@clear-capabilities/agentic-security-scanner 0.172.1 → 0.173.0

package/dist/3868.index.js

@@ -0,0 +1,292 @@
+export const id = 3868;
+export const ids = [3868];
+export const modules = {
+
+/***/ 33868:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   MEMORY_PROFILES: () => (/* binding */ MEMORY_PROFILES),
+/* harmony export */   capabilitiesFromFamilyHint: () => (/* binding */ capabilitiesFromFamilyHint),
+/* harmony export */   classifyModelFamily: () => (/* binding */ classifyModelFamily),
+/* harmony export */   detectMemoryTier: () => (/* binding */ detectMemoryTier),
+/* harmony export */   detectSystemMemory: () => (/* binding */ detectSystemMemory),
+/* harmony export */   recommendAdmission: () => (/* binding */ recommendAdmission)
+/* harmony export */ });
+/* unused harmony exports KNOWN_MODEL_SIZE_GB, evaluateMemoryAdmission */
+/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(48161);
+/* harmony import */ var _oom_feedback_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(67181);
+// Model family hints, RAM-aware memory profiles, and the memory-admission
+// check for the Ollama provider (agentic-security-ollama-offline-prd.md
+// §13, §14, §15, §22.3, §30).
+//
+// FAMILY HINTS ARE DEFAULTS, NEVER AUTHORITY (PRD §12/§13). A name like
+// `gemma4:e2b` tells us nothing Ollama itself won't confirm — it only lets the
+// harness suggest a sane default before any network call. If a model actually
+// installed under a family-hinted name lacks a capability the hint implied,
+// the runtime probe (model-probe.js, added when tool-calling/structured-output
+// probing lands) always wins. This module only classifies and estimates; it
+// never asserts a capability is present.
+//
+// MEMORY NUMBERS ARE ESTIMATES, NOT PROMISES (PRD §22.3, §14.1). Ollama
+// artifact sizes and this module's headroom reserves are best-effort figures
+// sourced from what Ollama currently publishes; they exist so the harness can
+// fail BEFORE an OS-level OOM, not so it can claim an exact answer. Every
+// admission decision leaves a stated safety margin rather than trying to pack
+// memory to the byte.
+
+
+
+
+// PRD §12/§13 FR-1203 — non-authoritative family hint from a model name.
+// Longest/most-specific pattern first so `qwen3.5:4b` doesn't fall through to
+// the bare `qwen` bucket.
+const FAMILY_PATTERNS = [
+  [/^qwen3\.5/i, 'qwen3.5'],
+  [/^qwen3-coder-next/i, 'qwen3-coder-next'],
+  [/^qwen3-coder/i, 'qwen3-coder'],
+  [/^qwen2\.5-coder/i, 'qwen2.5-coder'],
+  [/^qwen3/i, 'qwen3'],
+  [/^qwen/i, 'qwen'],
+  [/^gemma4/i, 'gemma4'],
+  [/^functiongemma/i, 'functiongemma'],
+  [/^gemma3/i, 'gemma3'],
+  [/^gemma/i, 'gemma'],
+];
+
+/** Non-authoritative family classification for defaults/messaging only. */
+function classifyModelFamily(modelName) {
+  const name = String(modelName || '').trim();
+  for (const [re, family] of FAMILY_PATTERNS) if (re.test(name)) return family;
+  return 'unknown';
+}
+
+// PRD §13.1 — non-authoritative defaults per family, overridden by any real
+// runtime probe result (model-probe.js). `tools`/`structuredJson`/`thinking`
+// are 'unknown' where Ollama's own behavior varies by specific tag/quant
+// rather than by family alone.
+const FAMILY_CAPABILITY_HINTS = {
+  'qwen3.5': { chat: true, structuredJson: true, tools: true, thinking: 'unknown' },
+  qwen3: { chat: true, structuredJson: true, tools: true, thinking: 'unknown' },
+  'qwen3-coder': { chat: true, structuredJson: true, tools: true, thinking: false },
+  'qwen3-coder-next': { chat: true, structuredJson: true, tools: true, thinking: false },
+  'qwen2.5-coder': { chat: true, structuredJson: true, tools: 'unknown', thinking: false },
+  qwen: { chat: true, structuredJson: 'unknown', tools: 'unknown', thinking: 'unknown' },
+  gemma4: { chat: true, structuredJson: true, tools: true, thinking: 'unknown' },
+  functiongemma: { chat: true, structuredJson: 'unknown', tools: true, thinking: false },
+  gemma3: { chat: true, structuredJson: true, tools: false, thinking: false },
+  gemma: { chat: true, structuredJson: 'unknown', tools: 'unknown', thinking: 'unknown' },
+  unknown: { chat: true, structuredJson: 'unknown', tools: 'unknown', thinking: 'unknown' },
+};
+
+/**
+ * Build the PRD §13.1 ModelCapabilities object from a family hint alone
+ * (Layer B). Layer A (Ollama's own /api/show metadata) and Layer C (runtime
+ * probes) are applied by the caller and override these fields — this
+ * function only ever sets `source.familyHint: true`.
+ */
+function capabilitiesFromFamilyHint(modelName) {
+  const family = classifyModelFamily(modelName);
+  const hint = FAMILY_CAPABILITY_HINTS[family] || FAMILY_CAPABILITY_HINTS.unknown;
+  return {
+    chat: hint.chat,
+    structuredJson: hint.structuredJson,
+    tools: hint.tools,
+    thinking: hint.thinking,
+    vision: false,
+    contextTokens: undefined,
+    source: { metadata: false, familyHint: true, runtimeProbe: false },
+  };
+}
+
+// ── RAM-aware memory profiles (PRD §14.4, §15.2, §22.3, §30) ───────────────
+
+const MB = 1024 * 1024;
+const GB = 1024 * MB;
+
+// Best-effort artifact sizes as currently distributed by Ollama, used only to
+// pick a SENSIBLE STARTING recommendation — the real admission decision below
+// uses actually-free memory, not this table. Keep in sync with the PRD's own
+// cited figures; a stale entry only affects the suggested default, never the
+// admission math (which reads real os.freemem()).
+const KNOWN_MODEL_SIZE_GB = Object.freeze({
+  'qwen3.5:2b': 1.7,
+  'qwen3.5:4b': 3.4,
+  'qwen3.5:9b': 6.6,
+  'gemma4:e2b': 7.2,
+  'gemma4:12b': 7.6,
+  'gemma4:latest': 9.6,
+});
+
+/** PRD §30 profile presets. `auto` picks between these by detected RAM. */
+const MEMORY_PROFILES = Object.freeze({
+  '8gb': {
+    label: '8gb',
+    preferredModel: 'qwen3.5:4b',
+    fallbackModel: 'qwen3.5:2b',
+    initialContextTokens: 4096,
+    targetContextTokens: 8192,
+    maxConcurrency: 1,
+    minFreeRamMb: 1536,
+  },
+  '16gb-qwen': {
+    label: '16gb-qwen',
+    preferredModel: 'qwen3.5:9b',
+    fallbackModel: 'qwen3.5:4b',
+    initialContextTokens: 16384,
+    targetContextTokens: 32768,
+    maxConcurrency: 1,
+    minFreeRamMb: 2048,
+  },
+  '16gb-gemma': {
+    label: '16gb-gemma',
+    preferredModel: 'gemma4:e2b',
+    fallbackModel: 'qwen3.5:4b',
+    initialContextTokens: 8192,
+    targetContextTokens: 16384,
+    maxConcurrency: 1,
+    minFreeRamMb: 2048,
+  },
+});
+
+/**
+ * PRD §22.3 — detect total/available system RAM. Thin wrapper over `os` so
+ * tests can inject fake values without mocking the `os` module globally.
+ */
+function detectSystemMemory({ totalBytes, freeBytes } = {}) {
+  return {
+    totalBytes: Number.isFinite(totalBytes) ? totalBytes : node_os__WEBPACK_IMPORTED_MODULE_0__.totalmem(),
+    freeBytes: Number.isFinite(freeBytes) ? freeBytes : node_os__WEBPACK_IMPORTED_MODULE_0__.freemem(),
+  };
+}
+
+/**
+ * Pick the RAM tier ('8gb' | '16gb') a machine falls into. Anything under
+ * ~9 GB total is treated as the 8 GB tier — real "8 GB" machines report
+ * slightly less than 8*1024^3 bytes to userspace (firmware/GPU reservations),
+ * so a hard `< 8*GB` cutoff would misclassify real 8 GB hardware as unknown.
+ */
+function detectMemoryTier(totalBytes) {
+  if (!Number.isFinite(totalBytes) || totalBytes <= 0) return 'unknown';
+  if (totalBytes < 9 * GB) return '8gb';
+  return '16gb';
+}
+
+/**
+ * PRD §22.3 admission algorithm: does `contextTokens` at `model` fit in
+ * currently-free memory with the configured reserve intact?
+ *
+ * This is deliberately conservative and coarse (PRD "avoid pretending memory
+ * estimates are exact"): model residency is estimated from KNOWN_MODEL_SIZE_GB
+ * when available (falling back to a pessimistic 8 GB assumption for an
+ * unrecognized tag so an unknown model never LOOKS safer than a known large
+ * one), and KV-cache growth is approximated as a fixed per-1K-token cost
+ * rather than modeled per-architecture — real KV cache size depends on layer
+ * count/head count/quantization the harness cannot know without Ollama's own
+ * runtime numbers.
+ */
+const ESTIMATED_KV_CACHE_MB_PER_1K_TOKENS = 32; // conservative, model-independent approximation
+const RUNTIME_OVERHEAD_MB = 512; // Ollama server + OS scheduler slack, independent of model size
+
+function evaluateMemoryAdmission({
+  modelName,
+  contextTokens,
+  freeBytes,
+  minFreeRamMb,
+  modelSizeGb,
+} = {}) {
+  const sizeGb = Number.isFinite(modelSizeGb) ? modelSizeGb : (KNOWN_MODEL_SIZE_GB[modelName] ?? 8);
+  const modelMb = sizeGb * 1024;
+  const kvCacheMb = (Number(contextTokens) || 0) / 1000 * ESTIMATED_KV_CACHE_MB_PER_1K_TOKENS;
+  const requiredMb = modelMb + kvCacheMb + RUNTIME_OVERHEAD_MB + (Number(minFreeRamMb) || 0);
+  const freeMb = (Number(freeBytes) || 0) / MB;
+  const admitted = freeMb >= requiredMb;
+  return {
+    admitted,
+    freeMb: Math.round(freeMb),
+    requiredMb: Math.round(requiredMb),
+    modelEstimateMb: Math.round(modelMb),
+    kvCacheEstimateMb: Math.round(kvCacheMb),
+    reserveMb: Number(minFreeRamMb) || 0,
+  };
+}
+
+/**
+ * Full recommendation flow (PRD §22 "Memory admission algorithm"):
+ * try the profile's preferred context, shrink it, then fall back to the
+ * profile's smaller model, before ever declaring the profile unusable.
+ * Never recommends cloud — the worst outcome this function can return is
+ * `{admitted:false}` with a human-readable explanation, which callers treat
+ * as "run deterministic-only" (PRD §23.4).
+ */
+function recommendAdmission(opts = {}) {
+  const result = _recommendAdmissionCore(opts);
+  // Adversarial-review fix (2026-09): a memory-admission ESTIMATE that
+  // actually caused a real OOM (ollama-provider.js's callOllamaChat now
+  // records this via oom-feedback.js) used to have no way to affect a
+  // future admission decision for the SAME model on the SAME machine — the
+  // exact same "admitted: true" would repeat forever. This does not
+  // recalibrate the underlying estimate (that needs real hardware variety
+  // one machine's observed failures can't substitute for); it attaches an
+  // honest warning so the decision is no longer presented with unqualified
+  // confidence.
+  const chosenModel = result.model || opts.requestedModel;
+  const prior = chosenModel ? (0,_oom_feedback_js__WEBPACK_IMPORTED_MODULE_1__/* .priorOOMFor */ .NL)(chosenModel) : null;
+  if (prior) {
+    return {
+      ...result,
+      priorOOMWarning: `'${chosenModel}' has previously failed with an out-of-memory error on this machine ` +
+        `(${prior.count} time${prior.count === 1 ? '' : 's'}, most recently ${new Date(prior.lastAt).toISOString()}). ` +
+        'The memory estimate below may be optimistic for your hardware.',
+    };
+  }
+  return result;
+}
+
+function _recommendAdmissionCore({ profile, freeBytes, requestedContextTokens, requestedModel } = {}) {
+  const p = MEMORY_PROFILES[profile];
+  if (!p) return { admitted: false, reason: `unknown memory profile '${profile}'` };
+
+  const model = requestedModel || p.preferredModel;
+  const attempts = [];
+
+  // 1. Requested (or target) context at the requested/preferred model.
+  const primaryContext = Number.isFinite(requestedContextTokens) ? requestedContextTokens : p.targetContextTokens;
+  let check = evaluateMemoryAdmission({ modelName: model, contextTokens: primaryContext, freeBytes, minFreeRamMb: p.minFreeRamMb });
+  attempts.push({ model, contextTokens: primaryContext, ...check });
+  if (check.admitted) return { admitted: true, model, contextTokens: primaryContext, attempts };
+
+  // 2. Reduce context to the profile's conservative initial value first —
+  //    PRD FR-2104: "shrink context before declaring an otherwise compatible
+  //    model unusable."
+  if (primaryContext !== p.initialContextTokens) {
+    check = evaluateMemoryAdmission({ modelName: model, contextTokens: p.initialContextTokens, freeBytes, minFreeRamMb: p.minFreeRamMb });
+    attempts.push({ model, contextTokens: p.initialContextTokens, ...check });
+    if (check.admitted) return { admitted: true, model, contextTokens: p.initialContextTokens, attempts, reducedContext: true };
+  }
+
+  // 3. Fall back to the profile's smaller model at its initial context.
+  if (p.fallbackModel && p.fallbackModel !== model) {
+    check = evaluateMemoryAdmission({ modelName: p.fallbackModel, contextTokens: p.initialContextTokens, freeBytes, minFreeRamMb: p.minFreeRamMb });
+    attempts.push({ model: p.fallbackModel, contextTokens: p.initialContextTokens, ...check });
+    if (check.admitted) {
+      return {
+        admitted: true, model: p.fallbackModel, contextTokens: p.initialContextTokens, attempts,
+        reducedContext: true, fellBackToSmallerModel: true,
+      };
+    }
+  }
+
+  // 4. Nothing fits — deterministic-only, never cloud.
+  return {
+    admitted: false,
+    attempts,
+    reason: `No local model/context combination fit in available memory with the configured reserve. ` +
+      `Recommend deterministic-only scanning, or free memory before retrying.`,
+  };
+}
+
+
+/***/ })
+
+};

package/dist/3917.index.js

@@ -0,0 +1,152 @@
+export const id = 3917;
+export const ids = [3917];
+export const modules = {
+
+/***/ 93917:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   verifyReleasePackage: () => (/* binding */ verifyReleasePackage)
+/* harmony export */ });
+/* unused harmony export MINIMUM_KINDS */
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+// The verifier for a signed release assurance package (E7-03). Used by `scripts/verify-release-package.mjs` (a command-line wrapper) and by `release-view`.
+//
+// This file imports nothing but Node built-ins. It does not use the producer's code, so a defect in the producer cannot make it agree with itself. What it
+// checks, each reported under its own code:
+//   FORMAT      known schema, supported major version, no unknown top-level keys
+//   SIGNATURE   Ed25519 over the domain label plus the canonical JSON of everything but the signature, verified with the key the CALLER supplies; the key the
+//               package names must be the same key (a package cannot vouch for itself, and a signature lifted from another package does not verify)
+//   SNAPSHOT    the snapshot digest matches its fields
+//   EVIDENCE    every record matches the digest in its reference; every reference matches its own digest; every reference is bound to this snapshot
+//   LINEAGE     every dependency is present, there is no cycle, and the stated order is the dependency order
+//   MANDATORY   every kind in the verifier's own minimum, in the caller's --require list, and in the package's own list is present
+//   COMPLETE    the package may not claim a complete scan over a scan health that is not complete
+//   FINDINGS    each finding's proof tier and exploitability flag equal what the finding itself says
+//   ASSERTIONS  every cited record is in the package, and a "supported" statement cites at least one
+
+
+const MINIMUM_KINDS = Object.freeze(['scan-health', 'finding']);
+const SCHEMA = 'agentic-security/release-package';
+const DOMAIN = `${SCHEMA}@1\n`;
+const TOP_KEYS = new Set(['schema', 'schemaVersion', 'snapshot', 'evidence', 'lineageOrder', 'requiredKinds', 'findings', 'completeness', 'policy', 'assertions', 'proves', 'doesNotProve', 'issuance', 'signature']);
+const ROLES = new Set(['finding', 'completeness', 'context', 'control', 'inventory']);
+
+const canon = (v) => {
+  if (v === null || typeof v !== 'object') return JSON.stringify(v ?? null);
+  if (Array.isArray(v)) return `[${v.map(canon).join(',')}]`;
+  return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canon(v[k])}`).join(',')}}`;
+};
+const digest = (v) => `sha256:${node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(canon(v)).digest('hex')}`;
+const isObj = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+function verifyReleasePackage(pkg, publicKeyPem, { require: extraRequired = [] } = {}) {
+  const errors = [];
+  const fail = (code, message) => errors.push({ code, message });
+  if (!isObj(pkg)) return { ok: false, errors: [{ code: 'FORMAT', message: 'the package is not an object' }] };
+  if (pkg.schema !== SCHEMA) fail('FORMAT', `unrecognised schema ${JSON.stringify(pkg.schema)}`);
+  const major = Number(String(pkg.schemaVersion).split('.')[0]);
+  if (major !== 1) fail('FORMAT', `unsupported version ${JSON.stringify(pkg.schemaVersion)}`);
+  for (const k of Object.keys(pkg)) if (!TOP_KEYS.has(k)) fail('FORMAT', `unrecognised top-level key "${k}", which the signature does not vouch for`);
+  if (errors.length) return { ok: false, errors };
+
+  // ---- SIGNATURE
+  const sig = pkg.signature;
+  let publicKey = null;
+  if (!publicKeyPem) fail('SIGNATURE', 'no public key was supplied');
+  else { try { publicKey = node_crypto__WEBPACK_IMPORTED_MODULE_0__.createPublicKey(publicKeyPem); } catch (e) { fail('SIGNATURE', `the public key is unusable: ${e.message}`); } }
+  if (!isObj(sig) || sig.algorithm !== 'ed25519' || typeof sig.value !== 'string') fail('SIGNATURE', 'the package is unsigned or uses an unsupported algorithm');
+  else if (publicKey) {
+    const { signature, ...rest } = pkg;
+    let ok = false;
+    try { ok = node_crypto__WEBPACK_IMPORTED_MODULE_0__.verify(null, Buffer.from(DOMAIN + canon(rest), 'utf8'), publicKey, Buffer.from(sig.value, 'base64')); } catch (e) { fail('SIGNATURE', `verification error: ${e.message}`); }
+    if (!ok && !errors.some((e) => e.code === 'SIGNATURE')) fail('SIGNATURE', 'the signature does not match the package contents: something changed after signing, or it was signed by another key');
+    const fp = node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(publicKey.export({ type: 'spki', format: 'der' })).digest('hex');
+    const named = pkg.issuance && pkg.issuance.issuer && pkg.issuance.issuer.keyFingerprint;
+    if (named !== fp) fail('SIGNATURE', 'the key the package names is not the key supplied for verification');
+    if (!pkg.issuance || pkg.issuance.independentlyCertified !== false) fail('SIGNATURE', 'a self-issued package may not claim independent certification');
+  }
+
+  // ---- SNAPSHOT
+  const snap = pkg.snapshot;
+  if (!isObj(snap)) fail('SNAPSHOT', 'there is no snapshot');
+  else {
+    const { digest: d, immutable, ...body } = snap;
+    if (d !== digest(body)) fail('SNAPSHOT', 'the snapshot does not match its digest');
+    if (immutable !== (!!body.commit && body.dirty === false)) fail('SNAPSHOT', 'the snapshot\'s immutability flag is not what its fields imply');
+  }
+
+  // ---- EVIDENCE
+  const entries = Array.isArray(pkg.evidence) ? pkg.evidence : [];
+  if (!Array.isArray(pkg.evidence)) fail('EVIDENCE', 'evidence is not a list');
+  const byDigest = new Map();
+  for (const [i, e] of entries.entries()) {
+    if (!isObj(e) || !isObj(e.ref) || !('payload' in e)) { fail('EVIDENCE', `entry ${i} is malformed`); continue; }
+    if (!ROLES.has(e.role)) fail('EVIDENCE', `entry ${i} has an unknown role ${JSON.stringify(e.role)}`);
+    const { digest: rd, findingProvenanceDigest, otherProvenanceDigest, ...rb } = e.ref;
+    if (rd !== digest(rb)) fail('EVIDENCE', `the reference of entry ${i} (${e.ref.kind}) does not match its own digest`);
+    if (e.ref.payloadDigest !== digest(e.payload)) fail('EVIDENCE', `the ${e.ref.kind} record in entry ${i} does not match the digest in its reference`);
+    if (isObj(snap) && e.ref.snapshotDigest !== snap.digest) fail('EVIDENCE', `the ${e.ref.kind} record in entry ${i} describes a different snapshot`);
+    if (byDigest.has(e.ref.digest)) fail('EVIDENCE', `entry ${i} duplicates another reference`);
+    byDigest.set(e.ref.digest, e);
+  }
+
+  // ---- LINEAGE
+  for (const e of byDigest.values()) for (const dep of e.ref.restsOn || []) if (!byDigest.has(dep)) fail('LINEAGE', `${e.ref.kind} rests on a record that is not in the package (${String(dep).slice(0, 19)}...)`);
+  const state = new Map(); const order = [];
+  const visit = (d, trail) => {
+    if (state.get(d) === 2) return; if (state.get(d) === 1) { fail('LINEAGE', `cycle through ${trail.concat(d).map((x) => x.slice(7, 15)).join(' -> ')}`); return; }
+    state.set(d, 1);
+    for (const dep of (byDigest.get(d) || { ref: {} }).ref.restsOn || []) if (byDigest.has(dep)) visit(dep, trail.concat(d));
+    state.set(d, 2); order.push(d);
+  };
+  for (const d of [...byDigest.keys()].sort()) visit(d, []);
+  if (JSON.stringify(order) !== JSON.stringify(pkg.lineageOrder)) fail('LINEAGE', 'the stated order is not the dependency order');
+  if (JSON.stringify(entries.map((e) => e && e.ref && e.ref.digest)) !== JSON.stringify(pkg.lineageOrder)) fail('LINEAGE', 'the evidence list is not in the stated order');
+
+  // ---- MANDATORY
+  const kinds = new Set([...byDigest.values()].map((e) => e.ref.kind));
+  const needed = new Set([...MINIMUM_KINDS, ...extraRequired, ...(Array.isArray(pkg.requiredKinds) ? pkg.requiredKinds : [])]);
+  for (const k of MINIMUM_KINDS) if (!(Array.isArray(pkg.requiredKinds) && pkg.requiredKinds.includes(k))) fail('MANDATORY', `the package does not declare "${k}" as required`);
+  for (const k of [...needed].sort()) if (!kinds.has(k)) fail('MANDATORY', `required evidence is missing: ${k}`);
+
+  // ---- COMPLETE
+  const healthEntry = [...byDigest.values()].find((e) => e.ref.kind === 'scan-health');
+  const c = pkg.completeness;
+  if (!isObj(c)) fail('COMPLETE', 'there is no completeness statement');
+  else if (healthEntry) {
+    const hs = healthEntry.payload && healthEntry.payload.status;
+    if (c.scanStatus !== hs) fail('COMPLETE', `the package states scan status ${JSON.stringify(c.scanStatus)} but the scan health says ${JSON.stringify(hs)}`);
+    if (c.verdict === 'complete' && hs !== 'complete') fail('COMPLETE', 'the package claims a complete scan over a scan health that is not complete');
+    if (c.verdict !== 'complete' && hs === 'complete') fail('COMPLETE', 'the package calls an unfinished scan complete or the reverse: the verdict disagrees with the scan health');
+    if (JSON.stringify(c.conditions) !== JSON.stringify(Array.isArray(healthEntry.payload.conditions) ? healthEntry.payload.conditions : [])) fail('COMPLETE', 'the stated conditions differ from the scan health\'s own');
+    if (c.source !== healthEntry.ref.digest) fail('COMPLETE', 'the completeness statement cites a different scan health');
+  }
+
+  // ---- FINDINGS
+  const findingEntries = [...byDigest.values()].filter((e) => e.ref.kind === 'finding');
+  const listed = new Map((Array.isArray(pkg.findings) ? pkg.findings : []).map((f) => [f.findingRef, f]));
+  if (listed.size !== findingEntries.length) fail('FINDINGS', `the package lists ${listed.size} findings but contains ${findingEntries.length}`);
+  for (const e of findingEntries) {
+    const f = listed.get(e.ref.digest);
+    if (!f) { fail('FINDINGS', `finding ${e.ref.payloadId} is in the package but not in its findings summary`); continue; }
+    const tier = e.payload && typeof e.payload.proofTier === 'string' ? e.payload.proofTier : 'unproven';
+    if (f.proofTier !== tier) fail('FINDINGS', `finding ${e.ref.payloadId}: the summary says proof tier ${JSON.stringify(f.proofTier)} but the finding says ${JSON.stringify(tier)}`);
+    if (f.exploitabilityProven !== (tier === 'execution-proven')) fail('FINDINGS', `finding ${e.ref.payloadId}: exploitability is stated as proven without an execution proof`);
+    if (f.integrity !== 'unmodified-since-signing') fail('FINDINGS', `finding ${e.ref.payloadId}: unexpected integrity statement`);
+  }
+
+  // ---- ASSERTIONS
+  for (const a of Array.isArray(pkg.assertions) ? pkg.assertions : []) {
+    for (const d of a.evidence || []) if (!byDigest.has(d)) fail('ASSERTIONS', `assertion ${a.id} cites a record that is not in the package`);
+    if (a.status === 'supported' && !(a.evidence || []).length) fail('ASSERTIONS', `assertion ${a.id} is "supported" but cites nothing`);
+    if (!['supported', 'unsupported', 'unknown'].includes(a.status)) fail('ASSERTIONS', `assertion ${a.id} has an unknown status`);
+  }
+  return { ok: errors.length === 0, errors, issuer: pkg.issuance && pkg.issuance.issuer, completeness: isObj(c) ? c.verdict : null };
+}
+
+
+
+/***/ })
+
+};

package/dist/3918.index.js

@@ -0,0 +1,192 @@
+export const id = 3918;
+export const ids = [3918];
+export const modules = {
+
+/***/ 63918:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   evaluatePolicy: () => (/* binding */ evaluatePolicy)
+/* harmony export */ });
+/* unused harmony export _internals */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(31421);
+// Policy-as-code gate (FR-SDLC-9).
+//
+// Today's CI gate is `--fail-on <severity>`. That's coarse. Customers want
+// to write nuanced rules: "fail if any sql-injection finding has
+// confidence ≥ 0.8 AND the file is under src/api/", or "fail if total
+// exploitability score across critical findings exceeds 5".
+//
+// We support two modes:
+//
+//   1. EXTERNAL OPA: if the `opa` binary is on PATH and `--policy <file.rego>`
+//      is supplied, we shell out to `opa eval -d <file> -i <findings.json>
+//      "data.<package>.deny"`. This is the right answer for customers who
+//      already use OPA elsewhere.
+//
+//   2. EMBEDDED MINI: when no opa binary is available, fall back to a tiny
+//      DSL that's a strict subset of rego. Rules read top-level
+//      `package`/`deny` blocks; each `deny` is a JS-evaluable expression
+//      over findings[]. This lets the v1 ship without an external binary
+//      dep while documenting the upgrade path.
+
+
+
+
+// ─── External OPA ─────────────────────────────────────────────────────────
+
+function _haveOpa() {
+  try {
+    const r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_1__.spawnSync)('opa', ['version'], { stdio: 'ignore', timeout: 3000 });
+    return r.status === 0;
+  } catch { return false; }
+}
+
+function _runOpa(policyFile, findingsJsonPath, packageName) {
+  const r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_1__.spawnSync)('opa', [
+    'eval', '-d', policyFile, '-i', findingsJsonPath,
+    `data.${packageName}.deny`,
+  ], { encoding: 'utf8', timeout: 10_000 });
+  if (r.error) return { ok: false, reason: `opa-error:${r.error.code || r.error.message}` };
+  if (r.status !== 0) return { ok: false, reason: `opa-exit:${r.status}`, stderr: r.stderr };
+  try {
+    const parsed = JSON.parse(r.stdout);
+    const result = parsed.result?.[0]?.expressions?.[0]?.value;
+    return { ok: true, denials: Array.isArray(result) ? result : [] };
+  } catch (e) {
+    return { ok: false, reason: `opa-output-parse:${e.message}` };
+  }
+}
+
+// ─── Embedded mini DSL ────────────────────────────────────────────────────
+//
+// Rego is too big to reimplement. We support a tiny shape:
+//
+//   # POLICY: agentic-security policy-gate v1
+//   deny[msg] {
+//     finding := input.findings[_]
+//     finding.severity == "critical"
+//     msg := sprintf("critical finding: %v at %v", [finding.vuln, finding.file])
+//   }
+//
+// Parser strategy: extract each `deny[msg] { ... }` block; translate the
+// body to a JS predicate. The grammar we accept is:
+//
+//   - `<lhs> == <value>` / `<lhs> != <value>` / `<lhs> > <num>` / `<lhs> < <num>`
+//   - `<lhs>` references `finding.<field>` or `input.<field>`
+//   - `msg := "..."` or `msg := sprintf("...", [args])` — the msg literal
+//   - newlines + `;` as separators
+//
+// Anything more complex requires the external OPA binary.
+
+function _parseEmbedded(policyText) {
+  const blocks = [];
+  // Match each `deny[NAME] { ... }` block (or `deny { ... }`).
+  const blockRe = /\bdeny(?:\s*\[\s*(\w+)\s*\])?\s*\{([\s\S]*?)\}/g;
+  let m;
+  while ((m = blockRe.exec(policyText))) {
+    const body = m[2];
+    const conditions = [];
+    let msgExpr = `"policy violation"`;
+    for (const line of body.split(/[\n;]/)) {
+      const ln = line.trim();
+      if (!ln || ln.startsWith('#')) continue;
+      // Assignment: `<id> := <expr>`
+      const asn = ln.match(/^(\w+)\s*:=\s*(.+)$/);
+      if (asn && asn[1] !== 'msg') continue;  // skip non-msg assignments
+      if (asn && asn[1] === 'msg') { msgExpr = asn[2].trim(); continue; }
+      // Comparison: `finding.<field> <op> <value>`
+      const cmp = ln.match(/^(finding|input)\.([a-zA-Z_][\w.]*)\s*(==|!=|<=|>=|<|>)\s*(.+)$/);
+      if (!cmp) continue;
+      const [, scope, field, op, valueRaw] = cmp;
+      let value = valueRaw.trim();
+      if (/^".*"$/.test(value)) value = JSON.stringify(value.slice(1, -1));
+      conditions.push({ scope, field, op, value });
+    }
+    blocks.push({ conditions, msgExpr });
+  }
+  return blocks;
+}
+
+function _evalBlock(block, finding) {
+  for (const c of block.conditions) {
+    const lhs = _resolvePath(finding, c.field);
+    let rhs;
+    try { rhs = JSON.parse(c.value); }
+    catch { rhs = c.value.replace(/^"|"$/g, ''); }
+    if (c.op === '==' && lhs !==  rhs) return null;
+    if (c.op === '!=' && lhs === rhs) return null;
+    if (c.op === '>'  && !(Number(lhs)  > Number(rhs))) return null;
+    if (c.op === '<'  && !(Number(lhs)  < Number(rhs))) return null;
+    if (c.op === '>=' && !(Number(lhs) >= Number(rhs))) return null;
+    if (c.op === '<=' && !(Number(lhs) <= Number(rhs))) return null;
+  }
+  return _renderMsg(block.msgExpr, finding);
+}
+
+function _resolvePath(obj, dotPath) {
+  return dotPath.split('.').reduce((o, k) => (o == null ? undefined : o[k]), obj);
+}
+
+function _renderMsg(expr, finding) {
+  // Strip outer quotes if string literal.
+  const m = expr.match(/^["'](.+)["']$/);
+  if (m) return m[1];
+  // sprintf shape: sprintf("...", [a, b])
+  const sf = expr.match(/^sprintf\s*\(\s*"([^"]+)"\s*,\s*\[(.+)\]\s*\)$/);
+  if (sf) {
+    const fmt = sf[1];
+    const args = sf[2].split(',').map(s => _resolvePath(finding, s.trim().replace(/^finding\./, '')));
+    let i = 0;
+    return fmt.replace(/%v/g, () => String(args[i++] ?? ''));
+  }
+  return expr;
+}
+
+function _runEmbedded(policyText, findings) {
+  const blocks = _parseEmbedded(policyText);
+  const denials = [];
+  for (const f of findings) {
+    for (const b of blocks) {
+      const msg = _evalBlock(b, f);
+      if (msg) denials.push(msg);
+    }
+  }
+  return { ok: true, denials };
+}
+
+// ─── Public API ────────────────────────────────────────────────────────────
+
+/**
+ * Evaluate a policy file against the findings list.
+ * Returns { ok, denials, runner } — denials is an array of human-readable
+ * strings (one per violation). When denials.length > 0, the gate fails.
+ */
+function evaluatePolicy(policyPath, findings, opts = {}) {
+  if (!policyPath || !node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(policyPath)) {
+    return { ok: false, reason: 'policy-file-missing' };
+  }
+  const policyText = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(policyPath, 'utf8');
+  const useExternal = !opts.embeddedOnly && _haveOpa();
+  if (useExternal) {
+    // Write findings to a temp file the opa binary reads.
+    const tmp = `/tmp/as-policy-${Date.now()}.json`;
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(tmp, JSON.stringify({ findings }));
+    const pkgMatch = policyText.match(/^\s*package\s+([\w.]+)/m);
+    const pkg = pkgMatch ? pkgMatch[1] : 'main';
+    const r = _runOpa(policyPath, tmp, pkg);
+    try { node_fs__WEBPACK_IMPORTED_MODULE_0__.unlinkSync(tmp); } catch {}
+    if (r.ok) return { ...r, runner: 'opa' };
+    // Fall through to embedded on opa error.
+  }
+  const r = _runEmbedded(policyText, findings);
+  return { ...r, runner: 'embedded' };
+}
+
+const _internals = { _parseEmbedded, _evalBlock, _runEmbedded };
+
+
+/***/ })
+
+};