@clear-capabilities/agentic-security-scanner 0.185.0 → 0.186.2

package/CHANGELOG.md

@@ -9,6 +9,40 @@
 > make the history less accurate, not more.
 
 
+## 0.186.2 - Haskell exploit proof, a default-scan drift gate, and the measurements behind earlier claims
+
+- **Haskell in the exploit proof fabric (GA capability, new language).** `proof doctor` now lists `haskell` and `proof generate` builds reproducers for Haskell findings. Reproducers run in GHC's interpreter (`ghc -e`), so there is no build step. Command injection and path-traversal writes are proven; server-side request forgery is refused because no HTTP client ships with GHC; SQL, argument injection and deserialization are refused by name. Only `base` and the packages that ship with GHC are allowed (read from the installed GHC); a handler that needs a web framework is refused with the package named. Template Haskell, quasi-quotes, CPP, the foreign function interface and plugin options are refused as load-time code execution. 45 of 45 fixture reproductions across 15 classes, 0 false confirmations. Limits: exercised under local confinement on macOS with GHC 9.14.1 only; the container image is wired but was not run against a real engine, and Linux was not exercised.
+- **`fix --apply --require-proof` now holds for Haskell and Nix fixes.** Their fixer returned before the proof gate, so the flag was silently ignored. The gate is shared now; the patch is previewed, proven, then written, and aborted if the written patch differs from the proven one.
+- **Correction to 0.186.0: default scan output did change.** 0.186.0 said a default scan's output was unchanged. It was not. Findings from flow-pair and structural detectors now carry `line` (taken from the sink, then the source) where they had none; on the fixtures used by the new gate, 33 of 84 findings gained a line, and one command-injection finding is now reported by the structural detector under the title "Command Injection (User-Controlled Input)". The stable finding id does not use the line. New detectors (redirect target, reflected input, send-file root, init scope, listen bind address) and general precision rules for open redirect, reflected input, blocking I/O, file serving, logging by name and Nix option types changed what some projects report. Line pragmas now match findings that had no line.
+- **New gate: default-scan drift (`bench/default-scan-drift`).** A default scan over eight committed fixtures is compared to a committed baseline; any added, removed or changed finding fails `npm test` and prints the difference. Re-baselining is explicit and belongs with a changelog entry naming the rule.
+- **Independent precision measurement (`bench/dag/independent`).** On projects the rule work never touched (koa, hapi, nest samples and strapi server packages; five Nix configuration collections), a seeded random sample of 60 flagged sites per language was labeled from source by one LLM reader. Precision of the whole default scan: JavaScript and TypeScript 7 of 60, 11.7% (95% interval 5.8% to 22.2%); Nix 4 of 59 decided sites, 6.8% (2.7% to 16.2%). This is the whole scan, not the narrower classes the 0.186.0 precision work targeted, so it does not contradict those figures; it shows they do not describe a typical project. The sample is for measurement only.
+- **Speed gate now matches the hosted runner.** The time-to-first-finding budget on the hosted runner is the median of ten passing release runs (11.1 s) with a 1.35x limit (15.0 s), and a new `ttff` job runs it on every pull request, so a slowdown like 0.186.0's is found before a tag.
+- **Unmet targets are stated.** The capability registry, README and graph-precision page list the targets 0.186.x missed: incremental analysis 2.5x and 2.4x on the synthetic projects against 3x, 75 of 982 sink sites still on the full path, 3 of 8 on the multi-service fixture, the z3 backend not used by a default scan.
+- **S7 test failures explained.** They ran the built bundle while it crashed at start-up on a statically imported optional package (the `z3-solver` import fixed in 0.186.0's follow-up). A new test fails if the bundle imports any optional package statically.
+- **The `v0.186.0` tag was removed.** That release was never published to npm.
+
+## 0.186.1 - Git history annotation blames once per file, which restores scan speed (fix)
+
+0.186.0 was tagged but never published: its release workflow stopped at the time-to-first-finding gate (15 to 18 s against a 13 s limit), so the first npm release carrying that work is 0.186.1. Nothing in 0.186.0's content changed apart from the fix below.
+
+- **Why it got slower.** Findings that used to carry no line number now carry one, so the git history step, which asks git who introduced each finding, ran for about twice as many findings. It ran one `git blame` per finding and one `git show` per commit, about 14 ms each. Measured on this repository's own source: 7.9 s on 0.185.0, 10.9 s on 0.186.0.
+- **The fix.** One `git blame` per file for all of its lines and one `git log --no-walk` for all commit messages. A file whose batch fails is blamed line by line, so a bad line number cannot lose the others. The annotations are the same; `test/git-history-batch.test.js` checks the batched answers against per-line `git blame`. Measured after the change: 8.3 s locally.
+- **Also in this release.** Two test fixes found by hosted CI: the artifact CLI tests now warm the OSV cache once, because a cold runner has none, and `owned-build/6` accepts a watchdog stop on a slow runner.
+
+## 0.186.0 - The graph-precision capabilities are reachable from the CLI, a z3 backend checks path feasibility, and demand queries and incremental analysis got faster (Preview)
+
+Everything new is Preview, opt-in and off by default. The new commands and the solver do not run in a default scan. **Correction (added in 0.186.2):** this entry originally said a default scan's output was unchanged. That was wrong for the release as a whole: the precision work, new detectors and a line-number backfill changed default output. See 0.186.2 for the list and the check that now catches this. No GA capability changed its contract.
+
+- **Reachable from the CLI.** `dataflow view`, `dataflow contracts`, `dataflow sink-query`, `dataflow plan-cuts`, `witness build` and `witness verify` expose the typed graph views, boundary contracts, demand reverse taint, min-cut control planner and signed witness bundles. Every report carries a completion status (`complete`, `partial`, `cancelled`, `unavailable`, `invalid`) and `negativeClaimAllowed`; "no modeled path" is never reported as "no vulnerability". `witness build` exits 1 and writes nothing when no modeled path exists. The graph views other than the dataflow view and a tool in the MCP server remain library-only.
+- **A real z3 feasibility backend (`AGENTIC_SECURITY_LINEAGE_SMT=z3`).** Path conditions are translated to SMT-LIB and checked with a per-query timeout and memory cap. Only a proven `unsat` over a verified encoding can reduce a path's exploitability; a timeout, an unknown result, a missing solver or a condition the encoding cannot express changes nothing. The synchronous graph build does not call it: it is reached through the async path-evidence entry points. NaN and loose-equality coercion are not modeled.
+- **Demand queries are faster.** A query with the index built per query is 23.4x faster than full analysis on this repository (was 1.9x), and 3.7x averaged over a 30-query sample that includes fallbacks. Instance-field reads in JS and TS no longer force a full fallback; 75 of 982 sink sites still use the full path, all at the caller-depth limit. Findings equal full analysis on all 982 sites. Call-graph name resolution got a name index that also speeds up the cold engine.
+- **Incremental analysis is faster.** A per-file IR cache (JS and TS, under `AGENTIC_SECURITY_INCREMENTAL`) removes re-parsing. End to end it is now 4.3x on `scanner/src`; on the two synthetic projects it is 2.5x and 2.4x, still short of the 3x target. Projects above about 5,000 functions still run cold at the default summary budget.
+- **Fewer false positives on the labeled samples.** Flagged sites that were true rose from 5 of 25 to 5 of 8 for JavaScript and from 6 of 17 to 6 of 8 for Nix, with recall unchanged (5 of 5 and 6 of 6). Part of the JavaScript gain is a measurement correction: line-less findings were credited to every same-class label in their file. The rules are general (a literal origin prefix on a redirect, request-input-only reflection, module-load blocking calls, confined file serving, bounded Nix option types) and each has a metamorphic test; the held-out split was not independent, which the benchmark summary now says. The multi-service fixture still finds 3 of 8: the misses need the cross-service join in a normal scan and a queue-consumer source model.
+- **The state-machine heuristic is narrowed.** A `.status` write is compared only with status sets declared in the same file, and test files are skipped. Before, the first set found anywhere in a project was applied to every write.
+- **Fixed.** The lineage deadline tests no longer assume which of two valid cancellations wins on a slow runner, and the regression report no longer embeds the exact bundle size, so a rebuild cannot make it stale. `@babel/core` and `z3-solver` moved to their latest releases and `@azure/msal-node` is pinned past an advisory in the extension's dev tooling.
+- **Self-scan baseline.** The scanner's own source falls to 688 findings; the only increases are three low advisories in the two new files that read files from disk.
+- **Not claimed.** Reachability, satisfiability and runtime observation are not exploit proof. A signature on a witness bundle proves integrity, not that the transfer models are right.
+
 ## 0.185.0 - Graph analysis says when it did not finish, and gains recursion handling, call-site correlation, demand queries, incremental invalidation, boundary contracts, control planning and replayable witnesses (Preview)
 
 All new behavior is Preview and is off by default or purely additive. No GA capability changed its contract.

package/bin/agentic-security.js

@@ -206,6 +206,22 @@ Commands:
   dataflow plan-cuts [path] --candidates <file.json> --output <file> [--query <file.json>] [--format json|markdown]
                                Plan a minimum-cost, hypothetical control placement (graph cut) over the
                                already-scanned lineage graph. Never verifies a remediation.
+                               The plan carries a completion contract (never a negative claim).
+  dataflow view [path] [--node <id> [--direction in|out|both] [--relations a,b] [--origins a,b]] [--output <file>]
+                               Opt-in typed graph view over the already-scanned lineage graph: identity,
+                               completion, SCC condensation of the data-flow relation, or one node's neighbours.
+  dataflow contracts [path] [--contracts <file>] [--output <file>]
+                               Opt-in boundary contracts: bind declared HTTP/queue/storage edges to parsed
+                               consumer sites and seed taint there. A declaration is a modeled input only.
+  dataflow sink-query [path] (--list | --file <rel> --line <n>) [--mode demand|full|compare] [--arg-index <n>]
+                               [--sink-id <id>] [--access-path <p>] [--rule-family <f>] [--max-work <n>]
+                               [--max-caller-depth <n>] [--on-limit full|partial] [--output <file>]
+                               Opt-in demand-driven reverse taint for one sink site. Verdicts: flow-found,
+                               no-flow-in-modeled-scope, unknown. There is no "safe".
+  witness build [path] --out <dir> [--sink <id>] | --list-sinks
+  witness verify <bundle.json> [--public-key <path>] [--artifacts <dir> --root <project>] [--json]
+                               Opt-in signed, replayable path witness bundles (Ed25519, same key as attest).
+                               A valid signature proves integrity only, never that the finding is real.
   dataflow scenario apply [path] --operations <file.json> --output <file> [--format json|markdown]
                                Simulate a hypothetical architecture change against the
                                already-scanned lineage graph — never mutates the real scan.
@@ -3571,6 +3587,32 @@ async function cmdDigest(args) {
   console.error('digest --slack <url> OR digest --discord <url>'); return 4;
 }
 
+/**
+ * --require-proof gate shared by the generic fix path and the Haskell/Nix language fixer: the patch (`files`: path -> patched text) is
+ * allowed only if the original exploit is confirmed beforehand and demonstrably blocked afterwards. Returns { ok, code }; nothing is written here.
+ */
+async function requireProofGate(args, scanRoot, f, last, files) {
+  // --require-proof: the patch is applied ONLY if the original exploit is confirmed beforehand and demonstrably blocked
+  // afterwards (posture/proof-fabric/fix-proof.js). Missing reproducer, unavailable environment or an incomplete replay all refuse.
+  const { resolveReproducer } = await import('../src/posture/proof-fabric/cli.js');
+  const { findSiblings } = await import('../src/posture/proof-fabric/siblings.js');
+  const { verifyFixWithProof, formatFixProof } = await import('../src/posture/proof-fabric/fix-proof.js');
+  const { verifyFix } = await import('../src/posture/fix-verify.js');
+  const loaded = resolveReproducer(scanRoot, f, args.flags.reproducer);
+  if (!loaded.reproducer) { console.error(`--require-proof: no reproducer for ${f.id}, and none could be generated: ${loaded.reason}. Refusing to apply; nothing was executed. Supply --reproducer <file>.`); return { ok: false, code: 4 }; }
+  if (loaded.generated) console.error(`--require-proof: using a reproducer generated from the finding (${loaded.generated.shape}, ${loaded.generated.class}); it counts only if executing it confirms the exploit.`);
+  const staticVerification = await verifyFix({ scanRoot, originalFindingStableId: f.stableId || null, files, recordMetrics: false });
+  // equivalent sibling exposures: the engine's own other findings of this kind, plus other places with the same code shape
+  const sib = findSiblings({ root: scanRoot, finding: f, scanFindings: last.findings || [] });
+  const siblings = sib.siblings.map((x) => ({ id: x.id ?? null, file: x.file, line: x.line, source: x.source }));
+  if (sib.truncated.length) console.error(`--require-proof: the sibling search stopped early (${sib.truncated.join(', ')}); absence of siblings is not shown.`);
+  const fp = await verifyFixWithProof({ finding: f, reproducer: loaded.reproducer, files, scanRoot, staticVerification, siblings, siblingSearchTruncated: sib.truncated });
+  console.log(formatFixProof(fp));
+  try { (await import('../src/posture/dnr/store.js')).saveRecord(scanRoot, f.stableId || f.id, 'fix', fp); } catch { /* recording is best effort; the refusal below does not depend on it */ }
+  if (!fp.verified) { console.error('\nRefusing to apply: the fix is not proof-verified (--require-proof).'); return { ok: false, code: 4 }; }
+  return { ok: true, code: 0 };
+}
+
 async function cmdFix(args) {
   const id = args.flags.finding;
   const isPreview = !!args.flags.preview;
@@ -3620,7 +3662,21 @@ async function cmdFix(args) {
         return 4;
       }
       const proj = loadLanguageProject(scanRoot);
+      // --require-proof applies to a Haskell fix exactly as to any other: the verified patch is previewed first, the exploit is
+      // confirmed against the original and blocked against the patch, and only then is the same patch written.
+      let provenFiles = null;
+      if (isApply && args.flags['require-proof']) {
+        const prev = await languageFixPreview(f, proj.files, { apply: false, root: scanRoot });
+        if (!prev.ok) { console.error(`No verified fix for this finding (${prev.status}${prev.tier ? `, ${prev.tier}` : ''}): ${prev.reason || 'unsupported'}`); return 4; }
+        provenFiles = prev.edits ? Object.fromEntries(prev.edits.map((e) => [e.file, e.after])) : { [prev.file]: prev.after };
+        const gate = await requireProofGate(args, scanRoot, f, last, provenFiles);
+        if (!gate.ok) return gate.code;
+      }
       const res = await languageFixPreview(f, proj.files, { apply: isApply, root: scanRoot });
+      if (provenFiles && res.ok) {
+        const applied = res.edits ? Object.fromEntries(res.edits.map((e) => [e.file, e.after])) : { [res.file]: res.after };
+        if (JSON.stringify(Object.entries(applied).sort()) !== JSON.stringify(Object.entries(provenFiles).sort())) { console.error('The patch written differs from the patch that was proof-verified. Run `agentic-security undo` and report this.'); return 1; }
+      }
       if (!res.ok) { console.error(`No verified fix for this finding (${res.status}${res.tier ? `, ${res.tier}` : ''}): ${res.reason || 'unsupported'}`); return 4; }
       console.log(`${res.label || 'FIX'}${res.tier ? ` (${res.tier})` : ''}: ${res.explanation || ''}`.trim());
       console.log(res.diff);
@@ -3724,23 +3780,8 @@ async function cmdFix(args) {
   // --require-proof: the patch is applied ONLY if the original exploit is confirmed beforehand and demonstrably blocked
   // afterwards (posture/proof-fabric/fix-proof.js). Missing reproducer, unavailable environment or an incomplete replay all refuse.
   if (args.flags['require-proof']) {
-    const { resolveReproducer } = await import('../src/posture/proof-fabric/cli.js');
-    const { findSiblings } = await import('../src/posture/proof-fabric/siblings.js');
-    const { verifyFixWithProof, formatFixProof } = await import('../src/posture/proof-fabric/fix-proof.js');
-    const { verifyFix } = await import('../src/posture/fix-verify.js');
-    const loaded = resolveReproducer(scanRoot, f, args.flags.reproducer);
-    if (!loaded.reproducer) { console.error(`--require-proof: no reproducer for ${f.id}, and none could be generated: ${loaded.reason}. Refusing to apply; nothing was executed. Supply --reproducer <file>.`); return 4; }
-    if (loaded.generated) console.error(`--require-proof: using a reproducer generated from the finding (${loaded.generated.shape}, ${loaded.generated.class}); it counts only if executing it confirms the exploit.`);
-    const files = { [f.file]: newContent };
-    const staticVerification = await verifyFix({ scanRoot, originalFindingStableId: f.stableId || null, files, recordMetrics: false });
-    // equivalent sibling exposures: the engine's own other findings of this kind, plus other places with the same code shape
-    const sib = findSiblings({ root: scanRoot, finding: f, scanFindings: last.findings || [] });
-    const siblings = sib.siblings.map((x) => ({ id: x.id ?? null, file: x.file, line: x.line, source: x.source }));
-    if (sib.truncated.length) console.error(`--require-proof: the sibling search stopped early (${sib.truncated.join(', ')}); absence of siblings is not shown.`);
-    const fp = await verifyFixWithProof({ finding: f, reproducer: loaded.reproducer, files, scanRoot, staticVerification, siblings, siblingSearchTruncated: sib.truncated });
-    console.log(formatFixProof(fp));
-    try { (await import('../src/posture/dnr/store.js')).saveRecord(scanRoot, f.stableId || f.id, 'fix', fp); } catch { /* recording is best effort; the refusal below does not depend on it */ }
-    if (!fp.verified) { console.error('\nRefusing to apply: the fix is not proof-verified (--require-proof).'); return 4; }
+    const gate = await requireProofGate(args, scanRoot, f, last, { [f.file]: newContent });
+    if (!gate.ok) return gate.code;
   }
   let result = await applyVerifiedFix({
     scanRoot,
@@ -5162,6 +5203,8 @@ async function cmdDataflowPlanCuts(args) {
   if (!loaded.ok) { process.stderr.write(`agentic-security dataflow plan-cuts: ${loaded.message}\n`); return 1; }
   const { planCuts } = await import('../src/lineage/cut-planner.js');
   const plan = planCuts(loaded.graph, query, candidates);
+  // Completion contract: a plan is `complete` only for a finite cut over a graph known complete; never a negative claim.
+  plan.contract = (await import('../src/posture/dag-commands.js')).planContract(plan);
   let data;
   if (format === 'json') data = JSON.stringify(plan, null, 2);
   else {
@@ -5171,6 +5214,7 @@ async function cmdDataflowPlanCuts(args) {
     for (const r of plan.validation?.residualPaths ?? []) lines.push(`- to \`${r.sink}\` via ${r.nodes.map((n) => `\`${n}\``).join(' -> ')}`);
     lines.push('', '## Limitations', '');
     for (const l of plan.limitations) lines.push(`- ${l}`);
+    lines.push('', `Completion: ${plan.contract.status}. A negative claim is never allowed for a hypothetical plan.`);
     data = lines.join('\n') + '\n';
   }
   try {
@@ -8012,6 +8056,7 @@ async function main() {
       }
       case 'boundaries': process.exit(await cmdBoundaries(args));
       case 'explore':  process.exit(await cmdExplore(args));
+      case 'witness':  process.exit(await (await import('../src/posture/dag-commands.js')).cmdWitness(args));
       case 'dataflow': {
         const sub = args._[1];
         if (sub === 'export') { process.exit(await cmdDataflowExport(args)); }
@@ -8053,6 +8098,9 @@ async function main() {
           break;
         }
         else if (sub === 'plan-cuts') { process.exit(await cmdDataflowPlanCuts(args)); }
+        else if (sub === 'view') { process.exit(await (await import('../src/posture/dag-commands.js')).cmdDataflowView(args)); }
+        else if (sub === 'contracts') { process.exit(await (await import('../src/posture/dag-commands.js')).cmdDataflowContracts(args)); }
+        else if (sub === 'sink-query') { process.exit(await (await import('../src/posture/dag-commands.js')).cmdDataflowSinkQuery(args)); }
         else if (sub === 'impact') {
           const impactSub = args._[2];
           if (impactSub === 'assess') { process.exit(await cmdDataflowImpactAssess(args)); }
@@ -8073,7 +8121,7 @@ async function main() {
           break;
         }
         else if (sub === 'twin') { process.exit(await cmdDataflowTwin(args)); }
-        process.stderr.write(`agentic-security dataflow: unknown subcommand "${sub}" — only "export", "diff", "watch", "scenario", "impact", "observations", and "twin" are supported.\n`);
+        process.stderr.write(`agentic-security dataflow: unknown subcommand "${sub}" — only "export", "diff", "watch", "scenario", "plan-cuts", "view", "contracts", "sink-query", "impact", "observations", and "twin" are supported.\n`);
         process.exit(2);
       }
       case 'governance': {

package/dist/1128.index.js

@@ -31,10 +31,14 @@ function makeIdentityTokenizer() {
 // EXPORTS
 __webpack_require__.d(__webpack_exports__, {
   WITNESS_SCHEMA: () => (/* binding */ WITNESS_SCHEMA),
+  buildWitnessBundle: () => (/* binding */ buildWitnessBundle),
+  exportProvenanceArtifact: () => (/* binding */ exportProvenanceArtifact),
+  parseWitnessBundle: () => (/* binding */ parseWitnessBundle),
+  signWitnessBundle: () => (/* binding */ signWitnessBundle),
   verifyWitness: () => (/* binding */ verifyWitness)
 });
 
-// UNUSED EXPORTS: buildWitnessBundle, exportProvenanceArtifact, parseWitnessBundle, replayWitness, signWitnessBundle, transferModelFingerprints, verifyWitnessSignature
+// UNUSED EXPORTS: replayWitness, transferModelFingerprints, verifyWitnessSignature
 
 // EXTERNAL MODULE: external "node:crypto"
 var external_node_crypto_ = __webpack_require__(77598);
@@ -118,7 +122,7 @@ function iso(v) {
  * dropped and only COUNTED (their names could themselves carry a value). Identities are tokenized with the
  * existing keyed-hash convention; a raw identity with no tokenizer is dropped, never kept.
  */
-function witness_runtime_sanitizeCausalGroups(groups, { tokenize = (0,identity_token.makeIdentityTokenizer)() } = {}) {
+function sanitizeCausalGroups(groups, { tokenize = (0,identity_token.makeIdentityTokenizer)() } = {}) {
   const out = []; const rejected = []; let droppedFields = 0;
   const GROUP_KEYS = new Set(['id', 'sessionRef', 'sessionId', 'traceId', 'environment', 'deploymentRef', 'deploymentConfigDigest',
     'identity', 'identityToken', 'firstObservedAt', 'lastObservedAt', 'edgeObservations']);
@@ -218,7 +222,7 @@ function assessRuntimeSupport({ pathEdgeIds, edgeStates, causalGroups = [], expe
   if (!ids.length || !isObj(edgeStates) || !edgeStates.evaluated) {
     return { ...base, status: 'not_consulted', statements: ['No telemetry was consulted for this path. That is not an observation of absence.'] };
   }
-  const sanitized = witness_runtime_sanitizeCausalGroups(causalGroups, { tokenize });
+  const sanitized = sanitizeCausalGroups(causalGroups, { tokenize });
   base.groupsConsidered = sanitized.groups.length; base.rejectedGroups = sanitized.rejected.length; base.droppedFields = sanitized.droppedFields;
 
   for (const id of ids) {
@@ -278,7 +282,7 @@ function assessRuntimeSupport({ pathEdgeIds, edgeStates, causalGroups = [], expe
  * R10.6: external proof references are bound to the sink, the value and the configuration. A reference that is
  * stale or mismatched is REJECTED with its reasons; it is never re-attached to the changed graph.
  */
-function witness_runtime_bindExploitProofs(proofs, expected) {
+function bindExploitProofs(proofs, expected) {
   const bound = []; const rejected = [];
   for (const [i, p] of arr(proofs).entries()) {
     const id = isObj(p) && typeof p.id === 'string' && REF_RE.test(p.id) ? p.id : `proof-${i}`;
@@ -302,7 +306,7 @@ function witness_runtime_bindExploitProofs(proofs, expected) {
 }
 
 /** Validate the nullable DAG-04 slot. Returns { ok, errors }. */
-function witness_runtime_validateControlEvidence(ce, pathEdgeIds) {
+function validateControlEvidence(ce, pathEdgeIds) {
   if (ce === null) return { ok: true, errors: [] };
   const errors = [];
   if (!isObj(ce)) return { ok: false, errors: ['control evidence must be an object or null'] };
@@ -321,7 +325,7 @@ function witness_runtime_validateControlEvidence(ce, pathEdgeIds) {
  * The four statuses, side by side. Returns exactly the four keys in EVIDENCE_STATUS_KEYS and nothing that
  * ranks, scores or combines them.
  */
-function witness_runtime_buildEvidenceStatuses({ pathComplete, controlEvidence, runtime, exploit }) {
+function buildEvidenceStatuses({ pathComplete, controlEvidence, runtime, exploit }) {
   return {
     modeledPath: { status: pathComplete ? 'connected_complete' : 'connected_partial' },
     feasibility: { status: controlEvidence ? controlEvidence.status : 'not_assessed' },
@@ -420,14 +424,14 @@ const fileOfScope = (scope) => (typeof scope === 'string' ? scope.split('::')[0]
 function exportProvenanceArtifact({ hops, incomplete = [] }) {
   const seen = new Map();
   for (const h of witness_bundle_arr(hops)) {
-    const norm = Object.fromEntries(HOP_FIELDS.map((f) => [f, h?.[f] ?? null]));
-    seen.set(canonicalJson(norm), norm);
+    const norm = Object.fromEntries(path_store/* HOP_FIELDS */.KO.map((f) => [f, h?.[f] ?? null]));
+    seen.set((0,evidence_bundle/* canonicalJson */.dj)(norm), norm);
   }
   const hopList = [...seen.keys()].sort().map((k) => seen.get(k));
   const truncations = witness_bundle_arr(incomplete)
     .map((u) => ({ scope: u.qid ?? u.scope ?? null, context: u.context ?? null, reason: u.reasons?.[0] ?? u.reason ?? 'analysis-incomplete' }))
-    .sort((a, b) => (canonicalJson(a) < canonicalJson(b) ? -1 : 1));
-  return { schema: PROVENANCE_ARTIFACT_SCHEMA, hops: hopList, truncations, digest: witness_bundle_sha(canonicalJson({ hops: hopList, truncations })) };
+    .sort((a, b) => ((0,evidence_bundle/* canonicalJson */.dj)(a) < (0,evidence_bundle/* canonicalJson */.dj)(b) ? -1 : 1));
+  return { schema: PROVENANCE_ARTIFACT_SCHEMA, hops: hopList, truncations, digest: witness_bundle_sha((0,evidence_bundle/* canonicalJson */.dj)({ hops: hopList, truncations })) };
 }
 
 function artifactDigest(a) {
@@ -568,8 +572,8 @@ function buildWitnessBundle(o = {}) {
   }
   const budget = { ...result.budget }; delete budget.expansionsUsed;
   const config = { pathQuery: budget, storeLimits: storeLimits.limits, ...(witness_bundle_isObj(o.analysisConfig) ? { extra: o.analysisConfig } : {}) };
-  const analysisConfigDigest = witness_bundle_sha(canonicalJson(config));
-  const graphDigest = computeGraphDigest(graph);
+  const analysisConfigDigest = witness_bundle_sha((0,evidence_bundle/* canonicalJson */.dj)(config));
+  const graphDigest = (0,export_json.computeGraphDigest)(graph);
 
   const files = [...new Set([srcNode, sinkNode, ...edges.flatMap((e) => [store.getNode(e.fromNodeId), store.getNode(e.toNodeId)])].map((n) => fileOfScope(n?.scope)).filter(Boolean))].sort();
   const sources = []; const unboundSourceFiles = [];
@@ -608,7 +612,7 @@ function buildWitnessBundle(o = {}) {
   const ceCheck = validateControlEvidence(ce, edges.map((e) => e.edgeId));
   if (!ceCheck.ok) return { ok: false, reason: `control evidence: ${ceCheck.errors.join('; ')}` };
 
-  const tokenize = o.tokenize ?? makeIdentityTokenizer();
+  const tokenize = o.tokenize ?? (0,identity_token.makeIdentityTokenizer)();
   let runtime;
   if (o.runtime) {
     const groups = sanitizeCausalGroups(o.runtime.causalGroups, { tokenize });
@@ -622,7 +626,7 @@ function buildWitnessBundle(o = {}) {
   const exploitInputs = witness_bundle_arr(o.exploitProofs).map((p) => sanitizeProof(p));
   const exploit = { inputs: exploitInputs, ...bindExploitProofs(exploitInputs, { sinkRef, dataElementId: edges[0].dataElementId, graphDigest, analysisConfigDigest }) };
 
-  const sourcePath = redactString(srcNode.path ?? ''); const sinkPath = redactString(sinkNode.path ?? '');
+  const sourcePath = (0,redact/* redactString */.rd)(srcNode.path ?? ''); const sinkPath = (0,redact/* redactString */.rd)(sinkNode.path ?? '');
   const redactions = (srcNode.path && sourcePath !== srcNode.path ? 1 : 0) + (sinkNode.path && sinkPath !== sinkNode.path ? 1 : 0);
 
   const bundle = jsonSafe({
@@ -669,7 +673,7 @@ function sanitizeProof(p) {
   const ref = (v) => (typeof v === 'string' && /^[A-Za-z0-9._:@/-]{1,160}$/.test(v) ? v : null);
   return {
     id: ref(p.id), kind: ['proof', 'dnr-hunt', 'incident'].includes(p.kind) ? p.kind : null, sinkRef: ref(p.sinkRef), dataElementId: ref(p.dataElementId),
-    graphDigest: ref(p.graphDigest), analysisConfigDigest: ref(p.analysisConfigDigest), note: typeof p.note === 'string' ? redactString(p.note).slice(0, 200) : null,
+    graphDigest: ref(p.graphDigest), analysisConfigDigest: ref(p.analysisConfigDigest), note: typeof p.note === 'string' ? (0,redact/* redactString */.rd)(p.note).slice(0, 200) : null,
   };
 }
 
@@ -693,9 +697,9 @@ function signedBytes(bundle) {
 
 /** Sign with the same Ed25519 key and self-issued trust basis as finding evidence bundles. */
 function signWitnessBundle(bundle, privateKeyPem) {
-  const publicKeyPem = crypto.createPublicKey(privateKeyPem).export({ type: 'spki', format: 'pem' });
-  const withIssuance = { ...bundle, issuance: buildLocalIssuance(publicKeyPem) };
-  const sig = crypto.sign(null, signedBytes(withIssuance), privateKeyPem);
+  const publicKeyPem = external_node_crypto_.createPublicKey(privateKeyPem).export({ type: 'spki', format: 'pem' });
+  const withIssuance = { ...bundle, issuance: (0,evidence_bundle/* buildLocalIssuance */.hc)(publicKeyPem) };
+  const sig = external_node_crypto_.sign(null, signedBytes(withIssuance), privateKeyPem);
   return { ...withIssuance, signature: { algorithm: 'ed25519', canonicalisation: WITNESS_SCHEMA, value: sig.toString('base64') } };
 }
 
@@ -874,16 +878,16 @@ function replayWitness(bundle, artifacts, opts = {}) {
     const gEdges = new Set(witness_bundle_arr(artifacts.graph.edges).map((e) => e.id));
     if (gb.edgeIds.some((id) => !gEdges.has(id))) fail('graph-binding', 'a bound graph edge is not in the graph artifact');
   }
-  const ceCheck = witness_runtime_validateControlEvidence(bundle.controlEvidence, edges.map((e) => e.edgeId));
+  const ceCheck = validateControlEvidence(bundle.controlEvidence, edges.map((e) => e.edgeId));
   if (!ceCheck.ok) fail('control-evidence', ceCheck.errors.join('; '));
   const rt = bundle.runtime;
   const reAssessed = witness_bundle_isObj(rt) ? runtimeAssessment(rt, gb ? gb.edgeIds : []) : null;
   if (!reAssessed || !same(reAssessed, rt.assessment)) fail('runtime-inconsistent', 'the recorded runtime assessment does not follow from its recorded inputs');
   if (rt?.inputs && !gb) fail('runtime-inconsistent', 'runtime inputs without a graph binding');
-  const reBound = witness_runtime_bindExploitProofs(witness_bundle_arr(bundle.exploit?.inputs), { sinkRef: last, dataElementId: edges[0]?.dataElementId, graphDigest: bundle.graphRef.digest, analysisConfigDigest: bundle.graphRef.analysisConfigDigest });
+  const reBound = bindExploitProofs(witness_bundle_arr(bundle.exploit?.inputs), { sinkRef: last, dataElementId: edges[0]?.dataElementId, graphDigest: bundle.graphRef.digest, analysisConfigDigest: bundle.graphRef.analysisConfigDigest });
   if (!same({ status: reBound.status, bound: reBound.bound, rejected: reBound.rejected }, { status: bundle.exploit?.status, bound: bundle.exploit?.bound, rejected: bundle.exploit?.rejected })) fail('proof-binding', 'the recorded proof binding does not follow from the sink, value and configuration it is bound to');
   if (reAssessed && bundle.completion) {
-    const ev = witness_runtime_buildEvidenceStatuses({ pathComplete: bundle.completion.path.complete && derived.overall === 'complete', controlEvidence: bundle.controlEvidence, runtime: reAssessed, exploit: reBound });
+    const ev = buildEvidenceStatuses({ pathComplete: bundle.completion.path.complete && derived.overall === 'complete', controlEvidence: bundle.controlEvidence, runtime: reAssessed, exploit: reBound });
     if (!same(ev, bundle.evidence)) fail('evidence-statuses', 'the four evidence statuses do not follow from their inputs');
   }
   return { ok: failures.length === 0, failures, warnings, derived };