@clear-capabilities/agentic-security-scanner 0.195.22 → 0.195.24

package/src/posture/fleet/fleet-manifest.js

@@ -14,7 +14,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { load as loadYaml } from '../../util/yaml.js';
 
-export const FLEET_MANIFEST_SCHEMA_KEYS = Object.freeze(['organization', 'repositories', 'workers', 'perRepoTimeout', 'retries', 'resources']);
+export const FLEET_MANIFEST_SCHEMA_KEYS = Object.freeze(['organization', 'repositories', 'workers', 'perRepoTimeout', 'retries', 'resources', 'cacheMaxAge']);
 export const REPO_KEYS = Object.freeze(['id', 'path', 'required', 'kind', 'internetFacing', 'environment', 'dataClasses', 'trustZone', 'calls', 'produces', 'consumes', 'reads', 'writes', 'providers', 'aliases']);
 export const RESOURCE_KEYS = Object.freeze(['id', 'kind', 'dataClasses', 'trustZone', 'internetFacing', 'environment', 'aliases']);
 export const REPO_KINDS = Object.freeze(['service', 'library', 'frontend', 'worker', 'gateway']);
@@ -93,12 +93,15 @@ export function validateFleetManifest(doc, { baseDir = '.' } = {}) {
   if (doc.workers != null && !(Number.isInteger(doc.workers) && doc.workers >= 1 && doc.workers <= 32)) errors.push('workers must be an integer in 1..32');
   if (doc.retries != null && !(Number.isInteger(doc.retries) && doc.retries >= 0 && doc.retries <= 5)) errors.push('retries must be an integer in 0..5');
   if (doc.perRepoTimeout != null && parseDuration(doc.perRepoTimeout, null) == null) errors.push(`perRepoTimeout is not a valid duration: ${doc.perRepoTimeout}`);
+  if (doc.cacheMaxAge != null && parseDuration(doc.cacheMaxAge, null) == null) errors.push(`cacheMaxAge is not a valid duration: ${doc.cacheMaxAge}`);
   if (errors.length) return { ok: false, errors };
   return {
     ok: true, errors: [],
     manifest: {
       organization: doc.organization, repositories: repos, resources,
       workers: doc.workers ?? 4, retries: doc.retries ?? 1, perRepoTimeoutMs: parseDuration(doc.perRepoTimeout, 20 * 60000),
+      // GA-09: a cached result older than this is stale and is not reused (the feeds it was enriched with have moved on); 7 days by default
+      cacheMaxAgeMs: parseDuration(doc.cacheMaxAge, 7 * 24 * 3600000),
     },
   };
 }

package/src/posture/fleet/job-runner.js

@@ -69,6 +69,21 @@ export function planRun({ manifest, manifestHash, store, runId = null, config =
  * Run (or continue) a planned run until no job is queued or leased by a live worker. Returns when the work is done, the signal
  * aborts, or `maxWaitMs` passes with only other workers' leases outstanding.
  */
+export const DEFAULT_CACHE_MAX_AGE_MS = 7 * 24 * 3600000;
+
+/**
+ * Is a cache hit fresh enough to reuse (GA-09)? A record with no readable `cachedAt` (written before 0.195.23) is never fresh, and a
+ * record older than `maxAgeMs` (the manifest's `cacheMaxAge`, 7 days by default) is stale. Returns `{ fresh, cacheAgeMs }`.
+ */
+export function cacheFreshness(hit, maxAgeMs, nowMs) {
+  if (!hit) return { fresh: false, cacheAgeMs: null };
+  const t = typeof hit.cachedAt === 'string' ? Date.parse(hit.cachedAt) : NaN;
+  if (Number.isNaN(t)) return { fresh: false, cacheAgeMs: null };
+  const cacheAgeMs = Math.max(0, nowMs - t);
+  const max = Number.isFinite(maxAgeMs) && maxAgeMs > 0 ? maxAgeMs : DEFAULT_CACHE_MAX_AGE_MS;
+  return { fresh: cacheAgeMs <= max, cacheAgeMs };
+}
+
 export async function runJobs({ manifest, store, runId, root, scan = childScan, scanOptions = {}, workers = manifest.workers, leaseMs = DEFAULTS.leaseMs, heartbeatMs = DEFAULTS.heartbeatMs, retryDelayMs = DEFAULTS.retryDelayMs, pollMs = DEFAULTS.pollMs, maxWaitMs = null, signal, now = () => Date.now(), onEvent = () => {}, cacheDir = null, artifactDir = null, useCache = true }) {
   const repoById = new Map(manifest.repositories.map((r) => [r.id, r]));
   const cacheD = cacheDir ?? statePath(root, 'fleet', 'cache');
@@ -78,7 +93,11 @@ export async function runJobs({ manifest, store, runId, root, scan = childScan,
   const writeArtifact = (job, payload) => {
     const text = JSON.stringify({ schema: 'agentic-security/fleet-scan-artifact', version: 1, runId, repoId: job.repoId, epoch: job.epoch, commit: job.commit, ...payload });
     const file = path.join(artD, `${job.repoId}.${job.epoch}.json`);
-    fs.writeFileSync(file, text, { mode: 0o600 });
+    // written whole or not at all (GA-09): a worker killed mid-write leaves no half artifact for the hash check to find, only a
+    // stray temp file, and the job stays leased until the lease expires and another worker redoes it
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, text, { mode: 0o600 });
+    fs.renameSync(tmp, file);
     return { file, sha256: sha(text) };
   };
 
@@ -100,11 +119,16 @@ export async function runJobs({ manifest, store, runId, root, scan = childScan,
       idleSince = null;
       const repo = repoById.get(job.repoId);
       onEvent({ type: 'start', repo: job.repoId, attempt: job.attempts });
-      const cached = useCache ? readCache(cacheD, job.cacheKey) : null;
+      const hit = useCache ? readCache(cacheD, job.cacheKey) : null;
+      // GA-09: a hit is reused only while it is fresh. A result with no recorded time (written before 0.195.23) or older than the
+      // manifest's `cacheMaxAge` is stale: it is scanned again, never folded into a green organization as if it were current.
+      const { fresh, cacheAgeMs } = cacheFreshness(hit, manifest.cacheMaxAgeMs, now());
+      const cached = fresh ? hit : null;
+      if (hit && !cached) onEvent({ type: 'cache-stale', repo: job.repoId, cacheAgeMs });
       if (cached) {
-        const a = writeArtifact(job, { entry: cached.entry, findings: cached.findings, findingsTruncated: !!cached.findingsTruncated, lineage: cached.lineage ?? null, cached: true });
+        const a = writeArtifact(job, { entry: cached.entry, findings: cached.findings, findingsTruncated: !!cached.findingsTruncated, lineage: cached.lineage ?? null, cached: true, cachedAt: cached.cachedAt, cacheAgeMs });
         const status = cached.entry?.scanHealth && cached.entry.scanHealth.status !== 'complete' ? 'partial' : 'succeeded';
-        if (store.complete(job.jobId, job.epoch, { status, artifactSha256: a.sha256, summary: { total: cached.entry?.total ?? null, cached: true, artifact: path.basename(a.file) }, now: now() })) onEvent({ type: 'done', repo: job.repoId, cached: true, status });
+        if (store.complete(job.jobId, job.epoch, { status, artifactSha256: a.sha256, summary: { total: cached.entry?.total ?? null, cached: true, cacheAgeMs, artifact: path.basename(a.file) }, now: now() })) onEvent({ type: 'done', repo: job.repoId, cached: true, status });
         continue;
       }
       const ac = new AbortController();

package/src/posture/fleet/org-health.js

@@ -45,6 +45,29 @@ export function computeOrgHealth({ manifest, jobs }) {
   return { counts, assurance, reasons, repositories: repos };
 }
 
+/**
+ * Fold artifact problems (a result whose file is missing or does not match its recorded hash) into the health (GA-09). The repository
+ * becomes `failed`; a required one turns the organization red, an optional one makes it degraded (it used to stay green); the counts
+ * move from whatever state the repository had, not always from `complete`. Returns the same object, changed in place.
+ */
+export function applyArtifactProblems(health, manifest, problems) {
+  if (!Array.isArray(problems) || !problems.length) return health;
+  const stateKey = { complete: 'complete', partial: 'partial', failed: 'failed', 'timed-out': 'timedOut', cancelled: 'cancelled', 'not-run': 'notRun' };
+  let requiredHit = false; let optionalHit = false;
+  for (const p of problems) {
+    const r = health.repositories.find((x) => x.id === p.repoId);
+    if (!r) continue;
+    if (r.state !== 'failed') { health.counts[stateKey[r.state]]--; health.counts.failed++; }
+    r.state = 'failed'; r.error = p.problem;
+    const required = manifest.repositories.some((m) => m.id === p.repoId && m.required);
+    if (required) requiredHit = true; else optionalHit = true;
+  }
+  if (requiredHit) health.assurance = 'red';
+  else if (optionalHit && health.assurance === 'green') health.assurance = 'degraded';
+  health.reasons.push(`${problems.length} result(s) could not be verified: ${problems.map((p) => `${p.repoId} (${p.problem})`).join(', ')}`);
+  return health;
+}
+
 const n = (x) => x.toLocaleString('en-US');
 export function renderOrgHealth(h) {
   const c = h.counts;

package/src/posture/fleet/scan-cache.js

@@ -102,7 +102,7 @@ export function writeCache(dir, key, payload) {
   if (!key || !/^[0-9a-f]{64}$/.test(key)) return false;
   try {
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const body = { schema: 'agentic-security/fleet-scan-cache', version: 1, key, ...payload };
+    const body = { schema: 'agentic-security/fleet-scan-cache', version: 1, key, cachedAt: new Date().toISOString(), ...payload };
     const doc = { ...body, digest: sha(JSON.stringify(body)) };
     const tmp = path.join(dir, `.${key}.${process.pid}.tmp`);
     fs.writeFileSync(tmp, JSON.stringify(doc), { mode: 0o600 });

package/src/posture/flow-narration.js

@@ -14,6 +14,8 @@
 // Fail-closed: any LLM error → template fallback, never a missing field.
 
 import { evaluateEgress } from '../egress/policy.js';
+import { modelFetch } from '../egress/transport.js';
+import { resolveProvider, buildProviderRequest } from '../llm-validator/providers.js';
 
 const TEMPLATES = {
   'sql-injection': (f) =>
@@ -63,14 +65,14 @@ function _renderTemplate(f) {
 // Optional LLM call. Disabled by default; opt-in via env. Falls back to the
 // template on any error.
 async function _renderLlm(f, scanRoot) {
-  const endpoint = process.env.AGENTIC_SECURITY_LLM_ENDPOINT;
-  if (!endpoint) return null;
+  // GA-06.3: the provider is resolved like the validator's, so the `local` preset's loopback refusal applies here too, instead of the
+  // raw endpoint variable being called regardless of the preset. The Ollama protocol is not implemented here: treated as not configured.
+  const provider = resolveProvider({ role: 'explain' });
+  if (!provider.ok || provider.config.provider === 'ollama') return null;
+  const { endpoint } = provider.config;
   // FR-601: evaluated before the prompt below is built.
   const egressDecision = evaluateEgress({ scanRoot, purpose: 'flow-narration', endpoint });
   if (!egressDecision.allowed) return null;
-  const apiKey = process.env.AGENTIC_SECURITY_LLM_API_KEY;
-  const headers = { 'Content-Type': 'application/json' };
-  if (apiKey) headers['Authorization'] = `Bearer ${apiKey}`;
   const prompt = `You are explaining a security finding to a developer in one paragraph.
 Vuln: ${f.vuln}
 CWE: ${f.cwe}
@@ -80,11 +82,11 @@ Snippet: ${(f.snippet || '').slice(0, 200)}
 
 Write ONE paragraph (5-7 sentences) covering: (1) how an attacker reaches this code, (2) what they get if exploited, (3) typical recovery cost. Plain English, no marketing language, no emoji.`;
   try {
-    const r = await fetch(endpoint, { method: 'POST', headers, body: JSON.stringify({ prompt }) });
+    const req = buildProviderRequest(provider.config, prompt, 512);
+    const r = await modelFetch(endpoint, { method: 'POST', headers: req.headers, body: JSON.stringify(req.body) });
     if (!r.ok) return null;
     const j = await r.json().catch(() => null);
-    const text = j && (j.response || j.text || j.content || j.output ||
-                       j.choices?.[0]?.message?.content || j.message?.content);
+    const text = req.extractText(j);
     if (typeof text !== 'string' || text.length < 30) return null;
     // Sanitize: strip control chars, markdown fences, HTML metachars.
     return text.replace(/[\x00-\x1f\x7f]/g, ' ').replace(/[<>&]/g, ' ')

package/src/posture/llm-redteam.js

@@ -14,6 +14,7 @@
 
 import { RED_TEAM_PROMPTS, ATTACK_STRATEGIES, PLUGIN_SEVERITY, categorizePrompts, pluginCoverage } from './llm-redteam-prompts.js';
 import { evaluateEgress } from '../egress/policy.js';
+import { modelFetch } from '../egress/transport.js';
 
 // ─── STATIC mode ─────────────────────────────────────────────────────────
 // Scan the repo for prompt files / system-prompt strings and check whether
@@ -143,7 +144,8 @@ async function sendPrompt(endpoint, apiKey, prompt) {
   if (apiKey) headers['Authorization'] = `Bearer ${apiKey}`;
   let response;
   try {
-    const r = await fetch(endpoint, {
+    // the target under test is the operator's named endpoint; the shared transport still refuses a redirect off it and caps the reply
+    const r = await modelFetch(endpoint, {
       method: 'POST',
       headers,
       body: JSON.stringify({ prompt }),

package/src/posture/provenance/coordinator.js

@@ -206,6 +206,14 @@ function describePartial(isScaLike, reason) {
         reasons: ['rename_detected_not_followed'],
       };
     }
+    // GA-05: the parent of the candidate commit could not be inspected (the replay there failed), so absence in it is unproven.
+    // This is not "we could not see far enough" (shallow) and not "it was never true" (never confirmed): it is "we do not know".
+    if (reason === 'parent-not-inspectable') {
+      return {
+        limitation: 'a candidate commit was found but the replay in its parent failed, so absence there is unproven; the introducing commit is the earliest observable, not a verified boundary',
+        reasons: ['parent_not_inspectable'],
+      };
+    }
     return {
       limitation: reason
         ? `earliest observable — history could not confirm a verified parent boundary (${reason})`

package/src/posture/provenance/origin-resolver.js

@@ -25,6 +25,9 @@
 
 import { candidateCommitsForLine, candidateCommitsForFiles, commitMeta, getBlobAtCommit, isAncestor } from './git-evidence.js';
 import { replayAt } from './predicate-replay.js';
+
+/** Test seam: a replacement `replayAt` (same signature) so a replay failure in a parent commit can be produced on demand. */
+export const _replayHooks = { replayAt: null };
 import { PROVENANCE_METHOD } from './schema.js';
 import { checkAbsentInSomeParent, detectRevert, detectCherryPick } from './dag-walk.js';
 import { loadRepoLineage } from './repo-lineage.js';
@@ -230,7 +233,7 @@ export async function resolveOrigin(scanRoot, finding, { since, deadlineAt, repo
   const replayCache = new Map();
   const replay = (sha) => {
     if (replayCache.has(sha)) return replayCache.get(sha);
-    const p = replayAt(scanRoot, sha, files, stableId, { deep: needsDeepReplay(finding) });
+    const p = (_replayHooks.replayAt || replayAt)(scanRoot, sha, files, stableId, { deep: needsDeepReplay(finding) });
     replayCache.set(sha, p);
     return p;
   };
@@ -286,13 +289,23 @@ export async function resolveOrigin(scanRoot, finding, { since, deadlineAt, repo
     }
 
     const presentInParent = await replay(parent);
-    const absentInParent = !presentInParent.present;
-    if (!absentInParent) continue; // predicate already true in parent — keep walking older candidates
+    if (presentInParent.present) continue; // predicate already true in parent — keep walking older candidates
+    // GA-05: `present: false` is proof of absence only when the parent WAS inspected and the predicate did not reproduce
+    // (`stableId-not-reproduced`), or the file did not exist there at all (`no-files-at-commit`: a file that is new in this
+    // commit). A parent the replay could not inspect (`replay-error`) proves nothing, so the boundary is not verified and the
+    // answer is `partial` with that reason, never `complete`.
+    if (presentInParent.reason === 'replay-error') {
+      return {
+        status: 'partial', reason: 'parent-not-inspectable', commitsConsidered,
+        findingOrigin: originFrom(meta, { absentInParents: [] }),
+        method: PROVENANCE_METHOD.SEMANTIC_REPLAY, parentBoundaryVerified: false,
+      };
+    }
 
     return {
       status: 'complete', method: PROVENANCE_METHOD.SEMANTIC_REPLAY, commitsConsidered,
       findingOrigin: originFrom(meta, { absentInParents: [parent] }),
-      parentBoundaryVerified: true,
+      parentBoundaryVerified: true, absenceEvidence: presentInParent.reason,
     };
   }
 

package/src/posture/rule-compiler/cli.js

@@ -8,9 +8,11 @@
 // model call — this is the deterministic half; a model may PROPOSE the candidate pattern this CLI is handed, but
 // it never decides promotion).
 import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
 import { statePath } from '../state-dir.js';
 import { packTrust, signPublishedRule } from './store.js';
-import { sharedFalsePositiveCorpus, falsePositiveHits, regressRules } from './regression.js';
+import { sharedFalsePositiveCorpus, falsePositiveHits, regressRules, promotedRuleIds } from './regression.js';
 import { draftRuleIR, validateRuleIR, ruleIRDigest } from './ir.js';
 import { checkEligibility } from './eligibility.js';
 import { buildCorpus } from './corpus.js';
@@ -35,6 +37,12 @@ function readJsonArg(pathOrInline) {
 
 export async function cmdRules(args, root) {
   const sub = args._[1];
+  // GA-07: a ledger that failed its integrity check (broken chain, bad or missing signature) refuses EVERY command, not only the
+  // ones that change state; nothing below can read a tampered history as fact or write over it.
+  if (['synthesize', 'evaluate', 'promote', 'status', 'rollback', 'cost', 'regress'].includes(sub)) {
+    const guard = loadLedger(root);
+    if (guard.tampered) { console.error(`Refusing: rule lifecycle ledger failed its integrity check (${guard.tamperReason}).`); return 4; }
+  }
   if (sub === 'synthesize') return cmdSynthesize(args, root);
   if (sub === 'evaluate') return cmdEvaluate(args, root);
   if (sub === 'promote') return cmdPromote(args, root);
@@ -42,7 +50,7 @@ export async function cmdRules(args, root) {
   if (sub === 'rollback') return cmdRollback(args, root);
   if (sub === 'cost') return cmdCost(args, root);
   if (sub === 'regress') return cmdRegress(args, root);
-  console.error('usage: rules synthesize <finding-id> --spec <file.json> [--auto] [--max-attempts N] | evaluate <rule-id> | promote <rule-id> | status [rule-id] | rollback <rule-id> | cost <rule-id>');
+  console.error('usage: rules synthesize <finding-id> --spec <file.json> [--auto] [--max-attempts N] | evaluate <rule-id> | promote <rule-id> --reviewed-by <person> [--scope <text>] | status [rule-id] | rollback <rule-id> | cost <rule-id> | regress [rule-id]');
   return 4;
 }
 
@@ -61,7 +69,7 @@ async function cmdSynthesize(args, root) {
   // The candidate pattern is the model's or the person's, when they gave one. Without one, or with --auto, the synthesis loop proposes
   // from the vulnerable and patched code, scores each attempt on the real corpus and its mutations, and revises (see proposal.js).
   let finalSpec = spec; let synthesis = null;
-  const corpusSpec = { originalCode: spec.originalCode, patchedCode: spec.patchedCode ?? null, nearbyCleanCode: spec.nearbyCleanCode ?? [], protectedVariantsCode: spec.protectedVariantsCode ?? [] };
+  const corpusSpec = { originalCode: spec.originalCode, patchedCode: spec.patchedCode ?? null, nearbyCleanCode: spec.nearbyCleanCode ?? [], protectedVariantsCode: spec.protectedVariantsCode ?? [], independentVulnerableCode: spec.independentVulnerableCode ?? [], independentCleanCode: spec.independentCleanCode ?? [] };
   const leak = checkLeakage(JSON.stringify(corpusSpec), { benchmarkNames: args.flags['benchmark-names'] ? String(args.flags['benchmark-names']).split(',') : [], fileNames: spec.fileNames ?? [] });
   if (!leak.ok) { console.error(`Refusing: the material for this rule shows benchmark or answer-key signals (${leak.offendingTerms.join('; ')}). Nothing was written.`); return 4; }
   if (args.flags.auto || (!spec.match && !spec.sink)) {
@@ -120,7 +128,7 @@ async function cmdEvaluate(args, root) {
     originatingFinding: ir.provenance.originatingFindingId, originatingCommit: ir.provenance.originatingCommit, evidenceState: ir.provenance.evidenceState,
     generatingModel: ir.provenance.model, promptConfigVersion: ir.provenance.promptConfigVersion,
     positiveCorpusHash: corpusHash(corpus.positives), negativeCorpusHash: corpusHash(corpus.negatives),
-    benchmarkResults: { precision: gate.evaluation.score.precision, recall: gate.evaluation.score.recall, tp: gate.evaluation.score.tp, fp: gate.evaluation.score.fp, fn: gate.evaluation.score.fn, tn: gate.evaluation.score.tn, protectedFailures: gate.evaluation.score.protectedFailures, thresholds: gate.evaluation.thresholds, gate: gate.pass ? 'passed' : 'failed', reasons: gate.reasons },
+    benchmarkResults: { precision: gate.evaluation.score.precision, recall: gate.evaluation.score.recall, tp: gate.evaluation.score.tp, fp: gate.evaluation.score.fp, fn: gate.evaluation.score.fn, tn: gate.evaluation.score.tn, protectedFailures: gate.evaluation.score.protectedFailures, independent: gate.independent, thresholds: gate.evaluation.thresholds, gate: gate.pass ? 'passed' : 'failed', reasons: gate.reasons },
     leakageCheck: leakage, mutatorCoverage: mutatorCoverage(corpusSpec.originalCode), discoveryCost: corpusSpec.discoveryCost ?? prev?.discoveryCost ?? null,
     promotionEvent: prev?.promotionEvent ?? null, evaluatedAt: new Date().toISOString(),
   });
@@ -136,23 +144,63 @@ async function cmdEvaluate(args, root) {
 function isStr(v) { return typeof v === 'string' && v.length > 0; }
 const fmtPct = (n) => (n == null ? 'unmeasured' : `${(n * 100).toFixed(1)}%`);
 
+/** Does this commit exist in the project's history? `true`, `false`, or `null` when the project is not a git repository. */
+function commitExists(root, sha) {
+  if (!fs.existsSync(path.join(root, '.git'))) return null;
+  try { execFileSync('git', ['cat-file', '-e', `${sha}^{commit}`], { cwd: root, stdio: 'ignore' }); return true; } catch { return false; }
+}
+
+const NOT_A_REVIEWER = /^(?:agent|model|auto|bot|llm|ai)$/i;
+
+// Promotion is a reviewed, human decision (GA-07). It needs the reviewer's name, a rule that is exactly the one that was evaluated, a
+// provenance that checks out, and no conflict with a rule that already exists; a model's recommendation on its own promotes nothing.
 async function cmdPromote(args, root) {
   const id = args._[2];
-  if (!id) { console.error('usage: rules promote <rule-id>'); return 4; }
+  if (!id) { console.error('usage: rules promote <rule-id> --reviewed-by <person> [--scope <text>] [--reason <text>]'); return 4; }
+  const reviewer = args.flags['reviewed-by'];
+  if (!isStr(reviewer) || NOT_A_REVIEWER.test(reviewer.trim())) {
+    console.error('usage: rules promote <rule-id> --reviewed-by <person>. A promotion records the person who reviewed the rule and its scope; a model or agent recommendation is not a review, so nothing is promoted without a named reviewer.');
+    return 4;
+  }
   const ledger = loadLedger(root);
   if (ledger.tampered) { console.error(`Refusing: rule lifecycle ledger failed its integrity check (${ledger.tamperReason}).`); return 4; }
   if (stateOf(ledger, id) !== 'VALIDATED') { console.error(`Rule ${id} is not VALIDATED (run rules evaluate first); refusing to promote.`); return 4; }
   const ir = loadIR(root, id);
   if (!ir) { console.error(`No rule IR found for ${id}.`); return 4; }
+  // the rule promoted must be the rule evaluated: an IR edited after `rules evaluate` has no evidence
+  const prov = loadProvenance(root, id);
+  if (!prov) { console.error(`Promotion refused: no evaluation record for ${id}; run rules evaluate first.`); return 4; }
+  if (prov.ruleHash !== ruleIRDigest(ir)) { console.error(`Promotion refused: the rule ${id} changed after it was evaluated (evaluated ${String(prov.ruleHash).slice(0, 12)}, now ${ruleIRDigest(ir).slice(0, 12)}); run rules evaluate again.`); return 4; }
+  // a named originating commit must be real history, not a typed-in string
+  const commit = ir.provenance?.originatingCommit;
+  if (commit) {
+    const exists = commitExists(root, commit);
+    if (exists === false) { console.error(`Promotion refused: originating commit ${commit} is not in this repository's history (invalid provenance).`); return 4; }
+    if (exists === null) { console.error(`Promotion refused: originating commit ${commit} cannot be verified because this project is not a git repository.`); return 4; }
+  }
+  // conflicts: a hand-written rule file with the same id, or a promoted rule with the identical match
+  const live = statePath(root, 'rules', `${id}.yml`);
+  let firstLine = null; // null: no file there (or unreadable, which is treated as absent below only when the read fails with ENOENT)
+  try { firstLine = fs.readFileSync(live, 'utf8').split('\n')[0]; } catch (e) { if (e.code !== 'ENOENT') firstLine = ''; }
+  if (firstLine !== null && !firstLine.startsWith('# Compiled by the rule compiler')) { console.error(`Promotion refused: a rule file that the compiler did not write already exists at ${live}; choose another rule id or remove that file deliberately.`); return 4; }
+  for (const other of promotedRuleIds(ledger)) {
+    if (other === id) continue;
+    const oir = loadIR(root, other);
+    if (oir && JSON.stringify(oir.match) === JSON.stringify(ir.match) && JSON.stringify(oir.languages) === JSON.stringify(ir.languages)) {
+      console.error(`Promotion refused: ${id} duplicates the promoted rule ${other} (identical match on the same languages); roll one back or narrow this one.`);
+      return 4;
+    }
+  }
   // other rules may have been promoted since this one was evaluated: hold it to the false-positive corpus as it is NOW
   const fpNow = falsePositiveHits(ir, sharedFalsePositiveCorpus(root, ledger, id));
   if (fpNow.length) { console.error(`Promotion refused: ${id} fires on ${fpNow.length} item(s) of the shared false-positive corpus (${fpNow.slice(0, 3).map((h) => h.label).join(', ')}). Re-evaluate or narrow the rule.`); return 1; }
   const pub = publishCustomRule(root, ir);
   if (!pub.ok) { console.error(`Promotion refused: ${pub.reason}`); return 4; }
-  const t = recordTransition(ledger, { ruleId: id, from: 'VALIDATED', to: 'PROMOTED', reason: args.flags.reason || 'promoted', actor: args.flags.actor || 'operator' });
+  const scope = isStr(args.flags.scope) ? args.flags.scope : null;
+  const review = { reviewer: reviewer.trim(), scope, independent: prov.benchmarkResults?.independent ?? null };
+  const t = recordTransition(ledger, { ruleId: id, from: 'VALIDATED', to: 'PROMOTED', reason: args.flags.reason || 'promoted', evidence: review, actor: args.flags.actor || reviewer.trim() });
   saveLedger(root, ledger);
-  const prov = loadProvenance(root, id);
-  if (prov) saveProvenance(root, id, { ...prov, promotionEvent: { at: new Date().toISOString(), actor: args.flags.actor || 'operator', reason: args.flags.reason || 'promoted', ruleHash: ruleIRDigest(ir) } });
+  saveProvenance(root, id, { ...prov, promotionEvent: { at: new Date().toISOString(), actor: args.flags.actor || reviewer.trim(), reviewer: reviewer.trim(), scope, reason: args.flags.reason || 'promoted', ruleHash: ruleIRDigest(ir) } });
   console.log(`Rule ${id}: VALIDATED -> PROMOTED. Published to ${pub.file}.`);
   // Publishing is not trusting. Rule packs are signature-checked so a rule dropped into a repository cannot run in someone's CI; sign this
   // one with the operator's key when there is one, and say plainly whether the scanner will load it.

package/src/posture/rule-compiler/corpus.js

@@ -20,11 +20,15 @@ function toRuntimeRule(ir) {
 
 const EXT = { javascript: 'x.js', typescript: 'x.ts', python: 'x.py', go: 'x.go', ruby: 'x.rb', java: 'x.java', rust: 'x.rs', csharp: 'x.cs', php: 'x.php', any: 'x.txt' };
 
-export function buildCorpus(ir, { originalCode, patchedCode = null, nearbyCleanCode = [], protectedVariantsCode = [] } = {}) {
+export function buildCorpus(ir, { originalCode, patchedCode = null, nearbyCleanCode = [], protectedVariantsCode = [], independentVulnerableCode = [], independentCleanCode = [] } = {}) {
   const positives = [{ label: 'original', code: originalCode }];
   for (const v of generateVariants(originalCode)) positives.push({ label: `sibling:${v.mutator}`, code: v.code });
+  // Independent examples (GA-07): vulnerable and safe code that is NOT the source finding and NOT a mutation of it, supplied by the
+  // reviewer from other places. They are never mutated, so they score as what they are: evidence from outside the rule's own material.
+  independentVulnerableCode.forEach((code, i) => positives.push({ label: `independent-vulnerable-${i}`, code }));
 
   const negatives = [];
+  independentCleanCode.forEach((code, i) => negatives.push({ label: `independent-clean-${i}`, code }));
   if (patchedCode) {
     negatives.push({ label: 'patched', code: patchedCode });
     for (const v of generateVariants(patchedCode)) negatives.push({ label: `patched-sibling:${v.mutator}`, code: v.code });
@@ -60,6 +64,10 @@ export function scoreRule(ir, corpus) {
   const recall = corpus.positives.length === 0 ? null : tp / corpus.positives.length;
   // "Protected negative failures" per PRD 3: a rule firing on a sanitizer/guard-carrying variant specifically.
   const protectedFailures = negResults.filter((n) => n.label.startsWith('protected-') && n.fired).length;
+  // Independent evidence, counted apart: how many examples from outside the finding's own material there were, and how they scored.
+  const indPos = posResults.filter((p) => p.label.startsWith('independent-vulnerable-'));
+  const indNeg = negResults.filter((n) => n.label.startsWith('independent-clean-'));
+  const independent = { positives: indPos.length, negatives: indNeg.length, detected: indPos.filter((p) => p.fired).length, falseAlarms: indNeg.filter((n) => n.fired).length };
 
-  return { precision, recall, tp, fp, tn, fn, protectedFailures, positives: posResults, negatives: negResults };
+  return { precision, recall, tp, fp, tn, fn, protectedFailures, independent, positives: posResults, negatives: negResults };
 }

package/src/posture/rule-compiler/ir.js

@@ -74,9 +74,18 @@ export function validateRuleIR(ir) {
   return errs;
 }
 
+/** JSON with every object's keys sorted at every depth, so the digest does not depend on insertion order. */
+function stableStringify(v) {
+  if (Array.isArray(v)) return `[${v.map(stableStringify).join(',')}]`;
+  if (v && typeof v === 'object') return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${stableStringify(v[k])}`).join(',')}}`;
+  return JSON.stringify(v);
+}
+
 export function ruleIRDigest(ir) {
   const { state: _s, ...rest } = ir;
-  return sha256(JSON.stringify(rest, Object.keys(rest).sort()));
+  // Until 0.195.23 this passed the TOP-LEVEL key list as the JSON replacer, which also filters nested objects: `match.pattern` and
+  // every structural regex were serialized as `{}`, so the digest never covered the one thing a rule is. Sorted at every depth now.
+  return sha256(stableStringify(rest));
 }
 
 /** Build a DRAFT rule IR. Caller supplies the candidate pattern — this module never invents one. */

package/src/posture/rule-compiler/promotion.js

@@ -4,7 +4,11 @@
 // actually recorded, and nothing in this module writes to it.
 import { scoreRule } from './corpus.js';
 
-export const PROMOTION_DEFAULTS = Object.freeze({ minPrecision: 0.95, minRecall: 0.80, maxProtectedFailures: 0 });
+// Since 0.195.23 (GA-07) promotion also needs independent evidence: at least one vulnerable and one safe example that are not the
+// source finding or a mutation of it, and the rule must detect every independent vulnerable example and stay quiet on every
+// independent safe one. The synthesis loop still scores attempts without them (`evaluateRule`); only the promotion decision
+// (`gatePromotion`) requires them, so a candidate can be proposed before a reviewer has gathered the outside examples.
+export const PROMOTION_DEFAULTS = Object.freeze({ minPrecision: 0.95, minRecall: 0.80, maxProtectedFailures: 0, minIndependentVulnerable: 1, minIndependentClean: 1 });
 
 // Deliberately independent of posture/evaluation/custody.js: that module's term list and guard are reserved for
 // the evaluation custodian's sealed-label boundary (QA-002.AC03), and a test enforces that nothing outside
@@ -59,5 +63,11 @@ export function gatePromotion({ ir, corpus, leakageCheck, thresholds } = {}) {
   const evalResult = evaluateRule(ir, corpus, thresholds);
   const reasons = [...evalResult.reasons];
   if (!leakageCheck || leakageCheck.ok !== true) reasons.push(leakageCheck ? `leakage check failed: ${leakageCheck.offendingTerms.join(', ')}` : 'leakage check was not run');
-  return { pass: reasons.length === 0, reasons, evaluation: evalResult };
+  const t = evalResult.thresholds;
+  const ind = evalResult.score.independent ?? { positives: 0, negatives: 0, detected: 0, falseAlarms: 0 };
+  if (ind.positives < t.minIndependentVulnerable) reasons.push(`${ind.positives} independent vulnerable example(s) beyond the source finding and its mutations (min ${t.minIndependentVulnerable}): supply independentVulnerableCode`);
+  else if (ind.detected < ind.positives) reasons.push(`misses ${ind.positives - ind.detected} of ${ind.positives} independent vulnerable example(s)`);
+  if (ind.negatives < t.minIndependentClean) reasons.push(`${ind.negatives} independent safe example(s) (min ${t.minIndependentClean}): supply independentCleanCode`);
+  else if (ind.falseAlarms > 0) reasons.push(`fires on ${ind.falseAlarms} of ${ind.negatives} independent safe example(s)`);
+  return { pass: reasons.length === 0, reasons, evaluation: evalResult, independent: ind };
 }

package/src/posture/rule-compiler/regression.js

@@ -41,7 +41,7 @@ function operatorFalsePositives(root) {
   return out;
 }
 
-function promotedRuleIds(ledger) {
+export function promotedRuleIds(ledger) {
   return [...new Set(ledger.entries.map((e) => e.ruleId))].filter((id) => stateOf(ledger, id) === 'PROMOTED');
 }
 

package/src/posture/rule-compiler/store.js

@@ -7,6 +7,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { statePath, ensureStateDir, safeWriteState } from '../state-dir.js';
 import { newLedger, verifyLedger } from './lifecycle.js';
+import { signLastScan, verifyLastScan } from '../integrity.js';
 import { compileToCustomRule } from './ir.js';
 import { verifyRulePack, loadTrustedKeys, signRulePack } from '../rule-pack-signing.js';
 
@@ -15,20 +16,39 @@ const EXT = { javascript: 'js', typescript: 'ts', python: 'py', go: 'go', ruby:
 
 function ruleDir(scanRoot, id) { return statePath(scanRoot, DIR, id); }
 
-export function loadLedger(scanRoot) {
+/**
+ * The lifecycle ledger is hash-chained (lifecycle.js) AND signed with the per-install HMAC key (the same key as last-scan.json),
+ * since 0.195.23 (GA-07): the chain alone could be recomputed by anyone who could edit the file. A ledger that fails either check,
+ * or that cannot be parsed, is returned WITH `tampered: true` and its reason, and `saveLedger` refuses to write it, so a bad ledger
+ * is never quietly replaced by a fresh one and its history lost. An unsigned ledger with entries (written before 0.195.23) is
+ * accepted only with AGENTIC_SECURITY_RULES_UNSIGNED=1, the same switch that accepts an unsigned rules override, and is signed on
+ * its next save.
+ */
+export function loadLedger(scanRoot, env = process.env) {
   const f = statePath(scanRoot, DIR, 'ledger.json');
   if (!fs.existsSync(f)) return newLedger();
-  try {
-    const ledger = JSON.parse(fs.readFileSync(f, 'utf8'));
-    const v = verifyLedger(ledger);
-    return v.ok ? ledger : { ...newLedger(), tampered: true, tamperReason: v.reason };
-  } catch { return newLedger(); }
+  let text;
+  try { text = fs.readFileSync(f, 'utf8'); } catch (e) { return { ...newLedger(), tampered: true, tamperReason: `cannot read the ledger: ${e.message}` }; }
+  let ledger;
+  try { ledger = JSON.parse(text); } catch (e) { return { ...newLedger(), tampered: true, tamperReason: `the ledger is not valid JSON: ${e.message}` }; }
+  if (!ledger || !Array.isArray(ledger.entries)) return { ...newLedger(), tampered: true, tamperReason: 'the ledger has no entries array' };
+  const v = verifyLedger(ledger);
+  if (!v.ok) return { ...ledger, tampered: true, tamperReason: v.reason };
+  const sig = verifyLastScan(text, `${f}.sig`);
+  if (sig === false) return { ...ledger, tampered: true, tamperReason: 'the ledger signature does not verify under this install key' };
+  if (sig === null && ledger.entries.length && env.AGENTIC_SECURITY_RULES_UNSIGNED !== '1') {
+    return { ...ledger, tampered: true, tamperReason: 'the ledger is unsigned (written before 0.195.23 or by another tool); set AGENTIC_SECURITY_RULES_UNSIGNED=1 once to accept and re-sign it' };
+  }
+  return ledger;
 }
 
 export function saveLedger(scanRoot, ledger) {
+  if (ledger?.tampered) return { ok: false, reason: `refusing to overwrite a ledger that failed its integrity check (${ledger.tamperReason})` };
   if (!ensureStateDir(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
   const f = statePath(scanRoot, DIR, 'ledger.json');
-  return { ok: safeWriteState(f, JSON.stringify(ledger, null, 2)) };
+  const text = JSON.stringify(ledger, null, 2);
+  const ok = safeWriteState(f, text) && safeWriteState(`${f}.sig`, signLastScan(text));
+  return { ok };
 }
 
 export function saveIR(scanRoot, ir) {