt, so the patch is not shown to block the exploit' });
+  }
+  let state = (0,_states_js__WEBPACK_IMPORTED_MODULE_0__/* .advance */ .np)('EXPLOIT_CONFIRMED', 'FIX_REPLAY_BLOCKED').state;
+
+  const degraded = [];
+  if (!staticVerification) degraded.push('static-verification-not-run');
+  else {
+    if (!staticVerification.ok) return out({ state, verified: false, completeness: 'FULL', incompleteStep: 'static-verification', reason: `exploit blocked, but static verification failed: ${staticVerification.rescan?.reason || 'a leg failed'}` });
+    for (const d of staticVerification.degradedLegs || []) degraded.push(d);
+  }
+  const lowAssurance = pre.environment?.assurance === 'lower';
+  if (lowAssurance) degraded.push('lower-assurance-local-confinement');
+  const siblingCount = Array.isArray(siblings) ? siblings.length : null;
+  if (siblingCount === null) degraded.push('sibling-search-not-run');
+  else if (siblingCount > 0) degraded.push(`sibling-exposures:${siblingCount}`);
+
+  const full = degraded.length === 0;
+  // Same split as fix-verify: `ok` (nothing that ran failed) earns FIX_VERIFIED; `completeness` says whether anything was skipped.
+  if (staticVerification && staticVerification.ok) state = (0,_states_js__WEBPACK_IMPORTED_MODULE_0__/* .advance */ .np)(state, 'FIX_VERIFIED').state;
+  return out({ state, verified: state === 'FIX_VERIFIED', completeness: full ? 'FULL' : 'DEGRADED', degradedLegs: degraded, siblings: siblings ?? null });
+}
+
+function formatFixProof(r) {
+  const L = r.legs || {};
+  return [
+    `Pre-patch exploit: ${L.prePatch?.state === 'EXPLOIT_CONFIRMED' ? 'PASS' : 'NOT CONFIRMED'}`,
+    `Post-patch exploit: ${!L.postPatch ? 'NOT RUN' : L.postPatch.exploitSucceeded > 0 ? 'STILL SUCCEEDS' : L.postPatch.completed === L.postPatch.attempts ? 'BLOCKED' : 'INCONCLUSIVE'}`,
+    `Regression tests: ${L.regression?.status === 'not-run' ? 'not run' : L.regression?.verifiedFull ? 'PASS' : L.regression?.ok ? 'PASS (degraded)' : 'FAIL'}`,
+    `Security rescan: ${L.rescan?.ok === true ? 'PASS' : L.rescan?.status === 'not-run' ? 'not run' : 'FAIL'}`,
+    `Completeness: ${r.completeness}${r.degradedLegs?.length ? ` (${r.degradedLegs.join('; ')})` : ''}`,
+    '',
+    `Evidence: ${r.state}${r.verified ? '' : ` (not verified: ${r.reason || r.incompleteStep || 'degraded'})`}`,
+  ].join('\n');
+}
+
+
+/***/ }),
+
+/***/ 84817:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   kO: () => (/* binding */ proveFinding)
+/* harmony export */ });
+/* unused harmony exports independentVerify, applySeverityPolicy, _newRunId */
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+/* harmony import */ var _states_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(58355);
+/* harmony import */ var _runner_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1595);
+/* harmony import */ var _reproducer_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(82034);
+/* harmony import */ var _proof_tier_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(24555);
+// Proof orchestration: finding + revision + reproducer + policy -> structured evidence.
+//
+// Rules that make this safe to trust:
+//  * The model may propose a reproducer and select an oracle. The oracle (oracles.js) judges. Never a model.
+//  * An attempt that did not complete (timeout, build failure, blocked, unsupported, error) is NOT a negative and NOT a
+//    positive: it is degraded evidence, it never advances the state, and it makes the result INCOMPLETE.
+//  * EXPLOIT_CONFIRMED needs `required` successes in `attempts` completed attempts AND a pass from an independent
+//    verifier that receives only {revision, reproducer, findingId, oracle} in a fresh environment.
+//  * "Not reproduced" is reported as such; it is never reported as safe.
+
+
+
+
+
+
+const PROOF_POLICY_DEFAULTS = Object.freeze({ attempts: 3, required: 3, independentReplay: true, timeoutMs: 20_000, cpus: 1, memoryMb: 512, network: 'none', requireContainer: false });
+const RESULT_SCHEMA = 'agentic-security/proof-result';
+
+function normalizePolicy(p = {}) {
+  const x = { ...PROOF_POLICY_DEFAULTS, ...p };
+  x.attempts = Math.max(1, Math.min(10, Math.trunc(Number(x.attempts)) || PROOF_POLICY_DEFAULTS.attempts));
+  x.required = Math.max(1, Math.min(x.attempts, Math.trunc(Number(x.required)) || x.attempts));
+  x.timeoutMs = Math.max(1000, Math.min(120_000, Number(x.timeoutMs) || PROOF_POLICY_DEFAULTS.timeoutMs));
+  return x;
+}
+
+const summarize = (a) => ({ status: a.status, fired: a.oracle?.fired === true, inconclusive: a.oracle?.inconclusive === true, reason: a.oracle?.reason ?? a.reasons?.[0] ?? null, durationMs: a.durationMs, degraded: a.degraded });
+
+/**
+ * Independent verifier. Takes a verifierView ONLY; any extra property (a model's reasoning, prior results) is rejected so
+ * the isolation of its inputs is checkable rather than a convention.
+ */
+async function independentVerify(view, opts = {}) {
+  const allowed = new Set(['revision', 'reproducer', 'findingId', 'oracle']);
+  const extra = Object.keys(view || {}).filter((k) => !allowed.has(k));
+  if (extra.length) return { status: 'rejected', reason: `verifier input must be exactly revision, reproducer, findingId, oracle; got extra: ${extra.join(', ')}` };
+  const attempt = await (opts.attemptFn ?? _runner_js__WEBPACK_IMPORTED_MODULE_2__/* .runAttempt */ .Tm)(structuredClone(view.reproducer), { ...opts, preferContainer: opts.preferContainer });
+  return { status: attempt.status === 'completed' ? (attempt.oracle?.fired ? 'confirmed' : 'not-reproduced') : 'incomplete', attempt: summarize(attempt), environment: attempt.environment ?? null };
+}
+
+/**
+ * @param {object} a
+ * @param {object} a.finding       the finding (id/stableId, severity, proofTier ...)
+ * @param {string} [a.revision]    commit the proof applies to
+ * @param {object} a.reproducer    serialized reproducer
+ * @param {object} [a.policy]
+ * @param {object} [a.deps]        test seams: { attemptFn }
+ */
+async function proveFinding({ finding, revision = null, reproducer, policy = {}, signal, deps = {}, sourceState = null, sourceRoot = null, overlay = null } = {}) {
+  const started = Date.now();
+  const pol = normalizePolicy(policy);
+  const attemptFn = deps.attemptFn ?? _runner_js__WEBPACK_IMPORTED_MODULE_2__/* .runAttempt */ .Tm;
+  const findingId = finding?.stableId ?? finding?.id ?? reproducer?.findingId ?? 'unknown';
+  const degradation = [];
+  let state = sourceState ?? (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .fromProofTier */ .jn)((0,_proof_tier_js__WEBPACK_IMPORTED_MODULE_4__/* .proofTierOf */ .gx)(finding || {}));
+  if (state === 'REPRODUCED') state = 'STATICALLY_CORROBORATED'; // an old single-run marker proof must be re-earned here
+  const startState = state;
+
+  const result = (extra) => ({
+    schema: RESULT_SCHEMA, version: 1, findingId, revision, startState, state, staticCorroboration: (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .stateRank */ .g3)(startState) >= 1, tier: (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .toProofTier */ .KF)(state),
+    oracle: reproducer?.oracle?.type ?? null, policy: pol,
+    reproducerDigest: reproducer ? safeDigest(reproducer) : null,
+    degradation, timing: { proofMs: Date.now() - started }, ...extra,
+  });
+
+  const errs = reproducer ? (0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .validateReproducer */ .mC)(reproducer) : ['no reproducer supplied'];
+  if (errs.length) { degradation.push('invalid-reproducer'); return result({ completeness: 'INCOMPLETE', outcome: 'invalid-reproducer', reasons: errs, attempts: { required: pol.required, run: 0, successes: 0, incomplete: 0 }, independentReplay: { status: 'not-run' } }); }
+
+  // A valid reproducer is itself the REPRODUCER_GENERATED rung. Static corroboration is recorded, not required: an exploit
+  // that reproduces under an independent oracle is deterministic corroboration in its own right, and a pattern-only finding
+  // must not be unable to earn proof merely because the taint engine never saw it. The record says which it was.
+  const staticCorroboration = (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .stateRank */ .g3)(startState) >= (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .stateRank */ .g3)('STATICALLY_CORROBORATED');
+  if (!staticCorroboration) degradation.push('no-static-corroboration');
+  state = 'REPRODUCER_GENERATED';
+
+  const attempts = [];
+  for (let i = 0; i < pol.attempts; i++) {
+    if (signal?.aborted) { degradation.push('cancelled'); break; }
+    const a = await attemptFn(structuredClone(reproducer), { limits: { timeoutMs: pol.timeoutMs }, signal, requireContainer: pol.requireContainer, preferContainer: pol.preferContainer, force: pol.force, sourceRoot, overlay });
+    attempts.push(a);
+    // Stop early once the threshold can no longer be met only if every attempt is a decisive negative; incomplete runs continue.
+  }
+  const completed = attempts.filter((a) => a.status === 'completed' && !a.oracle?.inconclusive);
+  const successes = completed.filter((a) => a.oracle?.fired).length;
+  const incomplete = attempts.length - completed.length;
+  for (const a of attempts) for (const d of a.degraded || []) if (!degradation.includes(d)) degradation.push(d);
+  if (incomplete) degradation.push(`incomplete-attempts:${incomplete}`);
+  const env = attempts.find((a) => a.environment)?.environment ?? null;
+  const base = {
+    environment: env && { mode: env.mode, assurance: env.assurance, backend: env.backend ?? null, note: env.note ?? null },
+    build: attempts.some((a) => a.status === 'build-failed') ? 'failed' : attempts.length ? 'ok' : 'not-run',
+    attempts: { required: pol.required, run: attempts.length, successes, incomplete, detail: attempts.map(summarize) },
+    artifactHashes: { reproducer: safeDigest(reproducer), observations: (0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .sha256 */ .sc)((0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .canonicalize */ .dw)(attempts.map((a) => a.observation ?? null))) },
+  };
+
+  if (successes > 0) {
+    const r = (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .advance */ .np)(state, 'REPRODUCED'); if (r.ok) state = r.state;
+  }
+  if (!attempts.length) return result({ ...base, completeness: 'INCOMPLETE', outcome: 'not-run', independentReplay: { status: 'not-run' } });
+  if (successes === 0) {
+    const decisive = completed.length === attempts.length;
+    return result({ ...base, completeness: decisive ? 'FULL' : 'INCOMPLETE', outcome: decisive ? 'not-reproduced' : 'inconclusive', note: 'not reproduced is not proof of safety', independentReplay: { status: 'not-run' } });
+  }
+  if (successes < pol.required || incomplete) {
+    return result({ ...base, completeness: incomplete ? 'INCOMPLETE' : 'DEGRADED', outcome: 'reproduced-below-threshold', independentReplay: { status: 'not-run' } });
+  }
+
+  let independent = { status: 'skipped' };
+  if (pol.independentReplay) {
+    independent = await independentVerify((0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .verifierView */ .IW)({ revision, reproducer, findingId, oracle: reproducer.oracle }), { attemptFn, limits: { timeoutMs: pol.timeoutMs }, signal, requireContainer: pol.requireContainer, force: pol.force, sourceRoot, overlay });
+    if (independent.status !== 'confirmed') degradation.push(`independent-replay:${independent.status}`);
+  } else degradation.push('independent-replay-disabled');
+  if (independent.status === 'confirmed') {
+    const r = (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .advance */ .np)(state, 'EXPLOIT_CONFIRMED'); if (r.ok) state = r.state;
+  }
+  const full = state === 'EXPLOIT_CONFIRMED' && base.environment?.assurance !== 'none';
+  return result({ ...base, independentReplay: independent, completeness: full ? (base.environment.assurance === 'lower' ? 'DEGRADED' : 'FULL') : 'INCOMPLETE', outcome: full ? 'exploit-confirmed' : 'reproduced-unverified' });
+}
+
+const safeDigest = (r) => { try { return (0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .reproducerDigest */ .we)(r); } catch { return null; } };
+
+/** Severity policy: optional, never on by default. Returns the finding unchanged unless the policy asks to demote. */
+function applySeverityPolicy(finding, evidenceState, policy) {
+  const req = policy?.criticalRequires;
+  if (!Array.isArray(req) || !req.length || finding?.severity !== 'critical') return finding;
+  const ok = req.some((s) => stateRankOf(evidenceState ?? 'CANDIDATE') >= stateRankOf(s));
+  return ok ? finding : { ...finding, severity: 'high', severityPolicy: { demotedFrom: 'critical', reason: `critical requires ${req.join(' or ')}; evidence state is ${evidenceState ?? 'CANDIDATE'}` } };
+}
+const _newRunId = () => randomBytes(6).toString('hex');
+
+
+/***/ }),
+
+/***/ 58355:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   KF: () => (/* binding */ toProofTier),
+/* harmony export */   g3: () => (/* binding */ stateRank),
+/* harmony export */   jn: () => (/* binding */ fromProofTier),
+/* harmony export */   np: () => (/* binding */ advance)
+/* harmony export */ });
+/* unused harmony exports EVIDENCE_STATES, COMPLETENESS */
+// Evidence state ladder for the Universal Exploit Proof Fabric.
+//
+// Evidence state is SEPARATE from severity and confidence. It extends, never replaces, the vocabulary that already
+// exists: `proof-tier.js` (execution-proven / proof-failed / taint-proven / unproven) and the fix-verify legs
+// (`verifiedFull`, `degradedLegs`). `toProofTier` / `fromProofTier` are the explicit bridges.
+//
+// Transitions are guarded: a state can only be reached from the state directly before it (or by dropping back), so no
+// caller can jump a finding to EXPLOIT_CONFIRMED without passing REPRODUCED, or to FIX_VERIFIED without
+// FIX_REPLAY_BLOCKED. A degraded or incomplete run NEVER advances a state.
+const EVIDENCE_STATES = Object.freeze([
+  'CANDIDATE',
+  'STATICALLY_CORROBORATED',
+  'REPRODUCER_GENERATED',
+  'REPRODUCED',
+  'EXPLOIT_CONFIRMED',
+  'FIX_REPLAY_BLOCKED',
+  'FIX_VERIFIED',
+]);
+
+const stateRank = (s) => EVIDENCE_STATES.indexOf(s);
+
+const REQUIRES_PREDECESSOR = Object.freeze(Object.fromEntries(EVIDENCE_STATES.map((s, i) => [s, i === 0 ? null : EVIDENCE_STATES[i - 1]])));
+
+/**
+ * Advance `from` to `to`. Returns { ok, state, reason }. Moving up requires `to` to be exactly the next rung; moving
+ * down or staying is always allowed (evidence can be lost, never invented). Unknown states are rejected.
+ */
+function advance(from, to) {
+  if (!EVIDENCE_STATES.includes(from)) return { ok: false, state: 'CANDIDATE', reason: `unknown current state: ${String(from)}` };
+  if (!EVIDENCE_STATES.includes(to)) return { ok: false, state: from, reason: `unknown target state: ${String(to)}` };
+  if (stateRank(to) <= stateRank(from)) return { ok: true, state: to, reason: null };
+  if (REQUIRES_PREDECESSOR[to] !== from) return { ok: false, state: from, reason: `cannot reach ${to} from ${from}: ${REQUIRES_PREDECESSOR[to]} is required first` };
+  return { ok: true, state: to, reason: null };
+}
+
+// Bridges to the older vocabulary so existing consumers keep working.
+function toProofTier(state) {
+  const r = stateRank(state);
+  if (r >= stateRank('EXPLOIT_CONFIRMED')) return 'execution-proven';
+  if (r >= stateRank('STATICALLY_CORROBORATED')) return 'taint-proven';
+  return 'unproven';
+}
+
+function fromProofTier(tier) {
+  if (tier === 'taint-proven') return 'STATICALLY_CORROBORATED';
+  // execution-proven under the older single-run marker path is one run, not the 3/3 + independent replay the fabric
+  // requires, so it maps to REPRODUCED and never to EXPLOIT_CONFIRMED.
+  if (tier === 'execution-proven') return 'REPRODUCED';
+  return 'CANDIDATE';
+}
+
+// Completeness vocabulary shared with fix-verify: FULL only when nothing was skipped.
+const COMPLETENESS = Object.freeze(['FULL', 'DEGRADED', 'INCOMPLETE']);
+
+
+/***/ })
+
+};