@clear-capabilities/agentic-security-scanner 0.195.28 → 0.195.30

package/src/posture/dnr/hunt.js

@@ -11,7 +11,7 @@
 // and in a sentence a person reads.
 import path from 'node:path';
 import { readLogs } from './log-reader.js';
-import { evaluateEvent, requiredFields } from './matchers.js';
+import { evaluateEvent, requiredFields, pathMatches } from './matchers.js';
 import { redactValue, fingerprint } from './redact.js';
 
 export const HUNT_VERDICTS = Object.freeze(['OBSERVED', 'NOT_OBSERVED', 'INCONCLUSIVE', 'TELEMETRY_UNAVAILABLE']);
@@ -25,7 +25,10 @@ const STATEMENTS = {
   TELEMETRY_UNAVAILABLE: () => 'There were no readable request records to search, so nothing can be said about past exploitation.',
 };
 
-const FIELD_COUNT_KEY = { method: 'method', path: 'path', query: 'query', body: 'body', headers: 'headers', status: 'status', auth: 'auth' };
+const FIELD_COUNT_KEY = { method: 'method', path: 'path', query: 'query', body: 'body', headers: 'headers', status: 'status', auth: 'auth', authOutcome: 'authOutcome', tenant: 'tenant' };
+
+// A matched line shows the RESPONSE indicated success; delivery of the data is an effect that needs a separately bound observer.
+const EFFECT = Object.freeze({ corroborated: false, basis: 'log-signal', reason: 'a matched log line is a detection signal; delivery or mutation needs a separately bound observer (runtime corroboration), which a log hunt does not have' });
 
 export async function huntLogs({ ir, logsPath, since = null, until = null, signal, limits } = {}) {
   const base = { schema: 'agentic-security/hunt-result', version: 1, findingId: ir.findingId, detectionId: ir.id, detectionDigest: ir.digest, notExploitedClaim: false, egress: 'none' };
@@ -38,6 +41,10 @@ export async function huntLogs({ ir, logsPath, since = null, until = null, signa
   let matchCount = 0; let firstSeen = null; let lastSeen = null;
   let undecidable = 0; const undecidableFields = new Set();
   let endpointEvents = 0; let outOfWindow = 0; let undated = 0;
+  // Threat-model FR-07.3: the target counter uses the SAME method and route template as the matcher (a different route with the same
+  // method used to count), and separates the relevant events from those that could be judged and those missing a required field.
+  const target = { relevant: 0, adjudicable: 0, missingRequired: 0, deniedAttempts: 0, authorizedDelegations: 0 };
+  const atEndpoint = (ev) => !!ir.endpoint && typeof ev.method === 'string' && ev.method.toUpperCase() === ir.endpoint.method && pathMatches(ir.endpoint.path, ev.path);
 
   const stats = await readLogs(logsPath, {
     signal, limits,
@@ -48,19 +55,27 @@ export async function huntLogs({ ir, logsPath, since = null, until = null, signa
         if ((sinceMs != null && t < sinceMs) || (untilMs != null && t > untilMs)) { outOfWindow++; return; }
       }
       const r = evaluateEvent(ir, ev);
-      if (r.undecidable) { undecidable++; r.missing.forEach((m) => undecidableFields.add(m)); return; }
-      if (ir.endpoint && ev.method === ir.endpoint.method) endpointEvents++;
+      const here = atEndpoint(ev);
+      if (here) target.relevant++;
+      if (r.undecidable) { undecidable++; if (here) target.missingRequired++; r.missing.forEach((m) => undecidableFields.add(m)); return; }
+      if (here) { endpointEvents++; target.adjudicable++; }
+      if (r.attempt === 'denied') target.deniedAttempts++;
+      if (r.attempt === 'authorized-delegation') target.authorizedDelegations++;
       if (!r.match) return;
       matchCount++;
       if (ev.time) { if (!firstSeen || ev.time < firstSeen) firstSeen = ev.time; if (!lastSeen || ev.time > lastSeen) lastSeen = ev.time; }
-      if (sampleList.length < MAX_SAMPLES) sampleList.push({ time: ev.time, method: ev.method, path: redactValue(ev.path, 160), matchedOn: r.matchedOn, valueFingerprint: fingerprint(r.value), valuePreview: redactValue(r.value, 80), status: ev.status });
+      if (sampleList.length < MAX_SAMPLES) sampleList.push({ time: ev.time, method: ev.method, path: redactValue(ev.path, 160), matchedOn: r.matchedOn, valueFingerprint: fingerprint(r.value), valuePreview: redactValue(r.value, 80), status: ev.status, ...(r.signal ? { signal: r.signal } : {}) });
     },
   });
 
   const logs = { source: path.basename(String(logsPath)), files: stats.files.length, filesSkipped: stats.filesSkipped, lines: stats.lines, parsed: stats.parsed, failed: stats.failed, truncated: stats.truncated };
   const window = { start: stats.windowStart, end: stats.windowEnd, datedEvents: stats.eventsWithTime };
   const caveats = [];
-  const result = (verdict) => ({ ...base, verdict, logs, window, coverage: { requestedWindow: { since, until }, outOfWindow, undated, endpointEvents, requiredFields: requiredFields(ir), fieldAvailability: Object.fromEntries(Object.entries(FIELD_COUNT_KEY).map(([k, key]) => [k, stats.parsed ? Number((stats.fieldCounts[key] / stats.parsed).toFixed(3)) : 0])) }, matches: { count: matchCount, firstSeen, lastSeen, samples: sampleList }, caveats, statement: STATEMENTS[verdict](matchCount) });
+  // A requested window the logs do not reach: the time before the first event or after the last cannot be searched, so it is a gap.
+  const windowGaps = [];
+  if (sinceMs != null && stats.windowStart && Date.parse(stats.windowStart) > sinceMs) windowGaps.push({ edge: 'start', from: new Date(sinceMs).toISOString(), to: stats.windowStart });
+  if (untilMs != null && stats.windowEnd && Date.parse(stats.windowEnd) < untilMs) windowGaps.push({ edge: 'end', from: stats.windowEnd, to: new Date(untilMs).toISOString() });
+  const result = (verdict) => ({ ...base, verdict, logs, window, effect: EFFECT, coverage: { requestedWindow: { since, until }, outOfWindow, undated, endpointEvents, target: { ...target, samples: sampleList.length, samplesCapped: matchCount > sampleList.length }, windowGaps, requiredFields: requiredFields(ir), fieldAvailability: Object.fromEntries(Object.entries(FIELD_COUNT_KEY).map(([k, key]) => [k, stats.parsed ? Number((stats.fieldCounts[key] / stats.parsed).toFixed(3)) : 0])) }, matches: { count: matchCount, firstSeen, lastSeen, samples: sampleList }, caveats, statement: STATEMENTS[verdict](matchCount) });
 
   if (stats.unreadable || stats.parsed === 0) {
     caveats.push(stats.unreadable ? 'the log path could not be read' : stats.lines === 0 ? 'the logs contain no lines' : 'no line was recognised as a request record (supported: common/combined access logs, JSON lines)');
@@ -78,6 +93,7 @@ export async function huntLogs({ ir, logsPath, since = null, until = null, signa
   if (!stats.eventsWithTime) caveats.push('no event carries a timestamp, so the searched time window is unknown');
   if (stats.filesSkipped.some((f) => f.reason !== 'not-a-log-extension')) caveats.push(`${stats.filesSkipped.filter((f) => f.reason !== 'not-a-log-extension').length} file(s) were skipped (${[...new Set(stats.filesSkipped.map((f) => f.reason))].join(', ')})`);
   if (undated > 0) caveats.push(`${undated} event(s) had no timestamp and were excluded by the requested window`);
+  for (const g of windowGaps) caveats.push(`the logs do not reach the ${g.edge} of the requested window (${g.from} to ${g.to} is not covered), so nothing is known about that time`);
   if (!caveats.length && ir.endpoint && endpointEvents === 0) caveats.push('no request to the endpoint appears in the logs at all (informational: nothing to exploit was seen either)');
   const blocking = caveats.some((c) => !c.startsWith('no request to the endpoint'));
   return result(blocking ? 'INCONCLUSIVE' : 'NOT_OBSERVED');

package/src/posture/dnr/log-reader.js

@@ -100,19 +100,61 @@ export function parseLine(line) {
     }
     const authHeader = headers.authorization ?? pick(f, ['authorization']);
     const authFlag = pick(f, ['authenticated', 'is_authenticated', 'auth.present']);
+    // Legacy: one boolean where a header wins over everything. Kept for existing callers; detections read the two facts below.
     const authPresent = authHeader != null ? true : typeof authFlag === 'boolean' ? authFlag : (sawHeaders ? false : null);
     const statusRaw = pick(f, ['status', 'status_code', 'response_code', 'http.response.status_code', 'sc-status', 'response.status', 'res.statuscode']);
     const status = Number.isInteger(Number(statusRaw)) && statusRaw !== undefined ? Number(statusRaw) : null;
-    return { time: parseTime(pick(f, ['@timestamp', 'timestamp', 'time', 'ts', 'start_time', 'datetime', 'date'])), method: typeof m === 'string' ? m.toUpperCase() : null, path: tgt.path ?? null, query: query ?? null, bodyParams, headers: sawHeaders ? headers : null, status, authPresent };
+    return { time: parseTime(pick(f, ['@timestamp', 'timestamp', 'time', 'ts', 'start_time', 'datetime', 'date'])), method: typeof m === 'string' ? m.toUpperCase() : null, path: tgt.path ?? null, query: query ?? null, bodyParams, headers: sawHeaders ? headers : null, status, authPresent, ...authFacts(f, authHeader, sawHeaders) };
   }
   const c = CLF.exec(text);
   if (c) {
     const { path: p, query } = fromRequestTarget(c[5]);
-    return { time: parseTime(c[3]), method: c[4], path: p, query, bodyParams: null, headers: null, status: c[6] === '-' ? null : Number(c[6]), authPresent: null };
+    return { time: parseTime(c[3]), method: c[4], path: p, query, bodyParams: null, headers: null, status: c[6] === '-' ? null : Number(c[6]), authPresent: null, ...UNKNOWN_AUTH };
   }
   return null;
 }
 
+// ── authentication and authorization facts (PRD threat-model FR-07.1, FR-07.5) ──────────────────────────────────────────────────────
+// Credential PRESENCE and the verified authentication OUTCOME are separate facts. A header only says a credential was sent; an
+// authoritative `authenticated: false` (or an auth result of "rejected") says it was refused, and survives a redacted header. Missing or
+// conflicting outcome fields leave the outcome `unknown`. Identity and policy fields (actor tenant, object tenant, a cross-tenant grant,
+// the authorization decision) are read only from these mapped field names, never from request headers, query or body, which the client
+// controls.
+const OUTCOME_FIELDS = ['authenticated', 'is_authenticated', 'auth.authenticated', 'auth.outcome', 'auth.result', 'authn.outcome', 'authn.result'];
+const ACTOR_TENANT_FIELDS = ['identity.tenant', 'actor.tenant', 'auth.tenant', 'principal.tenant'];
+const OBJECT_TENANT_FIELDS = ['object.tenant', 'resource.tenant', 'record.tenant'];
+const GRANT_FIELDS = ['authz.cross_tenant_grant', 'authz.delegated', 'authz.crossTenantGrant'];
+const DECISION_FIELDS = ['authz.decision', 'authz.result'];
+const UNKNOWN_AUTH = Object.freeze({ credentialPresent: null, authOutcome: 'unknown', actorTenant: null, objectTenant: null, crossTenantGrant: null, authzDecision: null });
+
+function outcomeOf(v) {
+  if (v === true) return 'authenticated';
+  if (v === false) return 'unauthenticated';
+  const s = String(v ?? '').trim().toLowerCase();
+  if (/^(?:true|success|succeeded|ok|authenticated|allow|allowed|valid)$/.test(s)) return 'authenticated';
+  if (/^(?:false|failure|failed|rejected|denied|invalid|unauthenticated|anonymous|none|expired)$/.test(s)) return 'unauthenticated';
+  return null;
+}
+const ident = (v) => (v === undefined || v === null || v === '' ? null : String(v).slice(0, 128));
+
+function authFacts(f, authHeader, sawHeaders) {
+  const outcomes = new Set(OUTCOME_FIELDS.map((k) => f[k]).filter((v) => v !== undefined).map(outcomeOf).filter(Boolean));
+  const authOutcome = outcomes.size === 1 ? [...outcomes][0] : 'unknown';
+  const presentFlag = f['auth.present'];
+  const credentialPresent = authHeader != null ? true : typeof presentFlag === 'boolean' ? presentFlag : (sawHeaders ? false : null);
+  const grant = GRANT_FIELDS.map((k) => f[k]).find((v) => v !== undefined);
+  const decision = DECISION_FIELDS.map((k) => f[k]).find((v) => v !== undefined);
+  const d = String(decision ?? '').toLowerCase();
+  return {
+    credentialPresent,
+    authOutcome: outcomes.size > 1 ? 'conflict' : authOutcome,
+    actorTenant: ident(pick(f, ACTOR_TENANT_FIELDS)),
+    objectTenant: ident(pick(f, OBJECT_TENANT_FIELDS)),
+    crossTenantGrant: grant === true || grant === 'true' ? true : grant === false || grant === 'false' ? false : null,
+    authzDecision: /^(?:allow|allowed|permit|granted)$/.test(d) ? 'allow' : /^(?:deny|denied|forbidden|refused)$/.test(d) ? 'deny' : null,
+  };
+}
+
 function collectFiles(root, limits, skipped) {
   const out = [];
   const walk = (p, depth) => {
@@ -142,7 +184,7 @@ function collectFiles(root, limits, skipped) {
  */
 export async function readLogs(target, { onEvent, signal, limits: over = {} } = {}) {
   const limits = { ...LIMITS, ...over };
-  const stats = { files: [], filesSkipped: [], lines: 0, parsed: 0, failed: 0, oversizeLines: 0, windowStart: null, windowEnd: null, eventsWithTime: 0, fieldCounts: { method: 0, path: 0, query: 0, body: 0, headers: 0, status: 0, auth: 0 }, truncated: [], budgetExhausted: false, aborted: false, unreadable: false };
+  const stats = { files: [], filesSkipped: [], lines: 0, parsed: 0, failed: 0, oversizeLines: 0, windowStart: null, windowEnd: null, eventsWithTime: 0, fieldCounts: { method: 0, path: 0, query: 0, body: 0, headers: 0, status: 0, auth: 0, authOutcome: 0, tenant: 0 }, truncated: [], budgetExhausted: false, aborted: false, unreadable: false };
   let st;
   try { st = fs.lstatSync(target); } catch { stats.unreadable = true; return stats; }
   if (st.isSymbolicLink()) { stats.unreadable = true; stats.filesSkipped.push({ file: path.basename(target), reason: 'symlink' }); return stats; }
@@ -178,6 +220,8 @@ export async function readLogs(target, { onEvent, signal, limits: over = {} } =
         if (ev.headers != null) stats.fieldCounts.headers++;
         if (ev.status != null) stats.fieldCounts.status++;
         if (ev.authPresent != null) stats.fieldCounts.auth++;
+        if (ev.authOutcome === 'authenticated' || ev.authOutcome === 'unauthenticated') stats.fieldCounts.authOutcome++;
+        if (ev.actorTenant != null && ev.objectTenant != null) stats.fieldCounts.tenant++;
         if (ev.time) { stats.eventsWithTime++; if (!stats.windowStart || ev.time < stats.windowStart) stats.windowStart = ev.time; if (!stats.windowEnd || ev.time > stats.windowEnd) stats.windowEnd = ev.time; }
         onEvent?.(ev);
       }

package/src/posture/dnr/matchers.js

@@ -3,7 +3,13 @@
 // searches the logs. An event is the NORMALIZED request record produced by log-reader.js or by the validator.
 //
 //   event = { time, method, path, query: {name: [values]}, bodyParams: {name: [values]} | null, headers: {name: value} | null,
-//             status, authPresent: boolean | null }
+//             status, authPresent: boolean | null,
+//             credentialPresent: boolean | null, authOutcome: 'authenticated'|'unauthenticated'|'unknown'|'conflict',
+//             actorTenant, objectTenant, crossTenantGrant: boolean | null, authzDecision: 'allow'|'deny'|null }
+//
+// Authentication (threat-model FR-07.1): the outcome decides, not the header. A request whose credential was REJECTED is
+// unauthenticated even though a header was sent; a header with no recorded outcome is undecidable, not "authenticated". An event
+// that carries only the legacy `authPresent` (an older caller) is judged as before.
 //
 // A missing field is `undefined`/`null`, never an empty string: "the log did not record this" and "the value was empty" are
 // different facts, and only the first makes an event undecidable.
@@ -20,11 +26,25 @@ export function pathMatches(template, actual) {
   return t.every((seg, i) => (/^(?::[A-Za-z_]\w*|\{[A-Za-z_]\w*\})$/.test(seg) ? a[i].length > 0 : seg === a[i]));
 }
 
+/**
+ * The authentication fact a detection may rely on: 'authenticated', 'unauthenticated' or 'unknown'. An explicit outcome wins; with
+ * no outcome, a request that carried NO credential is unauthenticated, and one that carried a credential is unknown (it may have
+ * been accepted or rejected). An event with only the legacy `authPresent` keeps its legacy reading.
+ */
+export function authenticationOf(event) {
+  const legacyOnly = event.authOutcome === undefined && event.credentialPresent === undefined;
+  if (legacyOnly) return event.authPresent === false ? 'unauthenticated' : event.authPresent === true ? 'authenticated' : 'unknown';
+  if (event.authOutcome === 'authenticated' || event.authOutcome === 'unauthenticated') return event.authOutcome;
+  if (event.authOutcome === 'conflict') return 'unknown';
+  return event.credentialPresent === false ? 'unauthenticated' : 'unknown';
+}
+
 /** Fields an event must have for a detection to be able to say "no" about it. */
 export function requiredFields(ir) {
   const need = new Set();
   if (ir.endpoint) { need.add('method'); need.add('path'); }
   if (ir.payloadClass === 'auth-bypass') { need.add('status'); need.add('auth'); return [...need]; }
+  if (ir.payloadClass === 'object-authz') { need.add('status'); need.add('auth'); need.add('tenant'); return [...need]; }
   const loc = ir.parameter?.location;
   if (loc === 'body') need.add('body');
   else if (loc === 'header' || loc === 'cookie') need.add('headers');
@@ -73,10 +93,30 @@ export function evaluateEvent(ir, event) {
   } else if (typeof event.path !== 'string') { res.missing.push('path'); res.undecidable = true; return res; }
 
   if (ir.payloadClass === 'auth-bypass') {
+    const auth = authenticationOf(event);
+    if (event.status == null) res.missing.push('status');
+    if (auth === 'unknown') res.missing.push('auth');
+    if (res.missing.length) { res.undecidable = true; return res; }
+    // a matched line is a SIGNAL that the response indicated success; delivery needs a separately bound observer
+    if (event.status >= 200 && event.status < 300 && auth === 'unauthenticated') { res.match = true; res.matchedOn = 'unauthenticated-success'; res.value = `${event.status}`; res.signal = 'response-indication'; }
+    return res;
+  }
+
+  if (ir.payloadClass === 'object-authz') {
+    // FR-07.2: an AUTHENTICATED actor whose tenant differs from the object's, with no explicit cross-tenant grant, and a success
+    // response. A denial (401/403 or a recorded deny) is an attempt, never a delivery. An unauthenticated success is the auth-bypass
+    // rule's case, not this one.
+    const auth = authenticationOf(event);
     if (event.status == null) res.missing.push('status');
-    if (event.authPresent == null) res.missing.push('auth');
+    if (auth === 'unknown') res.missing.push('auth');
+    // an unauthenticated request has no actor tenant to compare: it is decided (not this rule's case), not undecidable
+    if (auth !== 'unauthenticated' && (event.actorTenant == null || event.objectTenant == null)) res.missing.push('tenant');
     if (res.missing.length) { res.undecidable = true; return res; }
-    if (event.status >= 200 && event.status < 300 && event.authPresent === false) { res.match = true; res.matchedOn = 'unauthenticated-success'; res.value = `${event.status}`; }
+    if (auth !== 'authenticated' || event.actorTenant === event.objectTenant) return res;
+    const denied = event.status === 401 || event.status === 403 || event.authzDecision === 'deny';
+    if (denied) { res.attempt = 'denied'; return res; }
+    if (event.crossTenantGrant === true) { res.attempt = 'authorized-delegation'; return res; }
+    if (event.status >= 200 && event.status < 300) { res.match = true; res.matchedOn = 'cross-tenant-success'; res.value = `${event.status}`; res.signal = 'response-indication'; }
     return res;
   }
 

package/src/posture/dnr/outputs.js

@@ -32,6 +32,7 @@ const unavailable = (reason) => ({ applicable: false, reason });
 const fpNotes = (ir) => [
   'A legitimate client that sends this payload shape to the same endpoint (a security scanner, a penetration test).',
   ...(ir.payloadClass === 'auth-bypass' ? ['Public endpoints that are intentionally reachable without a credential.'] : []),
+  ...(ir.payloadClass === 'object-authz' ? ['A cross-tenant read that an operator or support role is allowed to make but whose grant is not recorded in the event.'] : []),
 ];
 
 /** Sigma rule as YAML text. JSON string syntax is used for every scalar; it is valid YAML and cannot be broken out of. */
@@ -72,7 +73,8 @@ function http(ir) {
     schema: 'agentic-security/http-detection', version: 1, id: ir.id, findingId: ir.findingId, level: levelFor(ir), mode: 'detect',
     request: { method: ir.endpoint.method, pathTemplate: ir.endpoint.path },
     parameter: ir.parameter,
-    payload: ir.payloadClass === 'auth-bypass' ? { class: 'auth-bypass', behavior: 'status 2xx with no credential' }
+    payload: ir.payloadClass === 'auth-bypass' ? { class: 'auth-bypass', behavior: 'status 2xx for a request that is not authenticated (no credential, or a rejected one)' }
+      : ir.payloadClass === 'object-authz' ? { class: 'object-authz', behavior: 'status 2xx for an authenticated actor whose tenant differs from the object\'s, with no cross-tenant grant', requiredFields: ['auth.outcome', 'actor.tenant', 'object.tenant', 'authz.cross_tenant_grant'] }
       : { class: ir.payloadClass, matcher: def.matcher, minLength: def.minLength ?? null, regex: classRegex(ir.payloadClass), flags: 'i' },
     limitations: ir.limitations,
   };
@@ -104,6 +106,7 @@ function logQuery(ir) {
   if (!ir.endpoint) return unavailable('no endpoint is known for this finding');
   const where = [{ field: 'http.request.method', op: 'eq', value: ir.endpoint.method }, hasTemplate(ir.endpoint.path) ? { field: 'url.path', op: 'regex', value: pathRegex(ir.endpoint.path) } : { field: 'url.path', op: 'eq', value: ir.endpoint.path }];
   if (ir.payloadClass === 'auth-bypass') where.push({ field: 'http.response.status_code', op: 'range', value: [200, 299] }, { field: 'http.request.headers.authorization', op: 'absent' });
+  else if (ir.payloadClass === 'object-authz') where.push({ field: 'http.response.status_code', op: 'range', value: [200, 299] }, { field: 'auth.outcome', op: 'eq', value: 'authenticated' }, { field: 'actor.tenant', op: 'ne-field', value: 'object.tenant' }, { field: 'authz.cross_tenant_grant', op: 'ne', value: true });
   else where.push({ field: ir.parameter?.location === 'body' ? 'http.request.body.content' : ir.parameter?.location === 'query' ? `url.query.${ir.parameter.name}` : 'url.query', op: 'regex', value: classRegex(ir.payloadClass), flags: 'i' });
   return { applicable: true, format: 'log-query', content: `${JSON.stringify({ schema: 'agentic-security/structured-log-query', version: 1, id: ir.id, findingId: ir.findingId, where }, null, 2)}\n` };
 }
@@ -152,8 +155,19 @@ const RENDERERS = { sigma, http, waf, 'log-query': logQuery, yara, spl, kql, clo
 export function renderDetection(ir, format) {
   const fn = RENDERERS[format];
   if (!fn) return { applicable: false, reason: `unknown format: ${format}` };
-  return { format, ...fn(ir) };
+  // Threat-model FR-07.4: a rule is published to a destination only when its field mapping carries what the rule needs. The
+  // object-authorization rule needs the actor's tenant, the object's tenant and any cross-tenant grant, which only this tool's own
+  // structured formats name; elsewhere it is reported as unavailable rather than rendered as a lossy predicate.
+  if (ir.payloadClass === 'object-authz' && !OBJECT_AUTHZ_FORMATS.has(format)) {
+    return { format, ...unavailable(`the ${format} destination's default fields carry no actor tenant, object tenant or cross-tenant grant, so the object-authorization rule cannot be expressed; use the http or log-query output with mapped fields`) };
+  }
+  const out = { format, ...fn(ir) };
+  // The rule languages see whether an Authorization header was sent, not whether it was accepted: the rendered rule covers the
+  // no-credential case only, and says so.
+  if (ir.payloadClass === 'auth-bypass' && out.applicable && format !== 'http') out.coverage = { covers: 'requests that sent no credential', notCovered: 'a credential that was sent and rejected: this destination has no authentication-outcome field' };
+  return out;
 }
+const OBJECT_AUTHZ_FORMATS = new Set(['http', 'log-query']);
 
 export function renderAll(ir) {
   return Object.fromEntries(FORMATS.map((f) => [f, renderDetection(ir, f)]));

package/src/posture/dnr/payload-classes.js

@@ -80,13 +80,23 @@ export const PAYLOAD_CLASSES = Object.freeze({
     effects: { process: 'memory-corruption-possible', network: 'none', db: 'none' },
   },
   'auth-bypass': {
-    cwe: ['CWE-287', 'CWE-306', 'CWE-285', 'CWE-862', 'CWE-863', 'CWE-639', 'CWE-284'],
-    behavior: 'a protected operation succeeds for a request that carries no credential',
+    cwe: ['CWE-287', 'CWE-306', 'CWE-285', 'CWE-862', 'CWE-863', 'CWE-284'],
+    behavior: 'a protected operation succeeds for a request that is not authenticated (no credential, or a credential that was rejected)',
     matcher: 'behavior',
     indicators: [],
     exemplars: { positive: [''], benign: [''] },
     effects: { process: 'none', network: 'none', db: 'none', access: 'protected-operation-without-credential' },
   },
+  // Threat-model FR-07.2: an authenticated actor receives another tenant's object. CWE-639 (authorization through a user-controlled
+  // key) moved here from auth-bypass, which could only see "no credential" and so never fired on the wrong-tenant case.
+  'object-authz': {
+    cwe: ['CWE-639'],
+    behavior: 'an authenticated actor receives an object that belongs to another tenant, with no explicit cross-tenant grant',
+    matcher: 'behavior',
+    indicators: [],
+    exemplars: { positive: [''], benign: [''] },
+    effects: { process: 'none', network: 'none', db: 'none', access: 'object-of-another-tenant-delivered' },
+  },
 });
 
 export const PAYLOAD_CLASS_NAMES = Object.freeze(Object.keys(PAYLOAD_CLASSES));

package/src/posture/dnr/validate.js

@@ -10,10 +10,10 @@ import { classRegex } from './outputs.js';
 
 const PROBE = 'probe';
 
-function eventFor(ir, { method, path, values, extraParam = null, status = 200, authPresent = null }) {
+function eventFor(ir, { method, path, values, extraParam = null, status = 200, authPresent = null, facts = null }) {
   const p = ir.parameter;
   const bag = {};
-  const ev = { time: '2024-01-01T00:00:00.000Z', method, path, query: {}, bodyParams: {}, headers: {}, status, authPresent };
+  const ev = { time: '2024-01-01T00:00:00.000Z', method, path, query: {}, bodyParams: {}, headers: {}, status, authPresent, ...(facts || {}) };
   const put = (loc, name, vals) => {
     if (loc === 'query') ev.query[name] = vals;
     else if (loc === 'body') ev.bodyParams[name] = vals;
@@ -39,14 +39,27 @@ export function validateDetection(ir) {
   if (!ir.endpoint) return { schema: 'agentic-security/detection-validation', version: 1, detectionId: ir.id, status: 'NOT_VALIDATED', reason: 'no endpoint is known, so there is no request to synthesize', cases, render, counts: { positives: 0, negatives: 0, passed: 0, failed: 0 } };
   const concretePath = ir.endpoint.path.replace(/(:[A-Za-z_]\w*|\{[A-Za-z_]\w*\})/g, '42');
   const { method } = ir.endpoint;
-  const add = (kind, name, ev) => { const r = evaluateEvent(ir, ev); cases.push({ kind, name, expected: kind === 'positive', fired: r.match, undecidable: r.undecidable, ok: kind === 'positive' ? r.match : !r.match }); };
+  // `undecidable` cases (threat-model FR-07.4): the rule must refuse to answer, neither fire nor clear, when a required fact is missing
+  const add = (kind, name, ev) => { const r = evaluateEvent(ir, ev); cases.push({ kind, name, expected: kind === 'positive' ? true : kind === 'undecidable' ? 'undecidable' : false, fired: r.match, undecidable: r.undecidable, ok: kind === 'positive' ? r.match : kind === 'undecidable' ? r.undecidable && !r.match : !r.match }); };
+  const auth = (credentialPresent, authOutcome, extra = {}) => ({ credentialPresent, authOutcome, actorTenant: null, objectTenant: null, crossTenantGrant: null, authzDecision: null, ...extra });
 
   if (ir.payloadClass === 'auth-bypass') {
     add('positive', 'success with no credential', eventFor(ir, { method, path: concretePath, status: 200, authPresent: false }));
+    add('positive', 'success after a credential was sent and rejected', eventFor(ir, { method, path: concretePath, status: 200, facts: auth(true, 'unauthenticated') }));
     add('negative', 'success with a credential', eventFor(ir, { method, path: concretePath, status: 200, authPresent: true }));
+    add('negative', 'success with an accepted credential', eventFor(ir, { method, path: concretePath, status: 200, facts: auth(true, 'authenticated') }));
     add('negative', 'refusal without a credential (401)', eventFor(ir, { method, path: concretePath, status: 401, authPresent: false }));
     add('negative', 'refusal without a credential (403)', eventFor(ir, { method, path: concretePath, status: 403, authPresent: false }));
     add('negative', 'same request on another path', eventFor(ir, { method, path: '/other/unrelated', status: 200, authPresent: false }));
+    add('undecidable', 'a credential header with no recorded outcome', eventFor(ir, { method, path: concretePath, status: 200, facts: auth(true, 'unknown') }));
+  } else if (ir.payloadClass === 'object-authz') {
+    const t = (actorTenant, objectTenant, extra = {}) => auth(true, 'authenticated', { actorTenant, objectTenant, ...extra });
+    add('positive', 'an authenticated actor receives another tenant\'s object', eventFor(ir, { method, path: concretePath, status: 200, facts: t('tenant-a', 'tenant-b') }));
+    add('negative', 'the rightful tenant reads its own object', eventFor(ir, { method, path: concretePath, status: 200, facts: t('tenant-b', 'tenant-b') }));
+    add('negative', 'a cross-tenant read under an explicit grant', eventFor(ir, { method, path: concretePath, status: 200, facts: t('tenant-a', 'tenant-b', { crossTenantGrant: true }) }));
+    add('negative', 'a cross-tenant attempt that was denied (403)', eventFor(ir, { method, path: concretePath, status: 403, facts: t('tenant-a', 'tenant-b', { authzDecision: 'deny' }) }));
+    add('negative', 'the same cross-tenant read on another path', eventFor(ir, { method, path: '/other/unrelated', status: 200, facts: t('tenant-a', 'tenant-b') }));
+    add('undecidable', 'no object tenant recorded', eventFor(ir, { method, path: concretePath, status: 200, facts: t('tenant-a', null) }));
   } else {
     for (const [i, v] of def.exemplars.positive.entries()) add('positive', `exploit payload #${i + 1}`, eventFor(ir, { method, path: concretePath, values: [v] }));
     for (const [i, v] of def.exemplars.benign.entries()) add('negative', `benign value #${i + 1} on the same endpoint`, eventFor(ir, { method, path: concretePath, values: [v] }));
@@ -57,7 +70,7 @@ export function validateDetection(ir) {
     add('negative', 'same endpoint, no parameter at all', eventFor(ir, { method, path: concretePath }));
     if (ir.parameter && ir.parameter.location !== 'path') add('negative', 'exploit payload in an unrelated parameter', eventFor(ir, { method, path: concretePath, values: exploit, extraParam: 'unrelated_field' }));
   }
-  const positives = cases.filter((c) => c.kind === 'positive'); const negatives = cases.filter((c) => c.kind === 'negative');
+  const positives = cases.filter((c) => c.kind === 'positive'); const negatives = cases.filter((c) => c.kind !== 'positive');
   const failed = cases.filter((c) => !c.ok);
   const status = failed.length === 0 && positives.length && negatives.length && render.regexCompiles ? 'VALIDATED' : 'FAILED';
   return { schema: 'agentic-security/detection-validation', version: 1, detectionId: ir.id, status, cases, render, counts: { positives: positives.length, negatives: negatives.length, passed: cases.length - failed.length, failed: failed.length }, failures: failed.map((c) => c.name) };

package/src/posture/evaluation/report.js

@@ -107,8 +107,9 @@ export function buildAccuracyReport({ score, protocol, population, run = null, r
       unsupported: { outcomesUnavailable: statusCounts.unavailable ?? 0, outcomesQuarantined: statusCounts.quarantined ?? 0 },
       unscored: {
         unlabeledTargets: score.unscored.unlabeledTargets.length, nonAdjudicatedLabels: score.unscored.nonAdjudicatedLabels,
-        unlabeledFindings: score.unscored.unlabeledFindings.count, positivesOutsideRun: score.unscored.positivesOutsideRun,
+        unlabeledFindings: score.unscored.unlabeledFindings.count, positivesOutsideRun: score.unscored.positivesOutsideRun, negativesOutsideRun: score.unscored.negativesOutsideRun ?? 0,
       },
+      reconciliation: score.reconciliation ? { enrolled: score.reconciliation.enrolled, reconciled: score.reconciliation.reconciled, byStatus: score.reconciliation.byStatus } : null,
       unknownLabels: { count: score.unscored.nonAdjudicatedLabels, note: 'candidate, disputed or rejected labels are never scored' },
       trueNegativeFailures: { count: score.negativeFailures.length, note: 'a negative whose scan did not complete is neither a true negative nor a false positive', items: score.negativeFailures },
       reviewQueue: { count: score.reviewQueue.length, note: 'findings no adjudicated label accounts for; they may be genuine and are not counted as false positives' },

package/src/posture/evaluation/score.js

@@ -17,6 +17,10 @@
 // (`clusterAlerts`) score once and are reported in `alertsCollapsed`; the operational
 // alert burden is report.js's job and is never hidden by this. The score also carries
 // `perTarget` tallies, which is what the grouped bootstrap resamples. Pure: no fs, no clock.
+//
+// Every enrolled label is reconciled to exactly one status (threat-model PRD FR-09.2), so the original denominator survives whatever the
+// run did: a positive is tp, fn, outside-run or not-adjudicated; a negative is tp-free by construction and is tn, fp, scan-failed,
+// outside-run or not-adjudicated. `reconciliation.reconciled` is true only when the statuses add up to the enrolled count.
 
 import { SCHEMA_VERSION } from '../assurance/schema-kit.js';
 import { digestOf } from '../assurance/identity.js';
@@ -82,7 +86,9 @@ export function scoreRun({ run, protocol, defects = [], negatives = [] }) {
 
   const e2e = { lang: {}, family: {} }; const cond = { lang: {}, family: {} };
   const misses = []; const falsePositives = []; const negativeFailures = []; const matchedFinding = new Set();
-  const unscored = { unlabeledTargets: [], nonAdjudicatedLabels: 0, unlabeledFindings: { count: 0, byReason: {} }, positivesOutsideRun: 0 };
+  const unscored = { unlabeledTargets: [], nonAdjudicatedLabels: 0, unlabeledFindings: { count: 0, byReason: {} }, positivesOutsideRun: 0, negativesOutsideRun: 0 };
+  const recon = [];
+  const settle = (l, kind, status, reason = null) => recon.push({ labelId: l?.id ?? null, kind, status, ...(reason ? { reason } : {}) });
   const queue = [];
 
   const labelledTargets = new Set();
@@ -92,14 +98,15 @@ export function scoreRun({ run, protocol, defects = [], negatives = [] }) {
     if (!perTarget[targetId]) perTarget[targetId] = { language, tp: 0, fn: 0, fp: 0, tn: 0 };
     perTarget[targetId][field] += n;
   };
-  const scoreable = (l) => {
+  const scoreable = (kind) => (l) => {
     if (isScoreable(l)) return true;
     unscored.nonAdjudicatedLabels++;
+    settle(l, kind, 'not-adjudicated');
     return false;
   };
 
-  for (const l of defects.filter(scoreable)) {
-    if (!inRun.has(l.targetId)) { unscored.positivesOutsideRun++; continue; }
+  for (const l of defects.filter(scoreable('positive'))) {
+    if (!inRun.has(l.targetId)) { unscored.positivesOutsideRun++; settle(l, 'positive', 'outside-run'); continue; }
     labelledTargets.add(l.targetId);
     const o = outcomeOf.get(`${l.targetId}|pre`);
     const completed = o?.status === 'completed';
@@ -108,21 +115,25 @@ export function scoreRun({ run, protocol, defects = [], negatives = [] }) {
       matchedFinding.add(`${l.targetId}|pre|${findingKey(hit)}`);
       for (const [m, k] of [[e2e.lang, l.language], [e2e.family, l.family], [cond.lang, l.language], [cond.family, l.family]]) bump(m, k, 'tp');
       tally(l.targetId, l.language, 'tp');
+      settle(l, 'positive', 'tp');
     } else {
       const reason = !o ? 'no-outcome' : completed ? 'not-detected' : o.status;
       misses.push({ labelId: l.id, targetId: l.targetId, reason, detail: o?.failureReason || null });
+      settle(l, 'positive', 'fn', reason);
       for (const [m, k] of [[e2e.lang, l.language], [e2e.family, l.family]]) bump(m, k, 'fn');
       tally(l.targetId, l.language, 'fn');
       if (completed) for (const [m, k] of [[cond.lang, l.language], [cond.family, l.family]]) bump(m, k, 'fn');
     }
   }
 
-  for (const n of negatives.filter(scoreable)) {
-    if (!inRun.has(n.targetId)) continue;
+  for (const n of negatives.filter(scoreable('negative'))) {
+    // a negative the run never reached is counted, not dropped: it leaves the denominator only with its reason
+    if (!inRun.has(n.targetId)) { unscored.negativesOutsideRun++; settle(n, 'negative', 'outside-run'); continue; }
     labelledTargets.add(n.targetId);
     const o = outcomeOf.get(`${n.targetId}|${n.variant}`);
     if (o?.status !== 'completed') {
       negativeFailures.push({ labelId: n.id, targetId: n.targetId, variant: n.variant, reason: o?.status || 'no-outcome', detail: o?.failureReason || null });
+      settle(n, 'negative', 'scan-failed', o?.status || 'no-outcome');
       continue;
     }
     const hits = new Map();
@@ -138,9 +149,11 @@ export function scoreRun({ run, protocol, defects = [], negatives = [] }) {
       for (const c of clusters) falsePositives.push({ labelId: n.id, targetId: n.targetId, kind: n.kind, finding: { file: c.members[0].file, line: c.members[0].line, family: c.family }, alertsCollapsed: c.members.length });
       for (const [m, k] of [[e2e.lang, n.language], [e2e.family, n.family], [cond.lang, n.language], [cond.family, n.family]]) { for (let i = 0; i < clusters.length; i++) bump(m, k, 'fp'); }
       tally(n.targetId, n.language, 'fp', clusters.length);
+      settle(n, 'negative', 'fp');
     } else {
       for (const [m, k] of [[e2e.lang, n.language], [e2e.family, n.family], [cond.lang, n.language], [cond.family, n.family]]) bump(m, k, 'tn');
       tally(n.targetId, n.language, 'tn');
+      settle(n, 'negative', 'tn');
     }
   }
 
@@ -160,12 +173,16 @@ export function scoreRun({ run, protocol, defects = [], negatives = [] }) {
   const endToEnd = { byLanguage: finalize(e2e.lang), byFamily: finalize(e2e.family) };
   const conditional = { byLanguage: finalize(cond.lang), byFamily: finalize(cond.family) };
   const completed = run.outcomes.filter((o) => o.status === 'completed').length;
+  const byStatus = {};
+  for (const r of recon) { const k = `${r.kind}:${r.status}`; byStatus[k] = (byStatus[k] || 0) + 1; }
+  const enrolled = defects.length + negatives.length;
+  const reconciliation = { enrolled, settled: recon.length, reconciled: recon.length === enrolled, byStatus: Object.fromEntries(Object.keys(byStatus).sort().map((k) => [k, byStatus[k]])), cases: recon };
   const score = {
     schema: SCORE_SCHEMA, schemaVersion: SCHEMA_VERSION, runId: run.runId, protocolHash: run.protocolHash, split: run.split,
     endToEnd: { ...endToEnd, ...aggregate(endToEnd.byLanguage), label: 'end-to-end: failures on known positives are misses' },
     conditional: { ...conditional, ...aggregate(conditional.byLanguage), label: 'conditional on completion: additional, never a replacement' },
     completion: { outcomes: run.outcomes.length, completed, rate: rate(completed, run.outcomes.length), totals: run.totals },
-    misses, falsePositives, negativeFailures, unscored, perTarget,
+    misses, falsePositives, negativeFailures, unscored, perTarget, reconciliation,
     reviewQueue: reviewQueue(queue),
     population: populationCounts(defects, negatives),
   };

package/src/posture/logic-claims.js

@@ -40,7 +40,7 @@
 // lenses live here in deterministic code rather than in the agent's prompt: a
 // reviewer asked to double-check itself is the same party voting twice.
 
-import { recordProducer, recordVerdict, consensusOf } from './verification-separation.js';
+import { recordProducer, recordVerdict, consensusOf, refutationRemoves } from './verification-separation.js';
 import { inferredInvariant } from './invariants/lifecycle.js';
 
 export const PRODUCER = 'agent:logic-reviewer';
@@ -132,7 +132,7 @@ export function verifyLogicClaim(claim, fileContents) {
   // ── citation ──────────────────────────────────────────────────────────────
   if (content === null) {
     recordVerdict(finding, {
-      verifierId: VERIFIER_CITATION, lens: 'citation', verdict: 'refuted',
+      verifierId: VERIFIER_CITATION, lens: 'citation', verdict: 'refuted', evidence: { kind: 'deterministic' },
       reason: `no file '${claim.file}' was scanned, so the cited location does not exist`,
     });
     finding.consensus = consensusOf(finding);
@@ -143,12 +143,12 @@ export function verifyLogicClaim(claim, fileContents) {
   const line = Number(claim.line);
   if (!Number.isInteger(line) || line < 1 || line > total) {
     recordVerdict(finding, {
-      verifierId: VERIFIER_CITATION, lens: 'citation', verdict: 'refuted',
+      verifierId: VERIFIER_CITATION, lens: 'citation', verdict: 'refuted', evidence: { kind: 'deterministic' },
       reason: `cited line ${claim.line} is outside ${claim.file} (${total} lines)`,
     });
   } else {
     recordVerdict(finding, {
-      verifierId: VERIFIER_CITATION, lens: 'citation', verdict: 'upheld',
+      verifierId: VERIFIER_CITATION, lens: 'citation', verdict: 'upheld', evidence: { kind: 'deterministic' },
       reason: `${claim.file}:${line} exists`,
     });
   }
@@ -158,7 +158,7 @@ export function verifyLogicClaim(claim, fileContents) {
   // snippet is UNDECIDED here, not upheld — silence is not corroboration.
   if (!claim.snippet || !String(claim.snippet).trim()) {
     recordVerdict(finding, {
-      verifierId: VERIFIER_QUOTATION, lens: 'quotation', verdict: 'undecided',
+      verifierId: VERIFIER_QUOTATION, lens: 'quotation', verdict: 'undecided', evidence: { kind: 'deterministic' },
       reason: 'the claim quotes no source, so there is nothing to check it against',
     });
   } else {
@@ -170,19 +170,19 @@ export function verifyLogicClaim(claim, fileContents) {
     const anywhere = _normalize(content);
     if (window.includes(want)) {
       recordVerdict(finding, {
-        verifierId: VERIFIER_QUOTATION, lens: 'quotation', verdict: 'upheld',
+        verifierId: VERIFIER_QUOTATION, lens: 'quotation', verdict: 'upheld', evidence: { kind: 'deterministic' },
         reason: 'the quoted source appears at the cited line',
       });
     } else if (anywhere.includes(want)) {
       // Right file, wrong line. Not a fabrication, but the location is not
       // usable as-is, so it is not corroboration either.
       recordVerdict(finding, {
-        verifierId: VERIFIER_QUOTATION, lens: 'quotation', verdict: 'undecided',
+        verifierId: VERIFIER_QUOTATION, lens: 'quotation', verdict: 'undecided', evidence: { kind: 'deterministic' },
         reason: 'the quoted source is in the file but not at the cited line',
       });
     } else {
       recordVerdict(finding, {
-        verifierId: VERIFIER_QUOTATION, lens: 'quotation', verdict: 'refuted',
+        verifierId: VERIFIER_QUOTATION, lens: 'quotation', verdict: 'refuted', evidence: { kind: 'deterministic' },
         reason: 'the quoted source does not appear in the cited file',
       });
     }
@@ -193,30 +193,31 @@ export function verifyLogicClaim(claim, fileContents) {
   if (finding.kind === 'missing-authentication') {
     const hit = AUTH_HINTS.find((re) => re.test(block));
     recordVerdict(finding, hit
-      ? { verifierId: VERIFIER_CORROBORATION, lens: 'authz', verdict: 'refuted',
+      ? { verifierId: VERIFIER_CORROBORATION, lens: 'authz', verdict: 'refuted', evidence: { kind: 'deterministic' },
         reason: `the handler around this line does authenticate (${hit.source})` }
-      : { verifierId: VERIFIER_CORROBORATION, lens: 'authz', verdict: 'upheld',
+      : { verifierId: VERIFIER_CORROBORATION, lens: 'authz', verdict: 'upheld', evidence: { kind: 'deterministic' },
         reason: 'no authentication marker anywhere in the enclosing handler' });
   } else if (finding.kind === 'missing-authorization' || finding.kind === 'missing-ownership-check') {
     const hit = OWNERSHIP_HINTS.find((re) => re.test(block));
     recordVerdict(finding, hit
-      ? { verifierId: VERIFIER_CORROBORATION, lens: 'authz', verdict: 'refuted',
+      ? { verifierId: VERIFIER_CORROBORATION, lens: 'authz', verdict: 'refuted', evidence: { kind: 'deterministic' },
         reason: `the handler around this line does scope the record to a user (${hit.source})` }
-      : { verifierId: VERIFIER_CORROBORATION, lens: 'authz', verdict: 'upheld',
+      : { verifierId: VERIFIER_CORROBORATION, lens: 'authz', verdict: 'upheld', evidence: { kind: 'deterministic' },
         reason: 'no ownership scoping in the enclosing handler' });
   } else {
     // No deterministic lens exists for this kind. Said out loud rather than
     // counted as agreement — an unchecked claim and a corroborated one must
     // not read the same in the consensus.
     recordVerdict(finding, {
-      verifierId: VERIFIER_CORROBORATION, lens: 'authz', verdict: 'undecided',
+      verifierId: VERIFIER_CORROBORATION, lens: 'authz', verdict: 'undecided', evidence: { kind: 'deterministic' },
       reason: `no deterministic lens covers claim kind '${finding.kind}'`,
     });
   }
 
   finding.consensus = consensusOf(finding);
   // Quarantine, not deletion — the same contract falsification uses.
-  finding.quarantined = finding.consensus.verdict === 'refuted';
+  // threat-model FR-04.3: a critical claim is quarantined only on a refutation with sufficient independent authority
+  finding.quarantined = refutationRemoves(finding, finding.consensus);
   return finding;
 }