@clear-capabilities/agentic-security-scanner 0.175.0 → 0.176.0

package/src/posture/dnr/outputs.js

@@ -0,0 +1,262 @@
+// Renderers for a detection IR (PRD 7, requirement 2): Sigma-compatible logic, a generic HTTP detection, generic WAF
+// suggestions, a structured log query and YARA where it is appropriate. The P1 renderers (Splunk SPL, Microsoft Sentinel KQL,
+// CloudWatch Logs Insights) are text only; nothing here connects to a SIEM.
+//
+// Every value interpolated into a rule comes from the IR, and the IR is closed-world (detection-ir.js), so a rule can only
+// contain what a proof established. Each renderer escapes for ITS target's quoting rules, because an endpoint path or a
+// parameter name is hostile input (it came from a reproducer a model may have written).
+import { PAYLOAD_CLASSES } from './payload-classes.js';
+
+export const FORMATS = Object.freeze(['sigma', 'http', 'waf', 'log-query', 'yara', 'spl', 'kql', 'cloudwatch', 'elastic', 'yaral', 'datadog']);
+
+/** One regular expression (source text, case-insensitive) covering a class's indicators. */
+export function classRegex(className) {
+  const def = PAYLOAD_CLASSES[className];
+  if (!def) return null;
+  if (def.matcher === 'length') return `.{${def.minLength},}`;
+  if (def.matcher === 'behavior') return null;
+  return def.indicators.map((re) => `(?:${re.source})`).join('|');
+}
+
+const hasTemplate = (p) => /\/(?::[A-Za-z_]\w*|\{[A-Za-z_]\w*\})(?=\/|$)/.test(p);
+const escRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/** A path template as an anchored regular expression. */
+function pathRegex(path) {
+  return `^${path.split('/').map((seg) => (/^(?::[A-Za-z_]\w*|\{[A-Za-z_]\w*\})$/.test(seg) ? '[^/]+' : escRe(seg))).join('/')}$`;
+}
+
+const levelFor = (ir) => (ir.confidence >= 0.8 ? 'high' : ir.confidence >= 0.5 ? 'medium' : 'low');
+const title = (ir) => `Exploitation attempt: ${ir.payloadClass} against ${ir.endpoint ? `${ir.endpoint.method} ${ir.endpoint.path}` : 'an application endpoint'}`;
+const numericRuleId = (ir) => 9000000 + (parseInt(ir.digest.slice(0, 5), 16) % 999999);
+const unavailable = (reason) => ({ applicable: false, reason });
+const fpNotes = (ir) => [
+  'A legitimate client that sends this payload shape to the same endpoint (a security scanner, a penetration test).',
+  ...(ir.payloadClass === 'auth-bypass' ? ['Public endpoints that are intentionally reachable without a credential.'] : []),
+];
+
+/** Sigma rule as YAML text. JSON string syntax is used for every scalar; it is valid YAML and cannot be broken out of. */
+function sigma(ir) {
+  if (!ir.endpoint) return unavailable('no endpoint is known for this finding, so there is no request to describe');
+  const q = JSON.stringify;
+  const lines = [
+    `title: ${q(title(ir))}`,
+    `id: ${q(`${ir.digest.slice(0, 8)}-${ir.digest.slice(8, 12)}-${ir.digest.slice(12, 16)}-${ir.digest.slice(16, 20)}-${ir.digest.slice(20, 32)}`)}`,
+    'status: experimental',
+    `description: ${q(`${ir.attackBehavior}. Generated from finding ${ir.findingId} (${ir.grounding}).`)}`,
+    'references:', `  - ${q(`finding:${ir.findingId}`)}`,
+    'author: agentic-security',
+    'logsource:', '  category: webserver',
+    'detection:', '  selection_request:',
+    `    cs-method: ${q(ir.endpoint.method)}`,
+  ];
+  if (hasTemplate(ir.endpoint.path)) lines.push(`    cs-uri-stem|re: ${q(pathRegex(ir.endpoint.path))}`);
+  else lines.push(`    cs-uri-stem: ${q(ir.endpoint.path)}`);
+  let condition = 'selection_request';
+  if (ir.payloadClass === 'auth-bypass') {
+    lines.push('  selection_outcome:', '    sc-status|startswith: "2"', '  filter_credential:', '    cs-authorization|exists: true');
+    condition = 'selection_request and selection_outcome and not filter_credential';
+  } else {
+    const field = ir.parameter?.location === 'body' ? 'request-body' : ir.parameter?.location === 'header' ? `cs(${ir.parameter.name})` : ir.parameter?.location === 'cookie' ? 'cs-cookie' : 'cs-uri-query';
+    lines.push('  selection_payload:', `    ${field}|re|i: ${q(classRegex(ir.payloadClass))}`);
+    condition = 'selection_request and selection_payload';
+  }
+  lines.push(`  condition: ${condition}`, 'falsepositives:', ...fpNotes(ir).map((n) => `  - ${q(n)}`), `level: ${levelFor(ir)}`,
+    'tags:', '  - attack.initial_access', '  - attack.t1190', ...(ir.cwe ? [`  - ${q(String(ir.cwe).toLowerCase().replace('cwe-', 'cwe.'))}`] : []));
+  return { applicable: true, format: 'sigma', content: `${lines.join('\n')}\n` };
+}
+
+function http(ir) {
+  if (!ir.endpoint) return unavailable('no endpoint is known for this finding');
+  const def = PAYLOAD_CLASSES[ir.payloadClass];
+  const detection = {
+    schema: 'agentic-security/http-detection', version: 1, id: ir.id, findingId: ir.findingId, level: levelFor(ir), mode: 'detect',
+    request: { method: ir.endpoint.method, pathTemplate: ir.endpoint.path },
+    parameter: ir.parameter,
+    payload: ir.payloadClass === 'auth-bypass' ? { class: 'auth-bypass', behavior: 'status 2xx with no credential' }
+      : { class: ir.payloadClass, matcher: def.matcher, minLength: def.minLength ?? null, regex: classRegex(ir.payloadClass), flags: 'i' },
+    limitations: ir.limitations,
+  };
+  return { applicable: true, format: 'http', content: `${JSON.stringify(detection, null, 2)}\n` };
+}
+
+/** ModSecurity-style suggestion. Always detect-only (`pass`): a generated rule must never block traffic on its own. */
+function waf(ir) {
+  if (!ir.endpoint) return unavailable('no endpoint is known for this finding');
+  const id = numericRuleId(ir);
+  const msg = `Agentic Security ${ir.id}: ${ir.payloadClass} on ${ir.endpoint.method} ${ir.endpoint.path}`.replace(/['"\\]/g, '');
+  const rx = (s) => s.replace(/"/g, '\\x22');
+  const pathOp = hasTemplate(ir.endpoint.path) ? `"@rx ${rx(pathRegex(ir.endpoint.path))}"` : `"@streq ${rx(ir.endpoint.path)}"`;
+  const out = [
+    '# SUGGESTION ONLY. Detect-only (pass). Review, test against your own traffic, then decide whether to enforce.',
+    `SecRule REQUEST_METHOD "@streq ${ir.endpoint.method}" "id:${id},phase:2,pass,nolog,chain"`,
+    `  SecRule REQUEST_FILENAME ${pathOp} "chain"`,
+  ];
+  if (ir.payloadClass === 'auth-bypass') {
+    out.push(`  SecRule &REQUEST_HEADERS:Authorization "@eq 0" "log,auditlog,msg:'${msg}',severity:'WARNING',tag:'cwe-${(ir.cwe || '').replace(/\D/g, '')}'"`);
+  } else {
+    const target = ir.parameter?.location === 'body' ? `ARGS_POST${ir.parameter ? `:${ir.parameter.name}` : ''}` : ir.parameter?.location === 'header' ? `REQUEST_HEADERS:${ir.parameter.name}` : ir.parameter?.location === 'cookie' ? `REQUEST_COOKIES:${ir.parameter.name}` : ir.parameter ? `ARGS_GET:${ir.parameter.name}` : 'ARGS';
+    out.push(`  SecRule ${target} "@rx ${rx(classRegex(ir.payloadClass))}" "t:urlDecodeUni,log,auditlog,msg:'${msg}',severity:'CRITICAL',tag:'cwe-${(ir.cwe || '').replace(/\D/g, '')}'"`);
+  }
+  return { applicable: true, format: 'waf', content: `${out.join('\n')}\n`, enforcement: 'detect-only' };
+}
+
+function logQuery(ir) {
+  if (!ir.endpoint) return unavailable('no endpoint is known for this finding');
+  const where = [{ field: 'http.request.method', op: 'eq', value: ir.endpoint.method }, hasTemplate(ir.endpoint.path) ? { field: 'url.path', op: 'regex', value: pathRegex(ir.endpoint.path) } : { field: 'url.path', op: 'eq', value: ir.endpoint.path }];
+  if (ir.payloadClass === 'auth-bypass') where.push({ field: 'http.response.status_code', op: 'range', value: [200, 299] }, { field: 'http.request.headers.authorization', op: 'absent' });
+  else where.push({ field: ir.parameter?.location === 'body' ? 'http.request.body.content' : ir.parameter?.location === 'query' ? `url.query.${ir.parameter.name}` : 'url.query', op: 'regex', value: classRegex(ir.payloadClass), flags: 'i' });
+  return { applicable: true, format: 'log-query', content: `${JSON.stringify({ schema: 'agentic-security/structured-log-query', version: 1, id: ir.id, findingId: ir.findingId, where }, null, 2)}\n` };
+}
+
+function yara(ir) {
+  if (ir.payloadClass !== 'deserialization') return unavailable(`YARA matches file or memory content; the ${ir.payloadClass} class is request-shaped, so a YARA rule would be misleading`);
+  const ident = `as_${ir.digest.slice(0, 12)}`;
+  const content = [
+    `rule ${ident} {`, '  meta:', `    description = ${JSON.stringify(`serialized object stream (${ir.findingId})`)}`, `    finding = ${JSON.stringify(ir.findingId)}`, '    generated_by = "agentic-security"',
+    '  strings:', '    $java_raw = { AC ED 00 05 }', '    $java_b64 = "rO0AB"', '    $pickle_b64 = "gASV"', '    $php = /O:[0-9]{1,4}:"[A-Za-z_\\\\]/',
+    '  condition:', '    any of them', '}', '',
+  ].join('\n');
+  return { applicable: true, format: 'yara', content };
+}
+
+const splQ = (s) => `"${s.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+function spl(ir) {
+  if (!ir.endpoint) return unavailable('no endpoint is known for this finding');
+  const pathPart = hasTemplate(ir.endpoint.path) ? `| regex uri_path=${splQ(pathRegex(ir.endpoint.path))}` : `uri_path=${splQ(ir.endpoint.path)}`;
+  const head = `index=* method=${ir.endpoint.method} ${hasTemplate(ir.endpoint.path) ? '' : pathPart}`.trim();
+  const rest = [hasTemplate(ir.endpoint.path) ? pathPart : null,
+    ir.payloadClass === 'auth-bypass' ? '| where status>=200 AND status<300 AND isnull(http_authorization)' : `| regex ${ir.parameter?.location === 'body' ? 'request_body' : 'uri_query'}=${splQ(`(?i)${classRegex(ir.payloadClass)}`)}`].filter(Boolean);
+  return { applicable: true, format: 'spl', content: `${[head, ...rest].join('\n')}\n` };
+}
+const kqlQ = (s) => `@"${s.replace(/"/g, '""')}"`;
+function kql(ir) {
+  if (!ir.endpoint) return unavailable('no endpoint is known for this finding');
+  if (['body', 'header', 'cookie'].includes(ir.parameter?.location)) return unavailable(`the W3CIISLog table does not record request ${ir.parameter.location}s, so this rule would never see the parameter`);
+  const lines = ['W3CIISLog', `| where csMethod == ${JSON.stringify(ir.endpoint.method)}`,
+    hasTemplate(ir.endpoint.path) ? `| where csUriStem matches regex ${kqlQ(pathRegex(ir.endpoint.path))}` : `| where csUriStem == ${JSON.stringify(ir.endpoint.path)}`,
+    ir.payloadClass === 'auth-bypass' ? '| where scStatus between (200 .. 299) and isempty(csAuthorization)' : `| where csUriQuery matches regex ${kqlQ(`(?i)${classRegex(ir.payloadClass)}`)}`];
+  return { applicable: true, format: 'kql', content: `${lines.join('\n')}\n` };
+}
+function cloudwatch(ir) {
+  if (!ir.endpoint) return unavailable('no endpoint is known for this finding');
+  if (['body', 'header', 'cookie'].includes(ir.parameter?.location)) return unavailable(`access logs do not record request ${ir.parameter.location}s, so this query would never see the parameter`);
+  const re = (s) => `/${s.replace(/\//g, '\\/')}/`;
+  const lines = ['fields @timestamp, @message', `| filter @message like ${re(`${ir.endpoint.method} ${hasTemplate(ir.endpoint.path) ? pathRegex(ir.endpoint.path).replace(/^\^|\$$/g, '') : escRe(ir.endpoint.path)}`)}`,
+    ir.payloadClass === 'auth-bypass' ? '| filter @message like /" 2[0-9][0-9] /' : `| filter @message like ${re(`(?i)${classRegex(ir.payloadClass)}`)}`, '| sort @timestamp desc'];
+  return { applicable: true, format: 'cloudwatch', content: `${lines.join('\n')}\n` };
+}
+
+const RENDERERS = { sigma, http, waf, 'log-query': logQuery, yara, spl, kql, cloudwatch };
+
+/** Render one format. An inapplicable format is reported as such with its reason, never as an empty rule. */
+export function renderDetection(ir, format) {
+  const fn = RENDERERS[format];
+  if (!fn) return { applicable: false, reason: `unknown format: ${format}` };
+  return { format, ...fn(ir) };
+}
+
+export function renderAll(ir) {
+  return Object.fromEntries(FORMATS.map((f) => [f, renderDetection(ir, f)]));
+}
+
+// ── Elasticsearch / Elastic Security, Google Chronicle (YARA-L) and Datadog Cloud SIEM (P1 adapters) ──────────────────────────────────
+// Text only, like every other renderer here: nothing connects to a SIEM. Each target has a different regular-expression dialect or none,
+// and a rule that silently means something else is worse than no rule, so a renderer either translates exactly or reports why it cannot.
+
+/**
+ * A JavaScript regular-expression source as an Elasticsearch/Lucene `regexp` pattern, or null when some construct has no Lucene
+ * equivalent (anchors, word boundaries, look-around, back-references). A lazy quantifier becomes greedy, which is exact for a yes/no match. Lucene matches the WHOLE term, so the caller
+ * wraps unanchored patterns in `.*(...).*`; case-insensitivity is the query's `case_insensitive` flag, not an inline flag.
+ */
+export function luceneRegex(src) {
+  const cls = { d: '0-9', w: 'a-zA-Z0-9_', s: ' \\t\\n\\r' };
+  const bare = { d: '[0-9]', D: '[^0-9]', w: '[a-zA-Z0-9_]', s: '[ \\t\\n\\r]', S: '[^ \\t\\n\\r]' };
+  const RESERVED = new Set(['&', '~', '<', '>', '@', '"', '#']);
+  let out = ''; let inClass = false; let prevQuant = false;
+  for (let i = 0; i < src.length; i++) {
+    const c = src[i];
+    if (c === '\\') {
+      const n = src[++i];
+      if (n === undefined) return null;
+      if (inClass) {
+        if (cls[n]) out += cls[n]; else if (/[dswDSWbBnrt0-9A-Za-z]/.test(n)) { if (n === 'n') out += '\\n'; else if (n === 'r') out += '\\r'; else if (n === 't') out += '\\t'; else return null; } else out += `\\${n}`;
+      } else if (bare[n]) out += bare[n];
+      else if (n === 'n') out += '\\n'; else if (n === 'r') out += '\\r'; else if (n === 't') out += '\\t';
+      else if (/[A-Za-z0-9]/.test(n)) return null;
+      else out += `\\${n}`;
+      prevQuant = false; continue;
+    }
+    if (inClass) { if (c === ']') inClass = false; out += RESERVED.has(c) ? `\\${c}` : c; continue; }
+    if (c === '[') { inClass = true; out += c; prevQuant = false; continue; }
+    if (c === '(') {
+      if (src[i + 1] === '?') { if (src[i + 2] === ':') { out += '('; i += 2; prevQuant = false; continue; } return null; }
+      out += '('; prevQuant = false; continue;
+    }
+    if (c === '^' || c === '$') return null;
+    if (c === '?' && prevQuant) { prevQuant = false; continue; } // a lazy quantifier: for a yes/no match the greedy form is equivalent, and Lucene has no lazy form
+    if (c === '*' || c === '+' || c === '?') { out += c; prevQuant = true; continue; }
+    if (c === '{') { const m = /^\{\d+(?:,\d*)?\}/.exec(src.slice(i)); if (!m) { out += '\\{'; prevQuant = false; continue; } out += m[0]; i += m[0].length - 1; prevQuant = true; continue; }
+    if (c === '}') { out += '\\}'; prevQuant = false; continue; }
+    out += RESERVED.has(c) ? `\\${c}` : c; prevQuant = false;
+  }
+  return inClass ? null : out;
+}
+
+function elastic(ir) {
+  if (!ir.endpoint) return unavailable('no endpoint is known for this finding');
+  const loc = ir.parameter?.location;
+  const filter = [{ term: { 'http.request.method': ir.endpoint.method } }];
+  if (hasTemplate(ir.endpoint.path)) {
+    const p = luceneRegex(pathRegex(ir.endpoint.path).replace(/^\^|\$$/g, ''));
+    if (p === null) return unavailable('the endpoint path template has no Lucene regular-expression form');
+    filter.push({ regexp: { 'url.path': { value: p } } });
+  } else filter.push({ term: { 'url.path': ir.endpoint.path } });
+  const mustNot = [];
+  if (ir.payloadClass === 'auth-bypass') {
+    filter.push({ range: { 'http.response.status_code': { gte: 200, lte: 299 } } });
+    mustNot.push({ exists: { field: 'http.request.headers.authorization' } });
+  } else {
+    const re = luceneRegex(classRegex(ir.payloadClass) ?? '');
+    if (re === null || !classRegex(ir.payloadClass)) return unavailable(`the ${ir.payloadClass} indicators use regular-expression constructs Lucene cannot express exactly (anchors, word boundaries or look-around), so a rule would not mean what the proof established`);
+    const field = loc === 'body' ? 'http.request.body.content' : loc === 'query' ? 'url.query' : loc === 'header' || loc === 'cookie' ? null : 'url.query';
+    if (!field) return unavailable(`ECS web logs do not record request ${loc}s by default, so this rule would never see the parameter`);
+    filter.push({ regexp: { [field]: { value: `.*(${re}).*`, case_insensitive: true } } });
+  }
+  const body = { query: { bool: { filter, ...(mustNot.length ? { must_not: mustNot } : {}) } }, _meta: { id: ir.id, findingId: ir.findingId, generatedBy: 'agentic-security', note: 'Lucene regexp matches the whole field value; the pattern is wrapped accordingly.' } };
+  return { applicable: true, format: 'elastic', content: `${JSON.stringify(body, null, 2)}\n` };
+}
+
+/** True when a regex source uses `^`, `$` or a word boundary outside a character class: its meaning depends on WHERE the value starts and ends. */
+const edgeSensitive = (src) => /[\^$]/.test(src.replace(/\\./g, 'x').replace(/\[[^\]]*\]/g, 'x')) || /\\[bB]/.test(src);
+
+function yaral(ir) {
+  if (!ir.endpoint) return unavailable('no endpoint is known for this finding');
+  if (['body', 'header', 'cookie'].includes(ir.parameter?.location)) return unavailable(`UDM HTTP events carry the URL, not request ${ir.parameter.location}s, so this rule would never see the parameter`);
+  if (ir.payloadClass === 'auth-bypass') return unavailable('UDM HTTP events do not carry request headers, so "no credential was sent" cannot be expressed');
+  const cr = classRegex(ir.payloadClass);
+  if (!cr) return unavailable(`the ${ir.payloadClass} class has no regular-expression indicators`);
+  // the indicators are written against a query string or a body; YARA-L sees the whole URL, so a pattern anchored to "the start/end of the value" would mean something else
+  if (edgeSensitive(cr)) return unavailable(`the ${ir.payloadClass} indicators are anchored to the start or end of the parameter value, and UDM only exposes the whole URL, so a rule would not mean what the proof established`);
+  const pathRe = hasTemplate(ir.endpoint.path) ? pathRegex(ir.endpoint.path).replace(/^\^|\$$/g, '') : escRe(ir.endpoint.path);
+  const urlRe = `(?i)^[^?]*${pathRe}(?:\\?.*)?$`;
+  const payloadRe = `(?i)${cr}`;
+  if (urlRe.includes('`') || payloadRe.includes('`')) return unavailable('the pattern contains a backtick, which cannot appear in a YARA-L raw regular expression');
+  const ident = `as_${ir.digest.slice(0, 12)}`;
+  const content = [
+    `rule ${ident} {`, '  meta:', `    description = ${JSON.stringify(title(ir))}`, `    finding = ${JSON.stringify(ir.findingId)}`, '    author = "agentic-security"', `    severity = ${JSON.stringify(levelFor(ir).toUpperCase())}`,
+    '  events:', '    $e.metadata.event_type = "NETWORK_HTTP"', `    $e.network.http.method = ${JSON.stringify(ir.endpoint.method)}`,
+    `    re.regex($e.target.url, \`${urlRe}\`)`, `    re.regex($e.target.url, \`${payloadRe}\`)`, '  condition:', '    $e', '}', '',
+  ].join('\n');
+  return { applicable: true, format: 'yaral', content };
+}
+
+function datadog(ir) {
+  if (!ir.endpoint) return unavailable('no endpoint is known for this finding');
+  if (ir.payloadClass !== 'auth-bypass') return unavailable(`Datadog log search has wildcards but no regular expressions, so the ${ir.payloadClass} indicators cannot be expressed exactly; use the log-query or sigma output`);
+  const wild = ir.endpoint.path.replace(/\/(?::[A-Za-z_]\w*|\{[A-Za-z_]\w*\})(?=\/|$)/g, '/*');
+  if (/[\s"\\]/.test(wild)) return unavailable('the endpoint path contains characters that cannot be quoted safely in a Datadog query');
+  const query = `@http.method:${ir.endpoint.method} @http.url_details.path:${wild} @http.status_code:[200 TO 299] -@http.request.headers.authorization:*`;
+  const rule = { name: title(ir), type: 'log_detection', isEnabled: false, message: `${title(ir)}. Finding ${ir.findingId}. Generated by agentic-security; review before enabling.`, tags: ['source:agentic-security'], queries: [{ query, aggregation: 'count', groupByFields: [], distinctFields: [], name: 'a' }], cases: [{ name: 'proven pattern seen', status: levelFor(ir) === 'high' ? 'high' : 'medium', condition: 'a > 0', notifications: [] }], options: { evaluationWindow: 900, keepAlive: 3600, maxSignalDuration: 86400 } };
+  return { applicable: true, format: 'datadog', content: `${JSON.stringify(rule, null, 2)}\n` };
+}
+RENDERERS.elastic = elastic; RENDERERS.yaral = yaral; RENDERERS.datadog = datadog;

package/src/posture/dnr/payload-classes.js

@@ -0,0 +1,120 @@
+// Payload classes for the Detection-and-Response loop (PRD 7). A class is a GENERIC, structural description of what an
+// exploit of a vulnerability family looks like on the wire (a shell metacharacter followed by a command word, a `..`
+// path segment, a request to a loopback address). It is deliberately not an indicator of compromise: nothing here names
+// an attacker address, domain, malware hash or user agent, because no proof ever observed one. A detection built from a
+// class can say "this request has the shape of a command injection against /api/export"; it cannot say who sent it.
+//
+// The same matcher (`matchesClass`) is used when a detection is validated, when historical logs are hunted, and when
+// the rendered rules are described, so the rule that is tested is the rule that ships.
+
+export const PAYLOAD_CLASSES = Object.freeze({
+  'sql-injection': {
+    cwe: ['CWE-89', 'CWE-564'],
+    behavior: 'SQL metacharacters change the structure of a database query built from request input',
+    matcher: 'regex',
+    indicators: [
+      /(?:'|%27)\s*(?:or|and)\s+(?:'|%27|"|%22|\d)/i,
+      /union(?:\s|\+|%20|\/\*.*?\*\/)+(?:all(?:\s|\+|%20)+)?select/i,
+      /(?:;|%3b)\s*(?:drop|insert|update|delete|alter|truncate)(?:\s|\+|%20)/i,
+      /(?:--|#|%23)(?:\s|\+|%20|$)/,
+      /\b(?:sleep|benchmark|pg_sleep|waitfor\s+delay)\s*\(?\s*['"]?\d/i,
+    ],
+    exemplars: { positive: ["' OR '1'='1", '1 UNION SELECT NULL,NULL--', "x'; DROP TABLE users--"], benign: ['alice', '42', "o'brien", 'blue-widget', 'sleeping bag'] },
+    effects: { process: 'none', network: 'none', db: 'query-structure-altered' },
+  },
+  'command-injection': {
+    cwe: ['CWE-78', 'CWE-77', 'CWE-88'],
+    behavior: 'shell metacharacters followed by a command cause the server to run an attacker-chosen command',
+    matcher: 'regex',
+    indicators: [
+      /(?:;|\||&&|\|\||`|\$\(|%3b|%7c|%26%26|%60|%24%28|%0a|\r?\n)(?:[ \t+]|%20){0,16}(?:cat|ls|id|whoami|uname|curl|wget|nc|ncat|bash|sh|zsh|python\d?|perl|ruby|php|node|touch|rm|chmod|ping|nslookup|dig|env|printenv)(?:\b|\s|%20|\+)/i,
+      /\$\{IFS\}|%24%7bIFS%7d/i,
+    ],
+    exemplars: { positive: ['report.pdf; cat /etc/passwd', 'a | whoami', '$(id)', 'x`uname -a`'], benign: ['report.pdf', 'quarterly summary', 'a-b_c.txt', 'cat photos', 'id'] },
+    effects: { process: 'child-process-spawned', network: 'none', db: 'none' },
+  },
+  'path-traversal': {
+    cwe: ['CWE-22', 'CWE-23', 'CWE-36', 'CWE-73'],
+    behavior: 'parent-directory segments in a path parameter reach files outside the intended directory',
+    matcher: 'regex',
+    indicators: [/(?:^|[\\/]|%2f|%5c)\.\.(?:[\\/]|%2f|%5c|$)/i, /%2e%2e(?:[\\/]|%2f|%5c)/i, /\.\.;\//, /%252e%252e/i, /\.{3,16}[\\/]/],
+    exemplars: { positive: ['../../etc/passwd', '..%2f..%2fetc%2fpasswd', '....//....//etc/passwd'], benign: ['report.pdf', 'docs/readme.txt', 'a..b.txt', 'v1.2..3'] },
+    effects: { process: 'none', network: 'none', db: 'none', file: 'file-outside-root-accessed' },
+  },
+  ssrf: {
+    cwe: ['CWE-918'],
+    behavior: 'a server-side request is directed at an internal, loopback or metadata address chosen by the caller',
+    matcher: 'regex',
+    indicators: [
+      /(?:^|[/@=:])(?:127(?:\.\d{1,3}){3}|localhost|0\.0\.0\.0|\[?::1\]?|0x7f[0-9a-f]{6}|2130706433)(?:[:/?#]|$)/i,
+      /169\.254\.\d{1,3}\.\d{1,3}/,
+      /(?:^|[/@=])(?:10(?:\.\d{1,3}){3}|192\.168(?:\.\d{1,3}){2}|172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2})(?:[:/?#]|$)/,
+      /metadata\.google\.internal|metadata\.azure\.com/i,
+    ],
+    exemplars: { positive: ['http://169.254.169.254/latest/meta-data/', 'http://127.0.0.1:8080/admin', 'http://localhost/'], benign: ['https://example.com/image.png', 'https://cdn.example.org/a.jpg', 'http://127.example.com.invalid/ok'] },
+    effects: { process: 'none', network: 'outbound-to-internal-address', db: 'none' },
+  },
+  deserialization: {
+    cwe: ['CWE-502'],
+    behavior: 'a serialized object stream is supplied where the application deserializes request data',
+    matcher: 'regex',
+    indicators: [/rO0AB/, /(?:%ac|\\xac)(?:%ed|\\xed)(?:%00|\\x00)(?:%05|\\x05)/i, /gASV|gAJ[A-Za-z]/, /(?:^|[^A-Za-z0-9])O:\d{1,4}:"[A-Za-z_\\]/, /!!python\/object|!ruby\/object/i, /__reduce__|cos\\nsystem|c__builtin__/],
+    exemplars: { positive: ['rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcA', 'gASVKAAAAAAAAACMBXBvc2l4lIwGc3lzdGVtlJOUjAJpZJSFlFKULg==', 'O:8:"stdClass":0:{}'], benign: ['hello world', 'Order 12345', 'rolling stones'] },
+    effects: { process: 'object-graph-instantiated', network: 'none', db: 'none' },
+  },
+  'file-write': {
+    cwe: ['CWE-434', 'CWE-646'],
+    behavior: 'a file name with an executable extension or a traversal segment is accepted by a file-writing operation',
+    matcher: 'regex',
+    indicators: [/\.(?:php\d?|phtml|phar|jsp|jspx|aspx?|cgi|sh|exe|dll)(?:[.\s%;]|$)/i, /(?:^|[\\/]|%2f|%5c)\.\.(?:[\\/]|%2f|%5c)/i, /%00/],
+    exemplars: { positive: ['shell.php', 'avatar.png.php', '../../var/www/html/x.jsp'], benign: ['photo.png', 'invoice-2024.pdf', 'notes.txt'] },
+    effects: { process: 'none', network: 'none', db: 'none', file: 'file-written-by-request' },
+  },
+  'buffer-overflow': {
+    cwe: ['CWE-120', 'CWE-121', 'CWE-122', 'CWE-787', 'CWE-125', 'CWE-119'],
+    behavior: 'an input far longer than any legitimate value is supplied to a fixed-size buffer',
+    matcher: 'length',
+    minLength: 512,
+    indicators: [],
+    exemplars: { positive: ['A'.repeat(600), 'B'.repeat(4096)], benign: ['alice', 'a normal sentence of moderate length', 'x'.repeat(64)] },
+    effects: { process: 'memory-corruption-possible', network: 'none', db: 'none' },
+  },
+  'auth-bypass': {
+    cwe: ['CWE-287', 'CWE-306', 'CWE-285', 'CWE-862', 'CWE-863', 'CWE-639', 'CWE-284'],
+    behavior: 'a protected operation succeeds for a request that carries no credential',
+    matcher: 'behavior',
+    indicators: [],
+    exemplars: { positive: [''], benign: [''] },
+    effects: { process: 'none', network: 'none', db: 'none', access: 'protected-operation-without-credential' },
+  },
+});
+
+export const PAYLOAD_CLASS_NAMES = Object.freeze(Object.keys(PAYLOAD_CLASSES));
+
+/** Map a CWE id (`CWE-89`, `89`, `cwe-89`) to a payload class name, or null when no class describes it. */
+export function classForCwe(cwe) {
+  const m = /(\d{1,5})/.exec(String(cwe ?? ''));
+  if (!m) return null;
+  const want = `CWE-${Number(m[1])}`;
+  for (const [name, def] of Object.entries(PAYLOAD_CLASSES)) if (def.cwe.includes(want)) return name;
+  return null;
+}
+
+/** Percent-decode once, tolerating malformed escapes (a hostile value must never throw here). */
+function decodeOnce(value) {
+  const s = String(value ?? '');
+  try { return decodeURIComponent(s.replace(/\+/g, ' ')); } catch { return s; }
+}
+
+/**
+ * Does `value` look like an exploit of `className`? Checks the raw and the once-decoded form, so an encoded payload and a
+ * plain one are treated alike. `behavior` classes have no value test: they match on request behavior, not content.
+ */
+export function matchesClass(className, value) {
+  const def = PAYLOAD_CLASSES[className];
+  if (!def || def.matcher === 'behavior') return false;
+  const raw = String(value ?? '').slice(0, 65536);
+  const forms = raw === decodeOnce(raw) ? [raw] : [raw, decodeOnce(raw)];
+  if (def.matcher === 'length') return forms.some((f) => f.length >= def.minLength);
+  return forms.some((f) => def.indicators.some((re) => re.test(f)));
+}

package/src/posture/dnr/redact.js

@@ -0,0 +1,25 @@
+// Redaction for anything the loop persists or prints from production logs (PRD 7, privacy requirements). A matched log value
+// is evidence that an exploit-shaped request existed; it must never also be a copy of a password, a token or regulated data.
+// Layered on the proof fabric's secret scrubber (credentials), with the data classes a request log is likely to carry.
+import { createHash } from 'node:crypto';
+import { scrubDeep } from '../proof-fabric/store.js';
+
+const PATTERNS = [
+  [/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, '[REDACTED-EMAIL]'],
+  [/\b(?:\d[ -]?){13,19}\b/g, '[REDACTED-NUMBER]'],
+  [/\b\d{3}-\d{2}-\d{4}\b/g, '[REDACTED-ID]'],
+  [/\b(?:bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi, '[REDACTED-CREDENTIAL]'],
+  [/\b(?:password|passwd|pwd|secret|token|api[_-]?key|authorization|session|sid)=[^&\s"']+/gi, (m) => `${m.split('=')[0]}=[REDACTED]`],
+  [/\b[A-Za-z0-9+/_-]{40,}={0,2}/g, '[REDACTED-TOKEN]'],
+];
+
+/** Redact a string for storage or display, then bound its length. */
+export function redactValue(value, max = 120) {
+  let t = String(value ?? '');
+  for (const [re, rep] of PATTERNS) t = t.replace(re, rep);
+  t = scrubDeep(t);
+  return t.length > max ? `${t.slice(0, max)}…` : t;
+}
+
+/** Stable short fingerprint of the ORIGINAL value, so two sightings of the same payload can be recognised without storing it. */
+export const fingerprint = (value) => createHash('sha256').update(String(value ?? '')).digest('hex').slice(0, 16);

package/src/posture/dnr/store.js

@@ -0,0 +1,57 @@
+// Persistence for the detection-and-response loop: `.agentic-security/dnr/<findingKey>/<kind>-<digest>.json`.
+// Same machinery and the same guarantees as the proof store, reused rather than copied where it is exported:
+// safe state-directory writes (no symlinks, no unsafe dirs), the encryption policy, retention as evidence, legal holds, and
+// a recursive secret scrub before anything touches disk. A record that no longer matches its own digest is returned FLAGGED,
+// never trusted and never silently dropped.
+import fs from 'node:fs';
+import path from 'node:path';
+import { statePath, ensureStateDir, safeWriteState } from '../state-dir.js';
+import { maybeEncryptForWrite, maybeDecryptForRead } from '../encryption-provider.js';
+import { canonicalize, sha256 } from '../proof-fabric/reproducer.js';
+import { scrubDeep, findingKey } from '../proof-fabric/store.js';
+
+const DIR = 'dnr';
+const MAX_RECORD_BYTES = 1024 * 1024;
+const RECORD_KINDS = Object.freeze(['detection', 'hunt', 'window', 'fix']);
+
+const digestOf = (record) => { const { recordDigest: _omit, ...rest } = record; return sha256(canonicalize(rest)); };
+
+export function saveRecord(root, findingId, kind, record) {
+  if (!RECORD_KINDS.includes(kind)) return { ok: false, reason: `unknown record kind: ${kind}` };
+  const safe = scrubDeep(record);
+  safe.schema = `agentic-security/dnr-${kind}-record`;
+  safe.kind = kind;
+  safe.findingId = String(findingId);
+  safe.savedAt = record.savedAt ?? new Date().toISOString();
+  safe.recordDigest = digestOf(safe);
+  const text = JSON.stringify(safe, null, 2);
+  if (Buffer.byteLength(text) > MAX_RECORD_BYTES) return { ok: false, reason: 'record exceeds the size limit' };
+  if (!ensureStateDir(root)) return { ok: false, reason: 'no safe state directory for this project' };
+  const enc = maybeEncryptForWrite(root, DIR, text);
+  if (!enc.ok) return { ok: false, reason: enc.reason };
+  const file = statePath(root, DIR, findingKey(findingId), `${kind}-${safe.recordDigest.slice(0, 16)}.json`);
+  if (!safeWriteState(file, enc.content)) return { ok: false, reason: 'state write refused' };
+  return { ok: true, file, digest: safe.recordDigest, encrypted: enc.encrypted };
+}
+
+/** Newest-first records of one kind for a finding. Tampered records are flagged. */
+export function listRecords(root, findingId, kind) {
+  const dir = statePath(root, DIR, findingKey(findingId));
+  let names = [];
+  try { names = fs.readdirSync(dir).filter((n) => n.startsWith(`${kind}-`) && n.endsWith('.json')); } catch { return []; }
+  const out = [];
+  for (const n of names) {
+    const file = path.join(dir, n);
+    try {
+      const rec = JSON.parse(maybeDecryptForRead(fs.readFileSync(file, 'utf8')));
+      out.push({ file, record: rec, tampered: rec.recordDigest !== digestOf(rec), mtime: fs.statSync(file).mtimeMs });
+    } catch { out.push({ file, record: null, tampered: true, mtime: 0 }); }
+  }
+  return out.sort((a, b) => b.mtime - a.mtime);
+}
+
+/** Newest intact record of a kind, or null. A tampered newest record does NOT fall through silently: the caller can see it via listRecords. */
+export function latestRecord(root, findingId, kind) {
+  return listRecords(root, findingId, kind).find((r) => r.record && !r.tampered) ?? null;
+}
+export const hasTamperedRecords = (root, findingId, kind) => listRecords(root, findingId, kind).some((r) => r.tampered);

package/src/posture/dnr/validate.js

@@ -0,0 +1,64 @@
+// Detection validation (PRD 7, requirement 6): before a detection is allowed to be "enabled", prove it behaves.
+//   positive exploit event  -> the detection fires
+//   negative lookalike      -> the detection does not fire
+// Events are synthesized from the IR's own proven facts (endpoint, parameter, class) and the class's exemplar payloads, then
+// pushed through the SAME evaluator the hunt uses, so a rule that validates is the rule that searches the logs. The negatives
+// are the point: a rule that fires on everything passes every positive test.
+import { PAYLOAD_CLASSES } from './payload-classes.js';
+import { evaluateEvent } from './matchers.js';
+import { classRegex } from './outputs.js';
+
+const PROBE = 'probe';
+
+function eventFor(ir, { method, path, values, extraParam = null, status = 200, authPresent = null }) {
+  const p = ir.parameter;
+  const bag = {};
+  const ev = { time: '2024-01-01T00:00:00.000Z', method, path, query: {}, bodyParams: {}, headers: {}, status, authPresent };
+  const put = (loc, name, vals) => {
+    if (loc === 'query') ev.query[name] = vals;
+    else if (loc === 'body') ev.bodyParams[name] = vals;
+    else if (loc === 'header' || loc === 'cookie') ev.headers[name.toLowerCase()] = vals[0];
+  };
+  void bag;
+  if (values) {
+    if (p?.location === 'path') {
+      const t = ir.endpoint.path.split('/').map((seg) => (seg === `:${p.name}` || seg === `{${p.name}}` ? encodeURIComponent(values[0]) : (/^(?::\w+|\{\w+\})$/.test(seg) ? 'x' : seg)));
+      if (path === ir.endpoint.path.replace(/(:[A-Za-z_]\w*|\{[A-Za-z_]\w*\})/g, '42')) ev.path = t.join('/');
+    } else if (p) put(p.location, extraParam ?? p.name, values);
+    else put('query', extraParam ?? PROBE, values);
+  }
+  // a channel the IR does not use is "present and empty", not "not logged": the event models a log that records everything
+  return ev;
+}
+
+export function validateDetection(ir) {
+  const def = PAYLOAD_CLASSES[ir.payloadClass];
+  const cases = [];
+  const render = { regexCompiles: true };
+  try { const rx = classRegex(ir.payloadClass); if (rx) new RegExp(rx, 'i'); } catch { render.regexCompiles = false; }
+  if (!ir.endpoint) return { schema: 'agentic-security/detection-validation', version: 1, detectionId: ir.id, status: 'NOT_VALIDATED', reason: 'no endpoint is known, so there is no request to synthesize', cases, render, counts: { positives: 0, negatives: 0, passed: 0, failed: 0 } };
+  const concretePath = ir.endpoint.path.replace(/(:[A-Za-z_]\w*|\{[A-Za-z_]\w*\})/g, '42');
+  const { method } = ir.endpoint;
+  const add = (kind, name, ev) => { const r = evaluateEvent(ir, ev); cases.push({ kind, name, expected: kind === 'positive', fired: r.match, undecidable: r.undecidable, ok: kind === 'positive' ? r.match : !r.match }); };
+
+  if (ir.payloadClass === 'auth-bypass') {
+    add('positive', 'success with no credential', eventFor(ir, { method, path: concretePath, status: 200, authPresent: false }));
+    add('negative', 'success with a credential', eventFor(ir, { method, path: concretePath, status: 200, authPresent: true }));
+    add('negative', 'refusal without a credential (401)', eventFor(ir, { method, path: concretePath, status: 401, authPresent: false }));
+    add('negative', 'refusal without a credential (403)', eventFor(ir, { method, path: concretePath, status: 403, authPresent: false }));
+    add('negative', 'same request on another path', eventFor(ir, { method, path: '/other/unrelated', status: 200, authPresent: false }));
+  } else {
+    for (const [i, v] of def.exemplars.positive.entries()) add('positive', `exploit payload #${i + 1}`, eventFor(ir, { method, path: concretePath, values: [v] }));
+    for (const [i, v] of def.exemplars.benign.entries()) add('negative', `benign value #${i + 1} on the same endpoint`, eventFor(ir, { method, path: concretePath, values: [v] }));
+    const exploit = [def.exemplars.positive[0]];
+    const otherMethod = method === 'GET' ? 'POST' : 'GET';
+    add('negative', `exploit payload with another method (${otherMethod})`, eventFor(ir, { method: otherMethod, path: concretePath, values: exploit }));
+    add('negative', 'exploit payload on another path', eventFor(ir, { method, path: '/other/unrelated', values: exploit }));
+    add('negative', 'same endpoint, no parameter at all', eventFor(ir, { method, path: concretePath }));
+    if (ir.parameter && ir.parameter.location !== 'path') add('negative', 'exploit payload in an unrelated parameter', eventFor(ir, { method, path: concretePath, values: exploit, extraParam: 'unrelated_field' }));
+  }
+  const positives = cases.filter((c) => c.kind === 'positive'); const negatives = cases.filter((c) => c.kind === 'negative');
+  const failed = cases.filter((c) => !c.ok);
+  const status = failed.length === 0 && positives.length && negatives.length && render.regexCompiles ? 'VALIDATED' : 'FAILED';
+  return { schema: 'agentic-security/detection-validation', version: 1, detectionId: ir.id, status, cases, render, counts: { positives: positives.length, negatives: negatives.length, passed: cases.length - failed.length, failed: failed.length }, failures: failed.map((c) => c.name) };
+}

package/src/posture/dnr/view.js

@@ -0,0 +1,51 @@
+// The unified finding view (PRD 7, requirement 8): FIND, PROVE, HUNT, FIX, VERIFY, DETECT in one place, assembled only from
+// records that exist. A step with no record is shown as missing, not inferred from its neighbours; a tampered record is
+// shown as such and not used.
+import fs from 'node:fs';
+import { statePath } from '../state-dir.js';
+import { listProofs } from '../proof-fabric/store.js';
+import { stateRank } from '../proof-fabric/states.js';
+import { latestRecord, listRecords } from './store.js';
+
+export function loadFindingFromLastScan(root, id) {
+  try {
+    const last = JSON.parse(fs.readFileSync(statePath(root, 'last-scan.json'), 'utf8'));
+    return (last.findings || []).find((f) => f.id === id || f.stableId === id) ?? null;
+  } catch { return null; }
+}
+
+const days = (w) => (w?.start && w?.end ? Math.max(1, Math.round((Date.parse(w.end) - Date.parse(w.start)) / 86400000)) : null);
+
+export function buildLifecycleView(root, findingId) {
+  const finding = loadFindingFromLastScan(root, findingId);
+  const proofs = listProofs(root, findingId);
+  const proofTampered = proofs.some((p) => p.tampered);
+  const proof = proofs.find((p) => p.record && !p.tampered)?.record ?? null;
+  // An earlier hunt that OBSERVED matches must not be hidden by a later hunt over different logs that did not.
+  const hunts = listRecords(root, findingId, 'hunt').filter((r) => r.record && !r.tampered).map((r) => r.record);
+  const hunt = hunts.find((h) => h.verdict === 'OBSERVED') ?? hunts[0] ?? null;
+  const otherVerdicts = hunt ? [...new Set(hunts.filter((h) => h !== hunt).map((h) => h.verdict))] : [];
+  const fix = latestRecord(root, findingId, 'fix')?.record ?? null;
+  const det = latestRecord(root, findingId, 'detection')?.record ?? null;
+  const tampered = [proofTampered ? 'proof' : null, ...['hunt', 'fix', 'detection'].map((k) => (listRecords(root, findingId, k).some((r) => r.tampered) ? k : null))].filter(Boolean);
+
+  const confirmed = proof && stateRank(proof.state) >= stateRank('EXPLOIT_CONFIRMED');
+  const steps = {
+    FIND: finding ? { status: 'done', text: `${confirmed ? 'Confirmed vulnerability' : 'Candidate finding'}: ${finding.vuln ?? finding.id}${finding.file ? ` (${finding.file}${finding.line ? `:${finding.line}` : ''})` : ''}` } : { status: 'missing', text: 'Finding not found in the last scan' },
+    PROVE: proof ? { status: confirmed ? 'done' : 'partial', text: confirmed ? `Exploit reproduced ${proof.attempts?.successes ?? 0}/${proof.attempts?.run ?? 0}, independent replay ${proof.independentReplay?.status ?? 'not run'}` : `Not confirmed (${proof.state})` } : { status: 'missing', text: 'No exploit proof' },
+    HUNT: hunt ? { status: hunt.verdict === 'OBSERVED' || hunt.verdict === 'NOT_OBSERVED' ? 'done' : 'partial', text: `${days(hunt.window) ?? 'unknown'} day(s) of telemetry searched, ${hunt.verdict === 'OBSERVED' ? `${hunt.matches?.count ?? 0} matching event(s) observed` : hunt.verdict === 'NOT_OBSERVED' ? 'no matching events (not the same as not exploited)' : `${hunt.verdict.toLowerCase().replace('_', ' ')}`}${otherVerdicts.length ? `; other hunt(s): ${otherVerdicts.join(', ')}` : ''}` } : { status: 'missing', text: 'No historical hunt run' },
+    FIX: fix ? { status: fix.verified ? 'done' : 'partial', text: fix.verified ? `${fix.completeness} verified remediation` : `Fix not verified: ${fix.reason ?? fix.incompleteStep ?? 'incomplete'}` } : { status: 'missing', text: 'No verified remediation recorded' },
+    VERIFY: fix ? (fix.legs?.postPatch && fix.legs.postPatch.exploitSucceeded === 0 && fix.legs.postPatch.completed === fix.legs.postPatch.attempts ? { status: 'done', text: 'Original exploit blocked' } : { status: 'partial', text: 'Original exploit not shown to be blocked' }) : { status: 'missing', text: 'No post-fix replay recorded' },
+    DETECT: det ? (det.validation?.status === 'VALIDATED' ? { status: 'done', text: `Recurrence rule enabled (${det.ir?.id})` } : { status: 'partial', text: `Detection ${det.ir?.id} generated but not validated (${det.validation?.status ?? 'no validation'}); not enabled` }) : { status: 'missing', text: 'No detection generated' },
+  };
+  return { findingId, steps, tampered, links: { detection: det ? { id: det.ir?.id, recordDigest: det.recordDigest, proofRecordDigest: det.proof?.recordDigest ?? null } : null, proofRecordDigest: proof?.recordDigest ?? null } };
+}
+
+export function formatLifecycleView(v) {
+  const mark = { done: 'x', partial: '~', missing: ' ' };
+  const lines = [`Finding ${v.findingId}`, ''];
+  for (const [name, s] of Object.entries(v.steps)) lines.push(`[${mark[s.status]}] ${name.padEnd(7)} ${s.text}`);
+  if (v.tampered.length) lines.push('', `WARNING: ${v.tampered.join(', ')} record(s) failed their integrity check and were not used.`);
+  lines.push('', '[x] done   [~] partial or unconfirmed   [ ] missing');
+  return lines.join('\n');
+}