@clear-capabilities/agentic-security-scanner 0.174.0 → 0.176.0

package/dist/7838.index.js

@@ -1,1082 +1,554 @@
 export const id = 7838;
-export const ids = [7838,2238];
+export const ids = [7838];
 export const modules = {
 
-/***/ 27785:
+/***/ 43556:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   _u: () => (/* binding */ gateFixOutput)
+/* harmony export */   F: () => (/* binding */ buildCorpus),
+/* harmony export */   T: () => (/* binding */ scoreRule)
 /* harmony export */ });
-/* unused harmony exports checkResidualHonesty, requireCitedEvidence, computeFixTier, checkMechanicalTierEvidence, _internals */
-// Deterministic honesty gates on fix / finding output (#7).
+/* harmony import */ var _mutation_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(85127);
+/* harmony import */ var _ir_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(87539);
+/* harmony import */ var _custom_rules_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(9049);
+// Automatic corpus creation and scoring for ONE candidate rule.
 //
-// The project's verification discipline (scanner/CLAUDE.md) exists because
-// several releases shipped broken or false because work was reported as done
-// without confirming the artifact changed. Two of those failure modes are
-// *textual* — they live in the prose an agent emits alongside a fix — and can
-// be caught deterministically, with no LLM and no network:
+// Positive corpus: the original vulnerable snippet plus its generated sibling variants (mutation.js).
+// Negative corpus: an explicit patched/clean variant the caller supplies, nearby clean patterns, protected
+// (sanitizer/guard) variants, and the NEGATIVE mutations of those (same mutators, applied to the safe side) — a
+// candidate rule must decline on ALL of them, not just the one hand-picked negative.
 //
-//   1. Hand-wave residual-risk prose. "The input is adequately handled",
-//      "future work", "tbd", "later" — vague assurances that claim safety
-//      without naming a concrete remaining vector. A residual you can't name
-//      is a residual you're guessing about; reject the guess.
-//
-//   2. An unbacked "this is a false positive / provably safe" verdict. Marking
-//      a finding safe is a coverage *reduction* — it must cite a `file:line`
-//      that shows why, exactly like the rules-override gate refuses to silently
-//      shrink coverage.
-//
-// Plus a conservative fix-tier classifier so a partial remediation can never be
-// labelled FULL: any workaround-only signal (rate-limit, docs, log-without-
-// reject) is WORKAROUND; anything short of (sink signature changed + all callers
-// routed + a discriminating test) is at most MITIGATION; only the full set with
-// no partial-sanitization caveat earns FULL.
-//
-// Pure functions, no side effects, no throwing — safe to call from a command,
-// a hook, or the MCP verify_fix path.
-
-// Vague-assurance phrases that a real residual must never hide behind. Matched
-// case-insensitively with word boundaries so "later" doesn't trip on
-// "collateral" and "tbd" doesn't trip on a longer token.
-const BANNED_RESIDUAL_PHRASES = Object.freeze([
-  'adequately handled',
-  'adequately handles',
-  'properly validated',
-  'properly handled',
-  'handled properly',
-  'handled safely',
-  'future work',
-  'more work needed',
-  'to be done',
-  'tbd',
-  'later',
-]);
+// Scoring reuses the exact runtime matcher (`runRule` in `../custom-rules.js`), never a second implementation —
+// the score a rule gets here is the score it will actually produce once promoted.
 
-// A citation shaped like `file:line` — one or more non-space, non-colon chars,
-// a colon, then digits. Unanchored: it need only appear somewhere in the item.
-const CITATION_RE = /[^\s:]+:\d+/;
 
-// Verdicts that assert the finding is not real and therefore demand a citation.
-// Compared after normalizing separators (`_`/space → `-`) and lowercasing, so
-// FALSE_POSITIVE, false-positive, and "provably safe" all land here.
-const FP_VERDICTS = Object.freeze(new Set(['false-positive', 'provably-safe', 'safe']));
 
-function _escapeRe(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
 
-/**
- * Reject vague-assurance / hand-wave residual-risk prose.
- *
- * An empty or whitespace-only residual is ok — there is no residual to lie
- * about. A non-empty residual is rejected when it contains any banned phrase;
- * each match yields one violation naming the offending phrase.
- *
- * @param {string} residualText
- * @returns {{ ok: boolean, violations: string[] }}
- */
-function checkResidualHonesty(residualText) {
-  const text = typeof residualText === 'string' ? residualText : '';
-  if (text.trim() === '') return { ok: true, violations: [] };
-
-  const violations = [];
-  for (const phrase of BANNED_RESIDUAL_PHRASES) {
-    const re = new RegExp(`\\b${_escapeRe(phrase)}\\b`, 'i');
-    if (re.test(text)) {
-      violations.push(`vague-assurance phrase: "${phrase}"`);
-    }
-  }
-  return { ok: violations.length === 0, violations };
-}
-
-function _isCitation(item) {
-  if (typeof item === 'string') return CITATION_RE.test(item);
-  if (item && typeof item === 'object' && typeof item.location === 'string') {
-    return CITATION_RE.test(item.location);
-  }
-  return false;
-}
-
-function _normalizeVerdict(verdict) {
-  return String(verdict).trim().toLowerCase().replace(/[_\s]+/g, '-');
-}
-
-/**
- * Require a file:line citation behind a "this is not real" verdict.
- *
- * For a false-positive / provably-safe / safe verdict (case-insensitive; also
- * accepts FALSE_POSITIVE), at least one evidence item must be a `file:line`
- * citation — either a string matching /[^\s:]+:\d+/ or an object
- * `{ location: "file:line" }`. Any other verdict passes unconditionally.
- *
- * @param {string} verdict
- * @param {Array|string|object} evidence
- * @returns {{ ok: boolean, violations: string[] }}
- */
-function requireCitedEvidence(verdict, evidence) {
-  if (typeof verdict !== 'string' || !FP_VERDICTS.has(_normalizeVerdict(verdict))) {
-    return { ok: true, violations: [] };
-  }
-  const items = Array.isArray(evidence)
-    ? evidence
-    : evidence == null
-      ? []
-      : [evidence];
-  if (items.some(_isCitation)) return { ok: true, violations: [] };
+function toRuntimeRule(ir) {
+  const { ok, doc, errs } = (0,_ir_js__WEBPACK_IMPORTED_MODULE_1__/* .compileToCustomRule */ .Mo)(ir);
+  if (!ok) throw new Error(`cannot build corpus for an invalid rule IR: ${errs.join('; ')}`);
+  const regexes = doc.match.allOf ? doc.match.allOf.map((p) => new RegExp(p, 'g')) : [new RegExp(doc.match.pattern, 'g')];
   return {
-    ok: false,
-    violations: ['false-positive/safe verdict requires a file:line citation'],
+    id: doc.id, title: doc.title, severity: doc.severity, cwe: doc.cwe, languages: doc.languages, message: doc.message,
+    regexes, requireAll: !!doc.match.allOf, windowLines: doc.match.window ?? 5,
+    notMatch: doc.match.notMatch ? new RegExp(doc.match.notMatch) : null,
   };
 }
 
-/**
- * Classify a fix into FULL | MITIGATION | WORKAROUND, conservative-first.
- *
- * @param {object} signals
- * @param {boolean} signals.sinkSignatureChanged
- * @param {boolean} signals.allCallersRouted
- * @param {boolean} signals.testDiscriminates - a test that fails pre-fix, passes post-fix
- * @param {boolean} [signals.rateLimitOnly]
- * @param {boolean} [signals.docsOnly]
- * @param {boolean} [signals.logOnlyNoReject]
- * @param {boolean} [signals.partialSanitization]
- * @returns {'FULL'|'MITIGATION'|'WORKAROUND'}
- */
-function computeFixTier(signals) {
-  const s = signals && typeof signals === 'object' ? signals : {};
-  if (s.rateLimitOnly || s.docsOnly || s.logOnlyNoReject) return 'WORKAROUND';
-  const complete = s.sinkSignatureChanged && s.allCallersRouted && s.testDiscriminates;
-  if (s.partialSanitization || !complete) return 'MITIGATION';
-  return 'FULL';
-}
+const EXT = { javascript: 'x.js', typescript: 'x.ts', python: 'x.py', go: 'x.go', ruby: 'x.rb', java: 'x.java', rust: 'x.rs', csharp: 'x.cs', php: 'x.php', any: 'x.txt' };
 
-/**
- * FR-308: cross-check a fix-completeness TIER against MECHANICAL evidence,
- * when any is available. `signals` (computeFixTier's input) is agent-
- * self-reported — this module cannot compute sinkSignatureChanged /
- * allCallersRouted / testDiscriminates itself (see the header above: "the
- * gate can only run against claims the AGENT self-reports... nothing here
- * is server-computable"). `pocLeg` is different: fix-verify.js's PoC leg is
- * a REAL execution result (posture/CLAUDE.md's execution-proof tiers), not
- * a claim. When it is available and shows the proof-of-concept STILL
- * demonstrates the vulnerability against the patch, a self-reported FULL
- * tier is not merely internally inconsistent — it is REFUTED by fact. This
- * is the literal "a mitigation or workaround cannot be represented as a
- * full fix" acceptance criterion, now backed by mechanical evidence where
- * it exists rather than by self-report consistency alone.
- *
- * A `pocLeg` of `not-requested` or `inconclusive` carries no mechanical
- * signal either way and is a no-op here — this check can only ever ADD a
- * violation on real contrary evidence, never manufacture one from absence.
- *
- * @param {string} tier
- * @param {{status: string, reason?: string}|null} pocLeg
- * @returns {{ ok: boolean, violations: string[] }}
- */
-function checkMechanicalTierEvidence(tier, pocLeg) {
-  if (!pocLeg || typeof pocLeg !== 'object') return { ok: true, violations: [] };
-  if (tier === 'FULL' && pocLeg.status === 'still-exploitable') {
-    return {
-      ok: false,
-      violations: [`tier 'FULL' is refuted by mechanical evidence: the proof-of-concept still demonstrates the vulnerability against the patch${pocLeg.reason ? ` (${pocLeg.reason})` : ''}`],
-    };
-  }
-  return { ok: true, violations: [] };
-}
+function buildCorpus(ir, { originalCode, patchedCode = null, nearbyCleanCode = [], protectedVariantsCode = [] } = {}) {
+  const positives = [{ label: 'original', code: originalCode }];
+  for (const v of (0,_mutation_js__WEBPACK_IMPORTED_MODULE_0__/* .generateVariants */ .G4)(originalCode)) positives.push({ label: `sibling:${v.mutator}`, code: v.code });
 
-/**
- * Compose the four gates for a single fix's output.
- *
- * ok = residual-honesty ok AND evidence-citation ok AND mechanical-tier-
- * evidence ok, further constrained by the tier/residual consistency
- * invariant:
- *   - a FULL tier must NOT carry a residual (a full fix has nothing left);
- *   - a non-FULL tier MUST document a residual (say what's still open).
- *
- * @param {{ residual?: string, verdict?: string, evidence?: any, signals?: object }} input
- * @param {{ pocLeg?: object|null }} [mechanical] - FR-308: optional real
- *   execution evidence (fix-verify.js's pocLeg) to cross-check the
- *   self-reported tier against. Omitted entirely by any caller that has no
- *   PoC leg to offer — this parameter never REQUIRES mechanical evidence,
- *   it only USES it when present.
- * @returns {{ ok: boolean, tier: string, violations: string[] }}
- */
-function gateFixOutput({ residual, verdict, evidence, signals } = {}, { pocLeg = null } = {}) {
-  const tier = computeFixTier(signals);
-  const residualCheck = checkResidualHonesty(residual);
-  const evidenceCheck = requireCitedEvidence(verdict, evidence);
-  const mechanicalCheck = checkMechanicalTierEvidence(tier, pocLeg);
-
-  const violations = [...residualCheck.violations, ...evidenceCheck.violations, ...mechanicalCheck.violations];
-  let ok = residualCheck.ok && evidenceCheck.ok && mechanicalCheck.ok;
-
-  const residualEmpty = typeof residual !== 'string' || residual.trim() === '';
-  if (tier === 'FULL' && !residualEmpty) {
-    violations.push('FULL tier cannot carry a residual');
-    ok = false;
-  }
-  if (tier !== 'FULL' && residualEmpty) {
-    violations.push('non-FULL tier must document a residual');
-    ok = false;
+  const negatives = [];
+  if (patchedCode) {
+    negatives.push({ label: 'patched', code: patchedCode });
+    for (const v of (0,_mutation_js__WEBPACK_IMPORTED_MODULE_0__/* .generateVariants */ .G4)(patchedCode)) negatives.push({ label: `patched-sibling:${v.mutator}`, code: v.code });
   }
+  // The safe side is mutated too (rename, wrapper, equivalent API, ALTERNATE SANITIZER, framework variant, ...): a rule keyed to one
+  // sanitizer's name or one framework's accessor fires on the sibling that uses another, and that is a protected-negative failure.
+  nearbyCleanCode.forEach((code, i) => {
+    negatives.push({ label: `nearby-clean-${i}`, code });
+    for (const v of (0,_mutation_js__WEBPACK_IMPORTED_MODULE_0__/* .generateVariants */ .G4)(code)) negatives.push({ label: `nearby-clean-${i}-sibling:${v.mutator}`, code: v.code });
+  });
+  protectedVariantsCode.forEach((code, i) => {
+    negatives.push({ label: `protected-${i}`, code });
+    for (const v of (0,_mutation_js__WEBPACK_IMPORTED_MODULE_0__/* .generateVariants */ .G4)(code)) negatives.push({ label: `protected-${i}-sibling:${v.mutator}`, code: v.code });
+  });
 
-  return { ok, tier, violations };
+  return { positives, negatives };
 }
 
-const _internals = Object.freeze({ BANNED_RESIDUAL_PHRASES, CITATION_RE, FP_VERDICTS });
+function scoreRule(ir, corpus) {
+  const rule = toRuntimeRule(ir);
+  const lang = ir.languages[0] || 'javascript';
+  const file = EXT[lang] || 'x.txt';
+  const run = (code) => (0,_custom_rules_js__WEBPACK_IMPORTED_MODULE_2__/* .runRule */ .OA)(rule, file, code).length > 0;
+
+  const posResults = corpus.positives.map((p) => ({ ...p, fired: run(p.code) }));
+  const negResults = corpus.negatives.map((n) => ({ ...n, fired: run(n.code) }));
+
+  const tp = posResults.filter((p) => p.fired).length;
+  const fn = posResults.length - tp;
+  const fp = negResults.filter((n) => n.fired).length;
+  const tn = negResults.length - fp;
+  const precision = tp + fp === 0 ? null : tp / (tp + fp);
+  const recall = corpus.positives.length === 0 ? null : tp / corpus.positives.length;
+  // "Protected negative failures" per PRD 3: a rule firing on a sanitizer/guard-carrying variant specifically.
+  const protectedFailures = negResults.filter((n) => n.label.startsWith('protected-') && n.fired).length;
+
+  return { precision, recall, tp, fp, tn, fn, protectedFailures, positives: posResults, negatives: negResults };
+}
 
 
 /***/ }),
 
-/***/ 32238:
+/***/ 87539:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   I3: () => (/* binding */ recordFixAttempt),
-/* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
-/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary),
-/* harmony export */   sU: () => (/* binding */ loadFixAttempts)
+/* harmony export */   GE: () => (/* binding */ ruleIRDigest),
+/* harmony export */   Mo: () => (/* binding */ compileToCustomRule),
+/* harmony export */   UQ: () => (/* binding */ RULE_STATES),
+/* harmony export */   g: () => (/* binding */ validateRuleIR),
+/* harmony export */   pc: () => (/* binding */ draftRuleIR)
 /* harmony export */ });
-/* unused harmony exports FIX_STAGES, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31174);
-// Time-to-validated-fix (R5, the reporting half).
-//
-// `verifyFix` already RUNS the stages and `test-runner.js` already times the
-// slowest one. What did not exist was anything durable to read afterwards, so
-// "how long does a fix actually take to validate" had no answer from real runs
-// — only an estimate (`time-to-fix.js` guesses engineering hours from family
-// and patch shape, before anything runs). This module is the opposite: it
-// records what the pipeline observed and reports the distribution.
-//
-// THE HONESTY RULES, which are most of why this file is longer than a mean:
+/* harmony import */ var _proof_fabric_reproducer_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(37055);
+// Rule intermediate representation: compiles DOWN into the existing pattern-rule engine
+// (`../custom-rules.js`), never a parallel matcher. "Compile" here means "emit a
+// custom-rules.js-compatible document" — detection at runtime is 100% the already-proven
+// regex/allOf/notMatch/window engine; this module only adds PROVENANCE metadata around it.
 //
-//  1. A failed attempt is NOT a data point about how long a fix takes. Fixes
-//     that fail verification fail fast (a re-scan that still sees the finding
-//     never reaches the test suite), so blending them into one average makes
-//     the pipeline look faster the worse it performs. Validated and failed
-//     attempts are summarised separately and never merged.
-//
-//  2. "Tests skipped" is not "tests passed". A project with no detectable
-//     suite can reach `ok:true` having run only the re-scan and the linter.
-//     That is a weaker claim than a fix whose suite executed, and it is also
-//     much faster, so counting the two together would quietly deflate the
-//     headline. They get their own bucket: `validated` means the suite ran and
-//     passed, `validatedWithoutTests` means there was no suite to run.
-//
-//  3. Every figure carries its `n`, and a percentile computed from too few
-//     samples is labelled unreliable rather than omitted or silently reported.
-//     Same precedent as the accuracy scorecard's `{n, d}` rates: a number
-//     without its denominator is not a measurement.
-//
-// Storage is append-only JSONL at `<scanRoot>/.agentic-security/fix-metrics.jsonl`,
-// one record per verification attempt. Nothing here throws (posture
-// convention) — an unwritable or corrupt log degrades to "no metrics", never
-// to a failed verification.
-
-
+// A rule's match semantics are deliberately the same closed vocabulary custom-rules.js
+// already supports (pattern | allOf+window | notMatch) — no new matching primitive is
+// introduced, so a promoted rule is exactly as auditable as a hand-written one.
+
+
+const RULE_IR_SCHEMA = 'agentic-security/rule-ir';
+const RULE_IR_VERSION = 1;
+const RULE_STATES = Object.freeze(['DRAFT', 'CANDIDATE', 'VALIDATED', 'PROMOTED', 'DEPRECATED', 'ROLLED_BACK']);
+const VALID_LANGS = new Set(['javascript', 'typescript', 'python', 'go', 'ruby', 'java', 'rust', 'csharp', 'php', 'any']);
+
+const isStr = (v) => typeof v === 'string' && v.length > 0;
+
+/** Problems with a draft rule IR; an empty list means it is well-formed (not yet validated/promoted). */
+function validateRuleIR(ir) {
+  const errs = [];
+  if (!ir || typeof ir !== 'object') return ['rule IR must be an object'];
+  if (ir.schema !== RULE_IR_SCHEMA) errs.push('unknown schema');
+  if (ir.version !== RULE_IR_VERSION) errs.push('unsupported rule IR version');
+  if (!isStr(ir.id) || !/^[a-z][a-z0-9-]{2,79}$/.test(ir.id)) errs.push('id must be a lowercase kebab-case string');
+  if (!isStr(ir.title)) errs.push('title required');
+  if (!['critical', 'high', 'medium', 'low'].includes(ir.severity)) errs.push('severity must be critical|high|medium|low');
+  if (!isStr(ir.cwe) || !/^CWE-\d+$/.test(ir.cwe)) errs.push('cwe must look like CWE-###');
+  if (!isStr(ir.family)) errs.push('family required');
+  if (!Array.isArray(ir.languages) || !ir.languages.length || !ir.languages.every((l) => VALID_LANGS.has(l))) errs.push('languages must be a non-empty array from the supported set');
+  const m = ir.match;
+  if (!m || typeof m !== 'object') errs.push('match required');
+  else {
+    const hasPattern = isStr(m.pattern);
+    const hasAllOf = Array.isArray(m.allOf) && m.allOf.length > 0 && m.allOf.every(isStr);
+    if (!hasPattern && !hasAllOf) errs.push('match needs a pattern or a non-empty allOf');
+    if (m.notMatch != null && !isStr(m.notMatch)) errs.push('notMatch must be a string');
+    if (m.window != null && !(Number.isInteger(m.window) && m.window > 0 && m.window <= 200)) errs.push('window must be an integer in 1..200');
+    for (const re of [m.pattern, ...(m.allOf || []), m.notMatch].filter(isStr)) {
+      try { new RegExp(re); } catch { errs.push(`invalid regex: ${re}`); }
+    }
+  }
+  // Declarative-only hint fields (sink/source/propagator/sanitizer/dominatingGuard/frameworkConstraint): free text,
+  // never executable, carried for provenance/review only and NOT consulted by the matcher.
+  for (const k of ['sink', 'source', 'propagator', 'sanitizer', 'dominatingGuard', 'frameworkConstraint']) {
+    if (ir[k] != null && !isStr(ir[k])) errs.push(`${k} must be a string when present`);
+  }
+  if (ir.exclusions != null && !(Array.isArray(ir.exclusions) && ir.exclusions.every(isStr))) errs.push('exclusions must be an array of strings');
+  if (!ir.provenance || typeof ir.provenance !== 'object') errs.push('provenance required');
+  else {
+    if (!isStr(ir.provenance.originatingFindingId)) errs.push('provenance.originatingFindingId required');
+    if (ir.provenance.originatingCommit != null && !isStr(ir.provenance.originatingCommit)) errs.push('provenance.originatingCommit must be a string');
+    if (!['execution-proven', 'taint-proven', 'deterministic-corroboration'].includes(ir.provenance.evidenceState)) errs.push('provenance.evidenceState must be execution-proven|taint-proven|deterministic-corroboration');
+  }
+  return errs;
+}
 
+function ruleIRDigest(ir) {
+  const { state: _s, ...rest } = ir;
+  return (0,_proof_fabric_reproducer_js__WEBPACK_IMPORTED_MODULE_0__/* .sha256 */ .sc)(JSON.stringify(rest, Object.keys(rest).sort()));
+}
 
+/** Build a DRAFT rule IR. Caller supplies the candidate pattern — this module never invents one. */
+function draftRuleIR({ id, title, severity, cwe, family, languages, match, remediation, originatingFindingId, originatingCommit, evidenceState, model = null, promptConfigVersion = null, ...hints }) {
+  const ir = {
+    schema: RULE_IR_SCHEMA, version: RULE_IR_VERSION, id, title, severity, cwe, family, languages, match,
+    remediation: remediation ?? null, state: 'DRAFT',
+    ...hints,
+    provenance: { originatingFindingId, originatingCommit: originatingCommit ?? null, evidenceState, model, promptConfigVersion },
+  };
+  return ir;
+}
 
-const LOG_FILE = 'fix-metrics.jsonl';
+/** Compile a rule IR into a custom-rules.js-compatible document. Caller writes the YAML. */
+function compileToCustomRule(ir) {
+  const errs = validateRuleIR(ir);
+  if (errs.length) return { ok: false, errs };
+  const doc = {
+    id: `rule-compiler/${ir.id}`,
+    title: ir.title,
+    severity: ir.severity,
+    cwe: ir.cwe,
+    languages: ir.languages,
+    match: { ...(ir.match.pattern ? { pattern: ir.match.pattern } : {}), ...(ir.match.allOf ? { allOf: ir.match.allOf, window: ir.match.window ?? 5 } : {}), ...(ir.match.notMatch ? { notMatch: ir.match.notMatch } : {}) },
+    message: ir.remediation || `${ir.title} (${ir.cwe}, compiled from ${ir.provenance.originatingFindingId})`,
+  };
+  return { ok: true, doc };
+}
 
-// Below this many samples a percentile is an artifact of the sample, not a
-// property of the pipeline. Reported anyway (hiding it invites re-deriving it
-// wrong downstream) but flagged, so a caller cannot quote it as settled.
-const RELIABLE_N = 10;
 
-// The stages verifyFix runs, in execution order. Kept here so the recorder and
-// the summariser cannot drift apart on stage naming.
-const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
+/***/ }),
 
-function _logPath(scanRoot) {
-  return (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, LOG_FILE);
-}
+/***/ 85127:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
-/**
- * Append one verification attempt. Best-effort and silent on failure: metrics
- * must never be able to fail a fix that otherwise verified.
- *
- * @returns {boolean} whether the record was written (for tests, not callers).
- */
-function recordFixAttempt(scanRoot, record) {
-  if (!scanRoot || !record || typeof record !== 'object') return false;
-  try {
-    const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
-    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
-    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return false;
-  node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
-    // One writeSync of one newline-terminated line: a concurrent reader sees
-    // whole records or nothing, and a torn tail is dropped on read.
-    node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');
-    return true;
-  } catch { return false; }
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   G4: () => (/* binding */ generateVariants),
+/* harmony export */   xv: () => (/* binding */ mutatorCoverage)
+/* harmony export */ });
+/* unused harmony exports variableRename, wrapInFunction, equivalentApi, alternateSanitizer, frameworkVariant, reorderStatements, MUTATOR_NAMES */
+// Bounded structural mutation for ONE candidate rule's own corpus — not bench/mutation's engine-wide verdict-flip
+// harness (a different scope: the whole deterministic+taint engine against curated adversarial cases). This module
+// exists only to answer PRD 3's "unseen sibling" question for a single rule: does the candidate still fire on a
+// structurally different variant of the same vulnerable shape, and does it still decline on a structurally
+// different variant of a mitigated shape.
+//
+// Mutations are SYNTACTIC, deterministic, seed-free and language-agnostic: variable rename, wrap-in-function,
+// reorder-adjacent-statements, insert-indirection (a pass-through local variable). No semantics are changed on
+// purpose — a mutation that silently changed behavior would make a "same vulnerability, different shape" claim
+// false.
+const RESERVED = new Set(['if', 'else', 'for', 'while', 'return', 'function', 'const', 'let', 'var', 'import', 'from', 'def', 'class', 'req', 'res']);
+
+function identifiers(code) {
+  const seen = new Set();
+  for (const m of code.matchAll(/\b([A-Za-z_][A-Za-z0-9_]*)\b/g)) if (!RESERVED.has(m[1]) && !/^[A-Z_]+$/.test(m[1])) seen.add(m[1]);
+  return [...seen];
 }
 
-/**
- * Read every well-formed attempt. A line that does not parse is skipped, not
- * fatal — the last line of an interrupted write is the expected case.
- */
-function loadFixAttempts(scanRoot) {
-  try {
-    const raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(_logPath(scanRoot), 'utf8');
-    const out = [];
-    for (const line of raw.split('\n')) {
-      if (!line.trim()) continue;
-      try {
-        const rec = JSON.parse(line);
-        if (rec && typeof rec === 'object' && typeof rec.totalMs === 'number') out.push(rec);
-      } catch { /* torn or hand-edited line — drop it, keep the rest */ }
-    }
-    return out;
-  } catch { return []; }
+function renameOne(code, from, to) {
+  if (!from || code.includes(to)) return null;
+  return code.replace(new RegExp(`\\b${from}\\b`, 'g'), to);
 }
 
-// Nearest-rank percentile over an ascending array. Nearest-rank rather than
-// interpolated because these are observed durations, and an interpolated p50
-// reports a duration that no run actually took.
-function _pct(sorted, p) {
-  if (!sorted.length) return null;
-  const rank = Math.ceil((p / 100) * sorted.length);
-  return sorted[Math.min(sorted.length - 1, Math.max(0, rank - 1))];
+function variableRename(code, { suffix = '_v2' } = {}) {
+  const ids = identifiers(code);
+  const target = ids.find((id) => id.length > 1);
+  if (!target) return null;
+  return renameOne(code, target, `${target}${suffix}`);
 }
 
-function _dist(values) {
-  const v = values.filter(x => typeof x === 'number' && Number.isFinite(x) && x >= 0).sort((a, b) => a - b);
-  if (!v.length) return { n: 0, minMs: null, p50Ms: null, p90Ms: null, maxMs: null, meanMs: null, reliable: false };
-  const sum = v.reduce((a, b) => a + b, 0);
-  return {
-    n: v.length,
-    minMs: v[0],
-    p50Ms: _pct(v, 50),
-    p90Ms: _pct(v, 90),
-    maxMs: v[v.length - 1],
-    meanMs: Math.round(sum / v.length),
-    // Says whether the percentiles above may be quoted, not whether the count
-    // is real. n and min/max/mean are exact at any sample size.
-    reliable: v.length >= RELIABLE_N,
-  };
+function wrapInFunction(code, { name = 'wrapped_v2' } = {}) {
+  if (!String(code).trim()) return null;
+  const indented = code.split('\n').map((l) => (l ? `  ${l}` : l)).join('\n');
+  return `function ${name}() {\n${indented}\n}\n${name}();\n`;
 }
 
-// Which bucket an attempt belongs to. Deliberately total: every attempt lands
-// in exactly one, so the bucket counts always sum to the attempt count and a
-// mis-shaped record cannot silently vanish from the denominator.
-function bucketOf(a) {
-  if (!a?.ok) return 'failed';
-  return a.testsRan ? 'validated' : 'validatedWithoutTests';
+/** Insert a pass-through local for the first simple right-hand-side identifier assigned with `=` (indirection,
+ * no behavior change): `x = y;` becomes `const indirectN = y; x = indirectN;`. */
+function insertIndirection(code) {
+  const m = /^(\s*)([A-Za-z_][A-Za-z0-9_.]*)\s*=\s*([A-Za-z_][A-Za-z0-9_.]*)\s*;/m.exec(code);
+  if (!m) return null;
+  const [whole, indent, lhs, rhs] = m;
+  const varName = `indirect_${Math.abs(_hash(rhs)) % 1000}`;
+  if (code.includes(varName)) return null;
+  return code.replace(whole, `${indent}const ${varName} = ${rhs};\n${indent}${lhs} = ${varName};`);
 }
 
-/**
- * Summarise a set of attempts into the reported distribution.
- *
- * `validated` is the headline: attempts that verified AND whose test suite
- * actually ran and passed. The other two buckets exist so that headline cannot
- * be inflated by counting weaker or faster outcomes inside it.
- */
-function summarizeFixDurations(attempts) {
-  const all = Array.isArray(attempts) ? attempts : [];
-  const buckets = { validated: [], validatedWithoutTests: [], failed: [] };
-  for (const a of all) buckets[bucketOf(a)].push(a);
-
-  const byStage = {};
-  for (const stage of FIX_STAGES) {
-    // Per-stage timings come from validated runs only. A stage's duration in a
-    // failed run is truncated by the failure (the pipeline stops), so mixing
-    // them in would understate every stage after the first failure point.
-    byStage[stage] = _dist(buckets.validated.map(a => a?.stages?.[stage]));
-  }
-
-  return {
-    attempts: all.length,
-    counts: {
-      validated: buckets.validated.length,
-      validatedWithoutTests: buckets.validatedWithoutTests.length,
-      failed: buckets.failed.length,
-    },
-    timeToValidatedFix: _dist(buckets.validated.map(a => a.totalMs)),
-    timeToValidatedFixWithoutTests: _dist(buckets.validatedWithoutTests.map(a => a.totalMs)),
-    timeToFailure: _dist(buckets.failed.map(a => a.totalMs)),
-    byStage,
-    reliableAtOrAbove: RELIABLE_N,
-  };
+function _hash(s) { let h = 0; for (const c of s) h = (h * 31 + c.charCodeAt(0)) | 0; return h; }
+
+// ---- the four mutators the PRD lists beyond rename / wrapper / indirection --------------------------------------------------
+// Each is a deterministic, table-driven textual rewrite that returns null when it does not apply. Tables are deliberately
+// small and conservative: an entry is here only when both sides are the same API family used the same way, so the claim "same
+// vulnerability, different shape" stays true. They are applied to the vulnerable side (does the rule still fire?) and to the safe
+// side (does it still decline?); the safe side is where a rule keyed to ONE sanitizer's name is caught.
+
+// equivalent APIs: the same operation through a sibling entry point
+const EQUIVALENT_APIS = Object.freeze([
+  [/\bchild_process\.exec\(/, 'child_process.execSync('], [/\bexecSync\(/, 'exec('], [/\bos\.system\(/, 'os.popen('],
+  [/\bdb\.query\(/, 'db.execute('], [/\bconnection\.query\(/, 'connection.execute('], [/\bcursor\.execute\(/, 'cursor.executemany('],
+  [/\bfs\.readFile\(/, 'fs.readFileSync('], [/\bfs\.readFileSync\(/, 'fs.readFile('], [/\bfs\.writeFile\(/, 'fs.writeFileSync('],
+  [/\bhttp\.get\(/, 'https.get('], [/\baxios\.get\(/, 'axios.request('], [/\bres\.send\(/, 'res.end('],
+  [/\bos\.Open\(/, 'os.OpenFile('], [/\bsubprocess\.call\(/, 'subprocess.run('], [/\bsubprocess\.run\(/, 'subprocess.call('],
+]);
+function equivalentApi(code) {
+  for (const [from, to] of EQUIVALENT_APIS) if (from.test(code)) return code.replace(from, to);
+  return null;
 }
 
-/** Read + summarise in one step. */
-function fixDurationReport(scanRoot) {
-  return summarizeFixDurations(loadFixAttempts(scanRoot));
+// alternate sanitizers: a different, equally valid way to neutralize the same input
+const ALTERNATE_SANITIZERS = Object.freeze([
+  [/\bescapeHtml\(/, 'validator.escape('], [/\bvalidator\.escape\(/, 'escapeHtml('], [/\bDOMPurify\.sanitize\(/, 'sanitizeHtml('], [/\bsanitizeHtml\(/, 'DOMPurify.sanitize('],
+  [/\bshlex\.quote\(/, 'pipes.quote('], [/\bhtml\.escape\(/, 'markupsafe.escape('], [/\bhtml\.EscapeString\(/, 'template.HTMLEscapeString('],
+  [/\bencodeURIComponent\(/, 'encodeURI('], [/\bpath\.basename\(/, 'path.parse('], [/\bparseInt\(/, 'Number('], [/\bNumber\(/, 'parseInt('],
+  [/\bstrconv\.Atoi\(/, 'strconv.ParseInt('], [/\bint\(/, 'abs('],
+]);
+function alternateSanitizer(code) {
+  for (const [from, to] of ALTERNATE_SANITIZERS) if (from.test(code)) return code.replace(from, to);
+  return null;
 }
 
-function _ms(v) {
-  if (v == null) return '—';
-  return v >= 1000 ? `${(v / 1000).toFixed(1)}s` : `${v}ms`;
+// framework variants: the same untrusted input reached through another framework's accessor
+const FRAMEWORK_VARIANTS = Object.freeze([
+  [/\breq\.body\./g, 'ctx.request.body.'], [/\breq\.query\./g, 'ctx.query.'], [/\breq\.params\./g, 'ctx.params.'],
+  [/\brequest\.args\.get\(/g, 'request.form.get('], [/\brequest\.form\.get\(/g, 'request.args.get('], [/\$_GET\[/g, '$_REQUEST['], [/\$_POST\[/g, '$_REQUEST['],
+  [/\br\.URL\.Query\(\)\.Get\(/g, 'r.FormValue('], [/\brequest\.getParameter\(/g, 'request.getHeader('],
+]);
+function frameworkVariant(code) {
+  for (const [from, to] of FRAMEWORK_VARIANTS) if (from.test(code)) { from.lastIndex = 0; return code.replace(from, to); }
+  return null;
 }
 
-/**
- * One-paragraph human summary. Returns null when there is nothing measured —
- * callers print nothing rather than printing an empty table.
- */
-function renderFixDurationSummary(sum) {
-  if (!sum || !sum.attempts) return null;
-  const d = sum.timeToValidatedFix;
-  const parts = [];
-  if (d.n) {
-    parts.push(
-      `time-to-validated-fix: median ${_ms(d.p50Ms)}, p90 ${_ms(d.p90Ms)} `
-      + `(n=${d.n}${d.reliable ? '' : `, below ${sum.reliableAtOrAbove} — percentiles not yet reliable`})`,
-    );
-  } else {
-    parts.push('time-to-validated-fix: no fix has both verified and had its test suite run yet');
+// reordering: swap the first pair of ADJACENT simple statements that share no identifier, so neither feeds the other. This is a
+// syntactic independence test, not a data-flow proof; it is applied to rule-corpus snippets, where a swap of two unrelated
+// statements is what a different author's version of the same code would plausibly look like.
+const CONTROL = /^\s*(?:if|else|for|while|switch|case|return|try|catch|finally|do|break|continue|throw|function|def|class|import|from|package|\}|\{|@|\/\/|#)\b|^\s*[}{]\s*$/;
+function reorderStatements(code) {
+  const lines = code.split('\n');
+  const simple = (l) => l.trim() && !CONTROL.test(l) && /[;)]\s*$|^[^=]*=[^=].*[^{]$/.test(l.trim()) && !/[{]\s*$/.test(l);
+  const ids = (l) => new Set([...l.matchAll(/\b[A-Za-z_][A-Za-z0-9_]*\b/g)].map((m) => m[0]).filter((x) => !RESERVED.has(x)));
+  for (let i = 0; i + 1 < lines.length; i++) {
+    if (!simple(lines[i]) || !simple(lines[i + 1])) continue;
+    const a = ids(lines[i]); const b = ids(lines[i + 1]);
+    if ([...a].some((x) => b.has(x))) continue;
+    const out = [...lines]; [out[i], out[i + 1]] = [out[i + 1], out[i]];
+    return out.join('\n');
   }
-  if (sum.counts.validatedWithoutTests) {
-    parts.push(`${sum.counts.validatedWithoutTests} verified with no detectable test suite (excluded from the median above)`);
-  }
-  if (sum.counts.failed) {
-    parts.push(`${sum.counts.failed} failed verification, median ${_ms(sum.timeToFailure.p50Ms)} (counted separately)`);
-  }
-  return parts.join('; ') + '.';
+  return null;
 }
 
-const _internals = { _dist, _pct, RELIABLE_N };
-
-
-// ── PRD F6.1 — score fixes on THREE AXES, not one ──────────────────────────
-//
-// The three axes the PRD names:
-//   (a) does the finding disappear      — the rescan leg
-//   (b) does the project's own suite pass — the tests leg
-//   (c) does an independent verifier agree — the PoC re-check leg
-//
-// All three were already computed by verifyFixCore and then collapsed into one
-// boolean, which is the problem: **(a) alone is satisfiable by deleting code.**
-// A patch that removes the vulnerable function passes the rescan, has nothing
-// left to fail, and — on a project with no detectable test suite — reaches
-// ok:true having proven only that the detector went quiet.
-//
-// Reporting the axes separately makes that visible. `aOnly` is the number that
-// matters most and the one nobody was publishing: attempts that satisfied ONLY
-// the disappearance axis. A high aOnly with a high headline is the shape of a
-// remediation feature that is deleting code and calling it a fix.
-function summarizeFixAxes(attempts) {
-  const list = Array.isArray(attempts) ? attempts.filter(Boolean) : [];
-  const d = list.length;
-
-  const rate = (pred) => ({ n: list.filter(pred).length, d });
-
-  // Each axis is judged INDEPENDENTLY of the overall verdict, so a leg that
-  // passed inside a failed attempt still counts for its own axis. Reading them
-  // off `ok` would make the three axes three copies of the same number.
-  const findingDisappeared = rate((a) => a.rescanOk === true || (a.ok === true && a.rescanOk !== false));
-  const testsStillPass = rate((a) => a.testsRan === true && a.testsOk !== false);
-  const verifierAgrees = rate((a) => a.pocOk === true);
-
-  const satisfiesAll = rate((a) =>
-    (a.rescanOk === true || (a.ok === true && a.rescanOk !== false))
-    && a.testsRan === true && a.testsOk !== false
-    && a.pocOk === true);
-
-  // The honesty number: disappearance WITHOUT either corroborating axis.
-  const aOnly = rate((a) => {
-    const disappeared = a.rescanOk === true || (a.ok === true && a.rescanOk !== false);
-    const corroborated = (a.testsRan === true && a.testsOk !== false) || a.pocOk === true;
-    return disappeared && !corroborated;
-  });
-
-  return {
-    total: d,
-    findingDisappeared,
-    testsStillPass,
-    verifierAgrees,
-    satisfiesAll,
-    aOnly,
-    meaning:
-      'findingDisappeared = the detector went quiet; testsStillPass = the project suite ran AND passed; '
-      + 'verifierAgrees = an independent PoC re-check confirmed the hole is shut. '
-      + 'aOnly counts attempts that satisfied ONLY disappearance — the shape a code-deleting "fix" produces.',
-    caveat: d === 0
-      ? 'no attempts recorded; every rate is 0/0 and means nothing'
-      : 'rates carry {n,d}; a small d is indicative, not settled',
-  };
+const MUTATORS = Object.freeze({
+  'variable-rename': variableRename, 'wrap-in-function': wrapInFunction, 'insert-indirection': insertIndirection,
+  'equivalent-api': equivalentApi, 'reorder-statements': reorderStatements, 'alternate-sanitizer': alternateSanitizer, 'framework-variant': frameworkVariant,
+});
+const MUTATOR_NAMES = Object.freeze(Object.keys(MUTATORS));
+
+/** Every mutator applied to `code`; mutators that don't apply (return null) are omitted, never silently skipped without saying so. */
+function generateVariants(code) {
+  const out = [];
+  for (const [name, fn] of Object.entries(MUTATORS)) {
+    let variant = null;
+    try { variant = fn(code); } catch { variant = null; }
+    if (variant && variant !== code) out.push({ mutator: name, code: variant });
+  }
+  return out;
 }
 
-/** Markdown for a report. Denominators always attached. */
-function renderFixAxes(sum) {
-  if (!sum || !sum.total) return '_No fix attempts recorded._\n';
-  const row = (label, r, note) => `| ${label} | ${r.n}/${r.d} | ${note} |`;
-  return [
-    '| Axis | Rate | Meaning |',
-    '|---|---|---|',
-    row('(a) finding disappeared', sum.findingDisappeared, 'the detector went quiet'),
-    row('(b) project tests pass', sum.testsStillPass, 'the suite RAN and passed'),
-    row('(c) verifier agrees', sum.verifierAgrees, 'an independent PoC re-check confirmed it'),
-    row('all three', sum.satisfiesAll, 'the only row that means "fixed"'),
-    row('(a) ALONE', sum.aOnly, 'satisfiable by deleting code — watch this number'),
-    '',
-  ].join('\n');
+/** Which of the seven mutators produced a variant for this code, and which did not (so a report can say what was not exercised). */
+function mutatorCoverage(code) {
+  const applied = new Set(generateVariants(code).map((v) => v.mutator));
+  return { applied: MUTATOR_NAMES.filter((n) => applied.has(n)), notApplicable: MUTATOR_NAMES.filter((n) => !applied.has(n)) };
 }
 
 
 /***/ }),
 
-/***/ 27838:
-/***/ ((__webpack_module__, __webpack_exports__, __webpack_require__) => {
+/***/ 57711:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
-__webpack_require__.a(__webpack_module__, async (__webpack_handle_async_dependencies__, __webpack_async_result__) => { try {
-__webpack_require__.r(__webpack_exports__);
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   runProjectLinter: () => (/* binding */ runProjectLinter),
-/* harmony export */   verifyFix: () => (/* binding */ verifyFix),
-/* harmony export */   verifyPatch: () => (/* binding */ verifyPatch)
+/* harmony export */   V2: () => (/* binding */ PROMOTION_DEFAULTS),
+/* harmony export */   kx: () => (/* binding */ evaluateRule),
+/* harmony export */   r_: () => (/* binding */ checkLeakage),
+/* harmony export */   z: () => (/* binding */ gatePromotion)
 /* harmony export */ });
-/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(31421);
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(73024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(67198);
-/* harmony import */ var _fix_honesty_gate_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(27785);
-/* harmony import */ var _test_runner_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(35136);
-/* harmony import */ var _fix_metrics_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(32238);
-/* harmony import */ var _verification_emit_js__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__(85578);
-var __webpack_async_dependencies__ = __webpack_handle_async_dependencies__([_engine_js__WEBPACK_IMPORTED_MODULE_3__]);
-_engine_js__WEBPACK_IMPORTED_MODULE_3__ = (__webpack_async_dependencies__.then ? (await __webpack_async_dependencies__)() : __webpack_async_dependencies__)[0];
-// Closed-loop /fix verification (Sentinel-parity FR-L4-4, FR-L4-5).
-//
-// Given a candidate patch (the new file content + the finding stableId being
-// fixed), verify it:
-//
-//   1. The original finding's stableId no longer fires on the patched file.
-//   2. No new findings at severity ≥ medium were introduced by the patch.
-//   3. The project's existing linter (when present) passes on the patched file.
-//   4. The project's own test suite (when detectable) still passes. This is
-//      the R5 gap-closer: a patch that silently deletes the feature would
-//      satisfy (1) and (2) just as well as a real fix — only running the
-//      tests catches that. See `test-runner.js` for detection + execution.
-//
-// If any of those fail, the caller is expected to NOT apply the patch and
-// instead surface a "fix plan" — a numbered list of steps the engineer can
-// follow — rather than dump a broken patch on the user.
-
-
-
+/* harmony import */ var _corpus_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(43556);
+// Promotion gate (PRD 3 "Promotion Gate"): precision/recall thresholds, zero protected-negative failures, zero
+// benchmark leakage. A candidate rule does NOT automatically become a production rule — `evaluateRule` only
+// scores; `gatePromotion` only judges; the lifecycle ledger (`lifecycle.js`) is the one place a PROMOTED state is
+// actually recorded, and nothing in this module writes to it.
 
 
+const PROMOTION_DEFAULTS = Object.freeze({ minPrecision: 0.95, minRecall: 0.80, maxProtectedFailures: 0 });
 
+// Deliberately independent of posture/evaluation/custody.js: that module's term list and guard are reserved for
+// the evaluation custodian's sealed-label boundary (QA-002.AC03), and a test enforces that nothing outside
+// posture/evaluation/ may import it. The anti-cheating need here is smaller and different in kind — a rule
+// synthesis prompt/corpus must not embed a benchmark name or an advisory id — so it gets its own small, independent
+// checker rather than reaching across that isolation boundary.
+const ADVISORY_ID = /\b(?:CVE|GHSA|CWE)-[A-Za-z0-9-]+\b/i;
 
+// What a synthesis agent must never see (PRD 3, anti-cheating): benchmark answer keys, hidden test labels, CWE-bearing hidden file
+// names, vulnerability comments and protected test metadata. These defaults are always applied; a caller adds its own benchmark names.
+const DEFAULT_BENCHMARK_NAMES = Object.freeze(['owasp benchmark', 'juliet', 'sard test', 'cve-replay', 'corpus-baseline', 'answer key', 'ground truth', 'adjudicated', 'hidden test', 'expectedresults']);
+const CWE_FILENAME = /(^|[\\/])[^\\/]*cwe[-_]?\d+[^\\/]*$/i;
+const ANSWER_KEY_FILENAME = /(^|[\\/])(?:labels?|answers?|expected|ground[-_]?truth|answer[-_]?key|oracle|result)[^\\/]*\.(?:json|jsonl|ya?ml|csv|txt)$/i;
+const VULNERABILITY_COMMENT = /(?:\/\/|#|\/\*|^\s*\*)\s*(?:POTENTIAL FLAW|FLAW\b|INCIDENTAL|BAD\b|GOOD\b|vulnerab\w*|insecure|exploit\w*)/im;
 
-
-
-const SEVERITY_RANK = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
-
-// Run a focused re-scan over just the patched file(s) using the in-memory
-// engine. No filesystem write needed — we hand the new content in via the
-// fileContents map.
-async function verifyPatch({
-  scanRoot,
-  originalFindingStableId,
-  files,   // { [relPath]: newContent }
-  depFileContents = {},
-} = {}) {
-  if (!files || typeof files !== 'object') return { ok: false, reason: 'no-files-provided' };
-  let fileContents = { ...files };
-  let scan;
-  // Haskell/Nix findings come from the deep (IR) layer and depend on imported modules: verifying a patch without
-  // either would never see the original finding at all, so a patch that fixes nothing would read "verified". The
-  // patched files are scanned deep, together with their import closure and manifests read from disk.
-  let deep;
-  if (Object.keys(fileContents).some((f) => /\.(?:l?hs|hs-boot|hsc|nix)$/i.test(f))) {
-    const { withLanguageContext } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 52603));
-    const lc = withLanguageContext(scanRoot, fileContents, depFileContents);
-    fileContents = lc.fileContents; depFileContents = lc.depFileContents; deep = true;
-  }
-  try {
-    // `provenance:false` is REQUIRED here, not an optimisation. This scan is
-    // deliberately scoped to just the patched file(s), so its finding set is a
-    // tiny subset of the project's. updateLifecycle marks every open stableId
-    // NOT in the set it is handed as `remediated` — so a single fix
-    // verification (every /fix, apply_fix, and autopilot iteration runs one)
-    // would mass-mark the rest of the project as remediated, then
-    // `reintroduced` on the next real scan. The patched content is also not
-    // committed, so there is no history to resolve provenance against anyway.
-    scan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_3__/* .runFullScan */ .wW)({ fileContents, depFileContents, scanRoot, provenance: false, ...(deep ? { deep: true } : {}) }, () => {});
-  } catch (e) {
-    return { ok: false, reason: 'rescan-failed', error: e.message };
-  }
-  const findings = (scan && scan.findings) || [];
-  const stillHasOriginal = !!originalFindingStableId &&
-    findings.some(f => f.stableId === originalFindingStableId);
-  if (stillHasOriginal) {
-    return { ok: false, reason: 'original-finding-still-present', stableId: originalFindingStableId };
-  }
-  // With language context in play, files that were only read for context carry findings that predate the patch;
-  // only findings in the PATCHED files can be introduced by it.
-  const patchedSet = new Set(Object.keys(files));
-  const introducedHighOrAbove = findings.filter(f =>
-    (SEVERITY_RANK[f.severity] ?? 9) <= SEVERITY_RANK.medium && (!deep || patchedSet.has(f.file)));
-  // Don't count findings on lines outside the patched files — but our
-  // fileContents map IS the patched files, so every finding is in-scope.
-  return {
-    ok: introducedHighOrAbove.length === 0,
-    reason: introducedHighOrAbove.length === 0 ? 'verified' : 'introduced-new-findings',
-    introduced: introducedHighOrAbove.map(f => ({
-      vuln: f.vuln, file: f.file, line: f.line, severity: f.severity,
-      stableId: f.stableId,
-    })),
-  };
-}
-
-// Detect which linter the project uses and run it on the patched files.
-// Returns { ok, runner, output } or { ok: true, runner: 'none' } when no
-// linter is configured (silent pass).
-function runProjectLinter(scanRoot, filePaths) {
-  if (!scanRoot || !Array.isArray(filePaths) || filePaths.length === 0) {
-    return { ok: true, runner: 'none' };
-  }
-  const has = (p) => { try { return node_fs__WEBPACK_IMPORTED_MODULE_1__.existsSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, p)); } catch { return false; } };
-  // Pick the linter by config file present in the repo root.
-  const jsFiles = filePaths.filter(f => /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(f));
-  const pyFiles = filePaths.filter(f => /\.py$/i.test(f));
-  const goFiles = filePaths.filter(f => /\.go$/i.test(f));
-  const javaFiles = filePaths.filter(f => /\.java$/i.test(f));
-
-  if (jsFiles.length && (has('.eslintrc') || has('.eslintrc.json') || has('.eslintrc.js') || has('eslint.config.js') || has('eslint.config.mjs'))) {
-    return runLinter(scanRoot, 'eslint', ['--no-error-on-unmatched-pattern', ...jsFiles]);
-  }
-  if (pyFiles.length && (has('pyproject.toml') || has('ruff.toml') || has('.ruff.toml'))) {
-    return runLinter(scanRoot, 'ruff', ['check', ...pyFiles]);
-  }
-  if (pyFiles.length && has('.flake8')) {
-    return runLinter(scanRoot, 'flake8', pyFiles);
-  }
-  if (goFiles.length && (has('.golangci.yml') || has('.golangci.yaml'))) {
-    return runLinter(scanRoot, 'golangci-lint', ['run', ...goFiles]);
-  }
-  if (javaFiles.length && has('checkstyle.xml')) {
-    return runLinter(scanRoot, 'checkstyle', ['-c', 'checkstyle.xml', ...javaFiles]);
-  }
-  return { ok: true, runner: 'none' };
-}
-
-function runLinter(cwd, cmd, args) {
-  let r;
-  try {
-    r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)(cmd, args, { cwd, encoding: 'utf8', timeout: 60_000 });
-  } catch (e) {
-    return { ok: true, runner: cmd, skipped: true, reason: 'binary-missing', error: e.message };
-  }
-  if (r.error && r.error.code === 'ENOENT') {
-    return { ok: true, runner: cmd, skipped: true, reason: 'binary-missing' };
-  }
-  if (r.status === null) {
-    return { ok: false, runner: cmd, reason: 'timed-out', output: (r.stderr || r.stdout || '').slice(-2000) };
-  }
-  return {
-    ok: r.status === 0,
-    runner: cmd,
-    exitCode: r.status,
-    output: ((r.stderr || '') + (r.stdout || '')).slice(-2000),
-  };
+/**
+ * Anti-cheating gate. Fails closed: any hit makes `ok` false, and the synthesis loop will not report a pass.
+ * @param {string} promptText everything the synthesis agent would be shown (corpus code, spec text)
+ * @param {{benchmarkNames?: string[], fileNames?: string[]}} opts
+ */
+function checkLeakage(promptText, { benchmarkNames = [], fileNames = [] } = {}) {
+  const hay = String(promptText ?? '');
+  const lower = hay.toLowerCase();
+  const offending = [];
+  for (const name of [...DEFAULT_BENCHMARK_NAMES, ...benchmarkNames]) if (name && lower.includes(String(name).toLowerCase())) offending.push(`benchmark name: ${name}`);
+  const m = ADVISORY_ID.exec(hay);
+  if (m) offending.push(`identifier: ${m[0]}`);
+  if (VULNERABILITY_COMMENT.test(hay)) offending.push('a comment that describes the vulnerability');
+  for (const f of fileNames) {
+    if (CWE_FILENAME.test(String(f))) offending.push(`weakness-bearing file name: ${f}`);
+    if (ANSWER_KEY_FILENAME.test(String(f))) offending.push(`answer-key file name: ${f}`);
+  }
+  return { ok: offending.length === 0, offendingTerms: offending };
 }
 
-// Top-level verify: re-scan + lint. Returns the combined verdict + a
-// human-readable summary string suitable for surfacing to the user.
-// Addition #7 — deterministic honesty gates on fix output. When the caller
-// supplies `fixMeta` ({ residual, verdict, evidence, signals }) — e.g. the
-// security-fixer agent's residual-risk text + completeness signals — the fix's
-// claims are checked mechanically (no hand-wave residual prose, a cited
-// file:line for any FP/safe verdict, and a FULL/MITIGATION/WORKAROUND tier). A
-// dishonest or over-claiming fix fails the gate. When `fixMeta` is absent
-// (the deterministic MCP write path, which has no claims to check) the honesty
-// gate is skipped and behavior is unchanged.
-// R5 (partial) — the test-suite stage. Runs the target project's own tests,
-// in the target project's own directory, against whatever is currently on
-// disk there. See `test-runner.js`'s header comment for why that run is
-// deliberately NOT routed through the R1 PoC-confinement sandbox: this is
-// the project's own already-trusted suite, not untrusted synthesized code.
-//
-// Caveat that matters for callers: `verifyPatch` above re-scans the
-// candidate patch purely in memory (no write to disk), but a test runner
-// needs real files — there is no cheap way to hand a runner an in-memory
-// overlay. So this leg reports on the CURRENT on-disk tree, not the
-// candidate `files` map, when `verifyFix` is used as a pre-write preview
-// (e.g. the `verify_fix` MCP tool). Callers that apply the patch first and
-// then re-verify get the strongest signal; that ordering is not enforced
-// here — it's the caller's responsibility, same as it already is for the
-// closed-loop `fix-verify-loop.js` path.
-// Does the caller's candidate patch differ from what is on disk right now?
-// If so, any test run necessarily exercised the pre-patch tree. Compared by
-// content so a patch that happens to match disk (already applied) is correctly
-// treated as NOT pre-patch.
-function _candidateDiffersFromDisk(scanRoot, files) {
-  if (!files || typeof files !== 'object') return false;
-  for (const [rel, content] of Object.entries(files)) {
-    if (typeof content !== 'string') continue;
-    try {
-      const abs = node_path__WEBPACK_IMPORTED_MODULE_2__.resolve(scanRoot, rel);
-      if (node_fs__WEBPACK_IMPORTED_MODULE_1__.readFileSync(abs, 'utf8') !== content) return true;
-    } catch {
-      return true; // candidate file absent on disk -> definitely not applied
-    }
-  }
-  return false;
+function evaluateRule(ir, corpus, thresholds = PROMOTION_DEFAULTS) {
+  const score = (0,_corpus_js__WEBPACK_IMPORTED_MODULE_0__/* .scoreRule */ .T)(ir, corpus);
+  const t = { ...PROMOTION_DEFAULTS, ...thresholds };
+  const reasons = [];
+  if (score.precision === null) reasons.push('precision unmeasured (no positive or negative corpus fired)');
+  else if (score.precision < t.minPrecision) reasons.push(`precision ${(score.precision * 100).toFixed(1)}% below ${(t.minPrecision * 100).toFixed(0)}%`);
+  if (score.recall === null) reasons.push('recall unmeasured (empty positive corpus)');
+  else if (score.recall < t.minRecall) reasons.push(`recall ${(score.recall * 100).toFixed(1)}% below ${(t.minRecall * 100).toFixed(0)}%`);
+  if (score.protectedFailures > t.maxProtectedFailures) reasons.push(`${score.protectedFailures} protected-negative failure(s) (max ${t.maxProtectedFailures})`);
+  return { pass: reasons.length === 0, reasons, score, thresholds: t };
 }
 
-async function verifyFix({
-  scanRoot,
-  originalFindingStableId,
-  files,
-  depFileContents,
-  fixMeta,
-  testTimeoutMs,
-  recordMetrics = true,
-  poc,
-  patchNegative,
-  assuranceConfig,
-} = {}) {
-  // R5 (reporting half) — time each stage as it runs. Measured here rather
-  // than inside each stage because only this function knows the boundaries of
-  // one verification ATTEMPT, which is the unit the distribution is over.
-  const stages = {};
-  const t0 = Date.now();
-  let mark = t0;
-  const _lap = (name) => { const now = Date.now(); stages[name] = now - mark; mark = now; };
-
-  const rescan = await verifyPatch({ scanRoot, originalFindingStableId, files, depFileContents });
-  _lap('rescan');
-  const lint = runProjectLinter(scanRoot, Object.keys(files || {}));
-  _lap('lint');
-  const tests = (0,_test_runner_js__WEBPACK_IMPORTED_MODULE_5__/* .runProjectTests */ .I)(scanRoot, testTimeoutMs != null ? { timeoutMs: testTimeoutMs } : {});
-  _lap('tests');
-  // True when a candidate patch was supplied but has not been written, so the
-  // suite necessarily ran against the pre-patch tree. Surfaced in the summary
-  // and on the result so a caller cannot mistake it for a verified patch.
-  const _testedPrePatch = !tests.skipped && _candidateDiffersFromDisk(scanRoot, files);
-  const testsOk = tests.skipped ? true : tests.passed === true;
-  // R5 — the PoC leg. Re-run the finding's proof-of-concept against the
-  // CANDIDATE patch inside R1's sandbox. A patch that still lets the PoC
-  // demonstrate the predicted effect has not fixed anything, however green the
-  // re-scan looks: the re-scan only proves the DETECTOR stopped firing, which
-  // a cosmetic edit can achieve. Execution is the stronger claim.
-  //
-  // Direction matters and is asymmetric on purpose. `execution-proven` after
-  // the patch is a hard FAIL. Anything else is NOT a pass — a PoC that failed
-  // to run, or a sandbox that could not start, is recorded as `inconclusive`
-  // and left out of the verdict entirely. Treating "could not prove it" as
-  // "fixed" is exactly the false confidence this leg exists to prevent.
-  //
-  // Computed BEFORE the honesty gate (FR-308): a still-exploitable PoC is
-  // MECHANICAL evidence, not a self-report, and gateFixOutput cross-checks a
-  // self-reported FULL tier against it below — the ordering matters, not
-  // just the value.
-  let pocLeg = { status: 'not-requested', reason: null, tier: null };
-  if (poc?.code) {
-    try {
-      const { proveFinding } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 17908));
-      const proved = await proveFinding({ ...(poc.finding || {}), poc }, { files });
-      const tier = proved.proofTier;
-      pocLeg = tier === 'execution-proven'
-        ? { status: 'still-exploitable', tier, reason: proved.proofEvidence?.observed || null }
-        : proved.proofEvidence?.ran
-          ? { status: 'no-longer-proven', tier, reason: proved.proofEvidence?.reason || null }
-          : { status: 'inconclusive', tier, reason: proved.proofEvidence?.reason || null };
-    } catch (e) {
-      pocLeg = { status: 'inconclusive', tier: null, reason: `proof harness error: ${e.message}` };
-    }
-  }
-  _lap('poc');
-  const pocOk = pocLeg.status !== 'still-exploitable';
-
-  // FR-308: "a mitigation or workaround cannot be represented as a full
-  // fix" — gateFixOutput's tier/residual check is a pure self-consistency
-  // check (fixMeta.signals is agent-self-reported; see fix-honesty-gate.js's
-  // header for why nothing there is server-computable). pocLeg IS
-  // server-computable — a real execution result, not a claim — so it is
-  // passed through as the one MECHANICAL cross-check available: a
-  // self-reported FULL tier is refuted, not just internally inconsistent,
-  // when the PoC still demonstrates the vulnerability against the patch.
-  // D-0024: `fixMeta` is a shared envelope — FR-307/FR-1002's `approval`
-  // key lives alongside FR-308's completeness self-report (`residual`/
-  // `verdict`/`evidence`/`signals`). Gating on mere object-truthiness meant
-  // a caller supplying ONLY `approval` (a real, common shape once the CLI's
-  // --approved-by flag and the MCP schema fix made that reachable) got
-  // silently gated on an UNRELATED FR-308 self-consistency check it never
-  // engaged with — computeFixTier(undefined) defaults to MITIGATION, which
-  // then demands a `residual` nobody was ever asked to supply, blocking an
-  // otherwise-genuine, approved fix for a reason that has nothing to do
-  // with completeness honesty. Scope the gate to fixMeta shapes that
-  // actually make a completeness-adjacent claim.
-  const hasHonestyClaim = fixMeta && typeof fixMeta === 'object' &&
-    (fixMeta.residual !== undefined || fixMeta.verdict !== undefined ||
-     fixMeta.evidence !== undefined || fixMeta.signals !== undefined);
-  let honesty = null;
-  if (hasHonestyClaim) {
-    try { honesty = (0,_fix_honesty_gate_js__WEBPACK_IMPORTED_MODULE_4__/* .gateFixOutput */ ._u)(fixMeta, { pocLeg }); } catch { honesty = null; }
-  }
-  _lap('honesty');
-
-  // X-204: patch-negative verification, only when the caller asked for it AND the `patch-negative-verification` feature is
-  // on. `patchNegative` is the requester's exploit scenario and functional cases ({ original, functional, commit?, ... }); the
-  // candidate `files` are the proposed diff. With the flag off, or no request, nothing here runs and every field below is
-  // exactly what it was before.
-  let pn = null;
-  if (patchNegative && typeof patchNegative === 'object') {
-    try {
-      const { verifyPatchNegative } = await __webpack_require__.e(/* import() */ 6907).then(__webpack_require__.bind(__webpack_require__, 26907));
-      pn = await verifyPatchNegative({
-        hypothesisId: originalFindingStableId, ...patchNegative, patch: { files },
-        commit: patchNegative.commit ?? (0,_verification_emit_js__WEBPACK_IMPORTED_MODULE_7__.headCommit)(scanRoot),
-      }, { config: assuranceConfig });
-    } catch (e) {
-      pn = { status: 'error', verifiedFix: false, incompleteStep: 'patch-negative', failureCode: 'harness-error', reason: `patch-negative verification failed to run: ${String(e?.message || e).slice(0, 200)}`, summary: '' };
-    }
-  }
-  const pnActive = pn !== null && pn.status !== 'disabled';
-  _lap('patchNegative');
-
-  const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && pocOk && (honesty ? honesty.ok : true) && (pnActive ? pn.verifiedFix === true : true);
-
-  // FR-305 (assurance-hardening PRD): `ok` alone conflates "every leg
-  // genuinely ran and passed" with "passed, but a required leg was skipped
-  // or unavailable" — `lint.ok`/`testsOk` are both true in the skipped case
-  // by design (this codebase does not fail-closed just because a repo has
-  // no linter or no detected test runner), so a caller checking only `ok`
-  // cannot tell the difference. `lint.skipped` is only ever true when a
-  // linter WAS configured but its binary could not be run (missing config
-  // entirely returns `runner: 'none'` with no `skipped` field at all — that
-  // is a genuine N/A, nothing was required, not a degradation). `verifiedFull`
-  // is the honest label: true only when nothing that WAS required was
-  // skipped. A caller must never present `ok: true, verifiedFull: false` as
-  // "fully verified" — `degradedLegs` names exactly what was skipped so a
-  // report can say so plainly instead of a bare pass.
-  const degradedLegs = [];
-  if (lint.skipped) degradedLegs.push(`lint: ${lint.runner} not installed`);
-  if (tests.skipped) degradedLegs.push(`tests: skipped (${tests.reason})`);
-  const verifiedFull = ok && degradedLegs.length === 0;
-
-  const durations = { ...stages, totalMs: Date.now() - t0 };
-  const summary = [
-    `re-scan: ${rescan.ok ? 'PASS' : 'FAIL — ' + rescan.reason}`,
-    `linter:  ${lint.runner === 'none' ? 'skipped (no linter config)'
-              : lint.skipped ? `${lint.runner} not installed`
-              : lint.ok ? `${lint.runner} PASS`
-              : `${lint.runner} FAIL (exit ${lint.exitCode})`}`,
-    // Say which tree the suite actually ran against. `files` is a candidate
-    // patch held in memory; the runner needs real files, so it sees whatever is
-    // on disk. Reporting a bare "PASS" here would let a caller believe the
-    // PATCH passed the tests when the suite may have run on unpatched code.
-    `tests:   ${tests.skipped ? `skipped (${tests.reason})`
-              : tests.timedOut ? 'FAIL (timed out)'
-              : tests.passed ? `PASS${_testedPrePatch ? ' — on the CURRENT on-disk tree, NOT the candidate patch' : ''}`
-              : `FAIL (exit ${tests.exitCode})`}`,
-    honesty ? `honesty: ${honesty.ok ? `PASS (${honesty.tier})` : 'FAIL — ' + honesty.violations.join('; ')}` : null,
-    // Never render `inconclusive` as a pass — say plainly that nothing was proven.
-    pocLeg.status === 'not-requested' ? null
-      : pocLeg.status === 'still-exploitable' ? `poc:     FAIL — the proof-of-concept still demonstrates the vulnerability against the patch`
-      : pocLeg.status === 'no-longer-proven' ? 'poc:     PASS (ran against the patch and no longer demonstrates the vulnerability)'
-      : `poc:     inconclusive — not counted either way (${pocLeg.reason || 'no detail reported'})`,
-    // FR-305: never let a degraded pass read the same as a full one.
-    pnActive ? `patch-negative: ${pn.verifiedFix ? 'PASS (verified-fix)' : `FAIL - not verified-fix, incomplete step '${pn.incompleteStep}' (${pn.failureCode}): ${pn.reason}`}` : null,
-    ok && !verifiedFull ? `NOTE:    PASSED, but NOT fully verified — ${degradedLegs.join('; ')}` : null,
-  ].filter(Boolean).join('\n');
-  // Persist the attempt so the distribution can be reported from real runs.
-  // `testsRan` is the load-bearing field: it is what keeps "verified with no
-  // test suite to run" out of the headline time-to-validated-fix bucket.
-  // A patch that was never written to disk is recorded too, but flagged — its
-  // suite ran against the pre-patch tree, so its timing is real while its
-  // verdict is about a different tree.
-  if (recordMetrics && scanRoot) {
-    (0,_fix_metrics_js__WEBPACK_IMPORTED_MODULE_6__/* .recordFixAttempt */ .I3)(scanRoot, {
-      at: new Date().toISOString(),
-      stableId: originalFindingStableId || null,
-      ok,
-      verifiedFull,
-      testsRan: !tests.skipped,
-      testsPassed: tests.skipped ? null : tests.passed === true,
-      testedPrePatch: _testedPrePatch,
-      lintRan: !(lint.skipped || lint.runner === 'none'),
-      honestyGated: honesty != null,
-      pocStatus: pocLeg.status,
-      files: Object.keys(files || {}).length,
-      stages,
-      totalMs: durations.totalMs,
-    });
-  }
-
-  // X-201: the one verification record, ADDITIVE. `ok` and every field above stay exactly as they were; the record
-  // says what was actually established (a static re-scan is not an exploit oracle, so without a PoC leg it is
-  // `not-run`, and nothing here can reach `confirmed`/`refuted`: that takes a trusted oracle adapter).
-  const emitted = (0,_verification_emit_js__WEBPACK_IMPORTED_MODULE_7__/* .emitVerification */ .T)('fix-verify', { rescan, lint, tests, poc: pocLeg }, {
-    originalFindingStableId, files, scanRoot, finding: poc?.finding,
-  });
-  const verificationRecord = emitted.ok ? emitted.record : null;
-
-  return {
-    ok, verifiedFull, degradedLegs, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary, verificationRecord,
-    // additive, present only when patch-negative verification was requested (X-204)
-    ...(pn ? { patchNegative: pn, ...(pnActive ? { fixStatus: pn.verifiedFix ? 'verified-fix' : 'not-verified-fix' } : {}) } : {}),
-  };
+/** The one promotion decision. Never auto-applied: a caller still has to act on `pass:true` by recording a
+ * lifecycle transition. Localization ("acceptable") is a human/caller judgment this function cannot make from
+ * line/column alone; it is surfaced for review, never silently assumed. */
+function gatePromotion({ ir, corpus, leakageCheck, thresholds } = {}) {
+  const evalResult = evaluateRule(ir, corpus, thresholds);
+  const reasons = [...evalResult.reasons];
+  if (!leakageCheck || leakageCheck.ok !== true) reasons.push(leakageCheck ? `leakage check failed: ${leakageCheck.offendingTerms.join(', ')}` : 'leakage check was not run');
+  return { pass: reasons.length === 0, reasons, evaluation: evalResult };
 }
 
-__webpack_async_result__();
-} catch(e) { __webpack_async_result__(e); } });
 
 /***/ }),
 
-/***/ 35136:
+/***/ 47838:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   I: () => (/* binding */ runProjectTests)
+/* harmony export */   Ry: () => (/* binding */ generalizeLine),
+/* harmony export */   _7: () => (/* binding */ synthesizeCandidate)
 /* harmony export */ });
-/* unused harmony export detectTestCommand */
-/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(31421);
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(73024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
-// R5 (partial, roadmap) — the project's own test suite as a verification
-// stage for `verifyFix()` (see `fix-verify.js`). Closes the gap where a
-// "verified" fix only proved a finding's stableId stopped firing — a patch
-// that deletes the feature entirely would satisfy that just as well as a
-// real fix. Running the project's own tests is the cheapest available check
-// that the application still works.
+/* unused harmony exports proposeCandidates, safeNames */
+/* harmony import */ var _ir_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(87539);
+/* harmony import */ var _corpus_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(43556);
+/* harmony import */ var _promotion_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(57711);
+// The synthesis loop for the rule compiler (PRD 3, requirement 5): propose, compile, test positives, test negatives, mutation test,
+// score, revise, repeat with bounded attempts, emit a candidate.
+//
+// "Models propose rules. Evidence promotes rules." A model's proposal (a `match` in the spec) is tried first when there is one.
+// When there is none, or it fails, this module proposes deterministically from the two pieces of evidence it has: the vulnerable
+// code and its patched twin. The lines that exist only in the vulnerable version say what the flaw looks like; the calls that exist
+// only in the patched version say what a safe version looks like (and become the `notMatch` that keeps the rule quiet on safe files).
+// No model is consulted here and nothing here promotes a rule: the loop returns attempts and a best candidate, and promotion stays
+// with the gate and the lifecycle ledger.
 //
-// Execution-safety note: this spawns the TARGET PROJECT's own test command
-// in the target project's own directory. That is deliberately NOT routed
-// through the R1 confinement sandbox (`../sandbox/`). That sandbox exists to
-// contain untrusted proof-of-concept exploit code the scanner itself
-// synthesizes — code nobody has vetted, being run for the first time. A
-// project's pre-existing test suite is the opposite case: it is the
-// project's own trusted source, already sitting on disk, and running it is
-// exactly what a human developer does by hand before trusting a fix.
-// Wrapping "npm test" / "pytest" / "go test" in the PoC sandbox's
-// syscall/network/filesystem restrictions would break the large majority of
-// real test suites (they bind local ports, spawn child processes, write temp
-// fixtures, etc.) for no corresponding security benefit.
+// Every attempt is scored against the real corpus (positives with their mutations, negatives with theirs) by the same matcher the
+// rule will run on once promoted. An attempt that does not clear the gate is revised from WHY it failed: low recall generalizes,
+// a negative that fires adds the safe version's names to `notMatch`.
 
 
 
 
+const esc = (s) => s.replace(/[.*+?^${}()|[\]\\\/]/g, '\\$&');
+const KEYWORDS = new Set(['if', 'else', 'for', 'while', 'return', 'function', 'const', 'let', 'var', 'new', 'await', 'async', 'try', 'catch', 'throw', 'typeof', 'def', 'class', 'import', 'from', 'with', 'in', 'of', 'and', 'or', 'not', 'is', 'func', 'fn', 'public', 'private', 'static', 'void', 'int', 'string']);
+const SOURCES = [
+  String.raw`req(?:uest)?\.(?:body|query|params|headers|cookies)\b`, String.raw`ctx\.(?:query|params|request\.body)\b`, String.raw`request\.(?:args|form|values|json|GET|POST)\b`,
+  String.raw`\$_(?:GET|POST|REQUEST|COOKIE)\b`, String.raw`process\.argv\b`, String.raw`os\.Args\b`, String.raw`\bgetParameter\s*\(`, String.raw`r\.(?:URL\.Query\(\)|FormValue)\b`,
+];
 
-const DEFAULT_TIMEOUT_MS = 300_000;
-const NPM_PLACEHOLDER = /Error: no test specified/i;
+const meaningful = (l) => { const t = l.trim(); return t.length >= 8 && !/^(?:\/\/|#|\/\*|\*|[{}()\];,]+$)/.test(t); };
 
-function _exists(scanRoot, rel) {
-  try { return node_fs__WEBPACK_IMPORTED_MODULE_1__.existsSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, rel)); } catch { return false; }
+/** Lines (trimmed) present only in `a`. */
+function onlyIn(a, b) {
+  const bs = new Set(String(b ?? '').split('\n').map((l) => l.trim()));
+  return String(a ?? '').split('\n').filter((l) => meaningful(l) && !bs.has(l.trim())).map((l) => l.trim());
 }
 
-function _isDir(scanRoot, rel) {
-  try { return node_fs__WEBPACK_IMPORTED_MODULE_1__.statSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, rel)).isDirectory(); } catch { return false; }
+/** Call names (a.b.c) in some code, in order of appearance, without keywords. */
+function callNames(code) {
+  const out = [];
+  for (const m of String(code).matchAll(/\b([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)\s*\(/g)) if (!KEYWORDS.has(m[1]) && !out.includes(m[1])) out.push(m[1]);
+  return out;
 }
 
-function _binaryAvailable(cmd) {
-  try {
-    const r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)(cmd, ['--version'], { timeout: 5_000, stdio: 'ignore' });
-    return !(r.error && r.error.code === 'ENOENT');
-  } catch {
-    return false;
-  }
+/** A regular expression for one source line: the call names stay, strings and the other identifiers become classes. */
+function generalizeLine(line) {
+  const keep = new Set(callNames(line));
+  let out = ''; let i = 0;
+  while (i < line.length) {
+    const c = line[i];
+    if (/\s/.test(c)) { const before = line[i - 1] ?? ''; while (/\s/.test(line[i] ?? '')) i++; out += /[\w$]/.test(before) && /[\w$]/.test(line[i] ?? '') ? String.raw`\s+` : String.raw`\s*`; continue; }
+    if (c === '"' || c === "'" || c === '`') { const q = c; let j = i + 1; while (j < line.length && line[j] !== q) j += line[j] === '\\' ? 2 : 1; out += q === '`' ? '`[^`]*`' : `(?:'[^']*'|"[^"]*")`; i = j + 1; continue; }
+    const id = /^[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*/.exec(line.slice(i));
+    if (id) { const tok = id[0]; const isCall = line[i + tok.length] === '(' || keep.has(tok); out += isCall || KEYWORDS.has(tok) ? esc(tok) : String.raw`[A-Za-z_$][\w$.]*`; i += tok.length; continue; }
+    const num = /^\d+(?:\.\d+)?/.exec(line.slice(i));
+    if (num) { out += String.raw`\d+(?:\.\d+)?`; i += num[0].length; continue; }
+    out += esc(c); i++;
+  }
+  return out;
 }
 
-// Detect the project's test command. Read-only — never spawns the actual
-// test run, only (optionally) a cheap `--version` probe to confirm a tool
-// like `pytest` is actually installed before committing to it. Returns
-// `null` when nothing detectable is found — most scanned repos will hit
-// this path, and that must not be treated as a failure by callers.
-function detectTestCommand(scanRoot) {
-  if (!scanRoot) return null;
-
-  // JS/TS — package.json with a real (non-placeholder) `scripts.test`.
-  let pkg = null;
-  try { pkg = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_1__.readFileSync(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, 'package.json'), 'utf8')); } catch { pkg = null; }
-  const testScript = pkg && pkg.scripts && pkg.scripts.test;
-  if (testScript && !NPM_PLACEHOLDER.test(String(testScript))) {
-    if (_exists(scanRoot, 'pnpm-lock.yaml')) return { cmd: 'pnpm', args: ['test'], kind: 'pnpm' };
-    if (_exists(scanRoot, 'yarn.lock')) return { cmd: 'yarn', args: ['test'], kind: 'yarn' };
-    if (_exists(scanRoot, 'bun.lockb') || _exists(scanRoot, 'bun.lock')) return { cmd: 'bun', args: ['test'], kind: 'bun' };
-    return { cmd: 'npm', args: ['test', '--silent'], kind: 'npm' };
-  }
-
-  // Python — pytest.ini / pyproject.toml / tox.ini / a tests/ dir, and the
-  // `pytest` binary actually available. If pytest isn't installed we do NOT
-  // report a python test command — falling through lets a later language
-  // marker (e.g. go.mod in a polyglot repo) still be detected.
-  const pyMarker = _exists(scanRoot, 'pytest.ini') || _exists(scanRoot, 'pyproject.toml') ||
-    _exists(scanRoot, 'tox.ini') || _isDir(scanRoot, 'tests');
-  if (pyMarker && _binaryAvailable('pytest')) {
-    return { cmd: 'pytest', args: ['-q'], kind: 'pytest' };
-  }
-
-  // Go
-  if (_exists(scanRoot, 'go.mod')) {
-    return { cmd: 'go', args: ['test', './...'], kind: 'go' };
-  }
-
-  return null;
+const sinkOf = (line) => callNames(line).filter((n) => !/^(?:console|logger|log)\b/.test(n))[0] ?? null;
+const interpolation = String.raw`(?:\+|\$\{|%s|%d|\.format\s*\(|\bf["']|\|\|)`;
+
+/** Ordered proposals, most specific first. Each is {strategy, match}; `match.notMatch` is added by `withSafeNames`. */
+function proposeCandidates({ vulnerableCode, patchedCode = null }) {
+  const vuln = onlyIn(vulnerableCode, patchedCode);
+  const lines = vuln.length ? vuln : String(vulnerableCode).split('\n').filter(meaningful).map((l) => l.trim()).filter((l) => callNames(l).length);
+  const out = []; const seen = new Set();
+  const add = (strategy, match) => { const k = JSON.stringify(match); if (!seen.has(k)) { seen.add(k); out.push({ strategy, match }); } };
+  for (const l of lines.slice(0, 3)) add('line-shape', { pattern: generalizeLine(l) });
+  for (const l of lines.slice(0, 3)) {
+    const sink = sinkOf(l);
+    if (sink) add('sink-with-interpolation', { pattern: `${esc(sink)}\\s*\\([^)\\n]*${interpolation}` });
+  }
+  const sink = lines.map(sinkOf).find(Boolean);
+  const src = SOURCES.find((s) => new RegExp(s).test(vulnerableCode));
+  if (sink && src) add('source-and-sink', { allOf: [`${esc(sink)}\\s*\\(`, src], window: 6 });
+  if (sink) add('sink-call', { pattern: `${esc(sink)}\\s*\\(` });
+  return out;
 }
 
-// Run the detected test command with a walltime budget. Always returns a
-// result object — never throws. Distinguishes four outcomes:
-//   - no detectable/runnable command  -> status: 'skipped'  (does NOT fail)
-//   - ran and exited 0                -> status: 'passed'
-//   - ran and exited non-zero         -> status: 'failed'
-//   - ran past the timeout budget     -> status: 'failed', timedOut: true
-function runProjectTests(scanRoot, { timeoutMs = DEFAULT_TIMEOUT_MS } = {}) {
-  const startedAt = Date.now();
-  const command = detectTestCommand(scanRoot);
-  if (!command) {
-    return {
-      status: 'skipped', passed: null, skipped: true,
-      reason: 'no-test-command-detected', exitCode: null, timedOut: false,
-      durationMs: Date.now() - startedAt,
-    };
-  }
+/** Names that appear in the patched code and not in the vulnerable code: the safe version's vocabulary. */
+function safeNames({ vulnerableCode, patchedCode }) {
+  if (!patchedCode) return [];
+  const v = new Set(callNames(vulnerableCode));
+  const names = callNames(patchedCode).filter((n) => !v.has(n));
+  if (/\?['"`]?\s*[,)]/.test(patchedCode) && !/\?['"`]?\s*[,)]/.test(vulnerableCode)) names.push('?');
+  return names;
+}
 
-  let r;
-  try {
-    r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)(command.cmd, command.args, {
-      cwd: scanRoot,
-      encoding: 'utf8',
-      timeout: timeoutMs,
-      env: { ...process.env, CI: '1' },
-    });
-  } catch (e) {
-    // The spawn call itself threw (rare — e.g. cwd vanished). Treat as
-    // "could not run", not "ran and failed".
-    return {
-      status: 'skipped', passed: null, skipped: true,
-      reason: `spawn-error: ${e.message}`, exitCode: null, timedOut: false,
-      durationMs: Date.now() - startedAt,
-    };
-  }
-  const durationMs = Date.now() - startedAt;
-
-  if (r.error && r.error.code === 'ENOENT') {
-    // The detected tool isn't actually installed on this machine. Not a
-    // test failure — the suite never ran.
-    return {
-      status: 'skipped', passed: null, skipped: true,
-      reason: `${command.kind}-not-installed`, exitCode: null, timedOut: false, durationMs,
-    };
-  }
+const PLACEHOLDER_RE = '\\?[\'"`]?\\s*[,)]';
+const safeRegex = (names) => (names.length ? names.map((n) => (n === '?' ? PLACEHOLDER_RE : esc(n))).join('|') : null);
 
-  if (r.status === null) {
-    // spawnSync sets status:null both on timeout-kill and on being killed by
-    // another signal; either way the run did not complete, which is a
-    // verification failure, never a skip — we asked for a result and the
-    // process was terminated before producing one.
-    return {
-      status: 'failed', passed: false, skipped: false,
-      reason: 'timed-out', exitCode: null, timedOut: true, durationMs,
-    };
-  }
+const summary = (score) => ({ precision: score.precision, recall: score.recall, tp: score.tp, fp: score.fp, fn: score.fn, tn: score.tn, protectedFailures: score.protectedFailures });
+const quality = (e) => (e.pass ? 10 : 0) + (e.score.precision ?? 0) * (e.score.recall ?? 0) - e.score.protectedFailures * 0.5;
 
-  return {
-    status: r.status === 0 ? 'passed' : 'failed',
-    passed: r.status === 0,
-    skipped: false,
-    reason: r.status === 0 ? null : 'test-failures',
-    exitCode: r.status,
-    timedOut: false,
-    durationMs,
+/**
+ * @param {object} o
+ * @param {object} o.base      the IR fields that are not the match: id, title, severity, cwe, family, languages, remediation, evidence
+ * @param {object} o.corpusSpec  { originalCode, patchedCode?, nearbyCleanCode?, protectedVariantsCode? }
+ * @param {object|null} o.proposed  a match supplied by a model or a person, tried first
+ * @returns {{attempts: object[], best: object|null, exhausted: boolean}}
+ */
+function synthesizeCandidate({ base, corpusSpec, proposed = null, maxAttempts = 6, thresholds, leakageOk = true }) {
+  const cap = Math.max(1, Math.min(12, maxAttempts));
+  const queue = [];
+  if (proposed) queue.push({ strategy: 'proposed', match: proposed });
+  for (const p of proposeCandidates({ vulnerableCode: corpusSpec.originalCode, patchedCode: corpusSpec.patchedCode })) queue.push(p);
+  const names = safeNames({ vulnerableCode: corpusSpec.originalCode, patchedCode: corpusSpec.patchedCode });
+  const attempts = []; const tried = new Set();
+  const tryOne = (strategy, match) => {
+    const key = JSON.stringify(match);
+    if (tried.has(key) || attempts.length >= cap) return null;
+    tried.add(key);
+    const ir = (0,_ir_js__WEBPACK_IMPORTED_MODULE_0__/* .draftRuleIR */ .pc)({ ...base, match });
+    const errs = (0,_ir_js__WEBPACK_IMPORTED_MODULE_0__/* .validateRuleIR */ .g)(ir);
+    if (errs.length) { attempts.push({ n: attempts.length + 1, strategy, match, valid: false, errors: errs, pass: false, reasons: errs }); return null; }
+    const corpus = (0,_corpus_js__WEBPACK_IMPORTED_MODULE_1__/* .buildCorpus */ .F)(ir, corpusSpec);
+    const ev = (0,_promotion_js__WEBPACK_IMPORTED_MODULE_2__/* .evaluateRule */ .kx)(ir, corpus, thresholds);
+    const rec = { n: attempts.length + 1, strategy, match, valid: true, pass: ev.pass && leakageOk, reasons: ev.reasons, score: summary(ev.score), ir, corpusSizes: { positives: corpus.positives.length, negatives: corpus.negatives.length } };
+    attempts.push(rec);
+    return { rec, ev };
   };
+  for (let qi = 0; qi < queue.length && attempts.length < cap; qi++) {
+    const first = tryOne(queue[qi].strategy, queue[qi].match);
+    if (!first) continue;
+    if (first.rec.pass) break;
+    // revise from the failure: a negative that fired means the safe version is not excluded yet
+    const fired = first.ev.score.negatives.filter((n) => n.fired);
+    const rx = safeRegex(names);
+    if (fired.length && rx && !queue[qi].match.notMatch) { const r = tryOne(`${queue[qi].strategy}+exclude-safe`, { ...queue[qi].match, notMatch: rx }); if (r?.rec.pass) break; }
+  }
+  const valid = attempts.filter((a) => a.valid);
+  const best = valid.length ? [...valid].sort((a, b) => quality({ pass: b.pass, score: b.score }) - quality({ pass: a.pass, score: a.score }))[0] : null;
+  return { attempts: attempts.map(({ ir, ...rest }) => rest), best: best ? { strategy: best.strategy, match: best.match, pass: best.pass, score: best.score, reasons: best.reasons } : null, exhausted: !attempts.some((a) => a.pass) };
 }