@clear-capabilities/agentic-security-scanner 0.195.25 → 0.195.27

package/src/posture/provenance/dag-walk.js

@@ -81,9 +81,13 @@ export async function checkAbsentInSomeParent(scanRoot, sha, replay) {
 }
 
 // git's own convention when using `git revert` (no -n/--no-edit override):
-// "Revert \"<original subject>\"". Message alone is spoofable, so this is
-// only the FIRST half of detection — see detectRevert.
-const REVERT_MESSAGE_RE = /^Revert "/;
+// "Revert \"<original subject>\"". Since git 2.43 a revert of a revert is
+// titled "Reapply \"<original subject>\"" instead (GA-05, 0.195.27: found by
+// the corpus case `revert-reintroduces`, whose origin commit is exactly that
+// shape); it is still a revert, and the diff inversion below still decides.
+// Message alone is spoofable, so this is only the FIRST half of detection —
+// see detectRevert.
+const REVERT_MESSAGE_RE = /^(?:Revert|Reapply) "/;
 
 /**
  * A commit is a real revert only when its message matches git's own Revert

package/src/posture/provenance/git-evidence.js

@@ -1,4 +1,5 @@
 import * as cp from 'node:child_process';
+import { STATE_DIR_NAME } from '../state-dir.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { hardenGitArgs, hardenGitEnv } from '../../util/git-hardening.js';
@@ -95,6 +96,26 @@ export function getRemoteUrl(scanRoot) {
   return r.ok ? r.stdout.trim() : null;
 }
 
+/**
+ * Whether the working tree has changes OUTSIDE the given path prefixes (default: the scanner's own state
+ * directory). `getRepoState().dirty` counts the scanner's own untracked state directory as dirty, which would make the
+ * lineage graph's recorded revision flip between two scans of an unchanged tree merely because the first
+ * scan created that directory. Null when not a git repository or when git fails.
+ */
+export function worktreeDirtyExcluding(scanRoot, ignorePrefixes = [`${STATE_DIR_NAME}/`]) {
+  if (!isGitRepo(scanRoot)) return null;
+  const r = _run(scanRoot, ['status', '--porcelain', '--untracked-files=all']);
+  if (!r.ok) return null;
+  for (const line of r.stdout.split('\n')) {
+    if (!line.trim()) continue;
+    const p = line.slice(3).replace(/^"|"$/g, '');
+    const renamedTo = p.includes(' -> ') ? p.split(' -> ')[1] : p;
+    if (ignorePrefixes.some((pre) => p.startsWith(pre) || renamedTo.startsWith(pre))) continue;
+    return true;
+  }
+  return false;
+}
+
 export function getRepoState(scanRoot) {
   if (!isGitRepo(scanRoot)) return null;
   const head = _run(scanRoot, ['rev-parse', 'HEAD']);

package/src/posture/provenance/origin-resolver.js

@@ -55,6 +55,20 @@ function relevantFiles(finding) {
   return [...files];
 }
 
+// GA-05 (0.195.27): revert and cherry-pick detection used to run only in deep mode's retry loop, which the standard walk reaches
+// only after it has MISSED. A standard-walk hit (the common case: the origin commit's first parent lacks the finding) therefore
+// never carried `revertOf` or `cherryPickOf`, even in deep mode. Whether the origin commit is a revert or a cherry-pick is a
+// property of that commit, not of which walk found it, so a deep-mode result is annotated the same way wherever it was resolved.
+// Standard mode is unchanged (the detection costs git processes, which is what the mode exists to make optional).
+function annotateNonLinear(scanRoot, origin, sha, candidates, mode) {
+  if (mode !== 'deep') return origin;
+  const { isRevert, revertsCommit } = detectRevert(scanRoot, sha, candidates);
+  const { isCherryPick, originalCommit } = detectCherryPick(scanRoot, sha);
+  origin.revertOf = isRevert ? revertsCommit : null;
+  origin.cherryPickOf = isCherryPick ? originalCommit : null;
+  return origin;
+}
+
 function originFrom(meta, { absentInParents }) {
   return {
     commit: meta.commit, authorName: meta.authorName, authorEmail: meta.authorEmail,
@@ -283,7 +297,7 @@ export async function resolveOrigin(scanRoot, finding, { since, deadlineAt, repo
       // and confidence.js will cap this at MEDIUM.
       return {
         status: 'complete', method: PROVENANCE_METHOD.SEMANTIC_REPLAY, commitsConsidered,
-        findingOrigin: originFrom(meta, { absentInParents: [] }),
+        findingOrigin: annotateNonLinear(scanRoot, originFrom(meta, { absentInParents: [] }), sha, candidates, mode),
         parentBoundaryVerified: false,
       };
     }
@@ -304,7 +318,7 @@ export async function resolveOrigin(scanRoot, finding, { since, deadlineAt, repo
 
     return {
       status: 'complete', method: PROVENANCE_METHOD.SEMANTIC_REPLAY, commitsConsidered,
-      findingOrigin: originFrom(meta, { absentInParents: [parent] }),
+      findingOrigin: annotateNonLinear(scanRoot, originFrom(meta, { absentInParents: [parent] }), sha, candidates, mode),
       parentBoundaryVerified: true, absenceEvidence: presentInParent.reason,
     };
   }

package/src/posture/provenance/providers/github.js

@@ -23,7 +23,10 @@ export async function fetchPRMetadata(scanRoot, commitSha, remoteUrl, config) {
       headers: { Authorization: `Bearer ${config.token}`, Accept: 'application/vnd.github+json' },
       signal: AbortSignal.timeout(8000),
     });
-    if (!r.ok) return null;
+    // GA-05 (0.195.27): a provider that answered with an error, or did not answer, is reported as UNAVAILABLE, which the
+    // coordinator records as a limitation on the finding. It is a different fact from "no pull request names this commit"
+    // (null), and folding the two together hid every outage, bad token and wrong base URL behind an empty enrichment.
+    if (!r.ok) return { unavailable: true, reason: `http-${r.status}` };
     const prs = await r.json();
     if (!Array.isArray(prs) || prs.length === 0) return null;
     const pr = prs[0];
@@ -33,8 +36,8 @@ export async function fetchPRMetadata(scanRoot, commitSha, remoteUrl, config) {
       approvals: null, // GitHub's PR-list-by-commit endpoint doesn't include review state; a real approvals count needs a second call, deliberately not made here to keep this a single-request enrichment.
       mergedAt: pr.merged_at || null,
     };
-  } catch {
-    return null;
+  } catch (e) {
+    return { unavailable: true, reason: e && e.name === 'TimeoutError' ? 'timeout' : 'network' };
   }
 }
 

package/src/posture/provenance/providers/gitlab.js

@@ -21,7 +21,9 @@ export async function fetchPRMetadata(scanRoot, commitSha, remoteUrl, config) {
       headers: { 'PRIVATE-TOKEN': config.token },
       signal: AbortSignal.timeout(8000),
     });
-    if (!r.ok) return null;
+    // GA-05 (0.195.27): an error reply or no reply is UNAVAILABLE (recorded as a limitation by the coordinator), which is a
+    // different fact from "no merge request names this commit" (null). See providers/github.js for the reasoning.
+    if (!r.ok) return { unavailable: true, reason: `http-${r.status}` };
     const mrs = await r.json();
     if (!Array.isArray(mrs) || mrs.length === 0) return null;
     const mr = mrs[0];
@@ -31,8 +33,8 @@ export async function fetchPRMetadata(scanRoot, commitSha, remoteUrl, config) {
       approvals: typeof mr.upvotes === 'number' ? mr.upvotes : null,
       mergedAt: mr.merged_at || null,
     };
-  } catch {
-    return null;
+  } catch (e) {
+    return { unavailable: true, reason: e && e.name === 'TimeoutError' ? 'timeout' : 'network' };
   }
 }
 

package/src/posture/rule-compiler/cli.js

@@ -11,8 +11,8 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { statePath } from '../state-dir.js';
-import { packTrust, signPublishedRule } from './store.js';
-import { sharedFalsePositiveCorpus, falsePositiveHits, regressRules, promotedRuleIds } from './regression.js';
+import { packTrust, signPublishedRule, publicKeyOf } from './store.js';
+import { sharedFalsePositiveCorpus, falsePositiveHits, regressRules, promotedRuleIds, corpusHash } from './regression.js';
 import { draftRuleIR, validateRuleIR, ruleIRDigest } from './ir.js';
 import { checkEligibility } from './eligibility.js';
 import { buildCorpus } from './corpus.js';
@@ -39,7 +39,7 @@ export async function cmdRules(args, root) {
   const sub = args._[1];
   // GA-07: a ledger that failed its integrity check (broken chain, bad or missing signature) refuses EVERY command, not only the
   // ones that change state; nothing below can read a tampered history as fact or write over it.
-  if (['synthesize', 'evaluate', 'promote', 'status', 'rollback', 'cost', 'regress'].includes(sub)) {
+  if (['synthesize', 'evaluate', 'promote', 'status', 'rollback', 'deprecate', 'cost', 'regress'].includes(sub)) {
     const guard = loadLedger(root);
     if (guard.tampered) { console.error(`Refusing: rule lifecycle ledger failed its integrity check (${guard.tamperReason}).`); return 4; }
   }
@@ -48,12 +48,25 @@ export async function cmdRules(args, root) {
   if (sub === 'promote') return cmdPromote(args, root);
   if (sub === 'status') return cmdStatus(args, root);
   if (sub === 'rollback') return cmdRollback(args, root);
+  if (sub === 'deprecate') return cmdDeprecate(args, root);
   if (sub === 'cost') return cmdCost(args, root);
   if (sub === 'regress') return cmdRegress(args, root);
-  console.error('usage: rules synthesize <finding-id> --spec <file.json> [--auto] [--max-attempts N] | evaluate <rule-id> | promote <rule-id> --reviewed-by <person> [--scope <text>] | status [rule-id] | rollback <rule-id> | cost <rule-id> | regress [rule-id]');
+  console.error('usage: rules synthesize <finding-id> --spec <file.json> [--auto] [--max-attempts N] | evaluate <rule-id> | promote <rule-id> --reviewed-by <person> --scope <text> [--sign-key <base64>] | status [rule-id] | rollback <rule-id> | deprecate <rule-id> | cost <rule-id> | regress [rule-id]');
   return 4;
 }
 
+/** The operator's Ed25519 key, when given: it signs the published rule AND the ledger, so a clone without this install's HMAC key can
+ * still verify the lifecycle history (store.js loadLedger). Never stored. */
+function authorKeyFrom(args) { return args.flags['sign-key'] ?? process.env.AGENTIC_SECURITY_PRIVATE_KEY ?? null; }
+
+/** Every command that changes the ledger saves it through here, so an author signature made at promotion is renewed by a later
+ * rollback or evaluation run with the same key instead of going stale (a stale one would read as tampering on the next clone). */
+function persistLedger(root, ledger, args) {
+  const r = saveLedger(root, ledger, { authorKey: authorKeyFrom(args) });
+  if (!r.ok && r.reason) console.error(r.reason);
+  return r;
+}
+
 // `--spec` carries exactly what a model or a human proposed: id/title/severity/cwe/family/languages/match/
 // remediation plus the corpus inputs (originalCode/patchedCode/nearbyCleanCode/protectedVariantsCode). This
 // command never invents a pattern; it only drafts the IR, checks eligibility and records DRAFT->CANDIDATE.
@@ -86,10 +99,16 @@ async function cmdSynthesize(args, root) {
   if (errs.length) { console.error(`Invalid rule: ${errs.join('; ')}`); return 4; }
 
   const ledger = loadLedger(root);
-  const draft = recordTransition(ledger, { ruleId: ir.id, from: null, to: 'DRAFT', reason: `drafted from ${findingId}`, actor: args.flags.actor || 'agent' });
-  if (!draft.ok) { console.error(draft.reason); return 4; }
-  const cand = recordTransition(ledger, { ruleId: ir.id, from: 'DRAFT', to: 'CANDIDATE', reason: 'eligibility passed', evidence: { eligibility: elig }, actor: args.flags.actor || 'agent' });
-  saveLedger(root, ledger);
+  // GA-07 (0.195.27): a rule that was rolled back re-enters as a CANDIDATE (the ledger's ROLLED_BACK -> CANDIDATE edge), keeping its
+  // history; any other existing state refuses, so a promoted or validated rule cannot be silently re-drafted over.
+  const current = stateOf(ledger, ir.id);
+  if (current !== null && current !== 'ROLLED_BACK') { console.error(`Rule ${ir.id} already exists in state ${current}; roll it back first, or choose another id.`); return 4; }
+  if (current === null) {
+    const draft = recordTransition(ledger, { ruleId: ir.id, from: null, to: 'DRAFT', reason: `drafted from ${findingId}`, actor: args.flags.actor || 'agent' });
+    if (!draft.ok) { console.error(draft.reason); return 4; }
+  }
+  const cand = recordTransition(ledger, { ruleId: ir.id, from: current === null ? 'DRAFT' : 'ROLLED_BACK', to: 'CANDIDATE', reason: current === null ? 'eligibility passed' : `re-entered after rollback; eligibility passed (drafted again from ${findingId})`, evidence: { eligibility: elig }, actor: args.flags.actor || 'agent' });
+  persistLedger(root, ledger, args);
   saveIR(root, { ...ir, state: 'CANDIDATE' });
   saveCorpus(root, ir.id, { ...corpusSpec, fileNames: spec.fileNames ?? [], discoveryCost: spec.discoveryCost ?? (args.flags['discovery-cost-usd'] ? { usd: Number(args.flags['discovery-cost-usd']), tokens: Number(args.flags['discovery-tokens']) || null, model: spec.model ?? null } : null) });
   if (synthesis) saveSynthesis(root, ir.id, { attempts: synthesis.attempts, best: synthesis.best });
@@ -119,9 +138,8 @@ async function cmdEvaluate(args, root) {
   if (fpHits.length) { gate.pass = false; gate.reasons.push(`fires on ${fpHits.length} of ${fpItems.length} item(s) in the shared false-positive corpus: ${fpHits.slice(0, 3).map((h) => h.label).join(', ')}${fpHits.length > 3 ? ', ...' : ''}`); }
   const cur = stateOf(ledger, id);
   if (gate.pass && cur === 'CANDIDATE') recordTransition(ledger, { ruleId: id, from: 'CANDIDATE', to: 'VALIDATED', reason: 'promotion gate passed', evidence: { score: gate.evaluation.score }, actor: args.flags.actor || 'agent' });
-  saveLedger(root, ledger);
+  persistLedger(root, ledger, args);
   saveEvaluation(root, id, gate);
-  const corpusHash = (list) => sha256(JSON.stringify(list.map((x) => [x.label, x.code]).sort()));
   const prev = loadProvenance(root, id);
   saveProvenance(root, id, {
     schema: 'agentic-security/rule-provenance', version: 1, ruleId: id, ruleVersion: 1, ruleHash: ruleIRDigest(ir),
@@ -159,7 +177,13 @@ async function cmdPromote(args, root) {
   if (!id) { console.error('usage: rules promote <rule-id> --reviewed-by <person> [--scope <text>] [--reason <text>]'); return 4; }
   const reviewer = args.flags['reviewed-by'];
   if (!isStr(reviewer) || NOT_A_REVIEWER.test(reviewer.trim())) {
-    console.error('usage: rules promote <rule-id> --reviewed-by <person>. A promotion records the person who reviewed the rule and its scope; a model or agent recommendation is not a review, so nothing is promoted without a named reviewer.');
+    console.error('usage: rules promote <rule-id> --reviewed-by <person> --scope <text>. A promotion records the person who reviewed the rule and its scope; a model or agent recommendation is not a review, so nothing is promoted without a named reviewer.');
+    return 4;
+  }
+  // GA-07 §3 (0.195.27): the reviewed SCOPE (what the rule is for, where it applies, what it must not flag) is part of the review
+  // record, not an optional note; a promotion without one records nothing a later reader could hold the rule to.
+  if (!isStr(args.flags.scope)) {
+    console.error('usage: rules promote <rule-id> --reviewed-by <person> --scope <text>. The reviewed scope is recorded with the promotion; state what the rule covers and where it applies.');
     return 4;
   }
   const ledger = loadLedger(root);
@@ -196,16 +220,32 @@ async function cmdPromote(args, root) {
   if (fpNow.length) { console.error(`Promotion refused: ${id} fires on ${fpNow.length} item(s) of the shared false-positive corpus (${fpNow.slice(0, 3).map((h) => h.label).join(', ')}). Re-evaluate or narrow the rule.`); return 1; }
   const pub = publishCustomRule(root, ir);
   if (!pub.ok) { console.error(`Promotion refused: ${pub.reason}`); return 4; }
-  const scope = isStr(args.flags.scope) ? args.flags.scope : null;
-  const review = { reviewer: reviewer.trim(), scope, independent: prov.benchmarkResults?.independent ?? null };
-  const t = recordTransition(ledger, { ruleId: id, from: 'VALIDATED', to: 'PROMOTED', reason: args.flags.reason || 'promoted', evidence: review, actor: args.flags.actor || reviewer.trim() });
-  saveLedger(root, ledger);
-  saveProvenance(root, id, { ...prov, promotionEvent: { at: new Date().toISOString(), actor: args.flags.actor || reviewer.trim(), reviewer: reviewer.trim(), scope, reason: args.flags.reason || 'promoted', ruleHash: ruleIRDigest(ir) } });
+  const scope = args.flags.scope.trim();
+  // GA-07 §3 (0.195.27): the evidence the reviewer looked at, digested into the promotion: the evaluation and provenance records
+  // as they stood, and the two corpus halves. `rules regress` re-derives the corpus digests and reports a rule whose corpus moved
+  // after the review as no longer the reviewed one.
+  const corpusNow = buildCorpus(ir, loadCorpus(root, id) ?? {});
+  const evidence = {
+    reviewer: reviewer.trim(), scope, independent: prov.benchmarkResults?.independent ?? null, ruleHash: ruleIRDigest(ir),
+    evaluationDigest: sha256(JSON.stringify(readJsonArg(path.join(statePath(root, 'rule-compiler', id), 'evaluation.json')))),
+    provenanceDigest: sha256(JSON.stringify({ ...prov, promotionEvent: undefined })),
+    positiveCorpusHash: corpusHash(corpusNow.positives), negativeCorpusHash: corpusHash(corpusNow.negatives),
+    sharedFalsePositiveItems: sharedFalsePositiveCorpus(root, ledger, id).length,
+  };
+  const t = recordTransition(ledger, { ruleId: id, from: 'VALIDATED', to: 'PROMOTED', reason: args.flags.reason || 'promoted', evidence, actor: args.flags.actor || reviewer.trim() });
+  const saved = persistLedger(root, ledger, args);
+  saveProvenance(root, id, { ...prov, promotionEvent: { at: new Date().toISOString(), actor: args.flags.actor || reviewer.trim(), reviewer: reviewer.trim(), scope, reason: args.flags.reason || 'promoted', ruleHash: ruleIRDigest(ir), evidence } });
   console.log(`Rule ${id}: VALIDATED -> PROMOTED. Published to ${pub.file}.`);
   // Publishing is not trusting. Rule packs are signature-checked so a rule dropped into a repository cannot run in someone's CI; sign this
-  // one with the operator's key when there is one, and say plainly whether the scanner will load it.
-  const key = args.flags['sign-key'] ?? process.env.AGENTIC_SECURITY_PRIVATE_KEY;
-  if (key) { const sg = signPublishedRule(pub.file, key); console.log(sg.ok ? `  signed: ${pub.file}.sig` : `  could not sign (${sg.reason}); the rule is published unsigned`); }
+  // one with the operator's key when there is one, and say plainly whether the scanner will load it. The same key author-signs the
+  // ledger, which is what lets `rules regress` on another machine (CI) verify the history without this install's HMAC key.
+  const key = authorKeyFrom(args);
+  if (key) {
+    const sg = signPublishedRule(pub.file, key); console.log(sg.ok ? `  signed: ${pub.file}.sig` : `  could not sign (${sg.reason}); the rule is published unsigned`);
+    console.log(saved.authorSigned ? `  ledger author-signed; another machine verifies it with AGENTIC_SECURITY_RULES_PUBLIC_KEY=${publicKeyOf(key)}` : '  ledger NOT author-signed; rules regress on another machine will refuse it');
+  } else {
+    console.log('  no --sign-key: the ledger carries only this install\'s signature, so rules regress on another machine (CI) will refuse it; promote with --sign-key <base64> to make it portable');
+  }
   const trust = packTrust(root, id);
   console.log(trust.live ? `  The scanner will load it (${trust.via}).` : `  NOT LIVE YET: the scanner will refuse this rule (${trust.reason}). To make it live: ${trust.remediation}.`);
   if (!t.ok) console.error(t.reason);
@@ -218,9 +258,10 @@ async function cmdRegress(args, root) {
   if (ledger.tampered) { console.error(`Refusing: rule lifecycle ledger failed its integrity check (${ledger.tamperReason}).`); return 4; }
   const only = args._[2] ?? null;
   const results = regressRules(root, ledger, { only, thresholds: args.flags.thresholds ? readJsonArg(args.flags.thresholds) : undefined });
-  if (args.flags.json) console.log(JSON.stringify({ results }, null, 2));
+  if (args.flags.json) console.log(JSON.stringify({ ledgerVerifiedBy: ledger.verifiedBy ?? null, results }, null, 2));
   else if (!results.length) console.log(only ? `No promoted rule ${only}.` : 'No rule is PROMOTED; nothing to regress.');
   else for (const r of results) { console.log(`${r.id}: ${r.status.toUpperCase()}${r.precision != null ? `  precision ${fmtPct(r.precision)}  recall ${fmtPct(r.recall)}  false-positive corpus hits ${r.fpCorpusHits}` : ''}`); for (const m of r.reasons) console.log(`  - ${m}`); }
+  if (!args.flags.json && results.length) console.log(`ledger verified by ${ledger.verifiedBy === 'author-key' ? `the author key (${ledger.authorKeyId})` : ledger.verifiedBy === 'install-key' ? 'this install\'s key' : 'nothing (unsigned, accepted by AGENTIC_SECURITY_RULES_UNSIGNED=1)'}`);
   if (only && !results.length) return 4;
   return results.every((r) => r.status === 'ok') ? 0 : 1;
 }
@@ -233,11 +274,25 @@ async function cmdRollback(args, root) {
   if (cur !== 'PROMOTED') { console.error(`Rule ${id} is not PROMOTED (current: ${cur ?? 'unknown'}); nothing to roll back.`); return 4; }
   const un = unpublishCustomRule(root, id);
   const t = recordTransition(ledger, { ruleId: id, from: 'PROMOTED', to: 'ROLLED_BACK', reason: args.flags.reason || 'operator rollback', actor: args.flags.actor || 'operator' });
-  saveLedger(root, ledger);
+  persistLedger(root, ledger, args);
   console.log(`Rule ${id}: PROMOTED -> ROLLED_BACK.${un.ok ? '' : ` (warning: could not remove published rule file: ${un.reason})`}`);
   return t.ok ? 0 : 1;
 }
 
+/** `rules deprecate <rule-id>`: retire a promoted rule for good (PROMOTED -> DEPRECATED, a terminal state); the published file is removed. */
+async function cmdDeprecate(args, root) {
+  const id = args._[2];
+  if (!id) { console.error('usage: rules deprecate <rule-id> [--reason text]'); return 4; }
+  const ledger = loadLedger(root);
+  const cur = stateOf(ledger, id);
+  if (cur !== 'PROMOTED') { console.error(`Rule ${id} is not PROMOTED (current: ${cur ?? 'unknown'}); only a promoted rule can be deprecated (roll back a candidate instead).`); return 4; }
+  const un = unpublishCustomRule(root, id);
+  const t = recordTransition(ledger, { ruleId: id, from: 'PROMOTED', to: 'DEPRECATED', reason: args.flags.reason || 'operator deprecation', actor: args.flags.actor || 'operator' });
+  persistLedger(root, ledger, args);
+  console.log(`Rule ${id}: PROMOTED -> DEPRECATED (terminal).${un.ok ? '' : ` (warning: could not remove published rule file: ${un.reason})`}`);
+  return t.ok ? 0 : 1;
+}
+
 async function cmdStatus(args, root) {
   const ledger = loadLedger(root);
   const id = args._[2];

package/src/posture/rule-compiler/negative-corpus.js

@@ -0,0 +1,39 @@
+// The shared negative corpus shipped with the scanner (GA-07 §3, 0.195.27): safe, idiomatic code that no promoted rule may fire
+// on, the same on every machine and in every repository. `regression.js` puts it in front of the shared false-positive corpus, so
+// `rules evaluate`, `rules promote` and `rules regress` all hold a rule to it; a rule that fires on any entry is refused at
+// evaluation and reported as regressed later, wherever it runs.
+//
+// Each entry is the SAFE side of a pattern the compiler is likely to be asked to detect: a parameterised query beside the
+// concatenated one, an argument-vector process spawn beside the shell string, a constant-time comparison beside the plain one.
+// They are plain strings in a module (not files on disk) so the bundle carries them without a build step and the corpus is
+// identical wherever the scanner runs. Keep every entry free of the unsafe form: a vulnerable snippet here would make a correct
+// rule fail its gate.
+export const SHIPPED_NEGATIVE_CORPUS = Object.freeze([
+  { name: 'js-parameterised-query', language: 'javascript', code: 'const rows = await db.query("SELECT * FROM orders WHERE owner = $1", [ownerId]);\n' },
+  { name: 'js-placeholder-query', language: 'javascript', code: 'const [row] = await conn.execute("SELECT id FROM users WHERE email = ?", [email]);\n' },
+  { name: 'js-orm-where-object', language: 'javascript', code: 'const user = await User.findOne({ where: { id: req.params.id, tenantId: req.user.tenantId } });\n' },
+  { name: 'js-execfile-argv', language: 'javascript', code: 'const out = execFileSync("git", ["log", "--format=%H", "-1", ref], { encoding: "utf8" });\n' },
+  { name: 'js-spawn-argv', language: 'javascript', code: 'const child = spawn("convert", [inputPath, "-resize", "200x200", outputPath], { stdio: "ignore" });\n' },
+  { name: 'js-path-confined', language: 'javascript', code: 'const target = path.resolve(root, name);\nif (!target.startsWith(root + path.sep)) throw new Error("outside root");\nconst text = fs.readFileSync(target, "utf8");\n' },
+  { name: 'js-constant-time-compare', language: 'javascript', code: 'const ok = a.length === b.length && crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));\n' },
+  { name: 'js-password-hash', language: 'javascript', code: 'const hash = await bcrypt.hash(password, 12);\nawait store.save({ email, hash });\n' },
+  { name: 'js-random-token', language: 'javascript', code: 'const token = crypto.randomBytes(32).toString("hex");\n' },
+  { name: 'js-json-parse-validated', language: 'javascript', code: 'const body = schema.parse(JSON.parse(raw));\nres.json({ id: body.id });\n' },
+  { name: 'js-template-escaped', language: 'javascript', code: 'res.send(template.render({ name: escapeHtml(req.query.name) }));\n' },
+  { name: 'js-fetch-allowlist', language: 'javascript', code: 'if (!ALLOWED_HOSTS.has(new URL(target).host)) return res.status(400).end();\nconst r = await fetch(target, { signal: AbortSignal.timeout(5000) });\n' },
+  { name: 'ts-parameterised-query', language: 'typescript', code: 'const rows: Row[] = await db.query("SELECT * FROM t WHERE id = $1", [id]);\n' },
+  { name: 'py-parameterised-query', language: 'python', code: 'cur.execute("SELECT * FROM users WHERE email = %s", (email,))\n' },
+  { name: 'py-subprocess-argv', language: 'python', code: 'subprocess.run(["ls", "-l", directory], check=True, capture_output=True)\n' },
+  { name: 'py-safe-yaml', language: 'python', code: 'config = yaml.safe_load(text)\n' },
+  { name: 'py-path-confined', language: 'python', code: 'target = os.path.realpath(os.path.join(root, name))\nif not target.startswith(root + os.sep):\n    raise ValueError("outside root")\n' },
+  { name: 'py-password-hash', language: 'python', code: 'digest = hashlib.pbkdf2_hmac("sha256", password.encode(), salt, 200_000)\n' },
+  { name: 'go-parameterised-query', language: 'go', code: 'row := db.QueryRow("SELECT name FROM users WHERE id = $1", id)\n' },
+  { name: 'go-exec-argv', language: 'go', code: 'out, err := exec.Command("git", "rev-parse", ref).Output()\n' },
+  { name: 'rb-parameterised-query', language: 'ruby', code: 'User.where("email = ?", params[:email]).first\n' },
+  { name: 'rb-system-argv', language: 'ruby', code: 'system("convert", input_path, "-resize", "200x200", output_path)\n' },
+  { name: 'java-prepared-statement', language: 'java', code: 'PreparedStatement ps = conn.prepareStatement("SELECT * FROM t WHERE id = ?");\nps.setInt(1, id);\nResultSet rs = ps.executeQuery();\n' },
+  { name: 'java-processbuilder-argv', language: 'java', code: 'Process p = new ProcessBuilder("git", "log", "-1", ref).start();\n' },
+  { name: 'php-prepared-statement', language: 'php', code: '$stmt = $pdo->prepare("SELECT * FROM users WHERE id = :id");\n$stmt->execute([":id" => $id]);\n' },
+  { name: 'cs-parameterised-query', language: 'csharp', code: 'var cmd = new SqlCommand("SELECT * FROM t WHERE id = @id", conn);\ncmd.Parameters.AddWithValue("@id", id);\n' },
+  { name: 'rs-parameterised-query', language: 'rust', code: 'let row = client.query_one("SELECT name FROM users WHERE id = $1", &[&id]).await?;\n' },
+]);

package/src/posture/rule-compiler/promotion.js

@@ -69,5 +69,26 @@ export function gatePromotion({ ir, corpus, leakageCheck, thresholds } = {}) {
   else if (ind.detected < ind.positives) reasons.push(`misses ${ind.positives - ind.detected} of ${ind.positives} independent vulnerable example(s)`);
   if (ind.negatives < t.minIndependentClean) reasons.push(`${ind.negatives} independent safe example(s) (min ${t.minIndependentClean}): supply independentCleanCode`);
   else if (ind.falseAlarms > 0) reasons.push(`fires on ${ind.falseAlarms} of ${ind.negatives} independent safe example(s)`);
+  for (const dup of dependentExamples(corpus)) reasons.push(`${dup.label} is not independent: it is the same code as ${dup.sameAs} (the source finding, its patch or a generated mutation), so it grades nothing the source did not`);
   return { pass: reasons.length === 0, reasons, evaluation: evalResult, independent: ind };
 }
+
+// GA-07 §2 (0.195.27): an "independent" example that is the original snippet, its patch, or one of the compiler's own mutations
+// (whitespace aside) is circular grading, which the independent-example rule exists to prevent. Compared after collapsing
+// whitespace so a re-indented copy is caught; a genuinely different example with the same shape is not (that is what a rule is for).
+const squash = (s) => String(s ?? '').replace(/\s+/g, ' ').trim();
+export function dependentExamples(corpus) {
+  const known = new Map();
+  for (const item of [...(corpus?.positives ?? []), ...(corpus?.negatives ?? [])]) {
+    if (item.label.startsWith('independent-')) continue;
+    const k = squash(item.code);
+    if (k && !known.has(k)) known.set(k, item.label);
+  }
+  const out = [];
+  for (const item of [...(corpus?.positives ?? []), ...(corpus?.negatives ?? [])]) {
+    if (!item.label.startsWith('independent-')) continue;
+    const sameAs = known.get(squash(item.code));
+    if (sameAs) out.push({ label: item.label, sameAs });
+  }
+  return out;
+}

package/src/posture/rule-compiler/regression.js

@@ -15,18 +15,22 @@ import { statePath } from '../state-dir.js';
 import { buildCorpus, scoreRule } from './corpus.js';
 import { evaluateRule } from './promotion.js';
 import { runRule, normalizeCustomRule } from '../custom-rules.js';
+import { createHash } from 'node:crypto';
 import { compileToCustomRule } from './ir.js';
 import { loadIR, loadCorpus, loadProvenance } from './store.js';
 import { stateOf } from './lifecycle.js';
+import { SHIPPED_NEGATIVE_CORPUS } from './negative-corpus.js';
 
 const FP_DIR = 'rule-compiler/fp-corpus';
 const MAX_FP_FILE = 256 * 1024;
 const MAX_FP_FILES = 500;
 const EXT_OF = { '.js': 'javascript', '.mjs': 'javascript', '.cjs': 'javascript', '.ts': 'typescript', '.py': 'python', '.go': 'go', '.rb': 'ruby', '.java': 'java', '.rs': 'rust', '.cs': 'csharp', '.php': 'php' };
 
-/** Operator-supplied false positives (real code a rule should never flag). Plain files; symlinks and oversized files are ignored. */
-function operatorFalsePositives(root) {
-  const dir = statePath(root, ...FP_DIR.split('/'));
+// GA-07 §3 (0.195.27): one or more directories of safe code shared ACROSS repositories (a fleet's common false-positive corpus),
+// named by path-separator-joined entries in this variable. Same rules as the project directory: plain files, size and count caps.
+const SHARED_FP_ENV = 'AGENTIC_SECURITY_RULES_FP_CORPUS';
+
+function falsePositiveFiles(dir, prefix) {
   const out = [];
   let names = [];
   try { names = fs.readdirSync(dir).sort(); } catch { return out; }
@@ -35,19 +39,32 @@ function operatorFalsePositives(root) {
     try {
       const st = fs.lstatSync(f);
       if (!st.isFile() || st.isSymbolicLink() || st.size > MAX_FP_FILE) continue;
-      out.push({ label: `operator-fp:${n}`, file: n, language: EXT_OF[path.extname(n).toLowerCase()] ?? 'any', code: fs.readFileSync(f, 'utf8') });
+      out.push({ label: `${prefix}:${n}`, file: n, language: EXT_OF[path.extname(n).toLowerCase()] ?? 'any', code: fs.readFileSync(f, 'utf8') });
     } catch { /* unreadable: skipped */ }
   }
   return out;
 }
 
+/** Operator-supplied false positives (real code a rule should never flag): the project's own directory, then every shared directory. */
+function operatorFalsePositives(root, env = process.env) {
+  const out = falsePositiveFiles(statePath(root, ...FP_DIR.split('/')), 'operator-fp');
+  for (const dir of String(env[SHARED_FP_ENV] || '').split(path.delimiter).map((s) => s.trim()).filter(Boolean)) {
+    out.push(...falsePositiveFiles(path.resolve(dir), `shared-fp:${path.basename(dir)}`));
+  }
+  return out;
+}
+
 export function promotedRuleIds(ledger) {
   return [...new Set(ledger.entries.map((e) => e.ruleId))].filter((id) => stateOf(ledger, id) === 'PROMOTED');
 }
 
-/** The shared false-positive corpus as seen by `exceptId`: the safe code of every OTHER promoted rule, plus the operator's files. */
-export function sharedFalsePositiveCorpus(root, ledger, exceptId = null) {
-  const items = [];
+/**
+ * The shared false-positive corpus as seen by `exceptId`: the safe code shipped with the scanner (`negative-corpus.js`, the same on
+ * every machine and in every repository), the safe code of every OTHER promoted rule, the operator's project files, and any
+ * directories shared across repositories through AGENTIC_SECURITY_RULES_FP_CORPUS.
+ */
+export function sharedFalsePositiveCorpus(root, ledger, exceptId = null, env = process.env) {
+  const items = SHIPPED_NEGATIVE_CORPUS.map((s) => ({ label: `shipped-fp:${s.name}`, language: s.language, code: s.code }));
   for (const id of promotedRuleIds(ledger)) {
     if (id === exceptId) continue;
     const ir = loadIR(root, id); const spec = loadCorpus(root, id);
@@ -55,7 +72,12 @@ export function sharedFalsePositiveCorpus(root, ledger, exceptId = null) {
     let corpus; try { corpus = buildCorpus(ir, spec); } catch { continue; }
     for (const n of corpus.negatives) items.push({ label: `rule:${id}:${n.label}`, language: ir.languages[0] ?? 'any', code: n.code });
   }
-  return [...items, ...operatorFalsePositives(root)];
+  return [...items, ...operatorFalsePositives(root, env)];
+}
+
+/** The digest of a corpus half, as `rules evaluate` records it in the provenance record and `rules regress` re-derives it. */
+export function corpusHash(list) {
+  return createHash('sha256').update(JSON.stringify(list.map((x) => [x.label, x.code]).sort())).digest('hex');
 }
 
 const FILE_FOR_LANG = { javascript: 'x.js', typescript: 'x.ts', python: 'x.py', go: 'x.go', ruby: 'x.rb', java: 'x.java', rust: 'x.rs', csharp: 'x.cs', php: 'x.php', any: 'x.txt' };
@@ -85,8 +107,16 @@ export function regressRules(root, ledger, { only = null, thresholds } = {}) {
     let ev; let corpus;
     try { corpus = buildCorpus(ir, spec); ev = evaluateRule(ir, corpus, thresholds); } catch (e) { results.push({ id, status: 'broken', reasons: [`cannot be scored: ${String(e.message).slice(0, 120)}`] }); continue; }
     const fp = falsePositiveHits(ir, sharedFalsePositiveCorpus(root, ledger, id));
-    const baseline = loadProvenance(root, id)?.benchmarkResults ?? null;
+    const prov = loadProvenance(root, id);
+    const baseline = prov?.benchmarkResults ?? null;
     const reasons = [...ev.reasons];
+    // GA-07 §3 (0.195.27): the promotion was a review of ONE rule against ONE corpus, both digested into the promotion event. A
+    // corpus edited after the review (an independent example dropped, a protected variant softened) can still clear the gate, so
+    // the gate alone would not notice; the digests do. Such a rule is `review-stale`: not regressed, but no longer the reviewed one.
+    const reviewed = prov?.promotionEvent?.evidence ?? null;
+    if (reviewed) {
+      if (reviewed.positiveCorpusHash !== corpusHash(corpus.positives) || reviewed.negativeCorpusHash !== corpusHash(corpus.negatives)) reasons.push('the corpus changed since the reviewed promotion (its digests no longer match the promotion event); re-evaluate and promote again');
+    }
     if (fp.length) reasons.push(`fires on ${fp.length} item(s) of the shared false-positive corpus: ${fp.slice(0, 3).map((h) => h.label).join(', ')}${fp.length > 3 ? ', ...' : ''}`);
     if (baseline && ev.score.recall != null && baseline.recall != null && ev.score.recall < baseline.recall) reasons.push(`recall fell from ${(baseline.recall * 100).toFixed(1)}% to ${(ev.score.recall * 100).toFixed(1)}% since promotion`);
     results.push({ id, status: reasons.length ? 'regressed' : 'ok', reasons, precision: ev.score.precision, recall: ev.score.recall, protectedFailures: ev.score.protectedFailures, fpCorpusHits: fp.length });

package/src/posture/rule-compiler/store.js

@@ -5,6 +5,7 @@
 // using the SAME filename convention `runRuleTests` already reads (`vulnerable`/`clean` in the path).
 import fs from 'node:fs';
 import path from 'node:path';
+import crypto from 'node:crypto';
 import { statePath, ensureStateDir, safeWriteState } from '../state-dir.js';
 import { newLedger, verifyLedger } from './lifecycle.js';
 import { signLastScan, verifyLastScan } from '../integrity.js';
@@ -35,20 +36,85 @@ export function loadLedger(scanRoot, env = process.env) {
   const v = verifyLedger(ledger);
   if (!v.ok) return { ...ledger, tampered: true, tamperReason: v.reason };
   const sig = verifyLastScan(text, `${f}.sig`);
-  if (sig === false) return { ...ledger, tampered: true, tamperReason: 'the ledger signature does not verify under this install key' };
+  if (sig === true) return { ...ledger, verifiedBy: 'install-key' };
+  // GA-07 §3 (0.195.27): the install key never leaves the machine that promoted the rule, so on a CI runner (or any other
+  // clone) the HMAC cannot verify. A ledger that `promote --sign-key` also signed with the operator's Ed25519 key is accepted
+  // when that signature verifies against a key the environment trusts: AGENTIC_SECURITY_RULES_PUBLIC_KEY (set outside the
+  // repository, a CI variable) or the trusted-keys store the rule packs already use. The chain check above still applies, and
+  // the signature covers the whole file, so a dropped last entry fails it like any other edit. A project-local key file alone
+  // is not trust (an author who can write .agentic-security/ could add one), which is why the env variable is the CI route.
+  const author = verifyAuthorSignature(text, `${f}${AUTHOR_SIG_SUFFIX}`, authorKeysFrom(scanRoot, env));
+  if (author.ok) return { ...ledger, verifiedBy: 'author-key', authorKeyId: author.keyId };
+  if (sig === false) return { ...ledger, tampered: true, tamperReason: `the ledger signature does not verify under this install key${author.present ? ` and its author signature does not verify against any trusted key (${author.reason})` : ' and it carries no author signature (promote with --sign-key to make it portable)'}` };
   if (sig === null && ledger.entries.length && env.AGENTIC_SECURITY_RULES_UNSIGNED !== '1') {
     return { ...ledger, tampered: true, tamperReason: 'the ledger is unsigned (written before 0.195.23 or by another tool); set AGENTIC_SECURITY_RULES_UNSIGNED=1 once to accept and re-sign it' };
   }
-  return ledger;
+  return { ...ledger, verifiedBy: sig === null ? 'unsigned-accepted' : 'install-key' };
 }
 
-export function saveLedger(scanRoot, ledger) {
+const AUTHOR_SIG_SUFFIX = '.author.sig';
+const PUBLIC_KEY_ENV = 'AGENTIC_SECURITY_RULES_PUBLIC_KEY';
+
+/** The Ed25519 public keys a ledger's author signature may verify against: the environment variable (one or more base64 raw keys,
+ * comma separated) first, then the rule-pack trust store (bundled keys, and the project file only when the operator honours it). */
+function authorKeysFrom(scanRoot, env) {
+  const keys = [];
+  for (const k of String(env[PUBLIC_KEY_ENV] || '').split(',').map((s) => s.trim()).filter(Boolean)) keys.push({ id: 'env', publicKey: k, alg: 'ed25519' });
+  const origErr = console.error; console.error = () => {};
+  try { keys.push(...loadTrustedKeys(scanRoot)); } catch { /* no trust store */ } finally { console.error = origErr; }
+  return keys;
+}
+
+function verifyAuthorSignature(text, sigPath, keys) {
+  let sig;
+  try { sig = fs.readFileSync(sigPath); } catch { return { ok: false, present: false, reason: 'no author signature' }; }
+  if (!keys.length) return { ok: false, present: true, reason: `no trusted key (set ${PUBLIC_KEY_ENV})` };
+  const body = Buffer.from(text, 'utf8');
+  for (const k of keys) {
+    try {
+      const keyBytes = Buffer.from(k.publicKey, 'base64');
+      if (keyBytes.length !== 32) continue;
+      const keyObj = crypto.createPublicKey({ key: { kty: 'OKP', crv: 'Ed25519', x: keyBytes.toString('base64url') }, format: 'jwk' });
+      if (crypto.verify(null, body, keyObj, sig)) return { ok: true, present: true, keyId: k.id || '(unnamed)' };
+    } catch { /* next key */ }
+  }
+  return { ok: false, present: true, reason: 'bad signature' };
+}
+
+function signWithAuthorKey(text, privateKeyB64) {
+  const privBytes = Buffer.from(privateKeyB64, 'base64');
+  if (privBytes.length !== 32) throw new Error('private key must be 32 bytes (raw ed25519)');
+  const keyObj = crypto.createPrivateKey({ key: Buffer.concat([Buffer.from('302e020100300506032b657004220420', 'hex'), privBytes]), format: 'der', type: 'pkcs8' });
+  return crypto.sign(null, Buffer.from(text, 'utf8'), keyObj);
+}
+
+/** The public key (base64 raw) that pairs with a raw Ed25519 private key; printed by `promote` so the operator can set it in CI. */
+export function publicKeyOf(privateKeyB64) {
+  const privBytes = Buffer.from(privateKeyB64, 'base64');
+  if (privBytes.length !== 32) return null;
+  const keyObj = crypto.createPrivateKey({ key: Buffer.concat([Buffer.from('302e020100300506032b657004220420', 'hex'), privBytes]), format: 'der', type: 'pkcs8' });
+  return Buffer.from(crypto.createPublicKey(keyObj).export({ format: 'jwk' }).x, 'base64url').toString('base64');
+}
+
+/**
+ * Write the ledger with its install-key signature and, when the operator's Ed25519 key is given, an author signature beside it
+ * (`ledger.json.author.sig`) that another machine can verify (see loadLedger). Without a key an existing author signature is
+ * removed rather than left stale: a signature that no longer matches the file would read as tampering on the next clone.
+ */
+export function saveLedger(scanRoot, ledger, { authorKey = null } = {}) {
   if (ledger?.tampered) return { ok: false, reason: `refusing to overwrite a ledger that failed its integrity check (${ledger.tamperReason})` };
   if (!ensureStateDir(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
   const f = statePath(scanRoot, DIR, 'ledger.json');
-  const text = JSON.stringify(ledger, null, 2);
-  const ok = safeWriteState(f, text) && safeWriteState(`${f}.sig`, signLastScan(text));
-  return { ok };
+  const { verifiedBy, authorKeyId, ...body } = ledger;
+  const text = JSON.stringify(body, null, 2);
+  let ok = safeWriteState(f, text) && safeWriteState(`${f}.sig`, signLastScan(text));
+  let authorSigned = false;
+  if (ok && authorKey) {
+    try { ok = safeWriteState(`${f}${AUTHOR_SIG_SUFFIX}`, signWithAuthorKey(text, authorKey)); authorSigned = ok; } catch (e) { return { ok: false, reason: `cannot author-sign the ledger: ${String(e.message).slice(0, 120)}` }; }
+  } else if (ok) {
+    try { fs.unlinkSync(`${f}${AUTHOR_SIG_SUFFIX}`); } catch { /* none to remove */ }
+  }
+  return { ok, authorSigned };
 }
 
 export function saveIR(scanRoot, ir) {