@clear-capabilities/agentic-security-scanner 0.172.1 → 0.174.0

package/src/language/haskell-ir.js

@@ -761,7 +761,9 @@ class FnLowerer {
   // ── statements / control flow ──────────────────────────────────────────────
   addCallNode(expr, ln) {
     if (!expr) return;
-    if (expr.kind === 'call') this.cfg.add('call', ln, { callee: expr.callee, args: expr.args, hs: expr.hs });
+    // The call expression carries the line it was written on. The context that finally executes it (the last statement of a `do` handed to `get "/r" $`) is on an
+    // earlier line, and reporting that line would place the finding on the start of the whole handler instead of on the sink.
+    if (expr.kind === 'call') this.cfg.add('call', Number.isInteger(expr.line) && expr.line >= 1 ? expr.line : ln, { callee: expr.callee, args: expr.args, hs: expr.hs });
     else if (expr.kind !== 'literal' && expr.kind !== 'ident') this.cfg.add('assign', ln, { target: `$e${this.tmp++}`, source: expr, hs: { demand: 'executed' } });
   }
 

package/src/language/haskell-models.js

@@ -49,6 +49,28 @@ export const HS_PACKAGES = Object.freeze({
   random: { modules: ['System.Random'], tested: ['1.2'] },
   hxt: { modules: ['Text.XML.HXT.Core'], tested: ['9.3'] },
   bytestring: { modules: ['Data.ByteString', 'Data.ByteString.Char8', 'Data.ByteString.Lazy'], tested: ['0.11', '0.12'] },
+  // Written from each library's documented API and checked only against the development cases in test/haskell/haskell-models-extended.test.js, which are
+  // plain source scans: no GHC build against these packages was run, so `tested` is empty and `modelStatus` reports every version as untested.
+  process_legacy: { modules: ['System.Cmd'], tested: [] },
+  turtle: { modules: ['Turtle'], tested: [] },
+  shelly: { modules: ['Shelly', 'Shelly.Lifted'], tested: [] },
+  hint: { modules: ['Language.Haskell.Interpreter'], tested: [] },
+  HDBC: { modules: ['Database.HDBC'], tested: [] },
+  'direct-sqlite': { modules: ['Database.SQLite3'], tested: [] },
+  'postgresql-libpq': { modules: ['Database.PostgreSQL.LibPQ'], tested: [] },
+  'persistent-backends': { modules: ['Database.Persist.Postgresql', 'Database.Persist.Sqlite', 'Database.Persist.MySQL', 'Database.Persist'], tested: [] },
+  req: { modules: ['Network.HTTP.Req'], tested: [] },
+  HTTP: { modules: ['Network.HTTP'], tested: [] },
+  snap: { modules: ['Snap.Core', 'Snap'], tested: [] },
+  Spock: { modules: ['Web.Spock', 'Web.Spock.Core'], tested: [] },
+  happstack: { modules: ['Happstack.Server', 'Happstack.Server.Internal.Types'], tested: [] },
+  network: { modules: ['Network.Socket.ByteString', 'Network.Socket.ByteString.Lazy'], tested: [] },
+  unix: { modules: ['System.Posix.Files'], tested: [] },
+  jwt: { modules: ['Web.JWT'], tested: [] },
+  'servant-auth-server': { modules: ['Servant.Auth.Server'], tested: [] },
+  'clientsession': { modules: ['Web.ClientSession'], tested: [] },
+  connection: { modules: ['Network.Connection'], tested: [] },
+  HsOpenSSL: { modules: ['OpenSSL.Session'], tested: [] },
 });
 
 // ── sources ─────────────────────────────────────────────────────────────────
@@ -85,6 +107,30 @@ src('Yesod', ['lookupGetParam', 'lookupGetParams', 'lookupPostParam', 'lookupPos
 // HTTP responses are untrusted data too when they come back from a remote service the app calls
 src('Network.HTTP.Simple', ['getResponseBody'], 'network', 'remote HTTP response', { package: 'http-conduit' });
 src('Network.HTTP.Client', ['responseBody'], 'network', 'remote HTTP response', { package: 'http-client' });
+// More file readers, and more web frameworks. Each reads a value the client (or the file's author) controls.
+src('Data.ByteString.Char8', ['readFile'], 'file-read', 'file content', { package: 'bytestring' });
+src('Data.ByteString.Lazy.Char8', ['readFile'], 'file-read', 'file content', { package: 'bytestring' });
+src('Data.Text.Lazy.IO', ['readFile'], 'file-read', 'file content', { package: 'text' });
+src('Network.Socket.ByteString', ['recv', 'recvFrom'], 'network', 'bytes read from a socket', { package: 'network' });
+src('Network.Socket.ByteString.Lazy', ['recv', 'getContents'], 'network', 'bytes read from a socket', { package: 'network' });
+src('Network.HTTP', ['getResponseBody'], 'network', 'remote HTTP response', { package: 'HTTP' });
+// Snap
+src('Snap.Core', ['getParam', 'getPostParam', 'getQueryParam', 'getParams', 'getPostParams', 'getQueryParams'], 'url-param', 'snap request parameter', { package: 'snap', framework: 'snap' });
+src('Snap.Core', ['readRequestBody', 'getRequestBody'], 'http-body', 'snap request body', { package: 'snap', framework: 'snap' });
+src('Snap', ['getParam', 'getPostParam', 'getQueryParam', 'getParams', 'getPostParams', 'getQueryParams'], 'url-param', 'snap request parameter', { package: 'snap', framework: 'snap' });
+// Spock
+src('Web.Spock', ['param', "param'", 'params'], 'url-param', 'spock request parameter', { package: 'Spock', framework: 'spock' });
+src('Web.Spock', ['header', 'cookie', 'cookies'], 'header', 'spock request header or cookie', { package: 'Spock', framework: 'spock' });
+src('Web.Spock', ['body', 'jsonBody', "jsonBody'", 'files'], 'http-body', 'spock request body', { package: 'Spock', framework: 'spock' });
+src('Web.Spock.Core', ['param', "param'", 'params'], 'url-param', 'spock request parameter', { package: 'Spock', framework: 'spock' });
+// Happstack
+src('Happstack.Server', ['look', 'lookText', "lookText'", 'lookBS', 'lookRead', 'lookPairs', 'lookPairsBS', 'lookCookieValue'], 'url-param', 'happstack request input', { package: 'happstack', framework: 'happstack' });
+// Yesod: the whole request value and its body
+src('Yesod.Core', ['getRequest', 'rawRequestBody', 'runRequestBody', 'lookupFile', 'lookupFiles'], 'http-body', 'yesod request', { package: 'yesod', framework: 'yesod' });
+src('Yesod', ['getRequest', 'rawRequestBody', 'runRequestBody', 'lookupFile', 'lookupFiles'], 'http-body', 'yesod request', { package: 'yesod', framework: 'yesod' });
+// Scotty: the underlying WAI request
+src('Web.Scotty', ['request'], 'http-body', 'scotty WAI request', { package: 'scotty', framework: 'scotty' });
+src('Web.Scotty.Trans', ['request'], 'http-body', 'scotty WAI request', { package: 'scotty', framework: 'scotty' });
 
 // ── sinks ───────────────────────────────────────────────────────────────────
 // family: the taint family the existing engine already uses (cmd | sql | path | url | xss)
@@ -161,6 +207,52 @@ sink('Prelude', ['putStrLn', 'putStr'], XSS_TEXT);
 sink('System.IO', ['putStrLn', 'putStr'], XSS_TEXT);
 sink('Data.Text.IO', ['putStrLn', 'putStr'], { ...XSS_TEXT, package: 'text' });
 
+// ── more sinks (written from the libraries' documented behaviour) ───────────────────────────────────────────────────────
+// CWE-78. The legacy System.Cmd module, Turtle and Shelly. A shell string is parsed by /bin/sh; a program name is not, but a tainted one is arbitrary execution.
+sink('System.Cmd', ['system'], { family: 'cmd', cwe: 'CWE-78', severity: 'critical', argIndex: 0, shell: true, package: 'process_legacy', vuln: 'OS Command Injection (shell string)', remediation: 'Do not build a shell command from input. Use `proc`/`callProcess` with a fixed program and pass each value as its own argument.' });
+sink('System.Cmd', ['rawSystem'], { family: 'cmd', cwe: 'CWE-78', severity: 'high', argIndex: 0, shell: false, package: 'process_legacy', vuln: 'OS Command Injection (program name)', remediation: 'Use a fixed program name; never take it from input.' });
+sink('System.Cmd', ['rawSystem'], { family: 'cmd', cwe: 'CWE-88', severity: 'medium', argIndex: 1, shell: false, argv: true, package: 'process_legacy', vuln: 'Argument Injection (process arguments)', remediation: 'Validate each argument against an allow-list, and put `--` before values that could start with a dash.' });
+sink('Turtle', ['shell', 'inshell', 'shells', 'inshells'], { family: 'cmd', cwe: 'CWE-78', severity: 'critical', argIndex: 0, shell: true, package: 'turtle', vuln: 'OS Command Injection (Turtle shell command)', remediation: 'Use `proc`/`procs` with a fixed program and a list of arguments, not a shell string built from input.' });
+sink('Turtle', ['proc', 'procs', 'inproc', 'inprocs'], { family: 'cmd', cwe: 'CWE-78', severity: 'high', argIndex: 0, shell: false, package: 'turtle', vuln: 'OS Command Injection (program name)', remediation: 'Use a fixed program name; never take it from input.' });
+sink('Turtle', ['proc', 'procs', 'inproc', 'inprocs'], { family: 'cmd', cwe: 'CWE-88', severity: 'medium', argIndex: 1, shell: false, argv: true, package: 'turtle', vuln: 'Argument Injection (process arguments)', remediation: 'Validate each argument against an allow-list, and put `--` before values that could start with a dash.' });
+for (const mod of ['Shelly', 'Shelly.Lifted']) {
+  sink(mod, ['run', 'run_', 'runFoldLines', 'command', 'command_'], { family: 'cmd', cwe: 'CWE-78', severity: 'high', argIndex: 0, shell: false, package: 'shelly', vuln: 'OS Command Injection (program name)', remediation: 'Use a fixed program name; never take it from input.' });
+  sink(mod, ['run', 'run_', 'runFoldLines'], { family: 'cmd', cwe: 'CWE-88', severity: 'medium', argIndex: 1, shell: false, argv: true, package: 'shelly', vuln: 'Argument Injection (process arguments)', remediation: 'Validate each argument against an allow-list, and put `--` before values that could start with a dash.' });
+  sink(mod, ['bash', 'bash_', 'bashPipeFail'], { family: 'cmd', cwe: 'CWE-78', severity: 'critical', argIndex: 0, shell: true, package: 'shelly', vuln: 'OS Command Injection (bash script text)', remediation: 'Do not build a script from input. Call the program directly with `run` and a list of arguments.' });
+}
+
+// CWE-94. Evaluating Haskell source text at run time (the hint package) runs whatever code the text holds.
+sink('Language.Haskell.Interpreter', ['interpret', 'eval', 'runStmt'], { family: 'code', cwe: 'CWE-94', severity: 'critical', argIndex: 0, package: 'hint', vuln: 'Code Injection (Haskell source evaluated at run time)', remediation: 'Do not evaluate text that came from a user. Parse the input into a closed data type and interpret that instead.' });
+
+// CWE-89. HDBC, direct-sqlite, postgresql-libpq, and the persistent backends that re-export rawSql. The query TEXT is the sink; a `?` placeholder with bound values is the safe form.
+sink('Database.HDBC', ['run', 'quickQuery', "quickQuery'", 'prepare', 'runRaw'], { ...SQL, argIndex: 1, package: 'HDBC', vuln: 'SQL Injection (HDBC query text)' });
+sink('Database.SQLite3', ['exec', 'prepare'], { ...SQL, argIndex: 1, package: 'direct-sqlite', vuln: 'SQL Injection (SQLite statement text)' });
+sink('Database.PostgreSQL.LibPQ', ['exec', 'execParams', 'prepare'], { ...SQL, argIndex: 1, package: 'postgresql-libpq', vuln: 'SQL Injection (libpq command text)' });
+for (const mod of ['Database.Persist.Postgresql', 'Database.Persist.Sqlite', 'Database.Persist.MySQL']) sink(mod, ['rawSql', 'rawExecute', 'rawQuery'], { ...SQL, argIndex: 0, package: 'persistent-backends', vuln: 'SQL Injection (raw SQL text)' });
+
+// CWE-918. Req builds a URL from typed pieces, so the HOST is the attacker-steered part; HTTP's request constructors take the URL text.
+sink('Network.HTTP.Req', ['https', 'http'], { ...SSRF, argIndex: 0, package: 'req', vuln: 'Server-Side Request Forgery (request host)' });
+sink('Network.HTTP', ['getRequest', 'postRequest', 'headRequest', 'simpleHTTP'], { ...SSRF, argIndex: 0, package: 'HTTP' });
+
+// CWE-601. Redirecting to a location taken from the request sends the user to a site the attacker names.
+const REDIRECT = { family: 'redirect', cwe: 'CWE-601', severity: 'medium', argIndex: 0, vuln: 'Open Redirect', remediation: 'Redirect only to a fixed path or to a value found in an allow-list; never to a request value as given.' };
+sink('Web.Scotty', ['redirect'], { ...REDIRECT, package: 'scotty', framework: 'scotty' });
+sink('Web.Scotty.Trans', ['redirect'], { ...REDIRECT, package: 'scotty', framework: 'scotty' });
+sink('Yesod.Core', ['redirect'], { ...REDIRECT, package: 'yesod', framework: 'yesod' });
+sink('Yesod.Core', ['redirectWith'], { ...REDIRECT, argIndex: 1, package: 'yesod', framework: 'yesod' });
+sink('Yesod', ['redirect'], { ...REDIRECT, package: 'yesod', framework: 'yesod' });
+sink('Snap.Core', ['redirect', "redirect'"], { ...REDIRECT, package: 'snap', framework: 'snap' });
+sink('Snap', ['redirect', "redirect'"], { ...REDIRECT, package: 'snap', framework: 'snap' });
+sink('Web.Spock', ['redirect'], { ...REDIRECT, package: 'Spock', framework: 'spock' });
+sink('Happstack.Server', ['seeOther', 'tempRedirect', 'movedPermanently'], { ...REDIRECT, package: 'happstack', framework: 'happstack' });
+
+// CWE-22. The same path operations through the other string types, and the POSIX file calls.
+sink('Data.ByteString.Char8', ['readFile', 'writeFile', 'appendFile'], { family: 'path', cwe: 'CWE-22', severity: 'high', argIndex: 0, package: 'bytestring', vuln: 'Path Traversal', remediation: 'Confirm the canonical path stays under an allowed directory before opening it.' });
+sink('Data.ByteString.Lazy.Char8', ['readFile', 'writeFile', 'appendFile'], { family: 'path', cwe: 'CWE-22', severity: 'high', argIndex: 0, package: 'bytestring', vuln: 'Path Traversal', remediation: 'Confirm the canonical path stays under an allowed directory before opening it.' });
+sink('Data.Text.Lazy.IO', ['readFile', 'writeFile', 'appendFile'], { family: 'path', cwe: 'CWE-22', severity: 'high', argIndex: 0, package: 'text', vuln: 'Path Traversal', remediation: 'Confirm the canonical path stays under an allowed directory before opening it.' });
+sink('System.Posix.Files', ['removeLink', 'createSymbolicLink', 'setFileMode', 'setOwnerAndGroup', 'readSymbolicLink'], { family: 'path', cwe: 'CWE-22', severity: 'high', argIndex: 0, package: 'unix', vuln: 'Path Traversal (file operation)', remediation: 'Confirm the canonical path stays under an allowed directory before the operation.' });
+sink('System.Posix.Files', ['rename'], { family: 'path', cwe: 'CWE-22', severity: 'high', argIndex: 'all', package: 'unix', vuln: 'Path Traversal (rename)', remediation: 'Confirm both canonical paths stay under an allowed directory.' });
+
 // ── sanitizers (context-specific; `appliesTo` is the family each one actually neutralises) ──
 const SAN = [];
 const san = (module, names, appliesTo, note, extra = {}) => { for (const e of E(module, names)) SAN.push({ ...e, appliesTo, note, ...extra }); };
@@ -219,6 +311,8 @@ export const HS_RULE_APIS = Object.freeze([
   ...E('Data.Text.IO', ['getContents', 'hGetContents']), ...E('Data.Text.Lazy.IO', ['getContents', 'hGetContents']),
   ...E('Data.Text', ['replicate', 'take']), ...E('Data.Vector', ['replicate']),
   ...E('Web.Cookie', ['defaultSetCookie']),
+  ...E('Web.JWT', ['hmacSecret', 'secret']), ...E('Servant.Auth.Server', ['fromSecret']), ...E('Web.ClientSession', ['initKey']),
+  ...E('Network.HTTP.Client.TLS', ['mkManagerSettings']), ...E('OpenSSL.Session', ['contextSetVerificationMode']),
   ...E('Text.XML.HXT.Core', ['withSubstDTDEntities']),
   ...E('System.IO.Unsafe', ['unsafePerformIO', 'unsafeInterleaveIO', 'unsafeDupablePerformIO']),
   ...E('Unsafe.Coerce', ['unsafeCoerce']),

package/src/language/haskell-security-rules.js

@@ -33,6 +33,8 @@ export const RULES = Object.freeze({
   'hs-unbounded-input-read': { cwe: 'CWE-770', severity: 'medium', family: 'resource-exhaustion', vuln: 'Whole input read into memory without a size limit', remediation: 'Bound the read (`BL.take n`, `hGetSome`, a request-size limit) before the data is consumed.' },
   'hs-unbounded-allocation': { cwe: 'CWE-770', severity: 'medium', family: 'resource-exhaustion', vuln: 'Allocation sized by parsed caller text without an upper bound', remediation: 'Clamp the size (`min limit n`) before allocating.' },
   'hs-partial-function-on-input': { cwe: 'CWE-248', severity: 'low', family: 'unhandled-exception', vuln: 'Partial function applied to caller-supplied text', remediation: 'Use the total variant (`readMaybe`, `listToMaybe`, pattern matching) and handle the failure.' },
+  'hs-tls-validation-disabled': { cwe: 'CWE-295', severity: 'high', family: 'tls-validation', vuln: 'TLS certificate validation is disabled', remediation: 'Do not disable certificate validation. Use the default settings (`tlsManagerSettings`, `TLSSettingsSimple False False False`, `VerifyPeer`) and, for a private certificate authority, add that authority to the trust store instead.' },
+  'hs-hardcoded-secret': { cwe: 'CWE-798', severity: 'high', family: 'hardcoded-credentials', vuln: 'Signing or encryption secret written in the source', remediation: 'Read the secret from the environment or a secret store at start-up, and rotate the one that was committed: it is now in the repository history.' },
   'hs-unsafe-io-boundary': { cwe: 'CWE-676', severity: 'low', family: 'unsafe-boundary', vuln: 'Unsafe IO / coercion boundary', remediation: 'Confine `unsafePerformIO`/`unsafeCoerce` to audited, well-tested wrappers.' },
 });
 
@@ -56,6 +58,11 @@ const PBKDF2_CALLS = new Set(['Crypto.KDF.PBKDF2.generate', 'Crypto.KDF.PBKDF2.f
 const STRONG_KDF = /^(?:Crypto\.KDF\.BCrypt\.|Crypto\.Argon2\.|Crypto\.Scrypt\.|Crypto\.KDF\.Scrypt\.|Crypto\.PasswordStore\.|Crypto\.BCrypt\.)/;
 const UNSAFE_CALLS = { 'System.IO.Unsafe.unsafePerformIO': 'unsafePerformIO', 'System.IO.Unsafe.unsafeInterleaveIO': 'unsafeInterleaveIO', 'System.IO.Unsafe.unsafeDupablePerformIO': 'unsafeDupablePerformIO', 'Unsafe.Coerce.unsafeCoerce': 'unsafeCoerce' };
 
+// TLS: the first field of TLSSettingsSimple (Network.Connection) is settingDisableCertificateValidation, and `VerifyNone` (OpenSSL.Session) skips peer verification.
+// The IR keeps a constructor's name in `hs.con` but not the module it came from, so a constructor counts only in a file that imports the module defining it.
+// Calls whose argument is a key or signing secret.
+const SECRET_KEY_CALLS = new Set(['Web.JWT.hmacSecret', 'Web.JWT.secret', 'Servant.Auth.Server.fromSecret', 'Web.ClientSession.initKey']);
+const isTrueLit = (e) => !!e && ((e.kind === 'literal' && /^true$/i.test(String(e.value))) || (e.kind === 'ident' && /(?:^|\.)True$/.test(e.name || '')));
 const TIME_SOURCES = new Set(['Data.Time.Clock.POSIX.getPOSIXTime', 'Data.Time.Clock.getCurrentTime', 'System.CPUTime.getCPUTime']);
 const SECURITY_FN_SUBSTR = /(?:token|nonce|secret|otp|csrf|session|salt|apikey|resetcode|passcode|verification)/i;
 // Short credential words that would over-match as substrings (`spin`, `mapping`, `keyboard`): matched as whole camelCase / snake_case words.
@@ -215,6 +222,16 @@ export function analyzeHaskellRules(files, opts = {}) {
               }
               continue;
             }
+            // TLS certificate validation switched off, by constructor
+            if (e.hs && e.hs.con) {
+              const importsFrom = (mods) => (fir.imports || []).some((im) => mods.includes(im.module));
+              if (e.hs.con === 'TLSSettingsSimple' && importsFrom(['Network.Connection', 'Network.Connection.Types'])) {
+                const positional = e.kind === 'array' && isTrueLit(e.elements[0]);
+                const named = e.kind === 'object' && (e.props || []).some((p) => p && p.key === 'settingDisableCertificateValidation' && isTrueLit(p.value));
+                if (positional || named) emit('hs-tls-validation-disabled', file, e.line || node.line, { detail: 'TLSSettingsSimple with settingDisableCertificateValidation = True', evidence: { setting: 'settingDisableCertificateValidation' } });
+              }
+              if (e.hs.con === 'VerifyNone' && e.kind === 'literal' && importsFrom(['OpenSSL.Session'])) emit('hs-tls-validation-disabled', file, e.line || node.line, { detail: 'OpenSSL verification mode VerifyNone', evidence: { mode: 'VerifyNone' } });
+            }
             // `xs !! n` raises on a short list: a partial function, written as an operator, applied to caller-supplied text
             if (e.kind === 'binary' && e.op === '!!' && e.left && mentionsText(e.left)) {
               emit('hs-partial-function-on-input', file, e.line || node.line, { detail: '!! on a caller-supplied list', evidence: { partial: '!!' } });
@@ -225,6 +242,9 @@ export function analyzeHaskellRules(files, opts = {}) {
             const line = e.line || node.line;
             const args = e.args || [];
 
+            // TLS certificate validation switched off
+            // a signing/encryption secret that is a constant in the source
+            if (SECRET_KEY_CALLS.has(c) && args[0] && isLiteralLike(args[0]) && !(args[0].kind === 'literal' && String(args[0].value).length < 8)) emit('hs-hardcoded-secret', file, line, { detail: `${c} given a constant`, confidence: 0.85, evidence: { call: c } });
             // weak hash
             if (WEAK_HASH_CALLS.has(c) || (c === 'Crypto.Hash.hashWith' && args[0] && args[0].kind === 'literal' && WEAK_ALGO_CONS.has(args[0].value))) {
               const pw = args.some((a) => [...names(a)].some((n) => PASSWORD_VAR.test(n)));

package/src/language/nixos-hardening.js

@@ -54,6 +54,11 @@ export const HARDENING_RULES = Object.freeze({
   'tls-not-enforced': { family: 'tls-runtime', cwe: 'CWE-319', severity: 'medium', ruleVersion: 1, vuln: 'Virtual host explicitly serves cleartext HTTP (forceSSL = false)', why: 'forceSSL = false is a deliberate choice to keep the plain-HTTP listener open for the whole host, so credentials and session data cross the network unencrypted.', fix: 'Set `forceSSL = true` (with `enableACME = true` or a certificate) so HTTP is redirected to HTTPS.' },
   'container-privileged': { family: 'container-declaration', cwe: 'CWE-250', severity: 'high', ruleVersion: 1, vuln: 'OCI container is declared privileged or with a dangerous mount', why: '--privileged, SYS_ADMIN/ALL capabilities and the container runtime socket give the container control of the host. Image layers are NOT scanned.', fix: 'Remove --privileged and the runtime socket mount; add only the specific capability the workload needs.' },
   'container-host-network': { family: 'container-declaration', cwe: 'CWE-668', severity: 'medium', ruleVersion: 1, vuln: 'OCI container shares the host network namespace', why: 'Host networking removes network isolation, so the container can reach and bind host-local services. Image layers are NOT scanned.', fix: 'Use the default bridge and publish only the needed ports on a specific address.' },
+  'user-root-equivalent-group': { family: 'privilege-escalation', cwe: 'CWE-269', severity: 'medium', ruleVersion: 1, vuln: 'A user is a member of a group that is equivalent to root', why: 'Membership of docker or lxd lets the user start a container with the host filesystem mounted, and membership of disk gives raw read and write access to the block devices. Each is root on the machine, without sudo and without a password prompt.', fix: 'Remove the group. Use rootless containers (virtualisation.docker.rootless, podman) or run the tool through sudo with a narrow rule.' },
+  'user-uid-zero': { family: 'privilege-escalation', cwe: 'CWE-250', severity: 'high', ruleVersion: 1, vuln: 'A user other than root has user id 0', why: 'User id 0 is root: the kernel does not look at the name. A second account with uid 0 is a root login that audit logs, sudo rules and per-user controls do not treat as root.', fix: 'Remove the uid assignment so the account gets a normal id, or use sudo for the cases that need root.' },
+  'getty-autologin': { family: 'login-access', cwe: 'CWE-306', severity: 'high', ruleVersion: 1, vuln: 'The console logs a user in without a password', why: 'services.getty.autologinUser starts a session on every virtual console with no authentication. For root that is a root shell for anyone with the keyboard, a serial line or a hypervisor console.', fix: 'Remove services.getty.autologinUser. Keep autologin to throwaway virtual machines and tests.' },
+  'display-autologin': { family: 'login-access', cwe: 'CWE-306', severity: 'low', ruleVersion: 1, vuln: 'The display manager logs a user in without a password', why: 'Automatic login skips authentication at the graphical login, so anyone who can power the machine on gets the session. Disk encryption is the only remaining barrier.', fix: 'Disable autoLogin, or keep it only where physical access is controlled and the disk is encrypted.' },
+  'pam-null-password': { family: 'login-access', cwe: 'CWE-258', severity: 'high', ruleVersion: 1, vuln: 'A PAM service accepts accounts with an empty password', why: 'allowNullPassword lets an account with no password log in through this service with an empty answer, which turns every passwordless account into an open login.', fix: 'Remove allowNullPassword (it defaults to false) and give every account a password hash or a key.' },
 });
 
 /** Which rules explain each privileged entry-point kind (reconciliation join). */
@@ -368,6 +373,41 @@ export function analyzeNixosHardening(opts, extra = {}) {
     }
   }
 
+  // ── accounts and console login ──
+  // Root-equivalent groups: each of these gives the member control of the host without sudo.
+  const ROOT_EQUIVALENT_GROUPS = new Map([['docker', 'start a container with the host root mounted'], ['lxd', 'start a privileged container with the host root mounted'], ['disk', 'read and write the raw block devices']]);
+  for (const o of cfg.options.filter((x) => x.namespace === 'nixos' && /^users\.users\.[^.]+\.extraGroups$/.test(x.path))) {
+    const name = o.path.split('.')[2];
+    if (name === 'root') continue;
+    const v = view(note(o, 'accounts'));
+    const items = v.state === 'known' ? asList(v.value) : v.state === 'conditional' ? asList(v.definiteItems) : [];
+    const bad = items.filter((g) => typeof g === 'string' && ROOT_EQUIVALENT_GROUPS.has(g));
+    if (bad.length) addFinding('user-root-equivalent-group', { anchor: anchorOf(o), scope: `users.users.${name}`, state: v.state === 'conditional' ? 'conditional' : 'active', uncertain: !v.definite, evidence: [evidenceOf(o)], extra: { groups: bad, effect: bad.map((g) => `${g}: ${ROOT_EQUIVALENT_GROUPS.get(g)}`) } });
+  }
+  for (const o of cfg.options.filter((x) => x.namespace === 'nixos' && /^users\.users\.[^.]+\.uid$/.test(x.path))) {
+    const name = o.path.split('.')[2];
+    if (name === 'root') continue;
+    const j = judge(note(o, 'accounts'), (x) => x === 0);
+    if (j === 'yes' || j === 'conditional') addFinding('user-uid-zero', { anchor: anchorOf(o), scope: `users.users.${name}`, state: j === 'conditional' ? 'conditional' : 'active', uncertain: !view(o).definite, evidence: [evidenceOf(o)] });
+  }
+  const gettyRes = note(nixos('services.getty.autologinUser'), 'login');
+  const gettyV = view(gettyRes);
+  if (gettyV.state === 'known' && typeof gettyV.value === 'string' && gettyV.value) {
+    addFinding('getty-autologin', { severity: gettyV.value === 'root' ? 'high' : 'low', anchor: anchorOf(gettyRes), scope: 'services.getty.autologinUser', state: 'active', uncertain: !gettyV.definite, evidence: [evidenceOf(gettyRes)], extra: { user: gettyV.value } });
+  }
+  for (const base of ['services.displayManager.autoLogin', 'services.xserver.displayManager.autoLogin']) {
+    const en = note(nixos(`${base}.enable`), 'login');
+    const j = judge(en, (x) => x === true);
+    if (j === 'yes' || j === 'conditional') {
+      const userV = view(nixos(`${base}.user`));
+      addFinding('display-autologin', { severity: userV.state === 'known' && userV.value === 'root' ? 'high' : 'low', anchor: anchorOf(en), scope: base, state: j === 'conditional' ? 'conditional' : 'active', uncertain: !view(en).definite, evidence: [evidenceOf(en)], extra: userV.state === 'known' ? { user: userV.value } : {} });
+    }
+  }
+  for (const o of cfg.options.filter((x) => x.namespace === 'nixos' && /^security\.pam\.services\.[^.]+\.allowNullPassword$/.test(x.path))) {
+    const j = judge(note(o, 'login'), (x) => x === true);
+    if (j === 'yes' || j === 'conditional') addFinding('pam-null-password', { anchor: anchorOf(o), scope: o.path.replace(/\.allowNullPassword$/, ''), state: j === 'conditional' ? 'conditional' : 'active', uncertain: !view(o).definite, evidence: [evidenceOf(o)] });
+  }
+
   // ── databases / listeners ──
   if (hasDefs('services.postgresql.')) {
     const enableRes = nixos('services.postgresql.enable');
@@ -398,6 +438,38 @@ export function analyzeNixosHardening(opts, extra = {}) {
     inventory.push({ kind: 'declared-service', name: 'nginx', state, listening: state === 'active' ? 'unknown' : state === 'conditional' ? 'unknown' : 'no', ports: [], ingress: 'unknown', reachability: { internet: 'unknown', reason: 'listen addresses are generated by the module and external topology is not modelled' }, evidence: [evidenceOf(enableRes)] });
   }
 
+  // ── other services that choose their bind address ──
+  // The same decision postgresql makes above. Only an EXPLICIT wildcard (or, for redis, an explicit null, which the module defines as "every interface") is reported:
+  // an unset option keeps the module's own default, which the catalog does not record for these services and which is never guessed.
+  const WILDCARD = (x, nullIsAll) => (x === null ? nullIsAll === true : typeof x === 'string' && x.split(/[\s,]+/).filter(Boolean).some((a) => a === '*' || a === '0.0.0.0' || a === '::' || a === '[::]'));
+  const LISTENERS = [
+    { name: 'redis', pattern: /^services\.redis\.servers\.([^.]+)\.bind$/, enable: (m) => `services.redis.servers.${m[1]}.enable`, portOpt: (m) => `services.redis.servers.${m[1]}.port`, port: 6379, nullIsAll: true, scope: (m) => `services.redis.servers.${m[1]}` },
+    { name: 'mysql', pattern: /^services\.mysql\.settings\.mysqld\.(?:bind-address|bind_address)$/, enable: () => 'services.mysql.enable', port: 3306, scope: () => 'services.mysql' },
+    { name: 'mongodb', pattern: /^services\.mongodb\.bind_ip$/, enable: () => 'services.mongodb.enable', port: 27017, scope: () => 'services.mongodb' },
+    { name: 'memcached', pattern: /^services\.memcached\.listen$/, enable: () => 'services.memcached.enable', portOpt: () => 'services.memcached.port', port: 11211, scope: () => 'services.memcached' },
+    { name: 'elasticsearch', pattern: /^services\.elasticsearch\.listenAddress$/, enable: () => 'services.elasticsearch.enable', portOpt: () => 'services.elasticsearch.port', port: 9200, scope: () => 'services.elasticsearch' },
+    { name: 'grafana', pattern: /^services\.grafana\.settings\.server\.http_addr$/, enable: () => 'services.grafana.enable', port: 3000, scope: () => 'services.grafana' },
+  ];
+  for (const L of LISTENERS) {
+    for (const o of cfg.options.filter((x) => x.namespace === 'nixos' && L.pattern.test(x.path))) {
+      const m = L.pattern.exec(o.path);
+      const listenRes = note(o, 'listener');
+      const wild = judge(listenRes, (x) => WILDCARD(x, L.nullIsAll));
+      if (wild !== 'yes' && wild !== 'conditional') continue;
+      const enableRes = note(nixos(L.enable(m)), 'listener');
+      const state = stateOf(enableRes);
+      if (state !== 'active' && state !== 'conditional') continue;
+      let port = L.port;
+      if (L.portOpt) { const pv = view(nixos(L.portOpt(m))); if (pv.state === 'known' && Number.isInteger(pv.value) && pv.value > 0) port = pv.value; }
+      const ingress = ingressFor(port);
+      const scope = L.scope(m);
+      inventory.push({ kind: 'declared-service', name: L.name, state, listening: 'yes', ports: [port], ingress, reachability: { internet: 'unknown', reason: 'external network topology is not part of the configuration' }, evidence: [evidenceOf(enableRes), evidenceOf(listenRes)] });
+      const st = state === 'conditional' || wild === 'conditional' ? 'conditional' : 'active';
+      const restricted = ingress === 'firewall-closed' || ingress === 'restricted-interface';
+      addFinding('listener-all-interfaces', { severity: restricted ? 'low' : ingress === 'open-in-firewall' || ingress === 'firewall-disabled' ? 'high' : 'medium', anchor: anchorOf(listenRes), scope, state: st, uncertain: !view(listenRes).definite, evidence: [evidenceOf(listenRes), evidenceOf(enableRes)], extra: { exposure: { enabled: true, listening: 'yes', ingress, reachable: 'unknown' } }, mitigations: restricted ? [{ kind: 'restrictive-ingress', ingress }] : [] });
+    }
+  }
+
   // ── TLS material and enforcement on nginx virtual hosts ──
   if (hasDefs('services.nginx.')) {
     const nginxState = stateOf(nixos('services.nginx.enable'));

package/src/lineage/build-attested-correlation.js

@@ -0,0 +1,63 @@
+// Runtime correlation that knows which build it is talking about (E5-02).
+//
+// `correlateObservations` (observation-correlation.js) is pinned, byte for byte, by its own tests: it answers "was this flow seen in the window" and
+// nothing about WHICH build was seen. This wrapper adds that, without changing it. A caller that names the static snapshot's identity gets back the
+// same correlation, computed over only the observations that could be about that code, plus a statement per flow of whether the evidence is tied to
+// the snapshot's build:
+//
+//   corroborated   every contributing observation matched the snapshot's identity (deployment-identity.js: matched)
+//   unattested     at least one contributing observation carried no comparable identity: seen at runtime, but not shown to be this code
+//   none           no contributing observation
+//
+// Observations from a DIFFERENT build are excluded and listed under `buildMismatchedObservationIds`: they are not evidence about this code at all.
+// A caller that names no snapshot identity gets the original result unchanged.
+import { execFileSync } from 'node:child_process';
+import { correlateObservations } from './observation-correlation.js';
+import { canCorroborate, linkObservationToSnapshot, normalizeIdentity, observationIdentity } from './deployment-identity.js';
+
+const LAYER_RUNTIME_OBSERVED = 'runtime_observed';
+
+/** The identity of the source snapshot at `root`: the git HEAD, whether the work tree is dirty, and anything the caller adds (image digest, build hash, environment). */
+export function snapshotIdentityOf(root, extra = {}) {
+  let commit = null; let dirty = false;
+  try {
+    commit = execFileSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }).trim();
+    dirty = execFileSync('git', ['status', '--porcelain'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 10000 }).trim().length > 0;
+  } catch { commit = null; }
+  return { ...normalizeIdentity({ commit, dirty, ...extra }) };
+}
+
+/**
+ * @param {object} graph
+ * @param {object[]|null|undefined} observations as for correlateObservations
+ * @param {object} opts correlateObservations' options plus
+ *   snapshotIdentity     {commit, buildHash, imageDigest, sbomRef, environment, dirty} of the static snapshot. Without it the original result is returned unchanged.
+ *   observationBuilds    {[observationId]: {commit, buildHash, imageDigest, sbomRef}} identity the importer recorded for an observation
+ */
+export function correlateWithBuild(graph, observations, opts = {}) {
+  const snapshot = opts.snapshotIdentity && typeof opts.snapshotIdentity === 'object' ? normalizeIdentity(opts.snapshotIdentity) : null;
+  if (!snapshot || !Array.isArray(observations)) return correlateObservations(graph, observations, opts);
+  const builds = opts.observationBuilds && typeof opts.observationBuilds === 'object' ? opts.observationBuilds : {};
+  const links = new Map(); const kept = []; const mismatched = [];
+  for (const obs of observations) {
+    const id = obs && typeof obs.id === 'string' ? obs.id : null;
+    const claimed = id && builds[id] ? { ...observationIdentity(obs), ...normalizeIdentity({ ...builds[id], environment: obs.environment }) } : observationIdentity(obs);
+    const link = linkObservationToSnapshot(claimed, snapshot);
+    if (id) links.set(id, link);
+    if (link.state === 'mismatched') { if (id) mismatched.push(id); continue; }
+    kept.push(obs);
+  }
+  const base = correlateObservations(graph, kept, opts);
+  const byFlow = {};
+  for (const [fid, entry] of Object.entries(base.byFlow || {})) {
+    const ids = entry.observationIds || [];
+    const corroboration = entry.layer !== LAYER_RUNTIME_OBSERVED || !ids.length ? 'none' : ids.every((i) => canCorroborate(links.get(i))) ? 'corroborated' : 'unattested';
+    byFlow[fid] = { ...entry, corroboration };
+  }
+  return {
+    ...base, byFlow,
+    buildMismatchedObservationIds: [...new Set(mismatched)].sort(),
+    buildLink: { requested: true, snapshot: { commit: snapshot.commit, buildHash: snapshot.buildHash, imageDigest: snapshot.imageDigest, environment: snapshot.environment, dirty: snapshot.dirty } },
+    limitations: [...(base.limitations || []), 'Observations from a different build were excluded; observations with no comparable build identity are kept but marked unattested, never corroborated.'],
+  };
+}

package/src/lineage/deployment-identity.js

@@ -0,0 +1,76 @@
+// Tying runtime observations to the code that was deployed (E5-02).
+//
+// A runtime observation is evidence about ONE running build. A static finding is evidence about ONE source snapshot. The two are the same subject only
+// when the build is known to have been made from that snapshot. Without that tie, "this route received traffic" says nothing about whether the code
+// that received it contained the finding, and calling it corroboration would be a false claim.
+//
+// WHAT TIES THEM. Four identity fields, compared when both sides have them:
+//   commit       the git commit (a full sha, or a prefix of at least 12 hex characters)
+//   buildHash    a build or reproducibility hash
+//   imageDigest  the container image digest (sha256:...)
+//   sbomRef      an SBOM or artifact reference
+// plus the environment the observation came from, which must equal the environment the snapshot's deployment record names when both are present.
+//
+// THE RULES (each is a test)
+//   mismatched   a field both sides carry DIFFERS, or the environments differ. One disagreement is enough, however many fields agree.
+//   matched      at least one STRONG field (commit, buildHash or imageDigest) is present on both sides and equal, and nothing disagrees
+//   unknown      no strong field is present on both sides: the observation carries no identity, the snapshot carries none, or they carry different kinds
+//   A snapshot with uncommitted changes cannot be tied to a commit: a commit match is downgraded to `unknown` with that reason, because the code that was
+//   scanned is not the code the commit names.
+// Only `matched` may be labelled corroborating. `unknown` is unattested evidence; `mismatched` is excluded and counted.
+export const STRONG_FIELDS = Object.freeze(['commit', 'buildHash', 'imageDigest']);
+export const IDENTITY_FIELDS = Object.freeze(['commit', 'buildHash', 'imageDigest', 'sbomRef']);
+const ATTR = Object.freeze({ commit: 'deployment.commit', buildHash: 'deployment.build', imageDigest: 'deployment.image.digest', sbomRef: 'deployment.sbom.ref' });
+export const IDENTITY_ATTRIBUTE_KEYS = Object.freeze(Object.values(ATTR));
+
+const hex = (s) => (typeof s === 'string' && /^[0-9a-f]{12,64}$/i.test(s) ? s.toLowerCase() : null);
+const digest = (s) => { const m = typeof s === 'string' ? /^(?:sha256:)?([0-9a-f]{64})$/i.exec(s) : null; return m ? `sha256:${m[1].toLowerCase()}` : null; };
+const token = (s) => (typeof s === 'string' && /^[A-Za-z0-9._:-]{1,128}$/.test(s) ? s : null);
+
+/** Normalise an identity-bearing object ({commit, buildHash, imageDigest, sbomRef, environment, dirty}) to comparable values; an unusable value becomes null. */
+export function normalizeIdentity(raw) {
+  const r = raw && typeof raw === 'object' ? raw : {};
+  return { commit: hex(r.commit), buildHash: token(r.buildHash), imageDigest: digest(r.imageDigest), sbomRef: token(r.sbomRef), environment: token(r.environment), dirty: r.dirty === true };
+}
+
+/** The identity an observation carries, from its approved attributes and its environment. */
+export function observationIdentity(obs) {
+  const a = (obs && obs.attributes) || {};
+  return normalizeIdentity({ commit: a[ATTR.commit], buildHash: a[ATTR.buildHash], imageDigest: a[ATTR.imageDigest], sbomRef: a[ATTR.sbomRef], environment: obs && obs.environment });
+}
+
+const sameCommit = (a, b) => { const n = Math.min(a.length, b.length); return n >= 12 && a.slice(0, n) === b.slice(0, n); };
+
+/**
+ * @param {object} observation a runtime observation (or an identity object)
+ * @param {object} snapshot    the static snapshot's identity: {commit, buildHash, imageDigest, sbomRef, environment, dirty}
+ * @returns {{state:'matched'|'mismatched'|'unknown', compared:string[], agreed:string[], disagreed:string[], reasons:string[]}}
+ */
+export function linkObservationToSnapshot(observation, snapshot) {
+  const o = observation && observation.attributes !== undefined ? observationIdentity(observation) : normalizeIdentity(observation);
+  const s = normalizeIdentity(snapshot);
+  const compared = []; const agreed = []; const disagreed = []; const reasons = [];
+  for (const f of IDENTITY_FIELDS) {
+    if (o[f] == null || s[f] == null) continue;
+    compared.push(f);
+    const eq = f === 'commit' ? sameCommit(o[f], s[f]) : o[f] === s[f];
+    (eq ? agreed : disagreed).push(f);
+  }
+  if (o.environment != null && s.environment != null) {
+    compared.push('environment');
+    if (o.environment === s.environment) agreed.push('environment'); else disagreed.push('environment');
+  }
+  if (disagreed.length) return { state: 'mismatched', compared, agreed, disagreed, reasons: disagreed.map((f) => `${f} differs between the observation and the snapshot`) };
+  const strong = agreed.filter((f) => STRONG_FIELDS.includes(f));
+  if (!strong.length) {
+    if (o.commit == null && o.buildHash == null && o.imageDigest == null) reasons.push('the observation carries no commit, build hash or image digest');
+    else if (s.commit == null && s.buildHash == null && s.imageDigest == null) reasons.push('the snapshot carries no commit, build hash or image digest');
+    else reasons.push('the observation and the snapshot carry different kinds of identity, so none can be compared');
+    return { state: 'unknown', compared, agreed, disagreed, reasons };
+  }
+  if (s.dirty && strong.length === 1 && strong[0] === 'commit') return { state: 'unknown', compared, agreed, disagreed, reasons: ['the snapshot has uncommitted changes: the code that was analysed is not the code the commit names'] };
+  return { state: 'matched', compared, agreed, disagreed, reasons: [`${strong.join(', ')} agree and nothing disagrees`] };
+}
+
+/** True only for a link that may be called corroboration. */
+export const canCorroborate = (link) => !!link && link.state === 'matched';

package/src/mcp/tools.js

@@ -28,6 +28,7 @@ import { redactString, redactFinding } from './redact.js';
 import { _remediationOf, normalizeFindings } from '../report/index.js';
 // X-206: the one projection of the verification record, shared with the JSON report, the text report and the autopilot response.
 import { verificationFields } from '../posture/verification/projection.js';
+import { verifyPatch, additiveFields } from '../fix/verify-patch.js';
 import { boundaryFields } from '../lineage/deployment/projection.js';
 // Git-origin provenance (Finding Provenance M0/M1). Distinct from
 // `finding.provenance` (AI-authorship) and from an SCA entry's `provenance`
@@ -879,25 +880,14 @@ export const apply_fix = {
       }
       // Inline re-verify — the load-bearing gate. Must pass to write.
       let verdict;
+      let fixVerification = null;
       try {
         const _files = Object.fromEntries(Object.entries(confinedAbs).map(([rel, v]) => [rel, v.content]));
-        if (process.env.AGENTIC_SECURITY_FIX_RUN_TESTS === '1') {
-          // Addition #7 — connect the closed-loop verifier: add the project test
-          // suite as a fourth verification leg (scan + lint + tests). Opt-in
-          // because many repos have no runner and we must not fail-closed by
-          // default. Normalized to the scan+lint verdict shape used below.
-          const { verifyFixWithTests } = await import('../posture/fix-verify-loop.js');
-          const t = await verifyFixWithTests({ scanRoot: ctx.sessionRoot, originalFindingStableId: f.stableId, files: _files });
-          verdict = { ok: t.ok, summary: t.summary, rescan: t.legs?.scan?.detail, lint: t.legs?.lint?.detail, tests: t.legs?.tests, testVerdict: t.verdict, verificationRecord: t.verificationRecord ?? null };
-        } else {
-          const verifyFixCore = await getVerifyFixCore();
-          verdict = await verifyFixCore({
-            scanRoot: ctx.sessionRoot,
-            originalFindingStableId: f.stableId,
-            files: _files,
-            fixMeta,
-          });
-        }
+        // One verifier for every route (E3-03). AGENTIC_SECURITY_FIX_RUN_TESTS used to swap in a second test runner here; verifyFix
+        // already carries the test leg, so the flag is now inert.
+        const central = await verifyPatch({ scanRoot: ctx.sessionRoot, finding: { id: f.id, stableId: f.stableId }, files: _files, fixMeta, route: 'mcp-apply-fix', mode: dry_run ? 'preview' : 'apply', verify: await getVerifyFixCore() });
+        verdict = central.verdict;
+        fixVerification = central.fixVerification;
       } catch (e) {
         return { _meta: META, applied: false, reason: `patch verification failed: ${e.message}` };
       }
@@ -909,6 +899,7 @@ export const apply_fix = {
           // X-201: the same version-1 verification record every surface emits (additive; null when none could be formed).
           verificationRecord: verdict.verificationRecord ?? null,
           ...verificationFields(verdict.verificationRecord),
+          ...(fixVerification ? additiveFields(fixVerification) : {}),
         };
       }
       // FR-307/FR-1002/D-0024: this caller-supplied-patch branch writes via
@@ -929,7 +920,7 @@ export const apply_fix = {
       }
       const materialClassification = classifyFixMaterialRisk(filesForMaterialClassification);
       if (dry_run) {
-        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, verificationRecord: verdict.verificationRecord ?? null, ...verificationFields(verdict.verificationRecord), materialClassification };
+        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, verificationRecord: verdict.verificationRecord ?? null, ...verificationFields(verdict.verificationRecord), materialClassification, ...(fixVerification ? additiveFields(fixVerification) : {}) };
       }
       const approvalRefusal = _highImpactApprovalRefusal(ctx, materialClassification, fixMeta);
       if (approvalRefusal) return approvalRefusal;
@@ -960,7 +951,7 @@ export const apply_fix = {
       }
       let acceptance = null;
       try { acceptance = fixAcceptanceRate(ctx.sessionRoot); } catch { /* best-effort */ }
-      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary, verificationRecord: verdict.verificationRecord ?? null, ...verificationFields(verdict.verificationRecord) }, acceptance, materialClassification };
+      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary, verificationRecord: verdict.verificationRecord ?? null, ...verificationFields(verdict.verificationRecord) }, acceptance, materialClassification, ...(fixVerification ? additiveFields(fixVerification) : {}) };
     }
 
     if (typeof f.fix?.replacement !== 'string') {
@@ -1118,21 +1109,8 @@ export const verify_fix = {
       // Best-effort: a missing/unsigned/tampered scan just means no PoC is
       // available to re-check, not a verify_fix failure — the rescan/lint/
       // tests legs below are independent of this and still apply.
-      let poc = null;
-      try {
-        const { scan: lastScan } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: true });
-        const orig = lastScan && (lastScan.findings || []).find(f => f.stableId === stable_id);
-        if (orig && orig.poc && orig.poc.code) poc = { ...orig.poc, finding: orig };
-      } catch { /* best-effort lookup; poc stays null */ }
-
-      const verifyFixCore = await getVerifyFixCore();
-      const r = await verifyFixCore({
-        scanRoot: ctx.sessionRoot,
-        originalFindingStableId: stable_id,
-        files: confined,
-        poc,
-        fixMeta,
-      });
+      const central = await verifyPatch({ scanRoot: ctx.sessionRoot, finding: { stableId: stable_id }, files: confined, fixMeta, route: 'mcp-verify-fix', mode: 'verify', verify: await getVerifyFixCore() });
+      const r = central.verdict;
       return {
         _meta: META,
         ok: r.ok,
@@ -1154,6 +1132,7 @@ export const verify_fix = {
         // `not-run` when no exploit oracle executed against the patch, never a bare pass/fail.
         verificationRecord: r.verificationRecord ?? null,
         ...verificationFields(r.verificationRecord),
+        ...additiveFields(central.fixVerification),
       };
     } catch (e) {
       return { _meta: META, ok: false, reason: `verify_fix failed: ${e.message}` };

package/src/pipeline/canonical-output.js

@@ -0,0 +1,64 @@
+// Canonical scan output (E6-06).
+//
+// A scan result mixes two kinds of fact. Some are about the CODE: which findings exist, where, with what evidence. Those must be identical on every
+// run over the same input, whatever order the files were read in, however many scans ran at once, and whenever it happened. The rest are about the
+// RUN: when it started, how long each stage took, which stage finished first. Those differ every time and are not a defect.
+//
+// This module splits them:
+//   canonical   findings (and the other finding-bearing lists) with volatile fields removed, numbers rounded to a fixed precision, object keys sorted,
+//               lists in a total order (file, line, vuln, stableId, id, then the serialized record as the last tiebreak). Hashed into `digest`.
+//   run         timestamps, durations, telemetry, scan id; kept, separate, and never part of the digest
+//   provenance  what produced the canonical part: scanner version, rule-pack hash, and each source of NONDETERMINISM that was active (a network feed,
+//               a model), named so a reader knows which results could legitimately differ
+//
+// The digest therefore answers one question: did two runs find the same things? A difference in `run` never changes it.
+import { createHash } from 'node:crypto';
+import { computeRulePackHash } from '../posture/deterministic.js';
+
+const LISTS = Object.freeze(['findings', 'secrets', 'logicVulns', 'supplyChain']);
+// fields inside a finding that describe the run, not the code
+const VOLATILE_FINDING_KEYS = new Set(['detectedAt', 'scannedAt', 'ts', 'timestamp', 'elapsedMs', 'durationMs', 'scanId']);
+const PRECISION = 6;
+
+const round = (n) => (Number.isInteger(n) ? n : Math.round(n * 10 ** PRECISION) / 10 ** PRECISION);
+function clean(v) {
+  if (Array.isArray(v)) return v.map(clean);
+  if (v && typeof v === 'object') {
+    const o = {};
+    for (const k of Object.keys(v).sort()) { if (VOLATILE_FINDING_KEYS.has(k) || v[k] === undefined) continue; o[k] = clean(v[k]); }
+    return o;
+  }
+  return typeof v === 'number' && Number.isFinite(v) ? round(v) : v;
+}
+const s = (x) => (x === undefined || x === null ? '' : String(x));
+function order(a, b) {
+  return s(a.file).localeCompare(s(b.file), 'en') || (Number(a.line) || 0) - (Number(b.line) || 0) || s(a.vuln || a.title).localeCompare(s(b.vuln || b.title), 'en')
+    || s(a.stableId).localeCompare(s(b.stableId), 'en') || s(a.id).localeCompare(s(b.id), 'en') || JSON.stringify(a).localeCompare(JSON.stringify(b), 'en');
+}
+
+/** Sources of nondeterminism that are active for this process, named. */
+export function nondeterminismSources(env = process.env) {
+  const out = [];
+  if (env.AGENTIC_SECURITY_LLM_ENDPOINT && env.AGENTIC_SECURITY_LLM_VALIDATE !== '0') out.push({ source: 'llm-validator', reason: 'a model endpoint is configured and the validator is on: its verdicts can differ between runs', model: env.AGENTIC_SECURITY_LLM_MODEL || null });
+  if (env.AGENTIC_SECURITY_DETERMINISTIC !== '1' && env.AGENTIC_SECURITY_OFFLINE !== '1') out.push({ source: 'network-feeds', reason: 'vulnerability and registry feeds are fetched and cached; their content changes over time' });
+  return out;
+}
+
+/**
+ * @param {object} scan a scan result
+ * @param {{env?:object, scannerVersion?:string}} opts
+ * @returns {{canonical:object, digest:string, run:object, provenance:object}}
+ */
+export function canonicalizeScan(scan, opts = {}) {
+  const canonical = {};
+  for (const k of LISTS) if (Array.isArray(scan && scan[k])) canonical[k] = scan[k].map(clean).sort(order);
+  const digest = createHash('sha256').update(JSON.stringify(canonical)).digest('hex');
+  const meta = (scan && (scan._scanMeta || scan.meta)) || {};
+  const run = {
+    scanId: meta.scanId ?? null, startedAt: meta.startedAt ?? null, durationMs: meta.durationMs ?? null,
+    telemetry: scan && scan.telemetry ? scan.telemetry : null,
+    fileTimings: Array.isArray(meta.fileTimings) ? meta.fileTimings : null,
+  };
+  const provenance = { scannerVersion: opts.scannerVersion ?? null, rulePackHash: computeRulePackHash(), nondeterminism: nondeterminismSources(opts.env), canonicalPrecision: PRECISION };
+  return { canonical, digest, run, provenance };
+}