@clear-capabilities/agentic-security-scanner 0.172.0 → 0.173.0

package/src/context-intelligence/counterexample.js

@@ -0,0 +1,200 @@
+// Deterministic counterexample validation for a candidate invariant violation (E4-04).
+//
+// A candidate (for example a cross-route inconsistency from E4-03) says "this route looks weaker than its sibling". This module tries to settle it
+// WITHOUT a model, in layers, and reports where it got to as one of four states that are never blended:
+//
+//   refuted     the claim is contradicted: the control IS on the path, the route is declared public by policy, there is no sensitive operation
+//               on the resource, or an executed attempt by the attacker was denied
+//   unresolved  the analysis cannot say: an unresolved call or a traversal limit could hide the control, or the fixture could not run
+//   plausible   every edge is resolved and the path reaches the resource's sensitive operation with no control of that kind before it, but nothing
+//               was executed. This is static evidence only
+//   proven      an authorized LOCAL request fixture ran the real handler code and the attacker, who does not own the object, read or changed the
+//               victim's object. Only an execution can produce this state
+//
+// MODEL OUTPUT NEVER ENTERS. This file imports nothing from the review or model paths and reads no prose: facts come from the code analysis, which
+// skips comments, docstrings and string contents, so a comment that claims a check exists, or tells a reviewer to ignore the finding, cannot move a
+// state. The evidence trace is a list of steps each naming its kind (`static` or `executed`), so a reader can see which layer decided.
+//
+// THE FIXTURE RUNNER executes handler code, so it is confined: a child process under Node's permission model with NO file access (the fixture's sources are loaded from memory), no
+// child processes and no workers, a driver that removes `fetch` and refuses every builtin and package, a scrubbed environment, a wall-clock
+// limit and capped output. Network is not part of Node's permission model, so it is blocked by the driver, not by the runtime: lower assurance. Express-style
+// apps are supported through a small in-process shim for `express`, and `db` is a recording in-memory store the fixture supplies. Code that needs
+// anything else (a real database, another module system, a missing dependency) ends as `unresolved`, never as `proven`.
+import { spawnSync } from 'node:child_process';
+import * as path from 'node:path';
+
+export const STATES = Object.freeze(['proven', 'plausible', 'refuted', 'unresolved']);
+const FIXTURE_TIMEOUT_MS = 8000;
+const MAX_OUTPUT = 200_000;
+const MAX_FIXTURE_BYTES = 100_000;
+
+// ---- the fixture runner -----------------------------------------------------------------------------------------------------
+
+const DRIVER = String.raw`
+'use strict';
+const path = require('node:path');
+const spec = JSON.parse(process.env.FIXTURE_SPEC);
+const ops = [];
+const store = JSON.parse(JSON.stringify(spec.store || {}));
+const match = (doc, q) => Object.entries(q || {}).every(([k, v]) => (v && typeof v === 'object' && !Array.isArray(v)) ? true : doc[k] === v);
+const coll = (name) => ({
+  async findOne(q) { ops.push({ op: 'findOne', c: name, q }); return (store[name] || []).find((d) => match(d, q)) || null; },
+  async find(q) { ops.push({ op: 'find', c: name, q }); return (store[name] || []).filter((d) => match(d, q)); },
+  async updateOne(q, u) { ops.push({ op: 'updateOne', c: name, q }); const d = (store[name] || []).find((x) => match(x, q)); if (d) Object.assign(d, (u && u.$set) || u); return { matchedCount: d ? 1 : 0 }; },
+  async deleteOne(q) { ops.push({ op: 'deleteOne', c: name, q }); const i = (store[name] || []).findIndex((x) => match(x, q)); if (i >= 0) store[name].splice(i, 1); return { deletedCount: i >= 0 ? 1 : 0 }; },
+  async insertOne(d) { ops.push({ op: 'insertOne', c: name }); (store[name] ||= []).push(d); return { insertedId: d.id }; },
+});
+global.db = new Proxy({}, { get: (_, name) => coll(String(name)) });
+const routes = []; const mw = [];
+const app = {};
+for (const m of ['get', 'post', 'put', 'patch', 'delete']) app[m] = (p, ...hs) => { routes.push({ method: m.toUpperCase(), path: p, handlers: hs.flat() }); return app; };
+app.use = (...a) => { const fn = a.find((x) => typeof x === 'function'); if (fn) mw.push(fn); return app; };
+app.listen = () => app; app.set = () => app; app.disable = () => app;
+const express = () => app; express.json = () => (q, s, n) => n(); express.urlencoded = () => (q, s, n) => n(); express.Router = () => app;
+// The fixture's files are loaded from memory: nothing is read from disk, so the process needs no file permission at all, and require can only
+// reach the shim for express and the fixture's own relative modules. Everything else, builtins included, is refused.
+delete globalThis.fetch; delete globalThis.WebSocket;
+const vm = require('node:vm');
+const cache = new Map();
+const norm = (p) => path.posix.normalize(p).replace(/^\.\//, '');
+const fileFor = (from, request) => {
+  const base = path.posix.join(path.posix.dirname(from), request);
+  for (const c of [base, base + '.js', base + '.cjs', base + '/index.js']) if (Object.hasOwn(spec.files, norm(c))) return norm(c);
+  return null;
+};
+const load = (file) => {
+  if (cache.has(file)) return cache.get(file).exports;
+  const mod = { exports: {} }; cache.set(file, mod);
+  const req = (request) => {
+    if (request === 'express') return express;
+    if (request.startsWith('.')) { const f = fileFor(file, request); if (f) return load(f); throw Object.assign(new Error('no such fixture module ' + request), { code: 'FIXTURE_UNSUPPORTED' }); }
+    throw Object.assign(new Error('fixture runner does not provide module ' + request), { code: 'FIXTURE_UNSUPPORTED' });
+  };
+  const wrapper = '(function (exports, require, module, __filename, __dirname) {' + spec.files[file] + '\n})';
+  vm.runInThisContext(wrapper, { filename: file })(mod.exports, req, mod, file, path.posix.dirname(file));
+  return mod.exports;
+};
+const matchRoute = (r, method, url) => {
+  if (r.method !== method) return null;
+  const a = r.path.split('/'); const b = url.split('/');
+  if (a.length !== b.length) return null;
+  const params = {};
+  for (let i = 0; i < a.length; i++) { if (a[i].startsWith(':')) params[a[i].slice(1)] = b[i]; else if (a[i] !== b[i]) return null; }
+  return params;
+};
+(async () => {
+  let result;
+  try {
+    load(norm(spec.entry));
+    const req0 = spec.request;
+    const hit = routes.map((r) => ({ r, params: matchRoute(r, req0.method, req0.path) })).find((x) => x.params);
+    if (!hit) { result = { error: 'no-route', detail: req0.method + ' ' + req0.path }; }
+    else {
+      const user = spec.user ? JSON.parse(JSON.stringify(spec.user)) : undefined;
+      const req = { method: req0.method, params: hit.params, query: req0.query || {}, body: req0.body || {}, headers: {}, user, get: () => undefined };
+      let done; const finished = new Promise((r) => { done = r; });
+      const res = { statusCode: 200, body: undefined, sent: false,
+        status(c) { this.statusCode = c; return this; }, json(b) { this.body = b; this.sent = true; done(); return this; }, send(b) { this.body = b; this.sent = true; done(); return this; },
+        sendStatus(c) { this.statusCode = c; this.sent = true; done(); return this; }, set() { return this; }, end() { this.sent = true; done(); return this; }, type() { return this; }, locals: {} };
+      const chain = [...mw, ...hit.r.handlers];
+      let i = 0;
+      const next = (err) => { if (err) { res.statusCode = 500; res.sent = true; done(); return; } const h = chain[i++]; if (!h) { done(); return; } try { const p = h(req, res, next); if (p && typeof p.then === 'function') p.catch((e) => { res.statusCode = 500; res.body = String(e && e.message); res.sent = true; done(); }); } catch (e) { res.statusCode = 500; res.body = String(e && e.message); res.sent = true; done(); } };
+      next();
+      await Promise.race([finished, new Promise((r) => setTimeout(r, 2000))]);
+      result = { status: res.statusCode, body: res.body, sent: res.sent, ops, store };
+    }
+  } catch (e) { result = { error: e && e.code === 'FIXTURE_UNSUPPORTED' ? 'unsupported' : 'load-failed', detail: String(e && e.message).slice(0, 300) }; }
+  process.stdout.write('@@RESULT@@' + JSON.stringify(result));
+})();
+`;
+
+/**
+ * Run one request against the real handler code under confinement.
+ * @param {{files:Record<string,string>, entry:string, request:{method:string,path:string,body?:object,query?:object}, user?:object, store?:object}} f
+ * @returns {{ok:boolean, status?:number, body?:any, ops?:object[], store?:object, error?:string, detail?:string}}
+ */
+export function runFixture(f) {
+  const total = Object.values(f.files || {}).reduce((n, t) => n + String(t).length, 0);
+  if (total > MAX_FIXTURE_BYTES) return { ok: false, error: 'too-large', detail: `${total} bytes of fixture source` };
+  for (const rel of Object.keys(f.files || {})) if (path.isAbsolute(rel) || rel.split('/').includes('..')) return { ok: false, error: 'bad-path', detail: rel };
+  // `--permission` with no allow flags: no file reads or writes, no child processes, no workers. The driver comes in through -e and the fixture's
+  // files through the environment, so nothing needs the disk. Network is not covered by the permission model; the driver removes `fetch` and
+  // refuses every builtin and package, which is the whole of its network reach.
+  const r = spawnSync(process.execPath, ['--permission', '-e', DRIVER], {
+    encoding: 'utf8', timeout: FIXTURE_TIMEOUT_MS, maxBuffer: MAX_OUTPUT,
+    env: { PATH: '/usr/bin:/bin', FIXTURE_SPEC: JSON.stringify({ files: f.files, entry: f.entry, request: f.request, user: f.user, store: f.store }) },
+  });
+  if (r.error) return { ok: false, error: r.error.code === 'ETIMEDOUT' ? 'timeout' : 'spawn-failed', detail: String(r.error.message).slice(0, 200) };
+  const out = String(r.stdout || ''); const i = out.indexOf('@@RESULT@@');
+  if (i < 0) return { ok: false, error: 'no-result', detail: String(r.stderr || '').slice(0, 300) };
+  let parsed; try { parsed = JSON.parse(out.slice(i + 10)); } catch { return { ok: false, error: 'bad-result' }; }
+  return parsed.error ? { ok: false, error: parsed.error, detail: parsed.detail } : { ok: true, ...parsed };
+}
+
+/**
+ * Make the attacker's request against the real handler code and say what happened to the victim's object. Used by assessCandidate and, after a patch,
+ * by the final verification of a fix (which must execute even when a static look already says the control is present).
+ * @returns {{state:'proven'|'refuted'|'unresolved', trace:object[], reasons:string[], reason?:string, status?:number}}
+ */
+export function executeAttempt(candidate, fx) {
+  const trace = [];
+  const method = fx.method || (candidate.operations?.includes('delete') ? 'DELETE' : candidate.operations?.includes('update') ? 'PUT' : 'GET');
+  const attack = runFixture({ files: fx.files, entry: fx.entry, request: { method, path: fx.path, body: fx.body }, user: fx.attacker.user, store: fx.store });
+  if (!attack.ok) { trace.push(step('executed', 'attacker request', `${attack.error}: ${attack.detail || ''}`)); return { state: 'unresolved', trace, reasons: [`the fixture could not run (${attack.error}); the claim stays unproven`], reason: `the fixture could not run (${attack.error}); the claim stays unproven` }; }
+  trace.push(step('executed', 'attacker request', `${method} ${fx.path} as ${JSON.stringify(fx.attacker.user)} -> ${attack.status}`));
+  const marker = fx.victim.marker;
+  const leaked = marker ? JSON.stringify(attack.body ?? '').includes(marker) : attack.status >= 200 && attack.status < 300 && attack.body != null;
+  const changed = JSON.stringify(attack.store?.[fx.victim.collection] || []) !== JSON.stringify(fx.store[fx.victim.collection] || []);
+  if (leaked || changed) {
+    trace.push(step('executed', 'effect on the victim\'s object', leaked ? 'the attacker received the victim\'s data' : 'the victim\'s object was modified by the attacker'));
+    if (fx.siblingPath) {
+      const sib = runFixture({ files: fx.files, entry: fx.entry, request: { method: fx.siblingMethod || 'GET', path: fx.siblingPath }, user: fx.attacker.user, store: fx.store });
+      if (sib.ok) trace.push(step('executed', 'the enforcing sibling, same attacker', `${fx.siblingMethod || 'GET'} ${fx.siblingPath} -> ${sib.status}${marker && !JSON.stringify(sib.body ?? '').includes(marker) ? ' (victim data withheld)' : ''}`));
+    }
+    return { state: 'proven', trace, reasons: ['an executed local request let a principal who does not own the object ' + (leaked ? 'read' : 'change') + ' it'], status: attack.status };
+  }
+  trace.push(step('executed', 'effect on the victim\'s object', 'none: the attacker was denied or got nothing'));
+  return { state: 'refuted', trace, reasons: [`an executed attempt by the attacker was denied (status ${attack.status})`], status: attack.status };
+}
+
+// ---- the assessment ---------------------------------------------------------------------------------------------------------
+
+const step = (kind, what, detail = null) => ({ kind, what, ...(detail ? { detail } : {}) });
+const sameBundle = (b, route) => b.entrypoint && b.entrypoint.label === route;
+
+/**
+ * @param {{route:string, resource:string, dimension:string, operations?:string[], enforcedAt?:object[], waivedBy?:string[]}} candidate  e.g. a finding from findCrossRouteInconsistencies
+ * @param {{bundles:object[], fixture?:{files:Record<string,string>, entry:string, victim:{user:object, ownsId:string, collection:string, marker?:string}, attacker:{user:object}, store:object, path:string, method?:string, body?:object, siblingPath?:string, siblingMethod?:string}}} ctx
+ * @returns {{state:'proven'|'plausible'|'refuted'|'unresolved', trace:object[], reasons:string[]}}
+ */
+export function assessCandidate(candidate, ctx) {
+  const trace = [];
+  const fail = (state, reason) => ({ state, trace, reasons: [reason] });
+  const bundle = (ctx.bundles || []).find((b) => sameBundle(b, candidate.route));
+  if (!bundle || !bundle.manifest) { trace.push(step('static', 'locate the route bundle', 'no bundle for this route')); return fail('unresolved', `no analysed bundle for ${candidate.route}`); }
+  trace.push(step('static', 'locate the route bundle', bundle.entrypoint.id));
+
+  if (candidate.waivedBy && candidate.waivedBy.length) { trace.push(step('static', 'check policy', `public-by-design: ${candidate.waivedBy.join(', ')}`)); return fail('refuted', `declared public by ${candidate.waivedBy.join(', ')}`); }
+
+  const facts = bundle.reach?.facts || [];
+  const sens = facts.filter((f) => f.category === 'sensitive');
+  if (!sens.length) { trace.push(step('static', 'find a sensitive operation', 'none on the path')); return fail('refuted', 'no sensitive operation is reachable from this route, so there is nothing to protect'); }
+  const first = Math.min(...sens.map((f) => f.effLine));
+  const kinds = candidate.dimension === 'ownership' ? ['ownership'] : [candidate.dimension];
+  const before = facts.filter((f) => f.category === 'control' && kinds.includes(f.kind) && (f.effLine < first || (f.basis === 'query-filter' && f.effLine <= first)));
+  if (before.length) { trace.push(step('static', `look for ${candidate.dimension} before the first sensitive operation`, `found at ${before[0].file}:${before[0].line}`)); return fail('refuted', `${candidate.dimension} is enforced at ${before[0].file}:${before[0].line} before the sensitive operation`); }
+  trace.push(step('static', `look for ${candidate.dimension} before the first sensitive operation`, 'none'));
+
+  const hidden = (bundle.manifest.unknowns || []).some((u) => u.material) || bundle.reach?.capped;
+  if (hidden) { trace.push(step('static', 'check for unresolved calls', 'a material unresolved call or a traversal limit')); return fail('unresolved', 'an unresolved call or a traversal limit could hide the control'); }
+  trace.push(step('static', 'check for unresolved calls', 'none'));
+
+  const fx = ctx.fixture;
+  if (!fx) return { state: 'plausible', trace, reasons: ['every edge on the path is resolved and no control precedes the sensitive operation; nothing was executed'] };
+
+  const ex = executeAttempt(candidate, fx);
+  trace.push(...ex.trace);
+  if (ex.state === 'unresolved') return fail('unresolved', ex.reason);
+  if (ex.state === 'proven') return { state: 'proven', trace, reasons: ex.reasons };
+  return { state: 'refuted', trace, reasons: ex.reasons };
+}

package/src/context-intelligence/cross-route.js

@@ -0,0 +1,111 @@
+// Cross-route consistency (E4-03): does every route that touches a resource enforce what its sibling routes enforce?
+//
+// The classic authorization bug is not a missing check on the only route; it is a check on `GET /orders/:id` and none on `PUT /orders/:id` or
+// `DELETE /orders/:id`. A per-route review sees each handler as fine. This compares, per resource, the controls the routes carry, using the facts
+// DCI already extracted along route -> middleware -> handler -> service -> persistence, so a check made in a service layer counts for the route that
+// reaches it.
+//
+// WHAT IT CLAIMS. For a resource touched by two or more routes, a control (authentication, authorization-role, ownership, tenant-scope) that at
+// least one route enforces before its sensitive operation and another does not is an INCONSISTENCY. It is evidence that the missing route is
+// weaker than its sibling, not proof of a vulnerability: that needs a counterexample (E4-04).
+//
+// WHAT IT REFUSES TO CLAIM.
+//   - A route whose control could hide behind an unresolved call or a traversal limit is `unknown`, never "missing": absence of evidence in an
+//     incomplete context is not absence of the control, and dynamic dispatch is not proof of safety either.
+//   - A route that an invariant declares public-by-design for that control is SUPPRESSED, with the policy id and reason kept.
+//   - A resource touched by a single route has nothing to compare and produces nothing.
+//   - The resource name comes from the text of the data operation (collection, table or model); an operation whose target cannot be named is
+//     left out and counted, not guessed.
+import { evaluateInvariants } from './invariants.js';
+
+export const CONSISTENCY_DIMENSIONS = Object.freeze(['authentication', 'authorization-role', 'ownership', 'tenant-scope']);
+
+const SQL_TARGET = /\b(?:FROM|INTO|UPDATE)\s+[`"']?([A-Za-z_][\w.]*)/i;
+const COLLECTION = /\bcollection\s*\(\s*['"`]([\w.-]+)['"`]\s*\)/;
+const DB_MEMBER = /\b(?:db|database|mongo|prisma|knex|models?)\s*\.\s*([A-Za-z_]\w*)\s*\.\s*(?:find|findOne|findMany|findById|findAll|findUnique|findFirst|insert|insertOne|insertMany|create|update|updateOne|updateMany|delete|deleteOne|deleteMany|remove|save|upsert|count|aggregate|get)\b/;
+const MODEL = /\b([A-Z][A-Za-z0-9]+)\s*\.\s*(?:find|findOne|findAll|findByPk|findById|findUnique|create|update|destroy|delete|remove|save|where|objects)\b/;
+const REPO_CALL = /\b([a-z][A-Za-z0-9]*?)(?:Repo|Repository|Dao|Store)\s*\.\s*\w+\s*\(/;
+
+/** Resource key: lowercase, singular-ish (`Orders`, `order`, `orders` all become `order`). */
+export function resourceKey(text) {
+  const t = String(text || '');
+  const m = COLLECTION.exec(t) || DB_MEMBER.exec(t) || SQL_TARGET.exec(t) || MODEL.exec(t) || REPO_CALL.exec(t);
+  if (!m) return null;
+  const raw = m[1].split('.').pop().toLowerCase();
+  if (!raw || ['db', 'models', 'model', 'table', 'tables', 'users_table_placeholder'].includes(raw)) return null;
+  return raw.replace(/ies$/, 'y').replace(/(?<!s)s$/, '');
+}
+
+function operationOf(fact) {
+  const t = String(fact.text || '');
+  if (/\b(?:delete|remove|destroy|drop)\w*/i.test(t)) return 'delete';
+  if (/\b(?:update|set|patch|save|upsert|replace)\w*/i.test(t)) return 'update';
+  if (/\b(?:insert|create|add)\w*/i.test(t)) return 'create';
+  return fact.subkind === 'write' ? 'update' : 'read';
+}
+
+function stateOf(bundle, dim) {
+  const facts = bundle.reach?.facts || [];
+  const sens = facts.filter((f) => f.category === 'sensitive');
+  const first = sens.length ? Math.min(...sens.map((f) => f.effLine)) : null;
+  const kinds = dim === 'ownership' ? ['ownership'] : [dim];
+  const ctl = facts.filter((f) => f.category === 'control' && kinds.includes(f.kind) && (first === null || f.effLine < first || (f.basis === 'query-filter' && f.effLine <= first)));
+  if (ctl.length) return { state: 'enforced', evidence: ctl.slice(0, 3).map((f) => ({ file: f.file, line: f.line, basis: f.basis, evidence: f.evidence })) };
+  const prot = bundle.manifest?.protection?.[dim === 'tenant-scope' ? 'ownership' : dim];
+  if (prot && prot.state === 'present' && dim !== 'tenant-scope' && dim !== 'ownership') return { state: 'enforced', evidence: prot.evidence || [] };
+  const unresolved = (bundle.manifest?.unknowns || []).some((u) => u.material) || bundle.reach?.capped || prot?.state === 'not_resolved' || prot?.state === 'omitted_due_to_budget';
+  return unresolved ? { state: 'unknown' } : { state: 'absent' };
+}
+
+/**
+ * @param {{entrypoint:object, manifest:object, reach:object}[]} bundles
+ * @param {{invariants?:object, now?:Date}} [opts] an invariants document: its public-by-design waivers suppress findings
+ */
+export function findCrossRouteInconsistencies(bundles, opts = {}) {
+  const now = opts.now || new Date();
+  const built = bundles.filter((b) => b.manifest && b.reach);
+  const byResource = new Map();
+  let unnamed = 0;
+  for (const b of built) {
+    const sens = (b.reach.facts || []).filter((f) => f.category === 'sensitive' && String(f.kind).startsWith('data-'));
+    const touched = new Map();
+    for (const f of sens) {
+      const key = resourceKey(f.text);
+      if (!key) { unnamed++; continue; }
+      if (!touched.has(key)) touched.set(key, new Set());
+      touched.get(key).add(operationOf(f));
+    }
+    for (const [key, ops] of touched) {
+      if (!byResource.has(key)) byResource.set(key, []);
+      byResource.get(key).push({ bundle: b, ops: [...ops].sort() });
+    }
+  }
+  const findings = []; const suppressed = []; const unknown = [];
+  const waiver = (b, dim) => {
+    if (!opts.invariants) return null;
+    const r = evaluateInvariants({ ...opts.invariants, invariants: [...opts.invariants.invariants, { id: 'PROBE-DIM', title: 'probe', rule: 'requires', appliesTo: { routes: ['**'] }, requires: [dim] }] }, [b], { now });
+    const probe = r.results.find((x) => x.invariantId === 'PROBE-DIM');
+    return probe && probe.verdict === 'public_by_policy' ? probe.waivedBy : null;
+  };
+  for (const [resource, entries] of [...byResource].sort(([a], [c]) => (a < c ? -1 : 1))) {
+    const routes = [...new Map(entries.map((e) => [e.bundle.entrypoint.id, e])).values()];
+    if (routes.length < 2) continue;
+    for (const dim of CONSISTENCY_DIMENSIONS) {
+      const states = routes.map((r) => ({ r, ...stateOf(r.bundle, dim) }));
+      const enforced = states.filter((s) => s.state === 'enforced');
+      if (!enforced.length) continue;
+      for (const s of states) {
+        if (s.state === 'enforced') continue;
+        const ep = s.r.bundle.entrypoint;
+        const base = { resource, dimension: dim, route: ep.label, file: ep.rootSpan?.file || ep.registrationSite?.file || '', operations: s.r.ops, enforcedAt: enforced.map((e) => ({ route: e.r.bundle.entrypoint.label, operations: e.r.ops, evidence: e.evidence })) };
+        if (s.state === 'unknown') { unknown.push({ ...base, reason: 'an unresolved call or a traversal limit could hide the control; dynamic dispatch is not proof of absence' }); continue; }
+        const w = waiver(s.r.bundle, dim);
+        if (w) { suppressed.push({ ...base, waivedBy: w, reason: 'declared public-by-design for this control' }); continue; }
+        const klass = dim === 'tenant-scope' ? 'cross-tenant' : dim === 'ownership' ? 'idor' : 'missing-control';
+        findings.push({ id: `xroute:${resource}:${dim}:${ep.id}`, class: klass, ...base, confidence: 'inconsistency', explanation: `${enforced.map((e) => e.r.bundle.entrypoint.label).join(', ')} enforce ${dim} on ${resource}; ${ep.label} (${s.r.ops.join('/')}) does not` });
+      }
+    }
+  }
+  findings.sort((a, b) => (a.id < b.id ? -1 : 1));
+  return { findings, suppressed, unknown, resourcesCompared: [...byResource].filter(([, e]) => new Set(e.map((x) => x.bundle.entrypoint.id)).size >= 2).map(([k]) => k).sort(), operationsWithoutResource: unnamed };
+}

package/src/context-intelligence/entrypoints.js

@@ -12,7 +12,7 @@
 //                        not resolve, a handler matched by name only, a router whose mount point is not visible
 //   unresolved           no handler could be identified; the manifest still exists and says so
 //   excluded_by_policy   deliberately not processed (operator exclusion, or the entry-point cap)
-import { hashOf } from './canonical.js';
+import { hashOf, safeLabel } from './canonical.js';
 import { callStatement, inlineBlockSpan, splitArgs } from './spans.js';
 import { dependencyParams, signatureText } from './controls.js';
 import { buildEntrypointInventory } from '../posture/entrypoint-inventory.js';
@@ -313,7 +313,7 @@ export async function collectEntrypoints({ fileContents, graph, config = {} }) {
     const n = (ord.get(stem) || 0) + 1;
     ord.set(stem, n);
     r.id = `ep:${stem.slice(0, 20)}${n > 1 ? `-${n}` : ''}`;
-    r.label = `${r.method ? r.method + ' ' : ''}${r.pathTemplate}`.trim() || r.kind;
+    r.label = safeLabel(`${r.method ? r.method + ' ' : ''}${r.pathTemplate}`) || r.kind;
     void hname;
     let disposition;
     const excluded = exclude.some(re => re.test(r.registrationSite.file) || re.test(r.pathTemplate));

package/src/context-intelligence/evaluation/index.js

@@ -92,6 +92,8 @@ export function metricsFor(units, protocolHash, name) {
     precision: precisionOf(c), recall: recallOf(c), f1: f1Of(c),
     precisionInterval: pn > 0 ? wilsonInterval(c.tp, pn) : { status: 'unmeasured', reason: 'nothing was reported' },
     f1Interval: f1,
+    // A point estimate with no interval around it reads as a finding. It is reportable only when the interval is measured.
+    reportable: f1 && f1.status === 'measured',
   };
 }
 
@@ -127,6 +129,9 @@ function readLedger(root) {
 const pct = (x) => (x === null || x === undefined ? 'n/a' : (x * 100).toFixed(0) + '%');
 const interval = (i) => (!i || i.status !== 'measured' ? `unmeasured (${i && i.reason ? i.reason.split(',')[0] : 'no data'})` : `${pct(i.low)} to ${pct(i.high)}`);
 
+// Precision, recall and F1 are printed only when their interval is measured; otherwise the counts stand alone.
+const shown = (m, x) => (m.reportable ? pct(x) : 'withheld');
+
 export function renderMarkdown(card) {
   const L = [];
   L.push('# Context Intelligence evaluation scorecard', '');
@@ -141,18 +146,20 @@ export function renderMarkdown(card) {
   for (const s of card.systems) {
     if (s.status !== 'measured') { L.push(`| ${s.system} | ${s.status}: ${s.reason} | | | | | | | | | | |`); continue; }
     const m = s.metrics;
-    L.push(`| ${s.system} | measured | ${m.counts.tp} | ${m.counts.fp} | ${m.counts.fn} | ${m.counts.tn} | ${pct(m.precision)} | ${pct(m.recall)} | ${pct(m.f1)} | ${interval(m.f1Interval)} | ${s.calls} | ${s.promptChars} |`);
+    L.push(`| ${s.system} | measured | ${m.counts.tp} | ${m.counts.fp} | ${m.counts.fn} | ${m.counts.tn} | ${shown(m, m.precision)} | ${shown(m, m.recall)} | ${shown(m, m.f1)} | ${interval(m.f1Interval)} | ${s.calls} | ${s.promptChars} |`);
   }
   L.push('', '## Economics (estimated; no price supplied)', '', '| system | median ctx tokens | P95 | P99 | model calls | calls per true positive | wall ms |', '|---|---|---|---|---|---|---|');
-  for (const s of card.systems) if (s.economics) { const e = s.economics; L.push(`| ${s.system} | ${e.contextTokens.median ?? 'n/a'} | ${e.contextTokens.p95 ?? 'n/a'} | ${e.contextTokens.p99 ?? 'n/a'} | ${e.modelCalls} | ${e.callsPerTruePositive === null ? 'n/a' : e.callsPerTruePositive.toFixed(1)} | ${e.wallMs} |`); }
+  for (const s of card.systems) if (s.economics) { const e = s.economics; L.push(`| ${s.system} | ${e.contextTokens.median ?? 'n/a'} | ${e.contextTokens.p95 ?? 'n/a'} | ${e.contextTokens.p99 ?? 'n/a'} | ${e.modelCalls} | ${e.callsPerTruePositive === null || !s.metrics || !s.metrics.reportable ? 'withheld' : e.callsPerTruePositive.toFixed(1)} | ${e.wallMs} |`); }
+  L.push('', 'Precision, recall, F1 and calls per true positive are withheld while their interval is unmeasured (fewer than 10 independent groups). The counts above are what was observed; they are not an estimate of anything.');
   L.push('', `Replay: \`${card.replay}\``, '');
   if (card.leakage.length) { L.push('## Leakage hits', ...card.leakage.map(h => `- ${h.where} ${h.file || ''} ${h.term}`), ''); }
   return L.join('\n');
 }
 
 export function renderCsv(card) {
-  const rows = [['system', 'case', 'variant', 'vulnerable', 'flagged', 'outcome', 'calls', 'promptChars']];
-  for (const s of card.systems) for (const u of (s.units || [])) rows.push([s.system, u.caseId, u.variant, u.vulnerable, u.flagged, u.outcome, u.calls, u.promptChars]);
+  // The marker is a column, not a banner: a CSV is the format that gets pasted into a spreadsheet without its header text.
+  const rows = [['system', 'case', 'variant', 'vulnerable', 'flagged', 'outcome', 'calls', 'promptChars', 'synthetic']];
+  for (const s of card.systems) for (const u of (s.units || [])) rows.push([s.system, u.caseId, u.variant, u.vulnerable, u.flagged, u.outcome, u.calls, u.promptChars, card.synthetic === false ? false : true]);
   return rows.map(r => r.join(',')).join('\n') + '\n';
 }
 

package/src/context-intelligence/evaluation/scripted-reader.js

@@ -189,6 +189,16 @@ function stripUntrustedKeepUser(t) { return stripUntrusted(t).replace(/""/g, '""
 
 function cite(l, role, claim) { return { role, file: l.file, startLine: l.n, endLine: l.n, claim }; }
 
+/** A reader that cites a line says what is on it: the claim quotes the cited text, as a careful model would. */
+function quoteCited(obj, blocks) {
+  const text = (c) => {
+    for (const b of blocks) if (b.file === c.file) { const l = b.lines.find(x => x.n === c.startLine); if (l) return l.text.trim().slice(0, 100); }
+    return '';
+  };
+  const fix = (list) => (Array.isArray(list) ? list.map(c => ({ ...c, claim: `${c.claim}: ${text(c)}` })) : list);
+  return { ...obj, evidence: fix(obj.evidence), observedMitigations: fix(obj.observedMitigations) };
+}
+
 /** The decision for a pack, from the observations. Returns the review JSON object. */
 export function decide(packId, obs, ctx) {
   const base = { observedMitigations: [], attackerControl: [], uncertainties: [], likelihood: 'low' };
@@ -237,7 +247,7 @@ export function scriptedReader() {
   const invoke = async (prompt) => {
     if (/^QUESTION PACK: /m.test(prompt)) {
       const packId = /^QUESTION PACK: ([\w-]+)\//m.exec(prompt)[1];
-      const label = /^ENTRY POINT 1: (.*?) \(id /m.exec(prompt)[1];
+      const label = (/^ENTRY POINT LABEL \(data\): (.*)$/m.exec(prompt) || [])[1] || '';
       const { blocks, unresolved, notIncluded, limit } = blocksFromReviewPrompt(prompt);
       const routes = findRoutes(blocks);
       const [method, ...rest] = label.split(' ');
@@ -246,7 +256,7 @@ export function scriptedReader() {
       if (!route) return JSON.stringify({ evidence: [], observedMitigations: [], conclusion: 'insufficient_evidence', invariant: 'unspecified', uncertainties: ['the registration is not in the provided context'] });
       const obs = analyseRoute(route, blocks);
       const complete = !unresolved && !notIncluded && !limit;
-      return JSON.stringify(decide(packId, obs, { complete, unresolved }));
+      return JSON.stringify(quoteCited(decide(packId, obs, { complete, unresolved }), blocks));
     }
     // hunt prompt: report the candidates for the lens, with a location
     const lens = /Your lens is ([\w ]+)\./.exec(prompt);

package/src/context-intelligence/findings.js

@@ -0,0 +1,166 @@
+// DCI findings through the EXISTING reporting path (E4-07).
+//
+// An invariant violation or a cross-route inconsistency is not reported in a format of its own. It becomes a candidate in the schema the `hunt`
+// pipeline already uses, goes through the same confirmation and judging (`adjudicate`: confirm.js -> judge.js), and comes out as a normal finding with
+// a stableId, a severity, a CWE and a `contextIntelligence` block. From there triage, SARIF (`toSARIF`), CI gates, the verified-fix policy and the
+// privacy controls apply with no DCI-specific code.
+//
+// WHAT THE EXISTING TIERS MEAN HERE. Severity comes from the confirmation tier alone (taint-confirmed high, sink-adjacent medium, unconfirmed low).
+// A deterministic counterexample maps onto those tiers like this, and only like this:
+//   proven      -> taint-confirmed   an executed local request showed the exposure
+//   plausible   -> sink-adjacent     a resolved path reaches the operation with no such control before it
+//   unresolved  -> unconfirmed       the analysis could not say
+//   refuted     -> no finding        the claim was contradicted; it is counted, not reported
+//
+// WHAT A DCI FINDING CARRIES (all under `contextIntelligence`, never as new top-level fields): the invariant violated (or the sibling-route rule),
+// the affected authorization scope (resource, control, routes, files), the code that shows it, the counterexample state and trace, a fix
+// recommendation, and a verification slot that `verifyDciFix` fills after a patch.
+import { createHash } from 'node:crypto';
+import { adjudicate } from './candidates.js';
+import { assessCandidate, executeAttempt } from './counterexample.js';
+import { findCrossRouteInconsistencies } from './cross-route.js';
+import { evaluateInvariants } from './invariants.js';
+import { buildContext } from './build.js';
+import { normalizeConfig } from './config.js';
+import { buildFixVerificationRecord, evidenceItem, leg } from '../fix/verification-record.js';
+import { patchHashOf } from '../fix/verification-adapters.js';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+
+const CWE = { ownership: 'CWE-639', 'tenant-scope': 'CWE-639', authentication: 'CWE-306', 'authorization-role': 'CWE-862' };
+const TIER_OF = { proven: 'taint-confirmed', plausible: 'sink-adjacent', unresolved: 'unconfirmed' };
+const FIX = {
+  ownership: 'Scope the data operation to the authenticated principal: add the owner to the query filter (for example `{ id, ownerId: req.user.id }`) or compare the loaded object\'s owner with the principal and reject on mismatch, the way the enforcing sibling route does.',
+  'tenant-scope': 'Scope the data operation to the principal\'s tenant: add the tenant to the query filter or reject when the object\'s tenant differs from the principal\'s, the way the enforcing sibling route does.',
+  authentication: 'Require an authenticated principal before the sensitive operation, using the same guard the sibling routes use.',
+  'authorization-role': 'Require the role the sibling routes require before the sensitive operation.',
+};
+const sha = (v) => createHash('sha256').update(JSON.stringify(v)).digest('hex');
+const siteOf = (ep) => ({ file: ep?.registrationSite?.file || ep?.rootSpan?.file || '', line: ep?.registrationSite?.line || ep?.rootSpan?.startLine || 1 });
+
+/**
+ * @param {{crossRoute?:object, invariantResults?:object[], bundles:object[], invariants?:object}} src
+ * @returns {object[]} candidates in the shared discovery schema, each with `deterministic` evidence
+ */
+export function candidatesFromEvidence({ crossRoute, invariantResults = [], bundles }) {
+  const byLabel = new Map(bundles.filter((b) => b.manifest).map((b) => [b.entrypoint.label, b]));
+  const out = [];
+  for (const f of crossRoute?.findings || []) {
+    const b = byLabel.get(f.route); if (!b) continue;
+    const site = siteOf(b.entrypoint);
+    const id = sha(['xroute', f.resource, f.dimension, f.route, site.file]).slice(0, 12);
+    out.push({
+      id, focusAreaId: sha(['ctx', b.manifest.contextHash]).slice(0, 12), lens: 'dci-authz',
+      title: `Inconsistent ${f.dimension} enforcement on ${f.resource}: ${f.route}`, file: site.file, line: site.line, family: 'authorization', cwe: CWE[f.dimension] || 'CWE-285',
+      rationale: f.explanation, entryPoint: f.route, sink: `${f.operations.join('/')} of ${f.resource}`, origin: 'context-intelligence', questionPack: null, advisoryOnly: false,
+      witnesses: [{ entrypointId: b.entrypoint.id, label: f.route, contextHash: b.manifest.contextHash, questionPack: null }],
+      sourceSpanEvidence: f.enforcedAt.flatMap((e) => (e.evidence || []).map((x) => ({ role: 'guard', file: x.file, startLine: x.line, endLine: x.line }))),
+      scopeIntegrity: { contextIntegrity: b.manifest.context.integrity, standalone: true, deterministicAgreement: 'agrees', deterministicProtection: null },
+      reviewStatus: 'deterministic', uncertainties: [], recommendedValidation: `Run the same request as a principal who does not own the ${f.resource} against ${f.route} and against ${f.enforcedAt[0]?.route}; the sibling should refuse and this route should not.`,
+      remediation: FIX[f.dimension] || 'Enforce the same control as the sibling routes.',
+      deterministic: {
+        rule: { kind: 'cross-route-consistency', description: `Every route that touches a resource enforces what its sibling routes enforce` },
+        invariant: null,
+        scope: { resource: f.resource, control: f.dimension, operations: f.operations, route: f.route, enforcedAt: f.enforcedAt.map((e) => e.route), files: [...new Set([site.file, ...f.enforcedAt.flatMap((e) => (e.evidence || []).map((x) => x.file))])] },
+        counterexample: null, fix: { recommendation: FIX[f.dimension] || null }, verification: { status: 'pending' },
+      },
+      _bundle: b, _crossRoute: f,
+    });
+  }
+  for (const r of invariantResults) {
+    if (r.verdict !== 'violated') continue;
+    const b = byLabel.get(r.label); if (!b) continue;
+    const site = siteOf(b.entrypoint);
+    const dims = r.controls.filter((c) => c.state === 'absent').map((c) => c.dim);
+    const id = sha(['inv', r.invariantId, r.entrypointId]).slice(0, 12);
+    out.push({
+      id, focusAreaId: sha(['ctx', b.manifest.contextHash]).slice(0, 12), lens: 'dci-authz',
+      title: `Invariant ${r.invariantId} violated: ${r.label}`, file: site.file, line: site.line, family: 'authorization', cwe: CWE[dims[0]] || 'CWE-285',
+      rationale: `${r.title}. ${r.reasons.join('; ')}`, entryPoint: r.label, sink: dims.join(', ') + ' missing', origin: 'context-intelligence', questionPack: null, advisoryOnly: false,
+      witnesses: [{ entrypointId: r.entrypointId, label: r.label, contextHash: b.manifest.contextHash, questionPack: null }], sourceSpanEvidence: [],
+      scopeIntegrity: { contextIntegrity: b.manifest.context.integrity, standalone: true, deterministicAgreement: 'agrees', deterministicProtection: null },
+      reviewStatus: 'deterministic', uncertainties: [], recommendedValidation: `Request ${r.label} as a principal lacking: ${dims.join(', ')}.`,
+      remediation: dims.map((d) => FIX[d]).filter(Boolean).join(' ') || 'Enforce the controls the invariant requires.',
+      deterministic: { rule: { kind: 'invariant', id: r.invariantId, title: r.title, declaredSeverity: r.severity || null }, invariant: { id: r.invariantId, title: r.title, requires: dims }, scope: { resource: null, control: dims, route: r.label, files: [r.file] }, counterexample: null, fix: { recommendation: dims.map((d) => FIX[d]).filter(Boolean) }, verification: { status: 'pending' } },
+      _bundle: b, _invariant: r,
+    });
+  }
+  return out.sort((a, b) => (a.id < b.id ? -1 : 1));
+}
+
+/**
+ * Attempt a counterexample for every candidate that has a cross-route basis, set each candidate's confirmation tier from it, and run the shared
+ * adjudication. Refuted candidates are returned separately and produce no finding.
+ */
+export async function dciFindings({ candidates, bundles, fixtures = {}, scanRoot = null }) {
+  const states = new Map(); const refuted = [];
+  const live = [];
+  for (const c of candidates) {
+    let a;
+    if (c._crossRoute) a = assessCandidate(c._crossRoute, { bundles, fixture: fixtures[c._crossRoute.route] || fixtures[c.id] });
+    else a = { state: 'plausible', trace: [{ kind: 'static', what: 'invariant evaluation', detail: 'the protection verdict for the required control is absent' }], reasons: ['no sibling route to attempt a counterexample against'] };
+    states.set(c.id, a);
+    const pub = { state: a.state, trace: a.trace, reasons: a.reasons };
+    if (a.state === 'refuted') { refuted.push({ id: c.id, title: c.title, file: c.file, line: c.line, refutation: pub }); continue; }
+    live.push({ ...c, deterministic: { ...c.deterministic, counterexample: pub } });
+  }
+  const clean = live.map(({ _bundle, _crossRoute, _invariant, ...rest }) => rest);
+  const taintProbe = async (cand) => ({ tier: TIER_OF[states.get(cand.id).state] || 'unconfirmed', evidence: { counterexample: states.get(cand.id).state } });
+  const adj = await adjudicate(clean, { taintProbe, scanRoot });
+  return { ...adj, counterexampleRefuted: refuted, assessments: Object.fromEntries([...states].map(([k, v]) => [k, v.state])) };
+}
+
+// ---- final verification of a fix ------------------------------------------------------------------------------------------------
+
+async function analyse(files, invariants, now) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'dci-verify-'));
+  try {
+    fs.writeFileSync(path.join(root, 'package.json'), '{"name":"p","version":"1.0.0"}');
+    for (const [f, t] of Object.entries(files)) { fs.mkdirSync(path.dirname(path.join(root, f)), { recursive: true }); fs.writeFileSync(path.join(root, f), t); }
+    const built = await buildContext(root, { config: normalizeConfig({}).config });
+    if (!built.ok) return { ok: false, reason: built.reason };
+    const crossRoute = findCrossRouteInconsistencies(built.bundles, { now, invariants });
+    const inv = invariants ? evaluateInvariants(invariants, built.bundles, { now }) : { results: [], problems: [] };
+    return { ok: true, bundles: built.bundles, crossRoute, invariantResults: inv.results };
+  } finally { fs.rmSync(root, { recursive: true, force: true }); }
+}
+
+/**
+ * Settle a DCI finding after a patch: is the cross-route inconsistency (or the invariant violation) gone in the patched tree, and does the same
+ * executed attempt now fail? Returns a verdict and a patch-level verification record in the shared fix-verification schema, so the verified-fix policy
+ * (completeness tiers, residual risk) applies unchanged.
+ * @param {{finding:object, candidate:object, before:Record<string,string>, after:Record<string,string>, fixture?:object, invariants?:object, now?:Date}} o
+ */
+export async function verifyDciFix({ finding, candidate, before, after, fixture = null, invariants = null, now = new Date() }) {
+  const post = await analyse(after, invariants, now);
+  const route = candidate._crossRoute?.route || candidate._invariant?.label;
+  const dim = candidate._crossRoute?.dimension;
+  const stillInconsistent = post.ok && post.crossRoute.findings.some((f) => f.route === route && (!dim || f.dimension === dim));
+  const stillViolated = post.ok && post.invariantResults.some((r) => r.verdict === 'violated' && r.label === route && (!candidate._invariant || r.invariantId === candidate._invariant.invariantId));
+  let after1 = null;
+  // the attempt is EXECUTED on the patched files even though a static look may already see the control: a fix is verified by the attack failing, not by the code looking right
+  if (candidate._crossRoute && fixture) after1 = executeAttempt(candidate._crossRoute, { ...fixture, files: after });
+  const execDenied = after1 && after1.state === 'refuted' && after1.trace.some((t) => t.kind === 'executed');
+  const execStillWorks = after1 && after1.state === 'proven';
+  const ev = []; const add = (kind, v) => { const e = evidenceItem({ kind, mediaType: 'application/json', sha256: sha(v) }); if (!ev.some((x) => x.id === e.id)) ev.push(e); return e.id; };
+  const before1 = finding?.contextIntelligence?.deterministic?.counterexample;
+  const securityAfter = !post.ok ? leg('blocked', { reason: `the patched tree could not be analysed (${post.reason})` })
+    : (stillInconsistent || stillViolated) ? leg('failed', { evidenceIds: [add('dci-reanalysis', { stillInconsistent, stillViolated })], reason: 'the same inconsistency or invariant violation is still reported on the patched tree' })
+    : leg('passed', { evidenceIds: [add('dci-reanalysis', { stillInconsistent, stillViolated })] });
+  const files = Object.keys(after).filter((f) => after[f] !== before[f]);
+  const record = buildFixVerificationRecord({
+    findingId: finding?.id || candidate.id, findingStableId: finding?.stableId, mode: 'verify', route: 'dci-reverify', patchHash: patchHashOf(Object.fromEntries(files.map((f) => [f, after[f]]))), postPatchHash: patchHashOf(after), affectedFiles: files.length ? files : ['(none)'],
+    securityBefore: leg('passed', { evidenceIds: [add('dci-finding', { id: finding?.id, scope: finding?.contextIntelligence?.deterministic?.scope })] }),
+    securityAfter,
+    exploitProofBefore: before1 && before1.state === 'proven' ? leg('passed', { evidenceIds: [add('dci-counterexample', before1)] }) : leg('not_run', { reason: 'the finding had no executed counterexample' }),
+    exploitProofAfter: execDenied ? leg('passed', { evidenceIds: [add('dci-counterexample-after', after1)] }) : execStillWorks ? leg('failed', { evidenceIds: [add('dci-counterexample-after', after1)], reason: 'the same executed attempt still succeeds on the patched tree' }) : leg('not_run', { reason: fixture ? 'the executed attempt could not be made on the patched tree' : 'no fixture was supplied' }),
+    newFindingDelta: post.ok ? (post.crossRoute.findings.filter((f) => !before1 || f.route !== route).length > 0 ? leg('not_run', { reason: 'other inconsistencies remain; not compared with the pre-patch set here' }) : leg('passed', { evidenceIds: [add('dci-reanalysis', { remaining: post.crossRoute.findings.length })] })) : leg('not_run', { reason: 'the patched tree could not be analysed' }),
+    behaviorPreservation: leg('not_run', { reason: 'run the project tests through the fix verifier (verifyPatch) to cover behaviour' }),
+    behaviorTests: leg('not_run', { reason: 'not run by this check' }),
+    // behaviour is required like everywhere else: a re-analysis and an attack that fails say the weakness is gone, not that the feature survived
+    requiredLegs: ['securityAfter', 'behaviorPreservation', 'behaviorTests', ...(fixture ? ['exploitProofAfter'] : [])], evidence: ev, tools: { engineVersion: null, verifier: 'dci-reverify' },
+  });
+  const status = (stillInconsistent || stillViolated || execStillWorks) ? 'failed' : (!post.ok ? 'inconclusive' : 'verified');
+  return { status, stillInconsistent, stillViolated, executedAfter: after1 ? { state: after1.state, trace: after1.trace } : null, record };
+}