@clear-capabilities/agentic-security-scanner 0.195.28 → 0.195.30

package/src/llm-validator/bounded-context.js

@@ -9,8 +9,15 @@
 //   invalid  a citation names a span or a line that was not sent: the model reasoned about code it was not shown, so the reply
 //            is not used (the caller turns it into `escalate`)
 //
-// What is not collected is stated in `gaps`, never implied: this tier has no call graph, so the callers of the enclosing function
-// are not included, and configuration files are not included.
+// Callers and configuration are collected by name, and the prompt says so:
+//
+//   callers        the nearest function definition above the finding, then call sites of that name in scanned files of the same
+//                  language. Matched by name, not resolved through imports or dispatch: a same-named function can appear, and
+//                  calls through aliases, callbacks or dynamic dispatch are missed.
+//   configuration  environment keys read in the finding's span, then the scanned configuration files that set them. Dotenv files
+//                  other than examples are never read, and the value of a secret-like key is masked before redaction.
+//
+// What is not collected is stated in `gaps`, never implied.
 
 import { languagePromptExtras } from '../language/context.js';
 
@@ -19,13 +26,13 @@ const lineOf = (x) => (x && Number.isInteger(x.line) && x.line > 0 ? x.line : nu
 /**
  * @returns {{spans:{id:string, role:string, file:string, start:number, end:number, text:string}[], gaps:string[]}}
  */
-export function collectBoundedContext(finding, fileContents, { window = 20, stepWindow = 3, maxSpans = 10 } = {}) {
+export function collectBoundedContext(finding, fileContents, { window = 20, stepWindow = 3, maxSpans = 10, maxCallers = 3, maxConfig = 2 } = {}) {
   const raw = [];
   const gaps = [];
-  const add = (role, file, line, w) => {
+  const add = (role, file, line, w, mask = null) => {
     const code = fileContents && typeof fileContents[file] === 'string' ? fileContents[file] : null;
     if (code === null) { gaps.push(`${role} file ${file} was not available`); return; }
-    const lines = code.split('\n');
+    const lines = mask ? code.split('\n').map(mask) : code.split('\n');
     const start = Math.max(1, line - w);
     const end = Math.min(lines.length, line + w);
     if (start > end) return;
@@ -38,6 +45,12 @@ export function collectBoundedContext(finding, fileContents, { window = 20, step
   for (const step of Array.isArray(finding && finding.path) ? finding.path : []) {
     if (lineOf(step)) add('path-step', step.file || finding.file, step.line, stepWindow);
   }
+  if (finding && finding.file && lineOf(finding) && typeof (fileContents || {})[finding.file] === 'string') {
+    collectCallers(finding, fileContents, { maxCallers, stepWindow, add, gaps });
+    collectConfiguration(finding, fileContents, { window, maxConfig, add, gaps });
+  } else {
+    gaps.push('the finding has no readable source line, so callers and configuration were not collected');
+  }
   // Merge spans that overlap or touch in the same file; the first role stays, the others are kept as `alsoRoles`.
   const merged = [];
   for (const s of raw) {
@@ -49,7 +62,7 @@ export function collectBoundedContext(finding, fileContents, { window = 20, step
     id: `S${i + 1}`, role: m.role, ...(m.alsoRoles.length ? { alsoRoles: m.alsoRoles } : {}), file: m.file, start: m.start, end: m.end,
     text: m.lines.slice(m.start - 1, m.end).map((l, k) => `${m.start + k}: ${l}`).join('\n'),
   }));
-  if (merged.length > maxSpans) gaps.push(`${merged.length - maxSpans} path span(s) beyond the first ${maxSpans} were not sent`);
+  if (merged.length > maxSpans) gaps.push(`${merged.length - maxSpans} span(s) beyond the first ${maxSpans} were not sent`);
   try {
     for (const x of languagePromptExtras(finding, fileContents)) {
       const n = x.text.split('\n').length;
@@ -57,11 +70,105 @@ export function collectBoundedContext(finding, fileContents, { window = 20, step
     }
   } catch { /* related excerpts are advisory */ }
   if (!spans.length) gaps.push('no source text was available for the finding');
-  gaps.push('callers of the enclosing function were not collected (this tier has no call graph)');
-  gaps.push('configuration files were not collected');
+  gaps.push('deployment configuration outside the repository (environment, secrets stores, cloud policy) was not collected');
   return { spans, gaps };
 }
 
+// ── callers ─────────────────────────────────────────────────────────────────
+const NOT_A_NAME = new Set(['if', 'for', 'while', 'switch', 'catch', 'return', 'function', 'else', 'do', 'try', 'new', 'typeof', 'await',
+  'with', 'sizeof', 'elif', 'except', 'when', 'match', 'case', 'super', 'this', 'self', 'import', 'require', 'where', 'let', 'in']);
+// Lines carrying a CWE-1333 pragma: bounded by MAX_DEF_LINE below, so the polynomial worst case is capped per line.
+const LANGS = [
+  { ext: /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i, defs: [/\bfunction\s*\*?\s*([A-Za-z_$][\w$]*)\s*\(/, /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:async\s*)?(?:function\b|\([^)]*\)\s*=>|[A-Za-z_$][\w$]*\s*=>)/, /^\s*(?:(?:public|private|protected|static|async|get|set)\s+)*([A-Za-z_$][\w$]*)\s*\([^)]*\)\s*\{/] }, // agentic-security-ignore: CWE-1333
+  { ext: /\.py$/i, defs: [/^\s*(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/] },
+  { ext: /\.rb$/i, defs: [/^\s*def\s+(?:self\.)?([A-Za-z_]\w*[?!]?)/] },
+  { ext: /\.go$/i, defs: [/^func\s+(?:\([^)]*\)\s*)?([A-Za-z_]\w*)\s*[[(]/] },
+  { ext: /\.rs$/i, defs: [/\bfn\s+([A-Za-z_]\w*)/] },
+  { ext: /\.php$/i, defs: [/\bfunction\s+([A-Za-z_]\w*)\s*\(/] },
+  { ext: /\.(?:java|kt|kts|cs|scala)$/i, defs: [/^\s*(?:(?:public|private|protected|internal|static|final|override|suspend|async|virtual|abstract|synchronized|open)\s+)*(?:fun\s+|def\s+)?(?:[\w<>\[\],.?]+\s+)?([A-Za-z_]\w*)\s*\([^;]*$/] }, // agentic-security-ignore: CWE-1333
+  { ext: /\.hs$/i, defs: [/^([a-z_][\w']*)\s*::/, /^([a-z_][\w']*)\b[^=\n]*=/], bare: true },
+];
+const langOf = (file) => LANGS.find((l) => l.ext.test(file)) || null;
+const escapeRe = (x) => x.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+// The definition patterns run over scanned (untrusted) source. None backtracks exponentially, but the modifier and type groups can go
+// quadratic on a long line, so a line longer than any real definition header is never matched.
+const MAX_DEF_LINE = 400;
+const defName = (lang, line) => {
+  if (line.length > MAX_DEF_LINE) return null;
+  for (const re of lang.defs) { const m = re.exec(line); if (m && !NOT_A_NAME.has(m[1])) return m[1]; }
+  return null;
+};
+
+/** The nearest function definition at or above `line` (1-based), within 400 lines. */
+export function enclosingFunction(file, code, line) {
+  const lang = langOf(file);
+  if (!lang) return null;
+  const lines = code.split('\n');
+  for (let i = Math.min(line, lines.length) - 1; i >= 0 && i >= line - 400; i--) {
+    const name = defName(lang, lines[i]);
+    if (name) return { name, line: i + 1 };
+  }
+  return null;
+}
+
+function collectCallers(finding, fileContents, { maxCallers, stepWindow, add, gaps }) {
+  const lang = langOf(finding.file);
+  const fn = lang ? enclosingFunction(finding.file, fileContents[finding.file], finding.line) : null;
+  if (!fn) { gaps.push('the enclosing function could not be determined, so callers were not collected'); return; }
+  const call = lang.bare ? new RegExp(`(?<![\\w'.])${escapeRe(fn.name)}(?![\\w'])`) : new RegExp(`(?<![\\w$])${escapeRe(fn.name)}\\s*\\(`);
+  const sites = [];
+  for (const [file, code] of Object.entries(fileContents)) {
+    if (typeof code !== 'string' || code.length > 1_000_000 || !lang.ext.test(file) || !code.includes(fn.name)) continue;
+    code.split('\n').forEach((text, i) => {
+      if (!call.test(text) || defName(lang, text) === fn.name) return;               // the definition (or a signature) is not a call
+      if (file === finding.file && i + 1 >= fn.line && i + 1 <= finding.line) return;  // recursion inside the finding's own function
+      sites.push({ file, line: i + 1 });
+    });
+  }
+  if (!sites.length) {
+    gaps.push(`no call site of ${fn.name} was found by name in the scanned files of the same language (it may be an entry point, exported, or called dynamically)`);
+    return;
+  }
+  for (const s of sites.slice(0, maxCallers)) add('caller', s.file, s.line, stepWindow);
+  gaps.push(`callers of ${fn.name} were matched by name, not resolved: a same-named function can appear, and calls through aliases, callbacks or dynamic dispatch are missed`);
+  if (sites.length > maxCallers) gaps.push(`${sites.length - maxCallers} further call site(s) of ${fn.name} were not sent`);
+}
+
+// ── configuration ───────────────────────────────────────────────────────────
+const ENV_READS = [
+  /process\.env\.([A-Za-z_][\w]*)/g, /process\.env\[\s*['"]([^'"]+)['"]\s*\]/g, /os\.environ(?:\.get)?\s*[[(]\s*['"]([^'"]+)['"]/g,
+  /\bgetenv\(\s*['"]([^'"]+)['"]/g, /\b(?:getEnv|lookupEnv)\s+"([^"]+)"/g, /System\.getenv\(\s*"([^"]+)"/g,
+  /\bENV(?:\.fetch\(\s*|\[\s*)['"]([^'"]+)['"]/g, /os\.(?:Getenv|LookupEnv)\(\s*"([^"]+)"/g, /env::var\(\s*"([^"]+)"/g,
+];
+const CONFIG_FILE = /(?:^|\/)(?:\.env\.(?:example|sample|template|dist)|[^/]+\.(?:ya?ml|toml|ini|conf|cfg|properties|nix)|docker-compose[^/]*|Dockerfile[^/]*|app\.json)$/i;
+const SECRET_KEY = /secret|token|passw|pwd|credential|private|api[_-]?key|auth/i;
+// Masks the value of a secret-like key; the generic redaction then runs over the whole span.
+const maskSecretValues = (text) => text.replace(/^(\s*(?:export\s+|-\s+)?["']?([\w.-]+)["']?\s*[:=]\s*)(.+)$/, (all, head, key) => (SECRET_KEY.test(key) ? `${head}<masked>` : all));
+
+function collectConfiguration(finding, fileContents, { window, maxConfig, add, gaps }) {
+  const lines = fileContents[finding.file].split('\n');
+  const span = lines.slice(Math.max(0, finding.line - 1 - window), finding.line + window).join('\n');
+  const keys = new Set();
+  for (const re of ENV_READS) for (const m of span.matchAll(re)) keys.add(m[1]);
+  if (!keys.size) { gaps.push("no configuration key is read near the finding, so no configuration file was collected"); return; }
+  const found = new Set(); let sent = 0; let more = 0;
+  for (const [file, code] of Object.entries(fileContents)) {
+    if (typeof code !== 'string' || !CONFIG_FILE.test(file) || code.length > 500_000) continue;
+    const cl = code.split('\n');
+    for (const key of keys) {
+      // the key is escaped before it reaches the pattern, which has no quantifier at all
+      const re = new RegExp(`(?<![\\w])${escapeRe(key)}(?![\\w])`); // agentic-security-ignore: CWE-1333
+      const i = cl.findIndex((t) => re.test(t));
+      if (i < 0) continue;
+      found.add(key);
+      if (sent < maxConfig) { add('configuration', file, i + 1, 1, maskSecretValues); sent++; } else more++;
+    }
+  }
+  const missing = [...keys].filter((k) => !found.has(k)).sort();
+  if (missing.length) gaps.push(`configuration key(s) ${missing.join(', ')} read near the finding are set in no scanned configuration file (they may be set at deploy time)`);
+  if (more) gaps.push(`${more} further configuration match(es) were not sent`);
+}
+
 /** Render spans as the untrusted excerpt block. */
 export function renderSpans(spans) {
   return spans.map((s) => `[${s.id} ${s.role}${s.alsoRoles ? `+${s.alsoRoles.join('+')}` : ''}] ${s.file}:${s.start}-${s.end}\n${s.text}`).join('\n\n');

package/src/llm-validator/index.js

@@ -90,7 +90,7 @@ const MAX_OUTPUT_TOKENS = 512;
 // reads as a refusal rather than as "no endpoint configured".
 let _localPresetRefusal = null;
 
-export const PROMPT_VERSION = 'v2.1-cited';
+export const PROMPT_VERSION = 'v2.2-callers-config';
 
 // System preamble — embeds a per-request challenge token the model MUST
 // echo, and a strict instruction-priority frame. {{challenge}} and {{nonce}}

package/src/mcp/CLAUDE.md

@@ -88,6 +88,12 @@ the before and after image, **no content**) and `languageFix.planDigest` after r
 caller then sends `apply_fix {finding_id, confirm:true, plan_digest}` (optionally `dry_run:true`, `fixMeta.approval` for a
 high-impact change).
 
+**Approval binding (threat-model FR-06.3).** `fixMeta.approval` may carry `expires` (ISO time) and `scope: {tool, action, target,
+change}`: `tool` is `apply_fix`, `action` is `apply-plan` (multi-file) or `apply-patch`, `target` is the finding's stableId, and
+`change` is the plan digest or the digest of the exact edits (path, before and after image hashes). `approvalBindingRefusal` refuses
+an expired approval and one issued for another tool, action, target or change. Under the restricted execution profile
+(`AGENTIC_SECURITY_EGRESS_PROFILE=restricted`) both fields are required; elsewhere an approval without them works as before.
+
 Design decision: the caller **cannot supply file content** on this path (`plan_digest` plus `patch` is refused). The server
 re-derives the plan with `planNixFix` over `loadLanguageProject` and refuses unless the digest matches, so "the plan applied is
 exactly the plan previewed" holds by construction, and a changed project file, a changed finding or an altered digest all give

package/src/mcp/tools.js

@@ -640,7 +640,26 @@ export const explain_finding = {
 // FR-307/FR-1002/FR-1003: the high-impact-change approval gate (approval evidence, approver identity, separation of duties),
 // shared by the caller-patch branch and the multi-file plan branch so the two cannot drift. Returns a refusal result, or null
 // when the change is not high-impact or is properly approved.
-function _highImpactApprovalRefusal(ctx, materialClassification, fixMeta) {
+// Threat-model PRD FR-06.3: an approval is bound to what it approved. With a `scope` it names the tool, the action, the target finding
+// and the change (the digest of the exact edits), and with `expires` it lapses. Under the restricted execution profile
+// (AGENTIC_SECURITY_EGRESS_PROFILE=restricted) both are required; elsewhere a supplied scope or expiry is still enforced. An approval
+// copied to another finding, another change or another tool, or used after it expired, is refused.
+export function approvalBindingRefusal(approval, expected, { now = Date.now(), restricted = process.env.AGENTIC_SECURITY_EGRESS_PROFILE === 'restricted' } = {}) {
+  if (restricted && (!approval.expires || !approval.scope)) return 'under the restricted profile an approval must carry an expiry and a scope {tool, action, target, change}';
+  if (approval.expires !== undefined) {
+    const t = Date.parse(approval.expires);
+    if (!Number.isFinite(t)) return 'the approval expiry is not a date';
+    if (!(t > now)) return 'the approval has expired';
+  }
+  if (approval.scope !== undefined) {
+    const sc = approval.scope;
+    if (!sc || typeof sc !== 'object') return 'the approval scope is not an object';
+    for (const k of ['tool', 'action', 'target', 'change']) if (sc[k] !== expected[k]) return `the approval was issued for another ${k}`;
+  }
+  return null;
+}
+
+function _highImpactApprovalRefusal(ctx, materialClassification, fixMeta, expected = null) {
   if (!materialClassification.highImpactCategories.length) return null;
   const cats = materialClassification.highImpactCategories.join(', ');
   const approval = fixMeta && typeof fixMeta === 'object' ? fixMeta.approval : null;
@@ -654,6 +673,10 @@ function _highImpactApprovalRefusal(ctx, materialClassification, fixMeta) {
       materialClassification,
     };
   }
+  if (expected) {
+    const bound = approvalBindingRefusal(approval, expected);
+    if (bound) return { _meta: META, applied: false, reason: `high-impact change (${cats}) approval rejected: ${bound}`, materialClassification };
+  }
   const approverRegistry = loadApproverRegistry(ctx.sessionRoot);
   const requiredRoles = requiredRolesFor(approverRegistry, materialClassification.highImpactCategories);
   const identityCheck = verifyApprover(approverRegistry, approval.approvedBy, requiredRoles);
@@ -739,7 +762,7 @@ async function _applyMultiFilePlan({ f, planDigest, dryRun, fixMeta, ctx, status
   if (!targets.ok) return refuse(targets.reason);
   const classification = classifyFixMaterialRisk(Object.fromEntries(plan.edits.map((e) => [e.file, { before: e.before, after: e.after }])));
   if (!dryRun) {
-    const approvalRefusal = _highImpactApprovalRefusal(ctx, classification, fixMeta);
+    const approvalRefusal = _highImpactApprovalRefusal(ctx, classification, fixMeta, { tool: 'apply_fix', action: 'apply-plan', target: f.stableId || f.id, change: planDigest });
     if (approvalRefusal) return { ...approvalRefusal, multiFile: true };
   }
   // The verification gates (syntax, rescan with no new finding, effective value changed as intended) run inside the lifecycle,
@@ -942,7 +965,8 @@ export const apply_fix = {
       if (dry_run) {
         return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, verificationRecord: verdict.verificationRecord ?? null, ...verificationFields(verdict.verificationRecord), materialClassification, ...(fixVerification ? additiveFields(fixVerification) : {}) };
       }
-      const approvalRefusal = _highImpactApprovalRefusal(ctx, materialClassification, fixMeta);
+      const changeDigest = _sha256(JSON.stringify(Object.entries(filesForMaterialClassification).sort(([a], [b]) => (a < b ? -1 : 1)).map(([k, v]) => [k, _sha256(v.before), _sha256(v.after)])));
+      const approvalRefusal = _highImpactApprovalRefusal(ctx, materialClassification, fixMeta, { tool: 'apply_fix', action: 'apply-patch', target: f.stableId || f.id, change: changeDigest });
       if (approvalRefusal) return approvalRefusal;
       const written = [];
       try {

package/src/pipeline/evidence-record.js

@@ -55,7 +55,7 @@ export function buildScanRecord({ root, scan, meta, argv = [], engineVersion, mo
     tool: { name: 'agentic-security', version: engineVersion || null },
     source: sourceState(root),
     invocation: { flags: invocationSummary(argv), mode: mode || (meta && meta.mode) || 'full' },
-    ignorePolicy: scan.scope ? { mode: scan.scope.policy.mode, ruleDigest: scan.scope.policy.ruleDigest, trackedFileSemantics: scan.scope.policy.trackedFileSemantics } : { mode: 'legacy-walk', ruleDigest: null, trackedFileSemantics: false },
+    ignorePolicy: scan.scope ? { mode: scan.scope.policy.mode, ruleDigest: scan.scope.policy.ruleDigest, trackedFileSemantics: scan.scope.policy.trackedFileSemantics, inventoryDigest: scan.scope.inventoryDigest ?? null } : { mode: 'legacy-walk', ruleDigest: null, trackedFileSemantics: false, inventoryDigest: null },
     rules: { rulesetVersion: scan._rulesetVersion || null, rulesetSource: scan._rulesetVersionSource || null },
     model: model ? { provider: model.provider, model: model.model, egress: model.egress, stages: model.stages } : { configured: false },
     capability: { status: h.status || null, conditions: Array.isArray(h.conditions) ? h.conditions.length : 0 },

package/src/posture/CLAUDE.md

@@ -73,6 +73,8 @@ function is not exported.
 
 Its contract is **recall-preserving, same precedent as `falsification.js` / `dataflow/proof-gate.js`**: it never removes a finding, never touches `severity`, and never asserts `unreachable` without positive evidence — a negative verdict additionally requires the intra-repo import graph to be hole-free *along the reachable set* (an unresolved relative import or a non-literal `require(x)` in a reachable file hides a possible edge, so every would-be `unreachable` degrades to `unknown`). `null`/`'unknown'` is a first-class state and is **not** the same as `false`. Wired in `engine.js` after the entry-point inventory is built and after every finding has been appended (multi-sink and cross-language chains included) so nothing escapes annotation; this is the one annotator that deliberately runs after `why-fired`.
 
+**Threat-model hardening (local, threat-model PRD).** `verification-separation.js` `consensusOf` now votes by independent evidence group (a shared `evidence.observationId`, `generator` or `lineage`, else one verifier), keeps the per-lens counts, reports `conflict` and a `refutationAuthority`; `refutationRemoves` lets a refutation take a critical finding out of the queue only with `sufficient` authority. `triage-memory.js`: a family/directory bucket is advisory (no confidence change); only an exact (stable id + file) decision applies, and for critical/high it also needs a reviewer, expiry, matching scope, unchanged fingerprint and the install's HMAC signature (`pastDecision.status`, `pastDecisionApplies`). `assurance/candidate-qualification.js`: the candidate packet and `evaluateCandidate`, which recomputes gates G-01..G-07 from case evidence (met, violated, unresolved, blocked) and never inherits a pass; `writeCandidateDecision` is atomic and idempotent.
+
 **Enforced verification separation (R7)** — `verification-separation.js`. The falsification pass could already try to *disprove* a finding; what it could not do was prove the checker was not the producer. This module supplies that structural guarantee:
 
 - `recordProducer(finding, producerId)` stamps provenance **write-once** — a later party cannot re-stamp itself as producer to manufacture separation.

package/src/posture/assurance/candidate-qualification.js

@@ -0,0 +1,155 @@
+// Candidate qualification (threat-model PRD FR-10.1, FR-10.2, section 6 "Candidate release gates").
+//
+// A release claim is qualified for an EXACT scanner, target artifact, deployment profile, policy and observation window, and only for
+// the cases it passes. The packet carries those identities and one record per required case (requirement, gate, expected and observed
+// outcome, verdict and reason code, artifact and policy bindings, evidence digests, expiry, owner). The decision is recomputed here from
+// the evidence, never read from the packet: a case whose bindings do not match the packet's target, that has expired, whose feed is
+// stale or whose legitimate control failed keeps its gate open, and the candidate is qualified only when every required gate is met.
+// A higher-level status never inherits a pass from a lower-level one: a gate with no case is unresolved, not met.
+//
+// Outcome per case: met (the expectation held), violated (it did not), unresolved (evidence missing, stale, expired or differently
+// scoped) or blocked (a prerequisite such as an attested runner or an independent population is unavailable). Pure apart from the
+// optional signed write, which is atomic.
+//
+// Evidence tiers stay separate qualifications (PRD section 1 and section 8). Each case carries `tier`: `local` (loopback fixtures on
+// this host, the default), `staging` (the owner-authorized staging deployment) or `independent` (an independently held population or
+// reviewer). A gate the caller declares in `requiredTiers` is met only by cases of that tier: local evidence never satisfies a staging
+// or independent gate by being more of it. A decision records the target it was computed for, and `revalidateDecision` refuses it for
+// any other artifact, policy or scanner bundle, so an upgrade invalidates candidate-bound evidence and a rollback is qualified only by
+// the earlier artifact's own unexpired decision (FR-10.4).
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const CANDIDATE_SCHEMA = 'agentic-security/candidate-packet';
+const CANDIDATE_VERSION = 1;
+export const GATES = Object.freeze({
+  'G-01': 'code regression', 'G-02': 'scan and graph coverage', 'G-03': 'prevention and repair', 'G-04': 'evidence and harness integrity',
+  'G-05': 'detection and response', 'G-06': 'independent accuracy', 'G-07': 'operability',
+});
+const EXPECT = new Set(['positive', 'negative', 'legitimate']);
+const TIERS = new Set(['local', 'staging', 'independent']);
+const DOMAIN = `${CANDIDATE_SCHEMA}@1\n`;
+const canon = (v) => {
+  if (v === null || typeof v !== 'object') return JSON.stringify(v ?? null);
+  if (Array.isArray(v)) return `[${v.map(canon).join(',')}]`;
+  // an undefined value is absent, exactly as JSON would carry it, so a packet and its JSON round trip have one digest
+  return `{${Object.keys(v).filter((k) => v[k] !== undefined).sort().map((k) => `${JSON.stringify(k)}:${canon(v[k])}`).join(',')}}`;
+};
+export const packetDigest = (p) => `sha256:${crypto.createHash('sha256').update(canon({ ...p, signature: undefined })).digest('hex')}`;
+
+/** Sign a packet with an Ed25519 private key; `verifyCandidatePacket` checks it with the key the caller trusts. */
+export function signCandidatePacket(packet, privateKeyPem) {
+  const body = { schema: CANDIDATE_SCHEMA, version: CANDIDATE_VERSION, ...packet };
+  delete body.signature;
+  return { ...body, signature: crypto.sign(null, Buffer.from(DOMAIN + canon(body)), privateKeyPem).toString('base64') };
+}
+export function verifyCandidatePacket(packet, publicKeyPem) {
+  if (!packet || packet.schema !== CANDIDATE_SCHEMA) return { ok: false, code: 'FORMAT' };
+  // a packet from a newer or older writer is refused by name, never read with this version's meaning
+  if (packet.version !== CANDIDATE_VERSION) return { ok: false, code: 'UNSUPPORTED_VERSION', version: packet.version ?? null };
+  const { signature, ...body } = packet;
+  try { return crypto.verify(null, Buffer.from(DOMAIN + canon(body)), publicKeyPem, Buffer.from(String(signature), 'base64')) ? { ok: true, code: 'VERIFIED' } : { ok: false, code: 'SIGNATURE' }; } catch { return { ok: false, code: 'SIGNATURE' }; }
+}
+
+/** Judge one case record against the packet's target. */
+function judgeCase(c, packet, now) {
+  const t = packet.target || {};
+  const miss = [];
+  for (const k of ['caseId', 'requirement', 'gate', 'expected', 'verdict', 'owner', 'expires']) if (c[k] === undefined || c[k] === null || c[k] === '') miss.push(k);
+  if (miss.length) return { outcome: 'unresolved', reason: `missing ${miss.join(', ')}`, owner: c.owner ?? null };
+  if (!GATES[c.gate] || !EXPECT.has(c.expected)) return { outcome: 'unresolved', reason: 'unknown gate or expectation' };
+  if (c.tier !== undefined && !TIERS.has(c.tier)) return { outcome: 'unresolved', reason: 'unknown evidence tier' };
+  if (c.blocked) return { outcome: 'blocked', reason: String(c.blocked) };
+  if (!(Date.parse(c.expires) > now)) return { outcome: 'unresolved', reason: 'the evidence has expired' };
+  if (c.artifactDigest && t.artifactDigest && c.artifactDigest !== t.artifactDigest) return { outcome: 'unresolved', reason: 'the evidence was produced against another artifact' };
+  if (c.policyDigest && t.policyDigest && c.policyDigest !== t.policyDigest) return { outcome: 'unresolved', reason: 'the evidence was produced under another policy' };
+  if (c.scannerBundle && packet.scanner?.bundleDigest && c.scannerBundle !== packet.scanner.bundleDigest) return { outcome: 'unresolved', reason: 'the evidence came from another scanner bundle' };
+  if (c.requiresArtifactBinding !== false && !c.artifactDigest) return { outcome: 'unresolved', reason: 'the evidence is not bound to an artifact' };
+  const o = c.observed;
+  if (!o || typeof o !== 'object') return { outcome: 'unresolved', reason: 'no observation is recorded' };
+  // the observation and the expectation stay separately inspectable; met/violated is derived, not asserted
+  if (c.kind === 'detection') {
+    // a detection case judges the signal, not the effect: positive means the rule must fire, negative that it must stay quiet,
+    // and an observation that does not say whether the rule fired leaves the case open
+    if (typeof o.detected !== 'boolean') return { outcome: 'unresolved', reason: 'the observation does not record whether the detection fired' };
+    if (c.expected === 'positive') return o.detected ? { outcome: 'met', reason: 'the detection fired on the reproduced effect' } : { outcome: 'violated', reason: 'the detection missed the reproduced effect' };
+    return o.detected ? { outcome: 'violated', reason: 'the detection fired where it must not' } : { outcome: 'met', reason: 'the detection stayed quiet where it must' };
+  }
+  const forbidden = o.forbiddenEffect === true; const legit = o.legitimateEffect === true;
+  if (c.expected === 'positive') return forbidden ? { outcome: 'met', reason: 'the vulnerable control reproduced the forbidden effect' } : { outcome: 'violated', reason: 'the vulnerable control did not reproduce the effect, so the fixture shows nothing' };
+  if (c.expected === 'negative') return forbidden ? { outcome: 'violated', reason: 'the forbidden effect occurred on the fixed artifact' } : { outcome: 'met', reason: 'no forbidden effect' };
+  return legit && !forbidden ? { outcome: 'met', reason: 'the legitimate operation succeeded' } : { outcome: 'violated', reason: 'the legitimate operation did not succeed' };
+}
+
+/**
+ * Recompute every gate from the packet's evidence.
+ * @param {object} packet
+ * @param {{requiredGates?:string[], requiredCases?:string[], requiredTiers?:Object<string,string>, now?:number, maxFeedAgeMs?:number}} o
+ * @returns {{status:'qualified'|'not-qualified', gates:object, cases:object[], blockers:object[], tiers:object}}
+ */
+export function evaluateCandidate(packet, { requiredGates = Object.keys(GATES), requiredCases = [], requiredTiers = {}, now = Date.now(), maxFeedAgeMs = 15 * 60 * 1000 } = {}) {
+  const cases = (packet.cases || []).map((c) => ({ caseId: c.caseId ?? null, gate: c.gate ?? null, requirement: c.requirement ?? null, owner: c.owner ?? null, tier: c.tier ?? 'local', ...judgeCase(c, packet, now) }));
+  const blockers = [];
+  for (const id of requiredCases) if (!cases.some((c) => c.caseId === id)) { cases.push({ caseId: id, gate: null, outcome: 'unresolved', reason: 'a required case has no record' }); blockers.push({ gate: null, caseId: id, reason: 'missing required case' }); }
+  // gate-level evidence that is not a case
+  const extra = {};
+  if (!packet.scope || packet.scope.status !== 'satisfied') extra['G-02'] = { outcome: 'unresolved', reason: packet.scope ? `the scope reconciliation is ${packet.scope.status}` : 'no scope reconciliation is in the packet' };
+  if (!packet.runner || packet.runner.attested !== true) extra['G-04'] = { outcome: 'blocked', reason: packet.runner?.reason || 'the runner did not attest the confinement the execution cases need' };
+  const ev = packet.evaluation;
+  if (!ev || ev.status !== 'measured') extra['G-06'] = { outcome: 'blocked', reason: ev?.reason || 'independent accuracy is unmeasured for this candidate' };
+  else if (ev.meetsFloors !== true) extra['G-06'] = { outcome: 'violated', reason: 'the measured population does not meet the registered floors' };
+  for (const f of packet.telemetry?.feeds || []) {
+    if (!f.lastHeartbeat || now - Date.parse(f.lastHeartbeat) > maxFeedAgeMs) { extra['G-05'] = { outcome: 'unresolved', reason: `feed ${f.name} is stale or has no heartbeat` }; break; }
+  }
+  const gates = {};
+  for (const g of requiredGates) {
+    const need = requiredTiers[g];
+    const ofGate = cases.filter((c) => c.gate === g);
+    // a case of another tier is reported, but it cannot meet a gate that names its tier
+    const mine = need ? ofGate.filter((c) => c.tier === need) : ofGate;
+    const rank = { violated: 3, blocked: 2, unresolved: 1, met: 0 };
+    let worst = mine.reduce((w, c) => (rank[c.outcome] > rank[w] ? c.outcome : w), 'met');
+    const reasons = mine.filter((c) => c.outcome !== 'met').map((c) => `${c.caseId}: ${c.reason}`);
+    if (extra[g]) { if (rank[extra[g].outcome] > rank[worst]) worst = extra[g].outcome; reasons.push(extra[g].reason); }
+    // no evidence is not a pass: a gate with no case and no gate-level evidence stays unresolved
+    if (need && !mine.length) { worst = rank[worst] > rank.unresolved ? worst : 'unresolved'; reasons.push(`no ${need} evidence for this gate${ofGate.length ? ` (${ofGate.length} case(s) of another tier do not count)` : ''}`); }
+    else if (!mine.length && !extra[g] && !(g === 'G-02' && packet.scope?.status === 'satisfied') && !(g === 'G-04' && packet.runner?.attested === true) && !(g === 'G-06' && ev?.status === 'measured')) { worst = 'unresolved'; reasons.push('no evidence for this gate'); }
+    gates[g] = { name: GATES[g], outcome: worst, reasons };
+    if (worst !== 'met') blockers.push({ gate: g, reason: reasons.join('; ') });
+  }
+  const tiers = { local: 0, staging: 0, independent: 0 };
+  for (const c of cases) if (tiers[c.tier] !== undefined) tiers[c.tier]++;
+  return { status: blockers.length ? 'not-qualified' : 'qualified', scope: packet.target ? { ...packet.target } : null, scannerBundle: packet.scanner?.bundleDigest ?? null, packetDigest: packetDigest(packet), gates, cases, blockers, tiers };
+}
+
+/**
+ * Is a recorded decision still the decision for this target? A decision qualifies only the artifact, policy and scanner bundle it was
+ * computed for and only until its earliest case expiry, so an upgrade or policy change invalidates it and a rollback is covered only by
+ * the earlier artifact's own decision.
+ * @param {object} decision  an `evaluateCandidate` result
+ * @param {{artifactDigest?:string, policyDigest?:string, scannerBundle?:string}} target
+ */
+export function revalidateDecision(decision, target, { packet = null, now = Date.now() } = {}) {
+  if (!decision || typeof decision !== 'object' || !decision.scope) return { valid: false, reason: 'no recorded decision scope' };
+  if (decision.status !== 'qualified') return { valid: false, reason: 'the recorded decision did not qualify the candidate' };
+  if (!target || !target.artifactDigest || decision.scope.artifactDigest !== target.artifactDigest) return { valid: false, reason: 'the artifact differs from the one the decision qualified' };
+  if (decision.scope.policyDigest && decision.scope.policyDigest !== target.policyDigest) return { valid: false, reason: 'the deployment policy differs from the one the decision qualified' };
+  if (decision.scannerBundle && target.scannerBundle && decision.scannerBundle !== target.scannerBundle) return { valid: false, reason: 'the scanner bundle differs from the one the decision qualified' };
+  if (packet) {
+    if (packetDigest(packet) !== decision.packetDigest) return { valid: false, reason: 'the packet is not the one the decision was computed from' };
+    const soonest = Math.min(...(packet.cases || []).map((c) => Date.parse(c.expires)).filter(Number.isFinite));
+    if (Number.isFinite(soonest) && !(soonest > now)) return { valid: false, reason: 'evidence the decision rests on has expired' };
+  }
+  return { valid: true, reason: 'the decision covers this artifact, policy and scanner bundle' };
+}
+
+/** Write a decision atomically; an identical retried write leaves the same bytes. */
+export function writeCandidateDecision(file, decision) {
+  const body = `${canon(decision)}\n`;
+  try { if (fs.readFileSync(file, 'utf8') === body) return { written: false, unchanged: true }; } catch { /* absent */ }
+  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`);
+  fs.writeFileSync(tmp, body, { mode: 0o644 });
+  fs.renameSync(tmp, file);
+  return { written: true, unchanged: false };
+}

package/src/posture/assurance/release-package-cli.js

@@ -2,9 +2,16 @@
 //
 //   release-package build [path] --private-key <pem> [--output <file>] [--fix-records <file>] [--public-key-out <file>]
 //   release-package verify <package.json> --public-key <pem> [--require kind,kind]
+//   release-package qualify <candidate-packet.json> --public-key <pem> [--require-case id,id] [--require-gate G-01,G-03]
+//                           [--require-tier G-05=staging,...] [--output <decision.json>] [--format text|json]
+//
+// `qualify` is the strict candidate qualification of the threat-model PRD (FR-10.3): it verifies the packet's signature, recomputes
+// every gate from the case evidence (`candidate-qualification.js`) and exits 0 only when the candidate is qualified. It never changes
+// what an ordinary scan exits with.
 //
 // `io.git(root, ...args)` answers a read-only git query (or null); the caller supplies it so this layer never spawns a process itself.
-// Exit codes: 0 built or verified; 1 the scan state failed its integrity check, or a package was rejected; 2 a usage problem or unreadable input.
+// Exit codes: 0 built, verified or qualified; 1 the scan state failed its integrity check, a package was rejected or a candidate was not
+// qualified; 2 a usage problem or unreadable input.
 //
 // What goes in: the scan's health record and one record per finding (and, with --fix-records, one verification record per fix claimed). The proof tier of a
 // finding is whatever the scan recorded; a finding that recorded none is `taint-proven` when the taint engine found its path and `unproven` otherwise. An
@@ -18,8 +25,9 @@ import { buildSnapshotRef } from './evidence-registry.js';
 import { buildReleasePackage, signReleasePackage } from './release-package.js';
 import { releaseVerdict, verifyStatedVerdict } from './release-verdict.js';
 import { verifyReleasePackage } from './release-package-verify.js';
+import { evaluateCandidate, verifyCandidatePacket, writeCandidateDecision, GATES } from './candidate-qualification.js';
 
-const USAGE = 'Usage: agentic-security release-package build [path] --private-key <pem> [--output <file>] [--fix-records <file>] [--public-key-out <file>]\n       agentic-security release-package verify <package.json> --public-key <pem> [--require kind,kind]';
+const USAGE = 'Usage: agentic-security release-package build [path] --private-key <pem> [--output <file>] [--fix-records <file>] [--public-key-out <file>]\n       agentic-security release-package verify <package.json> --public-key <pem> [--require kind,kind]\n       agentic-security release-package qualify <candidate-packet.json> --public-key <pem> [--require-case id,id] [--require-gate G-01,G-03] [--require-tier G-05=staging] [--output <decision.json>] [--format text|json]';
 const DEFAULT_OUT = 'release-package.json';
 
 
@@ -104,11 +112,45 @@ async function verify(args, say) {
   return 1;
 }
 
+const listFlag = (v) => String(v ?? '').split(',').map((x) => x.trim()).filter(Boolean);
+
+async function qualify(args, say) {
+  const file = args._[2];
+  const keyFile = args.flags['public-key'];
+  if (!file || !keyFile) { say.err(USAGE); return 2; }
+  let packet; let key;
+  try { packet = JSON.parse(fs.readFileSync(path.resolve(file), 'utf8')); key = fs.readFileSync(path.resolve(String(keyFile)), 'utf8'); } catch (e) { say.err(`Could not read the input: ${e.message}`); return 2; }
+  const requiredGates = args.flags['require-gate'] ? listFlag(args.flags['require-gate']) : Object.keys(GATES);
+  const unknown = requiredGates.filter((g) => !GATES[g]);
+  if (unknown.length) { say.err(`Unknown gate: ${unknown.join(', ')}. Gates: ${Object.keys(GATES).join(', ')}.`); return 2; }
+  const requiredTiers = {};
+  for (const pair of listFlag(args.flags['require-tier'])) {
+    const [g, t] = pair.split('=');
+    if (!GATES[g] || !['local', 'staging', 'independent'].includes(t)) { say.err(`--require-tier takes gate=tier pairs (tier local, staging or independent), got ${pair}`); return 2; }
+    requiredTiers[g] = t;
+  }
+  const sig = verifyCandidatePacket(packet, key);
+  if (!sig.ok) { say.err(`${sig.code}: the candidate packet ${sig.code === 'UNSUPPORTED_VERSION' ? `has version ${sig.version}, which this scanner does not read` : 'did not verify under the given key'}`); say.err('candidate NOT QUALIFIED'); return 1; }
+  const d = evaluateCandidate(packet, { requiredGates, requiredCases: listFlag(args.flags['require-case']), requiredTiers });
+  if (args.flags.output) {
+    try { writeCandidateDecision(path.resolve(String(args.flags.output)), d); } catch (e) { say.err(`Could not write the decision: ${e.message}`); return 2; }
+  }
+  if (args.flags.format === 'json') say.out(JSON.stringify(d, null, 2));
+  else {
+    const t = d.scope || {};
+    say.out(`candidate ${d.status === 'qualified' ? 'QUALIFIED' : 'NOT QUALIFIED'} for ${t.service || t.repository || 'an unnamed target'} artifact ${String(t.artifactDigest || 'unbound').slice(0, 19)} (${t.deploymentProfile || 'no profile'})`);
+    for (const [g, x] of Object.entries(d.gates)) say.out(`  ${g} ${x.name}: ${x.outcome}${x.reasons.length ? ` (${x.reasons.join('; ')})` : ''}`);
+    say.out(`  cases by tier: local ${d.tiers.local}, staging ${d.tiers.staging}, independent ${d.tiers.independent}`);
+  }
+  return d.status === 'qualified' ? 0 : 1;
+}
+
 export async function cmdReleasePackage(args, io = {}) {
   const say = { out: io.out || ((s) => console.log(s)), err: io.err || ((s) => console.error(s)) };
   const sub = args._[1];
   if (sub === 'build') return build(args, say, io.git || (() => null));
   if (sub === 'verify') return verify(args, say);
+  if (sub === 'qualify') return qualify(args, say);
   say.err(USAGE);
   return 2;
 }

package/src/posture/auditor-walkthrough.js

@@ -64,6 +64,7 @@ import { strengthOfControl as _strengthOfControl } from './coverage-strength.js'
 // visible regression on common real-world author names, not a fix.
 import { sanitizeForTerminal, pseudonymizeAuthor, PROVENANCE_COMPLIANCE_DISCLAIMER } from './provenance/schema.js';
 import { evaluateGraphFlowPredicate, buildObligationMappingFromGraphPredicate } from '../lineage/obligation-predicates.js';
+import { pastDecisionApplies } from './triage-memory.js';
 
 // Fix-round item 4b: this renderer had `sanitizeForTerminal` (injection
 // safety) but never honoured `--pseudonymize-authors` at all — an operator
@@ -597,7 +598,7 @@ export function evaluateFramework(scanRoot, fw, scan) {
           .flatMap(k => families.get(k) || []);
         const scoped = subfam ? candidates.filter(f => !f.subfamily || f.subfamily === subfam) : candidates;
         const minRank = SEVERITY_RANK[minSeverity];
-        const open = scoped.filter(f => !f.intentSuppressed && !f.pastDecision && (SEVERITY_RANK[f.severity] ?? 0) >= minRank);
+        const open = scoped.filter(f => !f.intentSuppressed && !pastDecisionApplies(f.pastDecision) && (SEVERITY_RANK[f.severity] ?? 0) >= minRank);
         if (open.length) {
           allCleared = false;
           contributingFindings.push(...open);

package/src/posture/dnr/detection-ir.js

@@ -74,14 +74,14 @@ export function buildDetectionIR({ finding, proof = null, allowUnproven = false
 
   let parameter = null;
   if (attack?.parameter) { parameter = { name: attack.parameter, location: attack.location }; facts.parameter = { source: 'reproducer', ref: 'attack.parameter' }; }
-  else if (payloadClass !== 'auth-bypass') limitations.push('no vulnerable parameter is known, so the payload test is applied to every query and body value of the endpoint');
+  else if (def.matcher !== 'behavior') limitations.push('no vulnerable parameter is known, so the payload test is applied to every query and body value of the endpoint');
 
   let sink = null;
   if (attack?.sink) { sink = attack.sink; facts.sink = { source: 'reproducer', ref: 'attack.sink' }; }
   const affectedOperation = { sink, file: finding.file ? String(finding.file) : null, line: Number.isInteger(finding.line) ? finding.line : null };
 
   const confidence = Math.max(0.1, Math.min(0.95,
-    (grounding === 'exploit-confirmed' ? 0.9 : grounding === 'reproduced' ? 0.7 : 0.4) - (endpoint ? 0 : 0.2) - (parameter || payloadClass === 'auth-bypass' ? 0 : 0.1)));
+    (grounding === 'exploit-confirmed' ? 0.9 : grounding === 'reproduced' ? 0.7 : 0.4) - (endpoint ? 0 : 0.2) - (parameter || def.matcher === 'behavior' ? 0 : 0.1)));
   if (grounding !== 'exploit-confirmed') limitations.push(grounding === 'reproduced' ? 'the exploit was reproduced but not independently confirmed' : 'the exploit was not executed; this detection rests on static analysis only');
 
   const ir = {