@clear-capabilities/agentic-security-scanner 0.195.29 → 0.195.30

package/CHANGELOG.md

@@ -9,6 +9,37 @@
 > make the history less accurate, not more.
 
 
+## 0.195.30 - Threat model hardening: verdicts bound to what they tested, honest path limits, a fail-closed restricted profile, and candidate qualification
+
+**Measured, 0.195.29:** `TIMINGS preflight=6s push=13s pr=4s checks=737s merge=5s verify=10s tag=2s release=254s npm=146s total=1177s release-clock=271s`, shipped from the merge to the published release in 271 s; the npm listing lagged the publish and `ship --resume` confirmed it.
+
+The locally verifiable part of the threat model hardening plan. Each of the nine reproduced baseline behaviours (TM-01 to TM-09) has a failing control that now passes. Staging delivery, independent accuracy measurement, attested execution and owner approvals are separate qualifications and are not claimed: the candidate packet records each as blocked. Nothing moved a maturity. Per-requirement state: `docs/implementation-status/threat-model-hardening.md`.
+
+- **Changed results, listed first.**
+  - A hunt's target counter counts only events with the matched route template and method, so an unrelated route no longer inflates it.
+  - An authoritative `authenticated: false` survives a redacted authorization header: a header alone shows a credential was present, not that it was accepted.
+  - An IAM deny blocks only the action, resource and condition it matches; a conditional or opaque deny that can affect the action leaves the path `unresolved` instead of blocked.
+  - A family or directory triage bucket is advisory: a new high finding keeps its confidence.
+  - Corroboration is counted by independent evidence group, not by lens.
+- **Detection (FR-07).** Credential presence and authentication outcome are separate. A new `object-authz` rule detects an authenticated actor receiving another tenant's object. Hunts report window gaps, and a detection signal is never reported as a corroborated effect on its own. CWE-639 moved to the new payload class; the detection IR documents the change.
+- **Scope (FR-01).** Standard JSON carries the `scope` object and a deterministic `inventoryDigest` over every eligibility decision before display caps. Scope preview agrees with it. A release scope reconciliation reports each critical route or unit as covered, excluded, unsupported or unknown.
+- **IAM and paths (FR-03).** Per-action deny evaluation, the `StringEquals`, `StringNotEquals`, `Bool` and `ArnEquals` condition subset, and `truncation.reasons` that tell depth, expansion, result-count and deadline cutoffs apart. A search that hit a bound cannot certify the absence of a path. `boundaries --action` queries one action. The boundary context version is 1.1.0, with optional fields only.
+- **Proof binding (FR-04).** A deployed path is promoted only by an Ed25519-signed proof binding from a trusted issuer. The binding covers the revision, artifact, policy, actor, tenant, route, scenario and oracle. A receipt from another revision or context keeps its stable id with a distinct diagnostic.
+- **Learned decisions (FR-05).** Exact, scoped, HMAC-signed triage decisions apply; bucket matches, expired, copied, cross-tenant and unsigned records do not. A confirmed root cause yields a sibling review queue with six separate states. The legacy `mitigated` count keeps its detector-coverage meaning.
+- **Restricted egress (FR-06).** `AGENTIC_SECURITY_EGRESS_PROFILE=restricted` requires its authoritative policy and fails closed on a malformed, unreadable, missing or unsupported one before any model request. An operator deny always wins. High-impact MCP approvals can be bound to tool, action, target and change, with an expiry; the restricted profile requires that binding.
+- **Pilot (FR-02, FR-08).** Loopback fixtures cover:
+  - a two-tenant records service (PILOT-01 to PILOT-08);
+  - the order approval invariant (wrong guard, then patched);
+  - an app-to-cloud chain whose object store adjudicates with its own evaluator;
+  - a bounded SQLite injection proof (PILOT-12).
+- **Candidate qualification (FR-10).**
+  - A signed candidate packet; gates G-01 to G-07 are recomputed from case evidence, never read from the packet.
+  - `agentic-security release-package qualify <packet> --public-key <pem>` exits 0 only when qualified.
+  - Each case carries a `local`, `staging` or `independent` tier, and a gate that requires a tier (`--require-tier G-05=staging`) counts only cases of that tier.
+  - `revalidateDecision` refuses a decision for another artifact, policy, scanner bundle or packet, or after its evidence expires.
+  - `npm run pilot:qualify` writes one signed packet per deployment identity. On a developer host it reports "not qualified", with the blocked staging, independent and attested-runner cases named.
+- **Evaluation scoring (FR-09.2).** Every enrolled label is reconciled to one status. A negative label whose target the run never reached used to leave the count without a trace; it is now counted as `negativesOutsideRun`.
+
 ## 0.195.29 - `scan --watch` watches, the validator collects callers and configuration, and pilot tooling for the measured targets
 
 **Measured, 0.195.28:** `TIMINGS preflight=3s push=6s pr=1s checks=430s merge=6s verify=6s tag=2s release=131s npm=450s total=1035s release-clock=145s`, shipped from the merge to the published release in 145 s; the run stopped once on a git index lock held by the post-commit gate warm-up, and `ship --resume` continued after it.

package/bin/agentic-security.js

@@ -147,6 +147,7 @@ Commands:
   release-view <package.json>  Developer, CISO and auditor views of one signed release package (--view, --format text|json|html, --previous, --public-key)
   metrics [path]               Assurance Coverage, Evidence Conversion and Verified Remediation Rate for the last scan, each with numerator and denominator (--format text|json)
   release-package build|verify Build a signed release package from the last scan (--private-key, --output, --fix-records), or check one offline (--public-key)
+                               release-package qualify <packet.json> --public-key <pem>: recompute candidate gates G-01..G-07 from a signed candidate packet (exit 0 only when qualified; --require-case, --require-gate, --require-tier G-05=staging, --output, --format json)
   reset [--yes] [--keep ...]   Right-to-delete: wipe accumulated learned state under .agentic-security/ (preserves operator-authored config)
                                --expired    only remove artifacts past their retention-class TTL
                                Every run writes a deletion-report.json proving what was planned/deleted/preserved/failed.
@@ -181,7 +182,7 @@ Commands:
   scan-baseline --current <f> --previous <f>
                                Finding-level diff between two scan JSON outputs.
                                Reports added / removed / changed findings.
-  boundaries --from <dir> [--findings <last-scan.json>] [--environment <name>] [--out <file>] [--json]
+  boundaries --from <dir> [--findings <last-scan.json>] [--environment <name>] [--out <file>] [--json] [--action <iam-action>]
                                Build a deployment boundary graph from local configuration
                                (and optional sanitized traces) and attach a boundary context
                                to each finding of a scan result. Read-only, local files only.
@@ -4166,9 +4167,9 @@ Do not suppress anything you are not certain is a false positive. When in doubt,
 // 3 the feature is disabled, blocked or unsupported on this platform (nothing was read).
 async function cmdBoundaries(args) {
   const f = args.flags;
-  const usage = 'Usage: agentic-security boundaries --from <dir> [--findings <last-scan.json>] [--environment <name>] [--repository <name>] [--revision <sha>] [--root <project>] [--out <file>] [--json] [--now <iso>]';
+  const usage = 'Usage: agentic-security boundaries --from <dir> [--findings <last-scan.json>] [--environment <name>] [--repository <name>] [--revision <sha>] [--root <project>] [--out <file>] [--json] [--now <iso>] [--action <iam-action>]';
   if (typeof f.from !== 'string' || !f.from) { console.error(usage); return 2; }
-  for (const k of ['findings', 'environment', 'repository', 'revision', 'out', 'now', 'root']) {
+  for (const k of ['findings', 'environment', 'repository', 'revision', 'out', 'now', 'root', 'action']) {
     if (f[k] !== undefined && (typeof f[k] !== 'string' || !f[k])) { console.error(`agentic-security boundaries: --${k} needs a value\n${usage}`); return 2; }
   }
   const scanRoot = path.resolve(f.root || '.');
@@ -4178,6 +4179,8 @@ async function cmdBoundaries(args) {
   const result = runBoundaries({
     config, from: path.resolve(f.from), environment: f.environment || 'prod', repository: f.repository || null, revision: f.revision || null,
     findingsFile: f.findings ? path.resolve(f.findings) : null, verifySignature: _verifyLastScan, now: f.now,
+    // threat-model FR-03.2: an action-specific query (`--action s3:GetObject`) decides each IAM hop for that action only
+    action: f.action || null,
   });
   if (result.status === 'disabled' || result.status === 'blocked' || result.status === 'unsupported') {
     console.error(`agentic-security boundaries: not run (${result.status}): ${result.reason}`);

package/dist/1340.index.js

@@ -666,6 +666,8 @@ function parseCompose(text, fileCtx) {
   return kit.result();
 }
 
+// EXTERNAL MODULE: ./src/lineage/deployment/iam-eval.js
+var iam_eval = __webpack_require__(1086);
 ;// CONCATENATED MODULE: ./src/lineage/deployment/adapter-cloud.js
 // adapter-cloud.js: Terraform plan JSON and IAM policy documents into
 // deployment boundary nodes and edges (X-302).
@@ -679,6 +681,7 @@ function parseCompose(text, fileCtx) {
 
 
 
+
 const TERRAFORM_PARSER = 'terraform-plan-json';
 const TERRAFORM_PARSER_VERSION = '1';
 const IAM_PARSER = 'iam-policy-json';
@@ -708,10 +711,12 @@ function applyPolicy(kit, identity, policy, subject) {
     const conditioned = isObject(st.Condition) && Object.keys(st.Condition).length > 0;
     read += 1;
     if (resources.length > MAX_RESOURCES_PER_STATEMENT) kit.gap('limit-exceeded', subject, `a statement lists ${resources.length} resources; only the first ${MAX_RESOURCES_PER_STATEMENT} are read`);
+    if (actions.join(',').length > 250) kit.gap('limit-exceeded', subject, 'a statement\'s action list is longer than the graph records; the clipped list leaves decisions about the missing actions unresolved');
+    if (conditioned && (0,iam_eval/* statementAttrs */.c2)(actions, st.Condition).conditionSupported !== true) kit.gap('unsupported-syntax', subject, 'a statement condition uses an operator or value outside the supported subset (StringEquals, StringNotEquals, Bool, ArnEquals); decisions it can affect stay unresolved');
     for (const r of resources.slice(0, MAX_RESOURCES_PER_STATEMENT)) {
       const target = kit.node('resource', `aws/${r}`, { trustZone: 'internal', attrs: r === '*' ? { wildcard: true } : {} });
-      const attrs = { actions: actions.join(',').slice(0, 250) };
-      if (conditioned) attrs.conditioned = true;
+      // threat-model FR-03.1: the action list (and whether it was clipped) and the condition, in a form the path search can decide
+      const attrs = (0,iam_eval/* statementAttrs */.c2)(actions, conditioned ? st.Condition : null);
       kit.edge('grants', identity, target, {
         effect, confidence: conditioned ? 'low' : 'high', discriminator: `${actions.join(',')}${conditioned ? ';cond' : ''}`.slice(0, 250), attrs,
       });
@@ -1638,8 +1643,8 @@ function applyCorrelation(graph, correlation) {
   return (0,boundary_graph/* buildBoundaryGraph */.v4)({ repository: graph.repository, revision: graph.revision, nodes, edges, gaps: graph.gaps, sources: graph.sources });
 }
 
-// EXTERNAL MODULE: ./src/lineage/deployment/projection.js + 1 modules
-var projection = __webpack_require__(73596);
+// EXTERNAL MODULE: ./src/lineage/deployment/projection.js + 2 modules
+var projection = __webpack_require__(83929);
 ;// CONCATENATED MODULE: ./src/lineage/deployment/boundaries-run.js
 // boundaries-run.js: the operator entry point that builds a boundary context for scanned findings (X-308 wiring).
 //
@@ -1741,7 +1746,7 @@ function readScanFindings(file, { maxBytes, verify } = {}) {
  * @param {string} [o.now]         ISO time used to judge trace staleness; defaults to the current time
  * @returns {object} typed result; `status` is ok | disabled | blocked | unsupported | error. Never throws.
  */
-function runBoundaries({ config, from, environment = 'prod', repository = null, revision = null, findingsFile = null, findings: suppliedFindings = null, verifySignature, now } = {}) {
+function runBoundaries({ config, from, environment = 'prod', repository = null, revision = null, findingsFile = null, findings: suppliedFindings = null, verifySignature, now, action = null } = {}) {
   const gate = (0,assurance_config/* featureStatus */.FX)(config, DEPLOYMENT_FEATURE);
   if (gate.status !== 'ok') return { ...gate, report: null };
   const limits = (0,assurance_config/* limitValues */.OH)(config);
@@ -1818,7 +1823,7 @@ function runBoundaries({ config, from, environment = 'prod', repository = null,
     if (integrity === 'unsigned') notes.push('the scan result carries no signature, so its integrity was not verified');
   }
 
-  const attached = (0,projection/* attachBoundaryContext */.Nu)({ config, findings, graph, bindings, now: clock });
+  const attached = (0,projection/* attachBoundaryContext */.Nu)({ config, findings, graph, bindings, now: clock, action });
   if (attached.status !== 'ok') return { ...attached, report: null };
   const contexts = attached.findings.map((f) => f.boundaryContext).filter(Boolean);
   const rows = attached.findings.map((f) => ({