@clear-capabilities/agentic-security-scanner 0.172.1 → 0.173.0

package/dist/8025.index.js

@@ -0,0 +1,130 @@
+export const id = 8025;
+export const ids = [8025];
+export const modules = {
+
+/***/ 18025:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   HO: () => (/* binding */ isValidHost),
+/* harmony export */   SK: () => (/* binding */ constantTimeEqual),
+/* harmony export */   Xv: () => (/* binding */ CSP_HEADER_VALUE),
+/* harmony export */   generateSessionToken: () => (/* binding */ generateSessionToken)
+/* harmony export */ });
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+// security.js — Milestone 3, sub-project Server, increment 1.
+//
+// Security primitives for the `explore` loopback HTTP server: session-token
+// generation/comparison and Host-header validation (the T2 DNS-rebinding
+// defense — see docs/DATA_FLOW_EXPLORER_THREAT_MODEL.md). No node:http
+// usage here — this module is pure and independently unit-testable.
+
+
+
+/** 32 random bytes, hex-encoded (64 hex chars) — the per-session token. */
+function generateSessionToken() {
+  return node_crypto__WEBPACK_IMPORTED_MODULE_0__.randomBytes(32).toString('hex');
+}
+
+/**
+ * Constant-time string comparison. Wraps crypto.timingSafeEqual, which
+ * THROWS on unequal-length buffers — guarded here the same way
+ * posture/integrity.js's verifyLastScan guards its own HMAC comparison
+ * (`stored.length !== expected.length`), which this function mirrors as
+ * its template. Never throws; returns false on any malformed input.
+ */
+function constantTimeEqual(a, b) {
+  if (typeof a !== 'string' || typeof b !== 'string') return false;
+  const bufA = Buffer.from(a, 'utf8');
+  const bufB = Buffer.from(b, 'utf8');
+  if (bufA.length !== bufB.length) return false;
+  try {
+    return node_crypto__WEBPACK_IMPORTED_MODULE_0__.timingSafeEqual(bufA, bufB);
+  } catch {
+    return false;
+  }
+}
+
+// Loopback hostnames this server ever legitimately answers to. Anything
+// else in a Host header is either a stray/misconfigured client or a
+// DNS-rebinding attempt from a hostile page — reject it (T2).
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '::1']);
+
+/**
+ * Validates a request's `Host` header against the port the server is
+ * actually listening on. Accepts only `127.0.0.1`/`localhost`/`::1`
+ * (`::1` written either bare or bracketed, `[::1]`), each carrying the
+ * expected port explicitly — this is the ENTIRE T2 (DNS rebinding)
+ * defense: a hostile page that points a fetch() at 127.0.0.1:<port> still
+ * sends the ATTACKER'S origin's Host header value (its own hostname), not
+ * "127.0.0.1", so this check rejects it regardless of same-origin policy
+ * quirks in any particular browser.
+ *
+ * A bare host with no port suffix is accepted ONLY when expectedPort is
+ * the default HTTP port (80) — browsers omit :80 for a default-port
+ * http:// request. In practice this server always listens on a
+ * non-default port, so that branch is effectively unreachable but is kept
+ * for RFC-correctness rather than special-cased away.
+ *
+ * @param {string|undefined} hostHeader
+ * @param {number} expectedPort
+ * @returns {boolean}
+ */
+function isValidHost(hostHeader, expectedPort) {
+  if (typeof hostHeader !== 'string' || hostHeader.length === 0) return false;
+  if (typeof expectedPort !== 'number' || !Number.isInteger(expectedPort) || expectedPort <= 0) return false;
+
+  const host = hostHeader.trim();
+  if (host.length !== hostHeader.length) return false; // reject leading/trailing whitespace outright
+  if (/\s/.test(host)) return false; // no embedded whitespace/control chars in a well-formed Host header
+
+  let hostname;
+  let port = null;
+
+  if (host.startsWith('[')) {
+    // Bracketed IPv6 literal form: [::1] or [::1]:port
+    const closeIdx = host.indexOf(']');
+    if (closeIdx === -1) return false;
+    hostname = host.slice(1, closeIdx); // strip brackets
+    const rest = host.slice(closeIdx + 1);
+    if (rest.length) {
+      if (!rest.startsWith(':')) return false;
+      const portStr = rest.slice(1);
+      if (!/^\d+$/.test(portStr)) return false;
+      port = Number(portStr);
+    }
+  } else {
+    const parts = host.split(':');
+    if (parts.length === 1) {
+      hostname = parts[0];
+    } else if (parts.length === 2) {
+      hostname = parts[0];
+      if (!/^\d+$/.test(parts[1])) return false;
+      port = Number(parts[1]);
+    } else {
+      // More than one colon with no brackets: either a malformed header or
+      // a bare (unbracketed) IPv6 literal, which is not valid Host syntax
+      // (RFC 7230 §5.4 requires brackets for an IPv6 literal). Reject.
+      return false;
+    }
+  }
+
+  hostname = hostname.toLowerCase();
+  if (!LOOPBACK_HOSTS.has(hostname)) return false;
+
+  if (port === null) return expectedPort === 80;
+  return port === expectedPort;
+}
+
+// This server serves JSON only in this increment (no HTML, no inline
+// script/style, no static assets) — `frontend/`'s own static assets are a
+// later increment's (Wire's) job, not S1's. `default-src 'none'` is
+// therefore the correct, maximally-restrictive policy: nothing this
+// server ever returns should load or execute ANY sub-resource. Revisit
+// only when a future increment starts serving HTML/JS itself.
+const CSP_HEADER_VALUE = "default-src 'none'; frame-ancestors 'none'";
+
+
+/***/ })
+
+};

package/dist/8054.index.js

@@ -0,0 +1,248 @@
+export const id = 8054;
+export const ids = [8054];
+export const modules = {
+
+/***/ 68054:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   verifyPatchNegative: () => (/* binding */ verifyPatchNegative)
+/* harmony export */ });
+/* harmony import */ var _assurance_identity_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(91026);
+/* harmony import */ var _assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(99666);
+/* harmony import */ var _assurance_config_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(20622);
+/* harmony import */ var _replay_replay_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(30891);
+/* harmony import */ var _oracles_registry_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(45603);
+/* harmony import */ var _patch_promotion_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(58144);
+/* harmony import */ var _repair_records_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(41458);
+// Patch-negative verification (X-204).
+//
+// A re-scan that no longer fires proves the DETECTOR went quiet; a cosmetic edit can do that. A repair is `verified-fix` here
+// only when three things are shown, each by an executed oracle run in an equivalent disposable environment:
+//
+//   1. original-positive   the original revision reproduces the exploit        (oracle outcome: confirmed)
+//   2. patched-negative    the patched revision no longer does, same oracle    (oracle outcome: refuted)
+//   3. functional-regression  declared legitimate behaviour is intact on the patched revision, with the same expectations
+//      holding on the original first (a baseline), so a wrong expectation is reported rather than blamed on the patch.
+//
+// All four runs (the baseline is one) go through `replayManifest`, so each is pinned by commit, fixture hash, patch hash,
+// toolchain, oracle version and inputs, executes inside the trust boundary, and issues a verifier receipt. The result is then
+// handed to `promotePatch`, which re-derives the diff and revision from the proposal and refuses any receipt that does not
+// match them. `verified-fix` needs the promotion; nothing else grants it.
+//
+// A failure never degrades to a vague "not verified": it names the SPECIFIC step that is incomplete and a typed failure code:
+//   original-not-reproduced      the original did not reproduce under the oracle (nothing to fix, or the scenario is wrong)
+//   patched-still-exploitable    the exploit still works on the patched revision
+//   patched-build-broken         the patched revision did not load or its benign control failed
+//   patched-negative-inconclusive the patched run decided nothing
+//   functional-omitted           no functional check was supplied
+//   functional-baseline-invalid  the declared expectations do not hold on the ORIGINAL revision
+//   functional-regression-detected the patched revision behaves differently from the declared expectations
+//   oracle-changed               the oracle, its version or its inputs differ between the original and patched runs
+//   revision-unbound             no exact commit: a verdict cannot be tied to a revision
+//   prerequisite-unmet           a toolchain, feature or isolation prerequisite is missing; resumable where stated
+//   environment-mismatch         the runs were not in equivalent environments
+//   promotion-refused            the receipts do not match the exact proposed diff and revision
+//
+// The behaviour check is the functional-regression oracle by default. A requester may name `business-state` as `functional.oracleId`
+// (X-406, `invariants/repair.js`): the same two runs and the same expectation, with an authorized-workflow scenario as the declared
+// case, and `promotePatch` then requires the functional receipts to come from that oracle class instead.
+//
+// Scope, stated so no caller overclaims: the exploit scenario and the functional cases are the REQUESTER's; this verifies the
+// declared scenario and cases, not that the patch is correct elsewhere. Linux is not claimed (the oracle platform statements
+// stay `unverified`). Receipts are valid inside this process only (see patch-promotion.js).
+
+
+
+
+
+
+
+
+const PATCH_NEGATIVE_FEATURE = 'patch-negative-verification';
+const FUNCTIONAL_ORACLE = 'functional-regression';
+// The check that behaviour is preserved is normally the functional-regression oracle. A requester may name `business-state`
+// instead (X-406): the same two runs, the same expectation (refuted), with an authorized-workflow scenario as the declared case.
+const FUNCTIONAL_ORACLES = Object.freeze([FUNCTIONAL_ORACLE, 'business-state']);
+
+const STEPS = Object.freeze(['original-positive', 'patched-negative', 'functional-baseline', 'functional-regression']);
+
+const ROLE_OF_STEP = Object.freeze({ 'original-positive': 'original', 'patched-negative': 'patched', 'functional-baseline': 'functionalBaseline', 'functional-regression': 'functional' });
+const EXPECTED = Object.freeze({ 'original-positive': 'confirmed', 'patched-negative': 'refuted', 'functional-baseline': 'refuted', 'functional-regression': 'refuted' });
+
+const stepResult = (step, status, extra = {}) => ({ step, status, expected: EXPECTED[step], outcome: null, code: null, reason: null, recordId: null, receiptDigest: null, ...extra });
+
+function replayCode(run) {
+  const first = (run.errors || [])[0];
+  if (!first) return 'manifest-rejected';
+  if (first.code === 'ORACLE_MISMATCH') return 'oracle-changed';
+  if (first.code === 'HASH_MISMATCH') return 'content-hash-mismatch';
+  return 'manifest-rejected';
+}
+
+function classify(step, run) {
+  if (run.status === 'rejected') return { status: 'incomplete', code: replayCode(run), reason: (run.errors || []).map((e) => e.message).join('; ').slice(0, 300) || 'the replay manifest was rejected' };
+  if (run.status === 'awaiting-prerequisites') {
+    const resumable = (run.prerequisites || []).every((p) => p.resumable);
+    return { status: 'incomplete', code: 'prerequisite-unmet', outcome: run.outcome ?? null, resumable, reason: `${(run.prerequisites || []).map((p) => `${p.kind} ${p.id} (${p.state})`).join('; ') || 'a prerequisite is unmet'}; nothing was executed${resumable ? ' (resumable)' : ''}` };
+  }
+  const outcome = run.outcome;
+  const observed = run.receipt?.observed || {};
+  // a business-state run reports its control flow under `preconditions`: a control flow that no longer works is a broken revision
+  const loadBroken = observed.targetLoaded === false || observed.benignCompleted === false || observed.preconditions?.controlRan === false || observed.preconditions?.controlDurableEffect === false;
+  if (outcome === 'error') return { status: 'incomplete', code: 'harness-error', reason: String(run.record?.reason || 'the oracle run failed').slice(0, 300), outcome };
+  if (outcome === EXPECTED[step]) return { status: 'passed', code: null, reason: run.record?.reason ?? null, outcome };
+  const reason = String(run.record?.reason || '').slice(0, 300);
+  switch (step) {
+    case 'original-positive':
+      return { status: 'failed', code: 'original-not-reproduced', reason: `the original revision did not reproduce the exploit (outcome '${outcome}'): ${reason}`, outcome };
+    case 'patched-negative':
+      if (outcome === 'confirmed') return { status: 'failed', code: 'patched-still-exploitable', reason: `the exploit still works on the patched revision: ${reason}`, outcome };
+      return loadBroken
+        ? { status: 'failed', code: 'patched-build-broken', reason: `the patched revision did not load or its benign control failed: ${reason}`, outcome }
+        : { status: 'failed', code: 'patched-negative-inconclusive', reason: `the patched run decided nothing (outcome '${outcome}'): ${reason}`, outcome };
+    case 'functional-baseline':
+      return { status: 'failed', code: 'functional-baseline-invalid', reason: `the declared functional expectations do not hold on the original revision (outcome '${outcome}'): ${reason}`, outcome };
+    default:
+      if (outcome === 'confirmed') return { status: 'failed', code: 'functional-regression-detected', reason: `the patched revision behaves differently from the declared expectations: ${reason}`, outcome };
+      return loadBroken
+        ? { status: 'failed', code: 'patched-build-broken', reason: `the patched revision did not load for the functional check: ${reason}`, outcome }
+        : { status: 'failed', code: 'functional-inconclusive', reason: `the functional check decided nothing (outcome '${outcome}'): ${reason}`, outcome };
+  }
+}
+
+function summaryOf(steps, verified, incomplete, code) {
+  const label = (s) => ({ passed: 'PASS', failed: 'FAIL', incomplete: 'INCOMPLETE', 'not-run': 'not run' })[s.status];
+  const lines = steps.map((s) => `${s.step}: ${label(s)}${s.code ? ` (${s.code})` : ''}${s.reason && s.status !== 'passed' ? ` - ${s.reason}` : ''}`);
+  lines.push(verified
+    ? 'verified-fix: the exploit reproduced on the original revision, did not reproduce on the patched revision, and the declared functional cases still hold. Only the declared scenario and cases were exercised.'
+    : `NOT verified-fix: incomplete step '${incomplete}'${code ? ` (${code})` : ''}.`);
+  return lines.join('\n');
+}
+
+/**
+ * Run the three-part patch-negative verification for one proposed patch. Never throws.
+ *
+ * @param {object} req
+ * @param {string} req.hypothesisId   the finding's stable id
+ * @param {string} req.commit         exact revision the patch is proposed against (40 or 64 hex)
+ * @param {object} req.original       { files, entry, oracleId, inputs, budgets? } the exploit scenario on the original files
+ * @param {object} req.patch          { files } the proposed diff: the new content of each changed file
+ * @param {object} [req.patched]      { oracleId?, inputs?, entry? }: must equal the original's; anything else is `oracle-changed`
+ * @param {object} [req.functional]   { inputs, budgets? } for the functional-regression oracle; omitting it prevents verified-fix
+ * @param {object} [req.pinnedOracle] { id, version, logicDigest } the oracle identity the requester recorded earlier
+ * @param {object[]} [req.ledger]     earlier repair records to extend
+ * @param {object} [o] { config, runOptions } config is the assurance config; runOptions go to the oracle runner (test seams)
+ */
+async function verifyPatchNegative(req, o = {}) {
+  const config = o.config || (0,_assurance_config_js__WEBPACK_IMPORTED_MODULE_2__.resolveAssuranceConfig)({ env: process.env });
+  const gate = (0,_assurance_config_js__WEBPACK_IMPORTED_MODULE_2__/* .featureStatus */ .FX)(config, PATCH_NEGATIVE_FEATURE);
+  const steps = STEPS.map((s) => stepResult(s, 'not-run', { reason: 'not reached' }));
+  const base = {
+    status: 'not-verified-fix', verifiedFix: false, incompleteStep: null, failureCode: null, reason: null, steps,
+    patchDigest: null, promotion: null, receipts: null, records: {}, verificationRecord: null, repairRecords: Array.isArray(req?.ledger) ? req.ledger : [], summary: '',
+  };
+  if (gate.status !== 'ok') {
+    return { ...base, status: 'disabled', incompleteStep: 'feature-gate', failureCode: gate.code || 'disabled', reason: `${PATCH_NEGATIVE_FEATURE} is not available: ${gate.reason}`, summary: `patch-negative verification did not run: ${gate.reason}` };
+  }
+  const refuse = (step, code, reason, extra = {}) => {
+    const rejected = req && (0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isPlainObject */ .Qd)(req.patch) && (0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isPlainObject */ .Qd)(req.patch.files) && Object.keys(req.patch.files).length && typeof req.hypothesisId === 'string'
+      ? ledgerFor(base.repairRecords, req, base.patchDigest ?? (0,_assurance_identity_js__WEBPACK_IMPORTED_MODULE_0__/* .digestOf */ .ol)(req.patch.files), { rejected: { step, code, reason } }) : { records: base.repairRecords };
+    return { ...base, ...extra, patchDigest: req?.patch?.files ? (0,_assurance_identity_js__WEBPACK_IMPORTED_MODULE_0__/* .digestOf */ .ol)(req.patch.files) : null, incompleteStep: step, failureCode: code, reason, repairRecords: rejected.records, summary: summaryOf(steps, false, step, code) };
+  };
+
+  // ---- shape and preconditions that need no execution
+  const patchFiles = req?.patch?.files;
+  if (!(0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isPlainObject */ .Qd)(req) || typeof req.hypothesisId !== 'string' || !req.hypothesisId || !(0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isPlainObject */ .Qd)(req.original) || !(0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isPlainObject */ .Qd)(req.original.files)
+    || typeof req.original.entry !== 'string' || typeof req.original.oracleId !== 'string' || !(0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isPlainObject */ .Qd)(req.original.inputs)
+    || !(0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isPlainObject */ .Qd)(patchFiles) || Object.keys(patchFiles).length === 0) {
+    return refuse('input-validation', 'bad-request', 'a request needs a hypothesis id, the original files, entry, oracle and inputs, and a non-empty patch');
+  }
+  if (!(0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isCommit */ .WM)(req.commit)) return refuse('input-validation', 'revision-unbound', 'no exact commit was given: a verdict cannot be tied to a revision');
+  const original = req.original;
+  const oracle = _oracles_registry_js__WEBPACK_IMPORTED_MODULE_4__.getOracle(original.oracleId);
+  if (!oracle) return refuse('input-validation', 'unknown-oracle', `the exploit oracle '${String(original.oracleId).slice(0, 60)}' is not registered`);
+  if (oracle.id === FUNCTIONAL_ORACLE) return refuse('input-validation', 'bad-request', 'the exploit oracle cannot be the functional-regression oracle');
+  const patched = (0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isPlainObject */ .Qd)(req.patched) ? req.patched : {};
+  if ((patched.oracleId !== undefined && patched.oracleId !== original.oracleId) || (patched.inputs !== undefined && (0,_assurance_identity_js__WEBPACK_IMPORTED_MODULE_0__/* .digestOf */ .ol)(patched.inputs) !== (0,_assurance_identity_js__WEBPACK_IMPORTED_MODULE_0__/* .digestOf */ .ol)(original.inputs)) || (patched.entry !== undefined && patched.entry !== original.entry)) {
+    return refuse('oracle-consistency', 'oracle-changed', 'the patched run names a different oracle, entry or inputs than the original run: a changed oracle cannot show the exploit is closed');
+  }
+  const pin = req.pinnedOracle;
+  if (pin !== undefined && (!(0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isPlainObject */ .Qd)(pin) || pin.id !== oracle.id || pin.version !== oracle.version || pin.logicDigest !== oracle.logicDigest)) {
+    return refuse('oracle-consistency', 'oracle-changed', 'the oracle differs from the identity the requester pinned (id, version or logic digest)');
+  }
+  const fn = req.functional;
+  if (!(0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isPlainObject */ .Qd)(fn) || !(0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isPlainObject */ .Qd)(fn.inputs)) {
+    return refuse('functional-regression', 'functional-omitted', 'no functional regression check was supplied: a patch that was never checked for behaviour cannot be a verified fix');
+  }
+  const functionalOracle = fn.oracleId === undefined ? FUNCTIONAL_ORACLE : fn.oracleId;
+  if (!FUNCTIONAL_ORACLES.includes(functionalOracle)) {
+    return refuse('input-validation', 'bad-request', `the functional check oracle must be one of ${FUNCTIONAL_ORACLES.join(', ')}`);
+  }
+
+  const patchDigest = (0,_assurance_identity_js__WEBPACK_IMPORTED_MODULE_0__/* .digestOf */ .ol)(patchFiles);
+  base.patchDigest = patchDigest;
+  let ledger = ledgerFor(base.repairRecords, req, patchDigest, {}).records; // proposed
+  const common = { hypothesisId: req.hypothesisId, commit: req.commit };
+  const plan = [
+    ['original-positive', { oracleId: original.oracleId, entry: original.entry, inputs: original.inputs, patchFiles: null, budgets: original.budgets }],
+    ['patched-negative', { oracleId: original.oracleId, entry: original.entry, inputs: original.inputs, patchFiles, budgets: original.budgets }],
+    ['functional-baseline', { oracleId: functionalOracle, entry: original.entry, inputs: fn.inputs, patchFiles: null, budgets: fn.budgets }],
+    ['functional-regression', { oracleId: functionalOracle, entry: original.entry, inputs: fn.inputs, patchFiles, budgets: fn.budgets }],
+  ];
+  const runs = {};
+  let failed = null;
+  for (const [i, [step, spec]] of plan.entries()) {
+    if (failed) continue;
+    let run;
+    try {
+      const manifest = (0,_replay_replay_js__WEBPACK_IMPORTED_MODULE_3__/* .createReplayManifest */ .$A)({ ...common, fixtureFiles: original.files, patchFiles: spec.patchFiles, oracleId: spec.oracleId, entry: spec.entry, inputs: spec.inputs, budgets: spec.budgets || {}, expected: { outcome: EXPECTED[step] } });
+      run = await (0,_replay_replay_js__WEBPACK_IMPORTED_MODULE_3__/* .replayManifest */ .TY)({ manifest, fixtureFiles: original.files, patchFiles: spec.patchFiles }, { config: o.config || config, runOptions: o.runOptions });
+    } catch (e) {
+      run = { status: 'rejected', errors: [{ code: 'RUN_FAILED', message: String(e?.message || e).slice(0, 200) }] };
+    }
+    const c = classify(step, run);
+    steps[i] = stepResult(step, c.status, { ...c, recordId: run.record?.id ?? null, receiptDigest: run.receipt?.receiptDigest ?? null });
+    if (run.executed && run.receipt) runs[ROLE_OF_STEP[step]] = run;
+    if (c.status !== 'passed') failed = { step, ...c };
+  }
+  base.records = Object.fromEntries(Object.entries(runs).map(([k, r]) => [k, r.record]));
+  if (failed) {
+    ledger = ledgerFor(ledger, req, patchDigest, { rejected: { step: failed.step, code: failed.code, reason: failed.reason } }).records;
+    const original0 = base.records.original ? (0,_repair_records_js__WEBPACK_IMPORTED_MODULE_6__/* .withRepairStatus */ .m$)(base.records.original, (0,_repair_records_js__WEBPACK_IMPORTED_MODULE_6__/* .verificationRepairFor */ .Kf)(ledger, req.hypothesisId, patchDigest)) : null;
+    return { ...base, incompleteStep: failed.step, failureCode: failed.code, reason: failed.reason, resumable: failed.resumable ?? false, repairRecords: ledger, verificationRecord: original0, summary: summaryOf(steps, false, failed.step, failed.code) };
+  }
+
+  // ---- the receipts must match the exact proposed diff and revision before anything is promoted
+  const receipts = Object.fromEntries(Object.entries(runs).map(([k, r]) => [k, r.receipt]));
+  const promotion = (0,_patch_promotion_js__WEBPACK_IMPORTED_MODULE_5__/* .promotePatch */ .l)({ proposal: { hypothesisId: req.hypothesisId, revision: req.commit, originalFiles: original.files, patchFiles, functionalOracle }, receipts });
+  if (!promotion.ok) {
+    const envBroken = promotion.reasons.some((r) => r.code === 'environment-mismatch');
+    const code = envBroken ? 'environment-mismatch' : promotion.reasons.some((r) => r.code === 'oracle-changed') ? 'oracle-changed' : 'promotion-refused';
+    const step = envBroken ? 'environment-equivalence' : code === 'oracle-changed' ? 'oracle-consistency' : 'promotion';
+    const reason = promotion.reasons.map((r) => r.message).join('; ').slice(0, 400);
+    ledger = ledgerFor(ledger, req, patchDigest, { rejected: { step, code, reason } }).records;
+    return { ...base, promotion, incompleteStep: step, failureCode: code, reason, repairRecords: ledger, verificationRecord: base.records.original ? (0,_repair_records_js__WEBPACK_IMPORTED_MODULE_6__/* .withRepairStatus */ .m$)(base.records.original, (0,_repair_records_js__WEBPACK_IMPORTED_MODULE_6__/* .verificationRepairFor */ .Kf)(ledger, req.hypothesisId, patchDigest)) : null, summary: summaryOf(steps, false, step, code) };
+  }
+  const promoted = (0,_repair_records_js__WEBPACK_IMPORTED_MODULE_6__/* .recordPromotion */ .Zw)(ledger, promotion, { verificationRecordId: base.records.patched?.id ?? null });
+  ledger = promoted.records;
+  const verificationRecord = (0,_repair_records_js__WEBPACK_IMPORTED_MODULE_6__/* .withRepairStatus */ .m$)(base.records.original, (0,_repair_records_js__WEBPACK_IMPORTED_MODULE_6__/* .verificationRepairFor */ .Kf)(ledger, req.hypothesisId, patchDigest, base.records.patched?.id));
+  return {
+    ...base, status: 'verified-fix', verifiedFix: true, promotion, receipts, repairRecords: ledger, verificationRecord,
+    reason: 'verified', summary: summaryOf(steps, true, null, null),
+  };
+}
+
+// The ledger for one verification: always starts with a `proposed` record, and records a rejection when verification stopped.
+function ledgerFor(records, req, patchDigest, { rejected } = {}) {
+  let list = Array.isArray(records) ? records : [];
+  const fields = { hypothesisId: req.hypothesisId, revision: (0,_assurance_schema_kit_js__WEBPACK_IMPORTED_MODULE_1__/* .isCommit */ .WM)(req.commit) ? req.commit : null, diffDigest: patchDigest };
+  if (!list.some((r) => r.hypothesisId === fields.hypothesisId && r.diffDigest === patchDigest)) list = (0,_repair_records_js__WEBPACK_IMPORTED_MODULE_6__/* .appendRepairRecord */ .f7)(list, { ...fields, kind: 'proposed', reason: 'a patch was proposed for verification' }).records;
+  if (rejected) list = (0,_repair_records_js__WEBPACK_IMPORTED_MODULE_6__/* .appendRepairRecord */ .f7)(list, { ...fields, kind: 'rejected', step: rejected.step, reason: `${rejected.code}: ${String(rejected.reason || '').slice(0, 300)}` }).records;
+  return { records: list };
+}
+
+
+/***/ })
+
+};

package/dist/8097.index.js

@@ -0,0 +1,201 @@
+export const id = 8097;
+export const ids = [8097];
+export const modules = {
+
+/***/ 48097:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   productionFeedbackReport: () => (/* binding */ productionFeedbackReport),
+/* harmony export */   renderProductionFeedbackSummary: () => (/* binding */ renderProductionFeedbackSummary)
+/* harmony export */ });
+/* unused harmony exports CATEGORIES, collectFeedbackEvents, summarizeFeedbackTrend, _internals */
+/* harmony import */ var _suppressions_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(82166);
+/* harmony import */ var _triage_memory_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(77008);
+/* harmony import */ var _sca_policy_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(75228);
+/* harmony import */ var _fix_history_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(74294);
+/* harmony import */ var _fix_metrics_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(62683);
+// FR-907 (assurance-hardening PRD): "Add longitudinal production feedback
+// measurement | Metrics separate user suppression, accepted risk, invalid
+// finding, fixed finding, and verification outcome."
+//
+// Read-only aggregation over 5 ALREADY-BUILT, separate mechanisms — this
+// module invents no new storage of its own, only a unified view:
+//
+//   user-suppression     -> triage-memory.jsonl (decision:'wont-fix'),
+//                            accepted.json (vibecoder soft-accept, dated),
+//                            suppressions.yml (pro exception, undated)
+//   invalid-finding       -> triage-memory.jsonl (decision:'false-positive')
+//   accepted-risk         -> sca-policy.yml's accept-risk[] (undated snapshot
+//                            — the policy file has no per-entry creation
+//                            timestamp, only an optional future `expires`)
+//   fixed-finding          -> fix-history/log.json (dated via `appliedAt`,
+//                            status-tagged: applied/pending/reverted/failed)
+//   verification-outcome  -> fix-metrics.jsonl (dated via `at`, ok-tagged)
+//
+// "Longitudinal" means: every event that HAS a real timestamp is usable in
+// a time-bucketed trend; every event that does NOT (accept-risk entries,
+// pro suppressions — neither schema records when the entry was added) is
+// still counted in its category total but reported separately as
+// "undated" rather than silently smeared across the time window or
+// silently dropped. Same disclosed-gap discipline this codebase already
+// uses elsewhere (privacy-framework.js's engine-gap bucket, accuracy-
+// scorecard.js's excluded-from-denominator entries) — a number without
+// its caveat is not a measurement.
+//
+// Never throws (posture convention): each of the 5 reads is wrapped
+// independently, so a missing or malformed source degrades only that ONE
+// category to empty, never blocks the other four. Every underlying reader
+// (loadSoftAccepted, loadProSuppressions, loadMemory, loadScaPolicy,
+// readLog, loadFixAttempts) already degrades gracefully on its own; the
+// wrapping here is defense in depth against a reader whose contract
+// changes later, not a claim that today's readers can throw.
+
+
+
+
+
+
+
+const MS_PER_DAY = 86400000;
+
+// The 5 categories named verbatim in FR-907's own acceptance criterion.
+const CATEGORIES = Object.freeze([
+  'user-suppression', 'accepted-risk', 'invalid-finding', 'fixed-finding', 'verification-outcome',
+]);
+
+function _safe(fn) {
+  try { return fn(); } catch { return []; }
+}
+
+/**
+ * One unified event per underlying record, tagged with which of the 5
+ * PRD-named categories it belongs to. `at` is an ISO timestamp or null
+ * when the source schema has no per-entry creation date. `raw` keeps the
+ * original record for drill-down — never re-derived from the unified
+ * shape, so nothing is lost in translation.
+ */
+function collectFeedbackEvents(scanRoot) {
+  const events = [];
+
+  for (const e of _safe(() => (0,_suppressions_js__WEBPACK_IMPORTED_MODULE_0__/* .loadSoftAccepted */ .gv)(scanRoot))) {
+    events.push({
+      category: 'user-suppression', source: 'suppressions.js:accepted.json',
+      at: e.accepted_at || null, findingId: e.id || null, file: e.file || null,
+      line: e.line ?? null, outcome: 'soft-accepted', raw: e,
+    });
+  }
+  for (const e of _safe(() => (0,_suppressions_js__WEBPACK_IMPORTED_MODULE_0__/* .loadProSuppressions */ .KM)(scanRoot))) {
+    events.push({
+      category: 'user-suppression', source: 'suppressions.js:suppressions.yml',
+      at: null, findingId: e.finding_id || null, file: e.file || null,
+      line: null, outcome: 'pro-exception', raw: e,
+    });
+  }
+  for (const e of _safe(() => (0,_triage_memory_js__WEBPACK_IMPORTED_MODULE_1__/* .loadMemory */ .ab)(scanRoot))) {
+    if (e.decision === 'wont-fix') {
+      events.push({
+        category: 'user-suppression', source: 'triage-memory.js',
+        at: e.at || null, findingId: e.id || null, file: e.file || null,
+        line: e.line ?? null, outcome: 'wont-fix', raw: e,
+      });
+    } else if (e.decision === 'false-positive') {
+      events.push({
+        category: 'invalid-finding', source: 'triage-memory.js',
+        at: e.at || null, findingId: e.id || null, file: e.file || null,
+        line: e.line ?? null, outcome: 'false-positive', raw: e,
+      });
+    }
+  }
+  const scaPolicy = _safe(() => (0,_sca_policy_js__WEBPACK_IMPORTED_MODULE_2__/* .loadScaPolicy */ .IN)(scanRoot));
+  const acceptRisk = scaPolicy && Array.isArray(scaPolicy.acceptRisk) ? scaPolicy.acceptRisk : [];
+  for (const e of acceptRisk) {
+    events.push({
+      category: 'accepted-risk', source: 'sca-policy.js',
+      at: null, findingId: e.cve || e.package || null, file: null,
+      line: null, outcome: 'accept-risk', raw: e,
+    });
+  }
+  for (const e of _safe(() => (0,_fix_history_js__WEBPACK_IMPORTED_MODULE_3__/* .readLog */ .x6)(scanRoot))) {
+    events.push({
+      category: 'fixed-finding', source: 'fix-history.js',
+      at: e.appliedAt || null, findingId: e.findingId || e.stableId || null,
+      file: e.file || null, line: null, outcome: e.status || 'unknown', raw: e,
+    });
+  }
+  for (const e of _safe(() => (0,_fix_metrics_js__WEBPACK_IMPORTED_MODULE_4__/* .loadFixAttempts */ .sU)(scanRoot))) {
+    events.push({
+      category: 'verification-outcome', source: 'fix-metrics.js',
+      at: e.at || null, findingId: e.stableId || null, file: null,
+      line: null, outcome: e.ok ? 'verified' : 'not-verified', raw: e,
+    });
+  }
+
+  return events;
+}
+
+/**
+ * Bucket events by day within a rolling `sinceDays`-day window — the same
+ * cutoff-window shape as posture/triage.js's own trend(). An event with no
+ * timestamp (or an unparseable one) cannot be placed on a time axis: it is
+ * counted once in `undated` per category rather than silently dropped or
+ * silently smeared into the window.
+ */
+function summarizeFeedbackTrend(events, { sinceDays = 30, now = Date.now() } = {}) {
+  const cutoff = now - sinceDays * MS_PER_DAY;
+  const byCategory = {};
+  for (const cat of CATEGORIES) byCategory[cat] = { total: 0, inWindow: 0, undated: 0 };
+
+  const dayBuckets = new Map(); // 'YYYY-MM-DD' -> { category: count }
+  for (const ev of Array.isArray(events) ? events : []) {
+    if (!ev || !CATEGORIES.includes(ev.category)) continue;
+    byCategory[ev.category].total++;
+    const t = ev.at ? Date.parse(ev.at) : NaN;
+    if (!Number.isFinite(t)) { byCategory[ev.category].undated++; continue; }
+    if (t < cutoff) continue;
+    byCategory[ev.category].inWindow++;
+    const dayKey = new Date(t).toISOString().slice(0, 10);
+    if (!dayBuckets.has(dayKey)) dayBuckets.set(dayKey, {});
+    const bucket = dayBuckets.get(dayKey);
+    bucket[ev.category] = (bucket[ev.category] || 0) + 1;
+  }
+
+  const series = [...dayBuckets.entries()]
+    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+    .map(([day, counts]) => ({ day, counts }));
+  return { sinceDays, byCategory, series };
+}
+
+/**
+ * Convenience wrapper: collect + summarize in one call — same pattern as
+ * fix-metrics.js's fixDurationReport(scanRoot).
+ */
+function productionFeedbackReport(scanRoot, opts) {
+  const events = collectFeedbackEvents(scanRoot);
+  return { events, ...summarizeFeedbackTrend(events, opts) };
+}
+
+/**
+ * One block of human-readable summary, or null when nothing was measured
+ * at all — same "null when nothing measured" contract as
+ * renderFixDurationSummary, so a caller can skip the section entirely
+ * rather than print an empty header.
+ */
+function renderProductionFeedbackSummary(report) {
+  if (!report || !Array.isArray(report.events) || !report.events.length) return null;
+  const lines = [`Production feedback (last ${report.sinceDays}d):`];
+  for (const cat of CATEGORIES) {
+    const c = report.byCategory[cat];
+    if (!c || c.total === 0) continue;
+    const undatedNote = c.undated ? `, ${c.undated} undated` : '';
+    lines.push(`  ${cat}: ${c.inWindow} in window / ${c.total} total${undatedNote}`);
+  }
+  return lines.length > 1 ? lines.join('\n') : null;
+}
+
+const _internals = { MS_PER_DAY };
+
+
+/***/ })
+
+};