@clear-capabilities/agentic-security-scanner 0.172.1 → 0.173.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-e7ecb2875e67c227bbc9a9643742632dbf486accded83c1ada02043d1c5307d1  agentic-security.mjs
+eab94f59f539296c01e17e2d914f419e131e2b4d1234865c011f755f11a64441  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.172.1",
+  "version": "0.173.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -67,6 +67,17 @@
     "test": "node ../scripts/run-unit-tests.mjs",
     "test:extras": "AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && node --experimental-test-module-mocks --test test/lineage-fault-injection.test.js && npm run test:python",
     "loop": "node ../scripts/loop-engineering/run.mjs",
+    "test:engineering-excellence": "node --test --test-concurrency=1 test/engineering-excellence/e0-01-inventory.test.js test/engineering-excellence/e0-02-baseline.test.js test/engineering-excellence/e0-03-contract.test.js test/engineering-excellence/e0-04-task-manifest.test.js test/engineering-excellence/e0-05-status-runner.test.js test/engineering-excellence/e0-06-backlog.test.js test/engineering-excellence/e1-01-dataset-provenance.test.js test/engineering-excellence/e1-02-splits.test.js test/engineering-excellence/e1-03-scoring.test.js test/engineering-excellence/e1-04-baseline-run.test.js test/engineering-excellence/e1-05-forensics.test.js test/engineering-excellence/e1-05-baseline-forensics.test.js test/engineering-excellence/e1-06-adversarial-controls.test.js test/engineering-excellence/e1-07-realcode-policy.test.js test/engineering-excellence/e1-07-baseline-gate.test.js test/engineering-excellence/e2-06-cross-language.test.js test/engineering-excellence/e2-08-suppression-attribution.test.js test/engineering-excellence/e2-09-semantic-gates.test.js test/engineering-excellence/e4-06-dci-real-app.test.js test/engineering-excellence/e6-08-perf-budget.test.js test/engineering-excellence/e8-02-e2e-demo.test.js test/engineering-excellence/e8-03-regression-report.test.js test/engineering-excellence/e8-04-docs.test.js test/engineering-excellence/e8-05-handoff.test.js test/engineering-excellence/e8-06-release-decision.test.js test/engineering-excellence/u01-ruby-path-resolver.test.js test/engineering-excellence/e1-08-scorecard.test.js test/engineering-excellence/e3-01-patch-routes.test.js test/engineering-excellence/e3-02-fix-verification-record.test.js test/engineering-excellence/e3-03-central-verifier.test.js test/engineering-excellence/e3-04-exploit-replay.test.js test/engineering-excellence/e3-05-functional-preservation.test.js test/engineering-excellence/e3-06-patch-policy.test.js test/engineering-excellence/e3-07-rollback-crash-safety.test.js test/engineering-excellence/e3-08-fix-benchmark.test.js test/engineering-excellence/e2-01-semantic-graph.test.js test/engineering-excellence/e2-02-cross-file-resolution.test.js test/engineering-excellence/e2-03-heap-fields-aliases.test.js test/engineering-excellence/e2-04-async-callbacks-frameworks.test.js test/engineering-excellence/e2-05-interprocedural-contexts.test.js test/engineering-excellence/e2-07-service-edges.test.js test/engineering-excellence/e4-01-dci-audit.test.js test/engineering-excellence/e4-02-invariants.test.js test/engineering-excellence/e4-03-cross-route.test.js test/engineering-excellence/e4-04-counterexample.test.js test/engineering-excellence/e4-05-llm-safeguards.test.js test/engineering-excellence/e4-07-dci-findings.test.js test/engineering-excellence/e6-01-telemetry.test.js test/engineering-excellence/e5-01-runtime-audit.test.js test/engineering-excellence/e5-02-build-identity.test.js test/engineering-excellence/e5-03-privacy-ingest.test.js test/engineering-excellence/e5-04-graph-reconciliation.test.js test/engineering-excellence/e5-05-exploitability-evidence.test.js test/engineering-excellence/e5-06-service-chain-graph.test.js test/engineering-excellence/e5-07-runtime-explanation.test.js test/engineering-excellence/e6-05-supervised-analyzers.test.js test/engineering-excellence/e6-06-determinism.test.js test/engineering-excellence/e6-07-adversarial-boundaries.test.js test/engineering-excellence/e6-03-shared-preprocessing.test.js test/engineering-excellence/e6-04-analysis-cache.test.js test/engineering-excellence/e7-01-evidence-contracts.test.js test/engineering-excellence/e7-03-release-package.test.js test/engineering-excellence/e7-04-compliance-truth.test.js test/engineering-excellence/e7-05-waivers-tenancy.test.js test/engineering-excellence/e7-02-provenance-coverage.test.js test/engineering-excellence/e7-06-fleet-exposure.test.js test/engineering-excellence/e7-07-perspectives.test.js test/engineering-excellence/e7-08-assurance-e2e.test.js test/engineering-excellence/e6-02-completion.test.js",
+    "ee:status": "node ../scripts/engineering-excellence/status.mjs --once",
+    "ee:init": "node ../scripts/engineering-excellence/init.mjs",
+    "ee:inventory": "node ../scripts/engineering-excellence/inventory.mjs",
+    "ee:contract": "node ../scripts/engineering-excellence/contract.mjs",
+    "ee:backlog": "node ../scripts/engineering-excellence/backlog.mjs",
+    "ee:dataset-audit": "node ../scripts/engineering-excellence/dataset-audit.mjs",
+    "ee:independent-baseline": "node ../scripts/engineering-excellence/independent-baseline.mjs",
+    "ee:dci-audit": "node ../scripts/engineering-excellence/dci-audit.mjs",
+    "ee:runtime-audit": "node ../scripts/engineering-excellence/runtime-audit.mjs",
+    "ee:ir-matrix": "node ../scripts/engineering-excellence/ir-matrix.mjs",
     "test:loop-real-prd": "node --test ../scripts/loop-engineering/test/loop-real-prd.test.js",
     "test:loop": "node --test --test-concurrency=1 ../scripts/loop-engineering/test/loop-manifest.test.js ../scripts/loop-engineering/test/loop-watchdog.test.js ../scripts/loop-engineering/test/loop-background.test.js ../scripts/loop-engineering/test/loop-dashboard.test.js ../scripts/loop-engineering/test/loop-evidence.test.js ../scripts/loop-engineering/test/loop-recovery.test.js ../scripts/loop-engineering/test/loop-remote.test.js ../scripts/loop-engineering/test/loop-runbook.test.js ../scripts/loop-engineering/test/loop-assurance-profile.test.js ../scripts/loop-engineering/test/loop-assurance-runtime.test.js ../scripts/loop-engineering/test/loop-bounds.test.js ../scripts/loop-engineering/test/loop-spend.test.js ../scripts/loop-engineering/test/loop-ci-attest.test.js",
     "test:python": "node ../scripts/run-python-tests.mjs",
@@ -137,6 +148,9 @@
     "bench:cve-replay:ci": "node ../bench/cve-replay/runner.mjs --ci",
     "bench:cve-replay:check": "node ../bench/cve-replay/runner.mjs --check-baseline",
     "bench:cve-replay:update-baseline": "node ../bench/cve-replay/runner.mjs --update-baseline",
+    "bench:realcode:report": "node ../bench/independent/realcode.mjs report",
+    "bench:realcode:check": "node ../bench/independent/realcode.mjs check --tier release",
+    "bench:realcode:check:quick": "node ../bench/independent/realcode.mjs check --tier quick",
     "bench:independent:gate:check": "node ../scripts/independent-population-gate.mjs",
     "bench:independent:update-gate-baseline": "node ../scripts/independent-population-gate.mjs --update-baseline",
     "bench:router-replay": "node ../bench/router-replay/runner.mjs",
@@ -163,9 +177,12 @@
     "bench:self-scan": "node ../bench/self-scan/measure.mjs",
     "bench:self-scan:check": "node ../bench/self-scan/check.mjs",
     "bench:nist-800-171-labels:check": "node ../bench/nist-800-171-labels/check.mjs",
-    "bench:mutation:check": "node ../bench/mutation/runner.mjs",
+    "bench:dci-real-app": "node ../bench/dci-real-app/runner.mjs", "bench:dci-real-app:check": "node ../bench/dci-real-app/runner.mjs --check", "ee:perf-budget": "node ../scripts/engineering-excellence/perf-budget.mjs", "ee:perf-budget:check": "node ../scripts/engineering-excellence/perf-budget.mjs --check", "ee:e2e-demo": "node ../scripts/engineering-excellence/e2e-demo.mjs", "ee:e2e-demo:check": "node ../scripts/engineering-excellence/e2e-demo.mjs --check", "ee:doc-captures": "node ../scripts/engineering-excellence/doc-captures.mjs", "ee:doc-captures:check": "node ../scripts/engineering-excellence/doc-captures.mjs --check", "ee:regression-report": "node ../scripts/engineering-excellence/regression-report.mjs", "ee:regression-report:check": "node ../scripts/engineering-excellence/regression-report.mjs --check", "ee:final-report": "node ../scripts/engineering-excellence/final-report.mjs", "ee:final-report:check": "node ../scripts/engineering-excellence/final-report.mjs --check", "bench:mutation:check": "node ../bench/mutation/runner.mjs",
     "baseline:capture": "node ../scripts/baseline-capture.mjs",
     "bench:protection-verdict:check": "node ../bench/protection-verdict/runner.mjs",
+    "bench:independent:forensics": "node ../bench/independent/forensics.mjs",
+    "bench:fix-verify": "node ../bench/fix-verification/runner.mjs",
+    "bench:fix-verify:check": "node ../bench/fix-verification/runner.mjs --check",
     "bench:fix-correctness": "node ../bench/fix-correctness/runner.mjs",
     "bench:iac-coverage": "node ../bench/iac-coverage/runner.mjs",
     "bench:prompt-injection": "node ../bench/prompt-injection/runner.mjs",
@@ -241,7 +258,15 @@
     "test:nixos-host": "node --test test/nix/nixos-host-runtime.test.js",
     "test:language-gates": "node --test --test-concurrency=1 test/language/language-benchmark-gates.test.js",
     "test:language-slow": "node --test --test-concurrency=1 test/language/language-doc-examples-metrics.test.js test/language/language-end-to-end.test.js test/language/language-package-ci.test.js test/language/language-scan-modes.test.js",
-    "test:chrome": "AGENTIC_SECURITY_CHROME_TESTS=1 node --test test/export-image.test.js test/server/cmd-dataflow-export.test.js"
+    "test:chrome": "AGENTIC_SECURITY_CHROME_TESTS=1 node --test test/export-image.test.js test/server/cmd-dataflow-export.test.js",
+    "ee:parse-reuse": "node ../scripts/engineering-excellence/parse-reuse-measure.mjs",
+    "ee:analysis-cache": "node ../scripts/engineering-excellence/analysis-cache-measure.mjs",
+    "ee:evidence-contracts": "node ../scripts/engineering-excellence/evidence-inventory.mjs",
+    "release:verify-package": "node ../scripts/verify-release-package.mjs",
+    "ee:completion": "node ../scripts/engineering-excellence/completion-analysis.mjs",
+    "ee:reproduce-timeouts": "node ../scripts/engineering-excellence/reproduce-timeouts.mjs",
+    "ee:provenance-measure": "node ../scripts/engineering-excellence/provenance-measure.mjs",
+    "ee:provenance-baseline": "node ../scripts/engineering-excellence/provenance-baseline.mjs"
   },
   "author": "Ross Young <ross@clearcapabilities.com>",
   "license": "PolyForm-Internal-Use-1.0.0",

package/src/context-intelligence/candidates.js

@@ -101,7 +101,8 @@ export async function adjudicate(candidates, opts = {}) {
         origin: 'context-intelligence', questionPack: c.questionPack, witnesses: c.witnesses, witnessCount: c.witnesses.length,
         sourceSpanEvidence: c.sourceSpanEvidence, scopeIntegrity: c.scopeIntegrity, reviewStatus: c.reviewStatus,
         uncertainties: c.uncertainties, recommendedValidation: c.recommendedValidation,
-        note: 'A model hypothesis checked for citations, not a proof. Severity comes from the confirmation tier only.',
+        ...(c.deterministic ? { deterministic: c.deterministic } : {}),
+        note: c.deterministic ? 'Derived from the code analysis and a deterministic counterexample attempt; no model produced this. Severity comes from the confirmation tier only.' : 'A model hypothesis checked for citations, not a proof. Severity comes from the confirmation tier only.',
       },
     };
   };

package/src/context-intelligence/capabilities.js

@@ -16,7 +16,8 @@ const BUILD = [
   { language: 'javascript/typescript', kind: 'http', frameworks: 'Express-style call registration (get/post/put/patch/delete/all, router.use, app.use)', status: 'verified', evidence: [T('build-js.test.js')], limits: 'Router mounts in another file and middleware factories are not followed (reported as router-mount-not-resolved); destructured and named imports are followed, re-exports and tsconfig path aliases are not.' },
   { language: 'python', kind: 'http', frameworks: 'decorator registration (Flask/FastAPI-style @app.route / @router.get), FastAPI Depends()/Security() guards', status: 'experimental', evidence: [T('build-python-haskell.test.js'), T('frameworks.test.js')], limits: 'Decorator guards are read from the decorator lines and Depends() guards from the signature (only dependencies named like an auth or user provider bind the principal); framework-level before_request hooks and Django URL conf are not modelled.' },
   { language: 'haskell', kind: 'http', frameworks: 'Scotty, WAI, Servant, Yesod (through the existing web model)', status: 'verified', evidence: [T('build-python-haskell.test.js'), T('frameworks.test.js')], limits: 'Static source analysis; the existing web model decides what a route is. Dynamic routes are reported unresolved.' },
-  { language: 'java/kotlin/c#/go/php/ruby/rust', kind: 'http', frameworks: 'whatever the engine route scan recognises', status: 'unsupported', evidence: [], limits: 'No fixture proves this, so it is listed as unsupported even though some routes may resolve: Handlers are resolved only for decorator/annotation-style registration; no dedicated fixtures here.' },
+  { language: 'php', kind: 'http', frameworks: 'Laravel Route:: registration (the entry point only)', status: 'experimental', evidence: ['test/engineering-excellence/e4-01-dci-audit.test.js'], limits: 'Measured by the E4-01 audit on one fixture: the routes resolve, but no control or sensitive operation was extracted from the handlers.' },
+  { language: 'java/kotlin/c#/go/ruby/rust', kind: 'http', frameworks: 'whatever the engine route scan recognises', status: 'unsupported', evidence: [], limits: 'Measured by the E4-01 audit (docs/engineering-excellence/DCI_MATURITY.md) on one fixture per language (Spring, net/http, ASP.NET, Rails): no entry point was found, so no bundle is built.' },
   { language: 'any with a recognised surface', kind: 'webhook/queue/cron/upload/cli', frameworks: 'existing entry-point inventory', status: 'experimental', evidence: [T('build-js.test.js')], limits: 'Handler is the enclosing declaration of the surface; no framework wiring beyond that.' },
   { language: 'haskell', kind: 'compiler metadata import', frameworks: 'hie-export/1 JSON export of GHC declarations and references', status: 'experimental', evidence: [T('hie-adapter.test.js')], limits: 'Reads an export; never runs GHC or hiedb. The export is validated against the source snapshot. No export produced by a real GHC run is checked in.' },
   { language: 'any', kind: 'compiler metadata build', frameworks: 'automatic metadata generation', status: 'blocked', evidence: [], limits: 'Running a compiler on untrusted source needs a sandbox proof this build does not have (Template Haskell, custom Setup and plugins run code).' },

package/src/context-intelligence/cli.js

@@ -351,6 +351,8 @@ async function cmdReview(root, args, format) {
         maxCalls: num(flag(args, 'max-calls')) || config.review.maxCalls,
         maxWallSeconds: num(flag(args, 'max-wall-seconds')) || config.review.maxWallSeconds,
         maxTokensPerJob: config.review.maxTokensPerJob,
+        maxTokensPerRepo: config.review.maxTokensPerRepo,
+        anonymizePrompts: config.review.anonymizePrompts,
         maxRetries: config.review.maxRetries,
         jobTimeoutMs: (num(flag(args, 'job-timeout-seconds')) || 120) * 1000,
         maxCostUsd: num(flag(args, 'max-cost-usd')) ?? config.review.maxCostUsd,

package/src/context-intelligence/config.js

@@ -22,7 +22,7 @@ export const DEFAULT_CONFIG = Object.freeze({
   maxFiles: 3000,
   semanticMetadata: { mode: 'off', haskellHieDir: null },
   context: { profile: 'standard', maxTokens: null, pruneLowValue: true, maxSymbols: 60, maxDepth: 12 },
-  review: { enabled: false, allowRemote: false, questionPacks: ['authz-idor'], concurrency: 2, maxCalls: 100, maxWallSeconds: 900, maxCostUsd: null, maxTokensPerJob: 40000, maxRetries: 3 },
+  review: { enabled: false, allowRemote: false, questionPacks: ['authz-idor'], concurrency: 2, maxCalls: 100, maxWallSeconds: 900, maxCostUsd: null, maxTokensPerJob: 40000, maxRetries: 3, maxTokensPerRepo: null, anonymizePrompts: false },
   replay: { contentAddressed: true, retention: 'inherit' },
 });
 
@@ -71,6 +71,8 @@ export function normalizeConfig(raw) {
       maxCostUsd: Number.isFinite(rv.maxCostUsd) && rv.maxCostUsd >= 0 ? rv.maxCostUsd : null,
       maxTokensPerJob: clamp(rv.maxTokensPerJob, 1000, 400000, d.review.maxTokensPerJob),
       maxRetries: clamp(rv.maxRetries, 0, 3, d.review.maxRetries),
+      maxTokensPerRepo: Number.isFinite(rv.maxTokensPerRepo) && rv.maxTokensPerRepo >= 1000 ? Math.trunc(rv.maxTokensPerRepo) : null,
+      anonymizePrompts: rv.anonymizePrompts === true,
     },
     replay: { contentAddressed: rp.contentAddressed !== false, retention: typeof rp.retention === 'string' ? rp.retention : 'inherit' },
   };

package/src/context-intelligence/controls.js

@@ -139,6 +139,51 @@ function clip(s) { return s.trim().slice(0, 160); }
  *   lines   the FILE's lines (0-based array)
  * Returns [{ symbolId, line, category:'control'|'sensitive', kind, subkind, evidence, basis, rejectionSeen, text }]
  */
+/**
+ * Blank the comments (and Python docstrings) of a source file, keeping every character position and newline, so line numbers do not move.
+ * The analysis looks for calls and comparisons in code; a comment that SAYS `ownerId: req.user.id` or `requireUser(req)` is prose, and prose is the
+ * easiest thing for a hostile or merely careless author to write. Strings are left alone (the principal and SQL rules already read around them).
+ */
+export function blankComments(text, file = '') {
+  const src = String(text || '');
+  const hash = /\.(?:py|rb|sh|php|pl|r)$/i.test(file);
+  const dashes = /\.l?hs$/i.test(file);
+  const cLike = !dashes && !/\.(?:py|rb|sh|pl|r)$/i.test(file);
+  const out = src.split('');
+  const n = src.length;
+  let i = 0;
+  const blank = (a, b) => { for (let k = a; k < b && k < n; k++) if (out[k] !== '\n') out[k] = ' '; };
+  while (i < n) {
+    const c = src[i]; const d = src[i + 1];
+    if (c === '"' || c === "'" || c === '`') {
+      if (/\.py$/i.test(file) && src.startsWith(c.repeat(3), i)) {
+        const end = src.indexOf(c.repeat(3), i + 3); const stop = end < 0 ? n : end + 3;
+        blank(i, stop); i = stop; continue;           // a docstring or triple-quoted block is prose
+      }
+      let j = i + 1;
+      while (j < n && src[j] !== c && !(src[j] === '\n' && c !== '`')) { if (src[j] === '\\') j++; j++; }
+      i = j + 1; continue;
+    }
+    if (cLike && c === '/' && d === '*') { const end = src.indexOf('*/', i + 2); const stop = end < 0 ? n : end + 2; blank(i, stop); i = stop; continue; }
+    if (cLike && c === '/' && d === '/' && (i === 0 || /[\s;,)}{\]]/.test(src[i - 1]))) { let j = src.indexOf('\n', i); if (j < 0) j = n; blank(i, j); i = j; continue; }
+    if (hash && c === '#' && !(file.endsWith('.php') && d === '[')) { let j = src.indexOf('\n', i); if (j < 0) j = n; blank(i, j); i = j; continue; }
+    if (dashes && c === '-' && d === '-' && !/[!#$%&*+./<=>?@\\^|~:]/.test(src[i + 2] || ' ')) { let j = src.indexOf('\n', i); if (j < 0) j = n; blank(i, j); i = j; continue; }
+    if (dashes && c === '{' && d === '-') { const end = src.indexOf('-}', i + 2); const stop = end < 0 ? n : end + 2; blank(i, stop); i = stop; continue; }
+    i++;
+  }
+  return out.join('');
+}
+
+function bodyAfterSignature(raw) {
+  const arrow = raw.indexOf('=>');
+  let rest = null;
+  if (arrow >= 0) rest = raw.slice(arrow + 2);
+  else { const m = /\)\s*\{(.*)$/.exec(raw); if (m) rest = m[1]; }
+  if (rest === null) return '';
+  const brace = /^\s*\{(.*)$/.exec(rest);
+  return brace ? brace[1] : rest;
+}
+
 export function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
   const out = [];
   const seen = new Set();
@@ -171,7 +216,10 @@ export function analyzeSymbolText(symbol, lines, { haskell = false } = {}) {
     const calls = [];
     const re = /([A-Za-z_$][\w$]*(?:(?:\.|::)[A-Za-z_$][\w$]*)*)\s*\(/g;
     let m;
-    if (!isDeclLine) { while ((m = re.exec(raw))) calls.push(m[1]); }
+    // A one-line handler (`app.get('/x', guard, async (req, res) => { res.json(await db.docs.findOne({ id })); })`) is its own declaration
+    // line, so skipping the whole line also skipped its body. Only the SIGNATURE is skipped: the calls after the arrow or the opening brace count.
+    const scanText = isDeclLine ? bodyAfterSignature(raw) : raw;
+    while ((m = re.exec(scanText))) calls.push(m[1]);
     if (haskell && !isDeclLine) {
       const hre = /\b([A-Z][\w.]*\.[a-z][\w']*|[a-z][\w']*)\b/g;
       while ((m = hre.exec(raw))) if (AUTH_NAME.test(m[1]) || HS_SENSITIVE.test(m[1])) calls.push(m[1]);

package/src/context-intelligence/counterexample.js

@@ -0,0 +1,200 @@
+// Deterministic counterexample validation for a candidate invariant violation (E4-04).
+//
+// A candidate (for example a cross-route inconsistency from E4-03) says "this route looks weaker than its sibling". This module tries to settle it
+// WITHOUT a model, in layers, and reports where it got to as one of four states that are never blended:
+//
+//   refuted     the claim is contradicted: the control IS on the path, the route is declared public by policy, there is no sensitive operation
+//               on the resource, or an executed attempt by the attacker was denied
+//   unresolved  the analysis cannot say: an unresolved call or a traversal limit could hide the control, or the fixture could not run
+//   plausible   every edge is resolved and the path reaches the resource's sensitive operation with no control of that kind before it, but nothing
+//               was executed. This is static evidence only
+//   proven      an authorized LOCAL request fixture ran the real handler code and the attacker, who does not own the object, read or changed the
+//               victim's object. Only an execution can produce this state
+//
+// MODEL OUTPUT NEVER ENTERS. This file imports nothing from the review or model paths and reads no prose: facts come from the code analysis, which
+// skips comments, docstrings and string contents, so a comment that claims a check exists, or tells a reviewer to ignore the finding, cannot move a
+// state. The evidence trace is a list of steps each naming its kind (`static` or `executed`), so a reader can see which layer decided.
+//
+// THE FIXTURE RUNNER executes handler code, so it is confined: a child process under Node's permission model with NO file access (the fixture's sources are loaded from memory), no
+// child processes and no workers, a driver that removes `fetch` and refuses every builtin and package, a scrubbed environment, a wall-clock
+// limit and capped output. Network is not part of Node's permission model, so it is blocked by the driver, not by the runtime: lower assurance. Express-style
+// apps are supported through a small in-process shim for `express`, and `db` is a recording in-memory store the fixture supplies. Code that needs
+// anything else (a real database, another module system, a missing dependency) ends as `unresolved`, never as `proven`.
+import { spawnSync } from 'node:child_process';
+import * as path from 'node:path';
+
+export const STATES = Object.freeze(['proven', 'plausible', 'refuted', 'unresolved']);
+const FIXTURE_TIMEOUT_MS = 8000;
+const MAX_OUTPUT = 200_000;
+const MAX_FIXTURE_BYTES = 100_000;
+
+// ---- the fixture runner -----------------------------------------------------------------------------------------------------
+
+const DRIVER = String.raw`
+'use strict';
+const path = require('node:path');
+const spec = JSON.parse(process.env.FIXTURE_SPEC);
+const ops = [];
+const store = JSON.parse(JSON.stringify(spec.store || {}));
+const match = (doc, q) => Object.entries(q || {}).every(([k, v]) => (v && typeof v === 'object' && !Array.isArray(v)) ? true : doc[k] === v);
+const coll = (name) => ({
+  async findOne(q) { ops.push({ op: 'findOne', c: name, q }); return (store[name] || []).find((d) => match(d, q)) || null; },
+  async find(q) { ops.push({ op: 'find', c: name, q }); return (store[name] || []).filter((d) => match(d, q)); },
+  async updateOne(q, u) { ops.push({ op: 'updateOne', c: name, q }); const d = (store[name] || []).find((x) => match(x, q)); if (d) Object.assign(d, (u && u.$set) || u); return { matchedCount: d ? 1 : 0 }; },
+  async deleteOne(q) { ops.push({ op: 'deleteOne', c: name, q }); const i = (store[name] || []).findIndex((x) => match(x, q)); if (i >= 0) store[name].splice(i, 1); return { deletedCount: i >= 0 ? 1 : 0 }; },
+  async insertOne(d) { ops.push({ op: 'insertOne', c: name }); (store[name] ||= []).push(d); return { insertedId: d.id }; },
+});
+global.db = new Proxy({}, { get: (_, name) => coll(String(name)) });
+const routes = []; const mw = [];
+const app = {};
+for (const m of ['get', 'post', 'put', 'patch', 'delete']) app[m] = (p, ...hs) => { routes.push({ method: m.toUpperCase(), path: p, handlers: hs.flat() }); return app; };
+app.use = (...a) => { const fn = a.find((x) => typeof x === 'function'); if (fn) mw.push(fn); return app; };
+app.listen = () => app; app.set = () => app; app.disable = () => app;
+const express = () => app; express.json = () => (q, s, n) => n(); express.urlencoded = () => (q, s, n) => n(); express.Router = () => app;
+// The fixture's files are loaded from memory: nothing is read from disk, so the process needs no file permission at all, and require can only
+// reach the shim for express and the fixture's own relative modules. Everything else, builtins included, is refused.
+delete globalThis.fetch; delete globalThis.WebSocket;
+const vm = require('node:vm');
+const cache = new Map();
+const norm = (p) => path.posix.normalize(p).replace(/^\.\//, '');
+const fileFor = (from, request) => {
+  const base = path.posix.join(path.posix.dirname(from), request);
+  for (const c of [base, base + '.js', base + '.cjs', base + '/index.js']) if (Object.hasOwn(spec.files, norm(c))) return norm(c);
+  return null;
+};
+const load = (file) => {
+  if (cache.has(file)) return cache.get(file).exports;
+  const mod = { exports: {} }; cache.set(file, mod);
+  const req = (request) => {
+    if (request === 'express') return express;
+    if (request.startsWith('.')) { const f = fileFor(file, request); if (f) return load(f); throw Object.assign(new Error('no such fixture module ' + request), { code: 'FIXTURE_UNSUPPORTED' }); }
+    throw Object.assign(new Error('fixture runner does not provide module ' + request), { code: 'FIXTURE_UNSUPPORTED' });
+  };
+  const wrapper = '(function (exports, require, module, __filename, __dirname) {' + spec.files[file] + '\n})';
+  vm.runInThisContext(wrapper, { filename: file })(mod.exports, req, mod, file, path.posix.dirname(file));
+  return mod.exports;
+};
+const matchRoute = (r, method, url) => {
+  if (r.method !== method) return null;
+  const a = r.path.split('/'); const b = url.split('/');
+  if (a.length !== b.length) return null;
+  const params = {};
+  for (let i = 0; i < a.length; i++) { if (a[i].startsWith(':')) params[a[i].slice(1)] = b[i]; else if (a[i] !== b[i]) return null; }
+  return params;
+};
+(async () => {
+  let result;
+  try {
+    load(norm(spec.entry));
+    const req0 = spec.request;
+    const hit = routes.map((r) => ({ r, params: matchRoute(r, req0.method, req0.path) })).find((x) => x.params);
+    if (!hit) { result = { error: 'no-route', detail: req0.method + ' ' + req0.path }; }
+    else {
+      const user = spec.user ? JSON.parse(JSON.stringify(spec.user)) : undefined;
+      const req = { method: req0.method, params: hit.params, query: req0.query || {}, body: req0.body || {}, headers: {}, user, get: () => undefined };
+      let done; const finished = new Promise((r) => { done = r; });
+      const res = { statusCode: 200, body: undefined, sent: false,
+        status(c) { this.statusCode = c; return this; }, json(b) { this.body = b; this.sent = true; done(); return this; }, send(b) { this.body = b; this.sent = true; done(); return this; },
+        sendStatus(c) { this.statusCode = c; this.sent = true; done(); return this; }, set() { return this; }, end() { this.sent = true; done(); return this; }, type() { return this; }, locals: {} };
+      const chain = [...mw, ...hit.r.handlers];
+      let i = 0;
+      const next = (err) => { if (err) { res.statusCode = 500; res.sent = true; done(); return; } const h = chain[i++]; if (!h) { done(); return; } try { const p = h(req, res, next); if (p && typeof p.then === 'function') p.catch((e) => { res.statusCode = 500; res.body = String(e && e.message); res.sent = true; done(); }); } catch (e) { res.statusCode = 500; res.body = String(e && e.message); res.sent = true; done(); } };
+      next();
+      await Promise.race([finished, new Promise((r) => setTimeout(r, 2000))]);
+      result = { status: res.statusCode, body: res.body, sent: res.sent, ops, store };
+    }
+  } catch (e) { result = { error: e && e.code === 'FIXTURE_UNSUPPORTED' ? 'unsupported' : 'load-failed', detail: String(e && e.message).slice(0, 300) }; }
+  process.stdout.write('@@RESULT@@' + JSON.stringify(result));
+})();
+`;
+
+/**
+ * Run one request against the real handler code under confinement.
+ * @param {{files:Record<string,string>, entry:string, request:{method:string,path:string,body?:object,query?:object}, user?:object, store?:object}} f
+ * @returns {{ok:boolean, status?:number, body?:any, ops?:object[], store?:object, error?:string, detail?:string}}
+ */
+export function runFixture(f) {
+  const total = Object.values(f.files || {}).reduce((n, t) => n + String(t).length, 0);
+  if (total > MAX_FIXTURE_BYTES) return { ok: false, error: 'too-large', detail: `${total} bytes of fixture source` };
+  for (const rel of Object.keys(f.files || {})) if (path.isAbsolute(rel) || rel.split('/').includes('..')) return { ok: false, error: 'bad-path', detail: rel };
+  // `--permission` with no allow flags: no file reads or writes, no child processes, no workers. The driver comes in through -e and the fixture's
+  // files through the environment, so nothing needs the disk. Network is not covered by the permission model; the driver removes `fetch` and
+  // refuses every builtin and package, which is the whole of its network reach.
+  const r = spawnSync(process.execPath, ['--permission', '-e', DRIVER], {
+    encoding: 'utf8', timeout: FIXTURE_TIMEOUT_MS, maxBuffer: MAX_OUTPUT,
+    env: { PATH: '/usr/bin:/bin', FIXTURE_SPEC: JSON.stringify({ files: f.files, entry: f.entry, request: f.request, user: f.user, store: f.store }) },
+  });
+  if (r.error) return { ok: false, error: r.error.code === 'ETIMEDOUT' ? 'timeout' : 'spawn-failed', detail: String(r.error.message).slice(0, 200) };
+  const out = String(r.stdout || ''); const i = out.indexOf('@@RESULT@@');
+  if (i < 0) return { ok: false, error: 'no-result', detail: String(r.stderr || '').slice(0, 300) };
+  let parsed; try { parsed = JSON.parse(out.slice(i + 10)); } catch { return { ok: false, error: 'bad-result' }; }
+  return parsed.error ? { ok: false, error: parsed.error, detail: parsed.detail } : { ok: true, ...parsed };
+}
+
+/**
+ * Make the attacker's request against the real handler code and say what happened to the victim's object. Used by assessCandidate and, after a patch,
+ * by the final verification of a fix (which must execute even when a static look already says the control is present).
+ * @returns {{state:'proven'|'refuted'|'unresolved', trace:object[], reasons:string[], reason?:string, status?:number}}
+ */
+export function executeAttempt(candidate, fx) {
+  const trace = [];
+  const method = fx.method || (candidate.operations?.includes('delete') ? 'DELETE' : candidate.operations?.includes('update') ? 'PUT' : 'GET');
+  const attack = runFixture({ files: fx.files, entry: fx.entry, request: { method, path: fx.path, body: fx.body }, user: fx.attacker.user, store: fx.store });
+  if (!attack.ok) { trace.push(step('executed', 'attacker request', `${attack.error}: ${attack.detail || ''}`)); return { state: 'unresolved', trace, reasons: [`the fixture could not run (${attack.error}); the claim stays unproven`], reason: `the fixture could not run (${attack.error}); the claim stays unproven` }; }
+  trace.push(step('executed', 'attacker request', `${method} ${fx.path} as ${JSON.stringify(fx.attacker.user)} -> ${attack.status}`));
+  const marker = fx.victim.marker;
+  const leaked = marker ? JSON.stringify(attack.body ?? '').includes(marker) : attack.status >= 200 && attack.status < 300 && attack.body != null;
+  const changed = JSON.stringify(attack.store?.[fx.victim.collection] || []) !== JSON.stringify(fx.store[fx.victim.collection] || []);
+  if (leaked || changed) {
+    trace.push(step('executed', 'effect on the victim\'s object', leaked ? 'the attacker received the victim\'s data' : 'the victim\'s object was modified by the attacker'));
+    if (fx.siblingPath) {
+      const sib = runFixture({ files: fx.files, entry: fx.entry, request: { method: fx.siblingMethod || 'GET', path: fx.siblingPath }, user: fx.attacker.user, store: fx.store });
+      if (sib.ok) trace.push(step('executed', 'the enforcing sibling, same attacker', `${fx.siblingMethod || 'GET'} ${fx.siblingPath} -> ${sib.status}${marker && !JSON.stringify(sib.body ?? '').includes(marker) ? ' (victim data withheld)' : ''}`));
+    }
+    return { state: 'proven', trace, reasons: ['an executed local request let a principal who does not own the object ' + (leaked ? 'read' : 'change') + ' it'], status: attack.status };
+  }
+  trace.push(step('executed', 'effect on the victim\'s object', 'none: the attacker was denied or got nothing'));
+  return { state: 'refuted', trace, reasons: [`an executed attempt by the attacker was denied (status ${attack.status})`], status: attack.status };
+}
+
+// ---- the assessment ---------------------------------------------------------------------------------------------------------
+
+const step = (kind, what, detail = null) => ({ kind, what, ...(detail ? { detail } : {}) });
+const sameBundle = (b, route) => b.entrypoint && b.entrypoint.label === route;
+
+/**
+ * @param {{route:string, resource:string, dimension:string, operations?:string[], enforcedAt?:object[], waivedBy?:string[]}} candidate  e.g. a finding from findCrossRouteInconsistencies
+ * @param {{bundles:object[], fixture?:{files:Record<string,string>, entry:string, victim:{user:object, ownsId:string, collection:string, marker?:string}, attacker:{user:object}, store:object, path:string, method?:string, body?:object, siblingPath?:string, siblingMethod?:string}}} ctx
+ * @returns {{state:'proven'|'plausible'|'refuted'|'unresolved', trace:object[], reasons:string[]}}
+ */
+export function assessCandidate(candidate, ctx) {
+  const trace = [];
+  const fail = (state, reason) => ({ state, trace, reasons: [reason] });
+  const bundle = (ctx.bundles || []).find((b) => sameBundle(b, candidate.route));
+  if (!bundle || !bundle.manifest) { trace.push(step('static', 'locate the route bundle', 'no bundle for this route')); return fail('unresolved', `no analysed bundle for ${candidate.route}`); }
+  trace.push(step('static', 'locate the route bundle', bundle.entrypoint.id));
+
+  if (candidate.waivedBy && candidate.waivedBy.length) { trace.push(step('static', 'check policy', `public-by-design: ${candidate.waivedBy.join(', ')}`)); return fail('refuted', `declared public by ${candidate.waivedBy.join(', ')}`); }
+
+  const facts = bundle.reach?.facts || [];
+  const sens = facts.filter((f) => f.category === 'sensitive');
+  if (!sens.length) { trace.push(step('static', 'find a sensitive operation', 'none on the path')); return fail('refuted', 'no sensitive operation is reachable from this route, so there is nothing to protect'); }
+  const first = Math.min(...sens.map((f) => f.effLine));
+  const kinds = candidate.dimension === 'ownership' ? ['ownership'] : [candidate.dimension];
+  const before = facts.filter((f) => f.category === 'control' && kinds.includes(f.kind) && (f.effLine < first || (f.basis === 'query-filter' && f.effLine <= first)));
+  if (before.length) { trace.push(step('static', `look for ${candidate.dimension} before the first sensitive operation`, `found at ${before[0].file}:${before[0].line}`)); return fail('refuted', `${candidate.dimension} is enforced at ${before[0].file}:${before[0].line} before the sensitive operation`); }
+  trace.push(step('static', `look for ${candidate.dimension} before the first sensitive operation`, 'none'));
+
+  const hidden = (bundle.manifest.unknowns || []).some((u) => u.material) || bundle.reach?.capped;
+  if (hidden) { trace.push(step('static', 'check for unresolved calls', 'a material unresolved call or a traversal limit')); return fail('unresolved', 'an unresolved call or a traversal limit could hide the control'); }
+  trace.push(step('static', 'check for unresolved calls', 'none'));
+
+  const fx = ctx.fixture;
+  if (!fx) return { state: 'plausible', trace, reasons: ['every edge on the path is resolved and no control precedes the sensitive operation; nothing was executed'] };
+
+  const ex = executeAttempt(candidate, fx);
+  trace.push(...ex.trace);
+  if (ex.state === 'unresolved') return fail('unresolved', ex.reason);
+  if (ex.state === 'proven') return { state: 'proven', trace, reasons: ex.reasons };
+  return { state: 'refuted', trace, reasons: ex.reasons };
+}

package/src/context-intelligence/cross-route.js

@@ -0,0 +1,111 @@
+// Cross-route consistency (E4-03): does every route that touches a resource enforce what its sibling routes enforce?
+//
+// The classic authorization bug is not a missing check on the only route; it is a check on `GET /orders/:id` and none on `PUT /orders/:id` or
+// `DELETE /orders/:id`. A per-route review sees each handler as fine. This compares, per resource, the controls the routes carry, using the facts
+// DCI already extracted along route -> middleware -> handler -> service -> persistence, so a check made in a service layer counts for the route that
+// reaches it.
+//
+// WHAT IT CLAIMS. For a resource touched by two or more routes, a control (authentication, authorization-role, ownership, tenant-scope) that at
+// least one route enforces before its sensitive operation and another does not is an INCONSISTENCY. It is evidence that the missing route is
+// weaker than its sibling, not proof of a vulnerability: that needs a counterexample (E4-04).
+//
+// WHAT IT REFUSES TO CLAIM.
+//   - A route whose control could hide behind an unresolved call or a traversal limit is `unknown`, never "missing": absence of evidence in an
+//     incomplete context is not absence of the control, and dynamic dispatch is not proof of safety either.
+//   - A route that an invariant declares public-by-design for that control is SUPPRESSED, with the policy id and reason kept.
+//   - A resource touched by a single route has nothing to compare and produces nothing.
+//   - The resource name comes from the text of the data operation (collection, table or model); an operation whose target cannot be named is
+//     left out and counted, not guessed.
+import { evaluateInvariants } from './invariants.js';
+
+export const CONSISTENCY_DIMENSIONS = Object.freeze(['authentication', 'authorization-role', 'ownership', 'tenant-scope']);
+
+const SQL_TARGET = /\b(?:FROM|INTO|UPDATE)\s+[`"']?([A-Za-z_][\w.]*)/i;
+const COLLECTION = /\bcollection\s*\(\s*['"`]([\w.-]+)['"`]\s*\)/;
+const DB_MEMBER = /\b(?:db|database|mongo|prisma|knex|models?)\s*\.\s*([A-Za-z_]\w*)\s*\.\s*(?:find|findOne|findMany|findById|findAll|findUnique|findFirst|insert|insertOne|insertMany|create|update|updateOne|updateMany|delete|deleteOne|deleteMany|remove|save|upsert|count|aggregate|get)\b/;
+const MODEL = /\b([A-Z][A-Za-z0-9]+)\s*\.\s*(?:find|findOne|findAll|findByPk|findById|findUnique|create|update|destroy|delete|remove|save|where|objects)\b/;
+const REPO_CALL = /\b([a-z][A-Za-z0-9]*?)(?:Repo|Repository|Dao|Store)\s*\.\s*\w+\s*\(/;
+
+/** Resource key: lowercase, singular-ish (`Orders`, `order`, `orders` all become `order`). */
+export function resourceKey(text) {
+  const t = String(text || '');
+  const m = COLLECTION.exec(t) || DB_MEMBER.exec(t) || SQL_TARGET.exec(t) || MODEL.exec(t) || REPO_CALL.exec(t);
+  if (!m) return null;
+  const raw = m[1].split('.').pop().toLowerCase();
+  if (!raw || ['db', 'models', 'model', 'table', 'tables', 'users_table_placeholder'].includes(raw)) return null;
+  return raw.replace(/ies$/, 'y').replace(/(?<!s)s$/, '');
+}
+
+function operationOf(fact) {
+  const t = String(fact.text || '');
+  if (/\b(?:delete|remove|destroy|drop)\w*/i.test(t)) return 'delete';
+  if (/\b(?:update|set|patch|save|upsert|replace)\w*/i.test(t)) return 'update';
+  if (/\b(?:insert|create|add)\w*/i.test(t)) return 'create';
+  return fact.subkind === 'write' ? 'update' : 'read';
+}
+
+function stateOf(bundle, dim) {
+  const facts = bundle.reach?.facts || [];
+  const sens = facts.filter((f) => f.category === 'sensitive');
+  const first = sens.length ? Math.min(...sens.map((f) => f.effLine)) : null;
+  const kinds = dim === 'ownership' ? ['ownership'] : [dim];
+  const ctl = facts.filter((f) => f.category === 'control' && kinds.includes(f.kind) && (first === null || f.effLine < first || (f.basis === 'query-filter' && f.effLine <= first)));
+  if (ctl.length) return { state: 'enforced', evidence: ctl.slice(0, 3).map((f) => ({ file: f.file, line: f.line, basis: f.basis, evidence: f.evidence })) };
+  const prot = bundle.manifest?.protection?.[dim === 'tenant-scope' ? 'ownership' : dim];
+  if (prot && prot.state === 'present' && dim !== 'tenant-scope' && dim !== 'ownership') return { state: 'enforced', evidence: prot.evidence || [] };
+  const unresolved = (bundle.manifest?.unknowns || []).some((u) => u.material) || bundle.reach?.capped || prot?.state === 'not_resolved' || prot?.state === 'omitted_due_to_budget';
+  return unresolved ? { state: 'unknown' } : { state: 'absent' };
+}
+
+/**
+ * @param {{entrypoint:object, manifest:object, reach:object}[]} bundles
+ * @param {{invariants?:object, now?:Date}} [opts] an invariants document: its public-by-design waivers suppress findings
+ */
+export function findCrossRouteInconsistencies(bundles, opts = {}) {
+  const now = opts.now || new Date();
+  const built = bundles.filter((b) => b.manifest && b.reach);
+  const byResource = new Map();
+  let unnamed = 0;
+  for (const b of built) {
+    const sens = (b.reach.facts || []).filter((f) => f.category === 'sensitive' && String(f.kind).startsWith('data-'));
+    const touched = new Map();
+    for (const f of sens) {
+      const key = resourceKey(f.text);
+      if (!key) { unnamed++; continue; }
+      if (!touched.has(key)) touched.set(key, new Set());
+      touched.get(key).add(operationOf(f));
+    }
+    for (const [key, ops] of touched) {
+      if (!byResource.has(key)) byResource.set(key, []);
+      byResource.get(key).push({ bundle: b, ops: [...ops].sort() });
+    }
+  }
+  const findings = []; const suppressed = []; const unknown = [];
+  const waiver = (b, dim) => {
+    if (!opts.invariants) return null;
+    const r = evaluateInvariants({ ...opts.invariants, invariants: [...opts.invariants.invariants, { id: 'PROBE-DIM', title: 'probe', rule: 'requires', appliesTo: { routes: ['**'] }, requires: [dim] }] }, [b], { now });
+    const probe = r.results.find((x) => x.invariantId === 'PROBE-DIM');
+    return probe && probe.verdict === 'public_by_policy' ? probe.waivedBy : null;
+  };
+  for (const [resource, entries] of [...byResource].sort(([a], [c]) => (a < c ? -1 : 1))) {
+    const routes = [...new Map(entries.map((e) => [e.bundle.entrypoint.id, e])).values()];
+    if (routes.length < 2) continue;
+    for (const dim of CONSISTENCY_DIMENSIONS) {
+      const states = routes.map((r) => ({ r, ...stateOf(r.bundle, dim) }));
+      const enforced = states.filter((s) => s.state === 'enforced');
+      if (!enforced.length) continue;
+      for (const s of states) {
+        if (s.state === 'enforced') continue;
+        const ep = s.r.bundle.entrypoint;
+        const base = { resource, dimension: dim, route: ep.label, file: ep.rootSpan?.file || ep.registrationSite?.file || '', operations: s.r.ops, enforcedAt: enforced.map((e) => ({ route: e.r.bundle.entrypoint.label, operations: e.r.ops, evidence: e.evidence })) };
+        if (s.state === 'unknown') { unknown.push({ ...base, reason: 'an unresolved call or a traversal limit could hide the control; dynamic dispatch is not proof of absence' }); continue; }
+        const w = waiver(s.r.bundle, dim);
+        if (w) { suppressed.push({ ...base, waivedBy: w, reason: 'declared public-by-design for this control' }); continue; }
+        const klass = dim === 'tenant-scope' ? 'cross-tenant' : dim === 'ownership' ? 'idor' : 'missing-control';
+        findings.push({ id: `xroute:${resource}:${dim}:${ep.id}`, class: klass, ...base, confidence: 'inconsistency', explanation: `${enforced.map((e) => e.r.bundle.entrypoint.label).join(', ')} enforce ${dim} on ${resource}; ${ep.label} (${s.r.ops.join('/')}) does not` });
+      }
+    }
+  }
+  findings.sort((a, b) => (a.id < b.id ? -1 : 1));
+  return { findings, suppressed, unknown, resourcesCompared: [...byResource].filter(([, e]) => new Set(e.map((x) => x.bundle.entrypoint.id)).size >= 2).map(([k]) => k).sort(), operationsWithoutResource: unnamed };
+}