@clear-capabilities/agentic-security-scanner 0.195.29 → 0.195.30

package/src/lineage/deployment/boundaries-run.js

@@ -98,7 +98,7 @@ export function readScanFindings(file, { maxBytes, verify } = {}) {
  * @param {string} [o.now]         ISO time used to judge trace staleness; defaults to the current time
  * @returns {object} typed result; `status` is ok | disabled | blocked | unsupported | error. Never throws.
  */
-export function runBoundaries({ config, from, environment = 'prod', repository = null, revision = null, findingsFile = null, findings: suppliedFindings = null, verifySignature, now } = {}) {
+export function runBoundaries({ config, from, environment = 'prod', repository = null, revision = null, findingsFile = null, findings: suppliedFindings = null, verifySignature, now, action = null } = {}) {
   const gate = featureStatus(config, DEPLOYMENT_FEATURE);
   if (gate.status !== 'ok') return { ...gate, report: null };
   const limits = limitValues(config);
@@ -175,7 +175,7 @@ export function runBoundaries({ config, from, environment = 'prod', repository =
     if (integrity === 'unsigned') notes.push('the scan result carries no signature, so its integrity was not verified');
   }
 
-  const attached = attachBoundaryContext({ config, findings, graph, bindings, now: clock });
+  const attached = attachBoundaryContext({ config, findings, graph, bindings, now: clock, action });
   if (attached.status !== 'ok') return { ...attached, report: null };
   const contexts = attached.findings.map((f) => f.boundaryContext).filter(Boolean);
   const rows = attached.findings.map((f) => ({

package/src/lineage/deployment/iam-eval.js

@@ -0,0 +1,105 @@
+// Action-specific IAM decisions for the boundary graph (threat-model PRD FR-03.1, FR-03.4; TM-03).
+//
+// A deny blocks a requested action only when its action and resource patterns match that action and resource AND its condition holds.
+// Before this, any deny edge on a hop blocked it: an unrelated `s3:DeleteObject` deny closed an `s3:GetObject` path, and a conditional
+// deny whose predicate was never evaluated closed it too.
+//
+// The finite policy subset this module decides, and nothing more:
+//   actions and resources  exact strings and IAM globs (`*`, `?`), case-insensitive for actions, case-sensitive for resources
+//   conditions             StringEquals, StringNotEquals, Bool, ArnEquals; every operator and every key must hold (AND), any listed
+//                          value of a key satisfies it (OR); a key the request context does not supply is UNKNOWN
+//   anything else          (an `...IfExists` or set operator, a policy variable, a value outside the attribute grammar, a clipped
+//                          action list) is recorded as unsupported and leaves the decision UNRESOLVED, never allowed or blocked
+//
+// Network denies are not IAM decisions and are not judged here: they still block the hop they sit on.
+const SUPPORTED_OPERATORS = new Set(['StringEquals', 'StringNotEquals', 'Bool', 'ArnEquals']);
+const MAX_CONDITIONS = 8;
+const VALUE_GRAMMAR = /^[A-Za-z0-9_.:\/*,@ +=-]{0,200}$/;
+
+/** IAM glob to RegExp. */
+function glob(pattern, flags = '') {
+  return new RegExp(`^${String(pattern).replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.')}$`, flags);
+}
+export const actionMatches = (pattern, action) => glob(pattern, 'i').test(String(action));
+export const resourceMatches = (pattern, resource) => glob(pattern).test(String(resource));
+
+/**
+ * The structured attributes a grants edge carries for one statement. Fits the graph's attribute grammar (at most 16 keys; values
+ * limited to a safe character set), so the graph contract and its digests are unchanged for every existing field.
+ */
+export function statementAttrs(actions, condition) {
+  const joined = actions.join(',');
+  const attrs = { actions: joined.slice(0, 250), actionsComplete: joined.length <= 250 };
+  if (!condition || typeof condition !== 'object' || !Object.keys(condition).length) return attrs;
+  attrs.conditioned = true;
+  let n = 0; let supported = true;
+  for (const [op, block] of Object.entries(condition)) {
+    if (!SUPPORTED_OPERATORS.has(op) || !block || typeof block !== 'object') { supported = false; continue; }
+    for (const [key, raw] of Object.entries(block)) {
+      const values = [].concat(raw).map(String);
+      const text = `${op} ${key}=${values.join(',')}`;
+      if (n >= MAX_CONDITIONS || !VALUE_GRAMMAR.test(text) || values.some((v) => v.includes(',') || v.includes('${'))) { supported = false; continue; }
+      attrs[`cond${n++}`] = text;
+    }
+  }
+  attrs.conditionSupported = supported;
+  return attrs;
+}
+
+/** Evaluate an edge's encoded condition against a request context. 'true' | 'false' | 'unknown' (with the reason). */
+export function evaluateCondition(attrs, context = {}) {
+  if (!attrs || !attrs.conditioned) return { result: 'true', reason: 'unconditional' };
+  if (attrs.conditionSupported !== true) return { result: 'unknown', reason: 'the condition uses an operator or value outside the supported subset' };
+  const ctx = context && typeof context === 'object' ? context : {};
+  let unknown = null;
+  for (const [k, text] of Object.entries(attrs)) {
+    if (!/^cond\d+$/.test(k)) continue;
+    const m = /^(\S+) ([^=]+)=(.*)$/.exec(String(text));
+    if (!m) return { result: 'unknown', reason: 'an encoded condition could not be read' };
+    const [, op, key, list] = m;
+    const values = list.split(',');
+    if (!Object.prototype.hasOwnProperty.call(ctx, key)) { unknown = unknown ?? `the request context does not supply ${key}`; continue; }
+    const actual = String(ctx[key]);
+    const holds = op === 'StringNotEquals' ? !values.includes(actual) : op === 'Bool' ? values.map((v) => v.toLowerCase()).includes(actual.toLowerCase()) : values.includes(actual);
+    if (!holds) return { result: 'false', reason: `${op} ${key} does not hold for ${actual}` };
+  }
+  return unknown ? { result: 'unknown', reason: unknown } : { result: 'true', reason: 'every condition holds for the request context' };
+}
+
+const actionsOf = (e) => String(e.attrs?.actions ?? '').split(',').filter(Boolean);
+const clipped = (e) => e.attrs?.actionsComplete === false;
+/** An edge that records no action list (another adapter, a hand-built graph): what it covers is not known. */
+export const opaque = (e) => actionsOf(e).length === 0;
+/** The pseudo-action used when the allow statements record no actions: "whatever was granted". */
+export const UNKNOWN_ACTION = '(unrecorded)';
+
+/**
+ * Decide one action across a hop's allow and deny grants edges.
+ * @returns {{action:string, outcome:'possible'|'blocked'|'unresolved'|'not-granted', blockers:object[], unresolvedBy:string[]}}
+ */
+export function decideAction(allows, denies, action, context) {
+  const unresolvedBy = [];
+  let granted = false;
+  for (const e of allows) {
+    const pats = actionsOf(e);
+    if (opaque(e)) { granted = true; continue; } // an allow with no action list grants something; it is not narrowed here
+    if (!pats.some((p) => actionMatches(p, action))) { if (clipped(e)) unresolvedBy.push(`allow ${e.id}: its action list was clipped, so ${action} may be granted`); continue; }
+    const c = evaluateCondition(e.attrs, context);
+    if (c.result === 'true') granted = true;
+    else if (c.result === 'unknown') { granted = true; unresolvedBy.push(`allow ${e.id}: ${c.reason}`); }
+  }
+  if (!granted && !unresolvedBy.length) return { action, outcome: 'not-granted', blockers: [], unresolvedBy };
+  const blockers = [];
+  for (const d of denies) {
+    const pats = actionsOf(d);
+    // a deny with no action list, or any deny when the granted actions are themselves unrecorded, cannot be matched: unresolved
+    if (opaque(d)) { unresolvedBy.push(`deny ${d.id}: it records no action list, so whether it covers ${action} is unknown`); continue; }
+    if (action === UNKNOWN_ACTION) { unresolvedBy.push(`deny ${d.id}: the granted actions are not recorded, so whether it covers them is unknown`); continue; }
+    if (!pats.some((p) => actionMatches(p, action))) { if (clipped(d)) unresolvedBy.push(`deny ${d.id}: its action list was clipped`); continue; }
+    const c = evaluateCondition(d.attrs, context);
+    if (c.result === 'true') blockers.push({ edgeId: d.id, action, matchedActions: pats.filter((p) => actionMatches(p, action)), condition: c.reason });
+    else if (c.result === 'unknown') unresolvedBy.push(`deny ${d.id}: ${c.reason}`);
+  }
+  if (blockers.length) return { action, outcome: 'blocked', blockers, unresolvedBy };
+  return { action, outcome: unresolvedBy.length ? 'unresolved' : 'possible', blockers, unresolvedBy };
+}

package/src/lineage/deployment/projection.js

@@ -27,6 +27,9 @@ export const COVERAGE_SCHEMA = 'agentic-security/boundary-coverage';
 export const BOUNDARY_FEATURE = 'deployment-boundaries';
 
 const CONTEXT_KEYS = ['schema', 'schemaVersion', 'id', 'hypothesisId', 'finding', 'binding', 'graph', 'exposure', 'paths', 'truncated', 'verification', 'uncovered', 'warnings'];
+// Optional from 1.1.0: a 1.0.0 context stays valid without them, and may not carry them.
+const OPTIONAL_KEYS_1_1 = ['truncation', 'action'];
+const SUPPORTED_VERSIONS = ['1.0.0', '1.1.0'];
 const FILTER_KEYS = ['service', 'repository', 'environment', 'tenant'];
 const MAX_STRING = 600;
 
@@ -72,7 +75,9 @@ export function validateBoundaryContext(ctx) {
   const errors = [];
   if (!ctx || typeof ctx !== 'object' || Array.isArray(ctx)) return { ok: false, errors: [{ code: 'BAD_TYPE', path: '', message: 'a boundary context must be an object' }] };
   if (ctx.schema !== BOUNDARY_CONTEXT_SCHEMA) errors.push({ code: 'BAD_SCHEMA', path: 'schema', message: `schema must be '${BOUNDARY_CONTEXT_SCHEMA}'` });
-  for (const k of Object.keys(ctx)) if (!CONTEXT_KEYS.includes(k)) errors.push({ code: 'UNKNOWN_FIELD', path: k, message: `field '${k}' is not part of a boundary context` });
+  if (!SUPPORTED_VERSIONS.includes(ctx.schemaVersion)) errors.push({ code: 'BAD_SCHEMA', path: 'schemaVersion', message: `schemaVersion must be one of ${SUPPORTED_VERSIONS.join(', ')}` });
+  const allowed = ctx.schemaVersion === '1.0.0' ? CONTEXT_KEYS : [...CONTEXT_KEYS, ...OPTIONAL_KEYS_1_1];
+  for (const k of Object.keys(ctx)) if (!allowed.includes(k)) errors.push({ code: 'UNKNOWN_FIELD', path: k, message: `field '${k}' is not part of a boundary context ${ctx.schemaVersion}` });
   for (const k of CONTEXT_KEYS) if (!(k in ctx)) errors.push({ code: 'MISSING_FIELD', path: k, message: `field '${k}' is required` });
   if (errors.length) return { ok: false, errors };
   if (typeof ctx.id !== 'string' || !ctx.id) errors.push({ code: 'BAD_TYPE', path: 'id', message: 'id must be a non-empty string' });
@@ -95,13 +100,14 @@ function pathView(p) {
     environments: p.environments, tenants: p.tenants, services, repositories, provenance: p.provenance,
     entry: p.entry, target: p.target,
     hops: p.hops.map((h) => ({
-      index: h.index, from: h.from, to: h.to, relations: h.relations, state: h.state,
+      index: h.index, from: h.from, to: h.to, relations: h.relations, state: h.state, ...(h.actions ? { actions: h.actions } : {}),
       edges: h.edges.map((e) => ({
         id: e.id, relation: e.relation, provenance: e.provenance, effect: e.effect, confidence: e.confidence, pathState: e.pathState,
         sourceRevision: e.sourceRevision, source: e.source, observationInterval: e.observationInterval, completeness: e.completeness,
       })),
     })),
     supportingEdgeIds: p.supportingEdgeIds, conditions: p.conditions, blockers: p.blockers, assumptions: p.assumptions,
+    ...(p.actionOutcomes ? { actionOutcomes: p.actionOutcomes } : {}),
     crossings: p.crossings, uncoveredBoundaries: uncovered,
     freshness: {
       observedFrom: p.coverage.observedFrom, observedUntil: p.coverage.observedUntil, staleHops: p.coverage.staleHops,
@@ -231,12 +237,12 @@ export function boundaryCoverage(contexts) {
  *
  * @returns {{ status: string, code?: string, reason?: string, findings: object[], errors: object[] }}
  */
-export function attachBoundaryContext({ config, findings, graph, bindings = [], records = [], now } = {}) {
+export function attachBoundaryContext({ config, findings, graph, bindings = [], records = [], now, action = null } = {}) {
   const gate = featureStatus(config, BOUNDARY_FEATURE);
   if (gate.status !== 'ok') return { ...gate, findings, errors: [] };
   const out = [], errors = [];
   for (const f of Array.isArray(findings) ? findings : []) {
-    const r = analyzeFindingBoundaries({ graph, finding: f, bindings, records, now });
+    const r = analyzeFindingBoundaries({ graph, finding: f, bindings, records, now, ...(action ? { action } : {}) });
     if (!r.ok) { errors.push(...r.errors); out.push(f); continue; }
     out.push({ ...f, boundaryContext: r.context });
   }

package/src/lineage/deployment/proof-binding.js

@@ -0,0 +1,79 @@
+// Scope-bound proof for deployed paths (threat-model PRD FR-04.1, FR-04.2; TM-05).
+//
+// A verification record proves a COMPONENT behaviour at one commit. Before this, a record for revision A promoted both the exposure
+// and the impact paths of a revision B graph to exploitable. Now:
+//
+//   component proof   the record is applicable (validated, trusted runtime proof, the class's oracle) AND its commit is the graph's
+//                     revision. A record for another revision is kept as historical evidence with the mismatch, never applied.
+//   path promotion    additionally needs a proof-binding envelope, version 1, for that record and that exact path: the artifact and
+//                     policy (graph) digests, environment, tenant, actor, route and action, the path id and its kind (exposure or
+//                     impact), the oracle version and the effect the oracle observed, issued and signed by an issuer the operator
+//                     trusts (an Ed25519 public key in the trust root). A matching digest or a caller's label is not authority.
+//
+// Every refusal has its own code, so a reviewer can tell a malformed envelope from a tampered, an expired or a replayed one. An exact
+// duplicate envelope adds nothing.
+import crypto from 'node:crypto';
+
+export const PROOF_BINDING_SCHEMA = 'agentic-security/proof-binding';
+export const PROOF_BINDING_VERSION = 1;
+const FIELDS = ['schema', 'version', 'recordId', 'commit', 'artifactDigest', 'policyDigest', 'environment', 'tenant', 'actor', 'route', 'action', 'pathId', 'claim', 'oracleVersion', 'effect', 'issuer', 'issuedAt', 'expires'];
+const REQUIRED = ['recordId', 'commit', 'artifactDigest', 'policyDigest', 'environment', 'actor', 'pathId', 'claim', 'oracleVersion', 'effect', 'issuer', 'issuedAt', 'expires'];
+const CLAIMS = new Set(['exposure', 'impact']);
+
+const canonical = (e) => JSON.stringify(FIELDS.map((k) => [k, e[k] ?? null]));
+export const bindingDigest = (e) => crypto.createHash('sha256').update(canonical(e)).digest('hex');
+
+/** Sign an envelope with an issuer's Ed25519 private key (used by an issuer and by tests). */
+export function signProofBinding(envelope, privateKeyPem) {
+  const body = { schema: PROOF_BINDING_SCHEMA, version: PROOF_BINDING_VERSION, ...envelope };
+  return { ...body, signature: crypto.sign(null, Buffer.from(canonical(body)), privateKeyPem).toString('base64') };
+}
+
+/** Structural and authority check of one envelope. Returns { ok, code, reason }. */
+export function verifyProofBinding(e, { trustRoot = {}, now = Date.now() } = {}) {
+  if (!e || typeof e !== 'object' || Array.isArray(e)) return { ok: false, code: 'malformed', reason: 'the binding is not an object' };
+  if (e.schema !== PROOF_BINDING_SCHEMA || e.version !== PROOF_BINDING_VERSION) return { ok: false, code: 'unsupported-version', reason: 'the binding schema or version is not supported' };
+  for (const k of Object.keys(e)) if (!FIELDS.includes(k) && k !== 'signature') return { ok: false, code: 'malformed', reason: `unknown binding field ${k}` };
+  for (const k of REQUIRED) if (e[k] === undefined || e[k] === null || e[k] === '') return { ok: false, code: 'missing-binding', reason: `the binding has no ${k}` };
+  if (!CLAIMS.has(e.claim)) return { ok: false, code: 'malformed', reason: 'claim must be exposure or impact' };
+  const key = trustRoot[e.issuer];
+  if (!key) return { ok: false, code: 'untrusted-issuer', reason: `issuer ${String(e.issuer).slice(0, 60)} is not in the operator's trust root` };
+  let good = false;
+  try { good = typeof e.signature === 'string' && crypto.verify(null, Buffer.from(canonical(e)), key, Buffer.from(e.signature, 'base64')); } catch { good = false; }
+  if (!good) return { ok: false, code: 'tampered', reason: 'the signature does not verify against the issuer\'s key' };
+  if (!(Date.parse(e.expires) > now)) return { ok: false, code: 'expired', reason: 'the binding has expired' };
+  return { ok: true, code: 'verified', reason: null };
+}
+
+/**
+ * Decide whether a path may be promoted by a component proof, given the bindings supplied for it.
+ * @param {{path:object, kind:'exposure'|'impact', graph:object, record:object, bindings:object[], trustRoot:object, now:number,
+ *          expect:{artifactDigest?:string, environment?:string, tenant?:string|null, actor?:string, route?:string, action?:string}}} a
+ * @returns {{promote:boolean, code:string, reason:string, bindingId:string|null, diagnostics:object[]}}
+ */
+export function judgePathPromotion({ path, kind, graph, record, bindings = [], trustRoot = {}, now = Date.now(), expect = {} }) {
+  const diagnostics = [];
+  const seen = new Set();
+  const forRecord = bindings.filter((b) => b && b.recordId === record.id);
+  if (!forRecord.length) return { promote: false, code: 'component-only', reason: 'the proof covers the component; no issued binding ties it to this deployed path', bindingId: null, diagnostics };
+  for (const b of forRecord) {
+    const id = bindingDigest(b);
+    if (seen.has(id)) continue; // an exact duplicate adds no authority
+    seen.add(id);
+    const v = verifyProofBinding(b, { trustRoot, now });
+    if (!v.ok) { diagnostics.push({ bindingId: id.slice(0, 16), code: v.code, reason: v.reason }); continue; }
+    const mismatch = [];
+    if (b.commit !== record.commit) mismatch.push('commit');
+    if (graph.revision && b.commit !== graph.revision) mismatch.push('revision');
+    if (b.policyDigest !== graph.digest) mismatch.push('policy');
+    if (b.pathId !== path.id) mismatch.push('path');
+    if (b.claim !== kind) mismatch.push('claim');
+    if (record.oracle && b.oracleVersion !== String(record.oracle.version ?? '')) mismatch.push('oracle');
+    if (!(path.environments || []).includes(b.environment)) mismatch.push('environment');
+    if ((path.tenants || []).length && !(path.tenants || []).includes(b.tenant)) mismatch.push('tenant');
+    for (const k of ['artifactDigest', 'environment', 'tenant', 'actor', 'route', 'action']) if (expect[k] !== undefined && expect[k] !== null && b[k] !== expect[k]) mismatch.push(k);
+    if (mismatch.length) { diagnostics.push({ bindingId: id.slice(0, 16), code: 'context-mismatch', reason: `the binding was issued for another ${[...new Set(mismatch)].join(', ')}` }); continue; }
+    return { promote: true, code: 'bound', reason: `issued binding ${id.slice(0, 16)} by ${b.issuer} ties the proof to this ${kind} path`, bindingId: id.slice(0, 16), diagnostics };
+  }
+  return { promote: false, code: diagnostics.length ? diagnostics[0].code : 'component-only', reason: diagnostics.length ? diagnostics.map((d) => d.reason).join('; ') : 'no binding applies', bindingId: null, diagnostics };
+}

package/src/llm-validator/bounded-context.js

@@ -156,7 +156,8 @@ function collectConfiguration(finding, fileContents, { window, maxConfig, add, g
     if (typeof code !== 'string' || !CONFIG_FILE.test(file) || code.length > 500_000) continue;
     const cl = code.split('\n');
     for (const key of keys) {
-      const re = new RegExp(`(?<![\\w])${escapeRe(key)}(?![\\w])`);
+      // the key is escaped before it reaches the pattern, which has no quantifier at all
+      const re = new RegExp(`(?<![\\w])${escapeRe(key)}(?![\\w])`); // agentic-security-ignore: CWE-1333
       const i = cl.findIndex((t) => re.test(t));
       if (i < 0) continue;
       found.add(key);

package/src/mcp/CLAUDE.md

@@ -88,6 +88,12 @@ the before and after image, **no content**) and `languageFix.planDigest` after r
 caller then sends `apply_fix {finding_id, confirm:true, plan_digest}` (optionally `dry_run:true`, `fixMeta.approval` for a
 high-impact change).
 
+**Approval binding (threat-model FR-06.3).** `fixMeta.approval` may carry `expires` (ISO time) and `scope: {tool, action, target,
+change}`: `tool` is `apply_fix`, `action` is `apply-plan` (multi-file) or `apply-patch`, `target` is the finding's stableId, and
+`change` is the plan digest or the digest of the exact edits (path, before and after image hashes). `approvalBindingRefusal` refuses
+an expired approval and one issued for another tool, action, target or change. Under the restricted execution profile
+(`AGENTIC_SECURITY_EGRESS_PROFILE=restricted`) both fields are required; elsewhere an approval without them works as before.
+
 Design decision: the caller **cannot supply file content** on this path (`plan_digest` plus `patch` is refused). The server
 re-derives the plan with `planNixFix` over `loadLanguageProject` and refuses unless the digest matches, so "the plan applied is
 exactly the plan previewed" holds by construction, and a changed project file, a changed finding or an altered digest all give

package/src/mcp/tools.js

@@ -640,7 +640,26 @@ export const explain_finding = {
 // FR-307/FR-1002/FR-1003: the high-impact-change approval gate (approval evidence, approver identity, separation of duties),
 // shared by the caller-patch branch and the multi-file plan branch so the two cannot drift. Returns a refusal result, or null
 // when the change is not high-impact or is properly approved.
-function _highImpactApprovalRefusal(ctx, materialClassification, fixMeta) {
+// Threat-model PRD FR-06.3: an approval is bound to what it approved. With a `scope` it names the tool, the action, the target finding
+// and the change (the digest of the exact edits), and with `expires` it lapses. Under the restricted execution profile
+// (AGENTIC_SECURITY_EGRESS_PROFILE=restricted) both are required; elsewhere a supplied scope or expiry is still enforced. An approval
+// copied to another finding, another change or another tool, or used after it expired, is refused.
+export function approvalBindingRefusal(approval, expected, { now = Date.now(), restricted = process.env.AGENTIC_SECURITY_EGRESS_PROFILE === 'restricted' } = {}) {
+  if (restricted && (!approval.expires || !approval.scope)) return 'under the restricted profile an approval must carry an expiry and a scope {tool, action, target, change}';
+  if (approval.expires !== undefined) {
+    const t = Date.parse(approval.expires);
+    if (!Number.isFinite(t)) return 'the approval expiry is not a date';
+    if (!(t > now)) return 'the approval has expired';
+  }
+  if (approval.scope !== undefined) {
+    const sc = approval.scope;
+    if (!sc || typeof sc !== 'object') return 'the approval scope is not an object';
+    for (const k of ['tool', 'action', 'target', 'change']) if (sc[k] !== expected[k]) return `the approval was issued for another ${k}`;
+  }
+  return null;
+}
+
+function _highImpactApprovalRefusal(ctx, materialClassification, fixMeta, expected = null) {
   if (!materialClassification.highImpactCategories.length) return null;
   const cats = materialClassification.highImpactCategories.join(', ');
   const approval = fixMeta && typeof fixMeta === 'object' ? fixMeta.approval : null;
@@ -654,6 +673,10 @@ function _highImpactApprovalRefusal(ctx, materialClassification, fixMeta) {
       materialClassification,
     };
   }
+  if (expected) {
+    const bound = approvalBindingRefusal(approval, expected);
+    if (bound) return { _meta: META, applied: false, reason: `high-impact change (${cats}) approval rejected: ${bound}`, materialClassification };
+  }
   const approverRegistry = loadApproverRegistry(ctx.sessionRoot);
   const requiredRoles = requiredRolesFor(approverRegistry, materialClassification.highImpactCategories);
   const identityCheck = verifyApprover(approverRegistry, approval.approvedBy, requiredRoles);
@@ -739,7 +762,7 @@ async function _applyMultiFilePlan({ f, planDigest, dryRun, fixMeta, ctx, status
   if (!targets.ok) return refuse(targets.reason);
   const classification = classifyFixMaterialRisk(Object.fromEntries(plan.edits.map((e) => [e.file, { before: e.before, after: e.after }])));
   if (!dryRun) {
-    const approvalRefusal = _highImpactApprovalRefusal(ctx, classification, fixMeta);
+    const approvalRefusal = _highImpactApprovalRefusal(ctx, classification, fixMeta, { tool: 'apply_fix', action: 'apply-plan', target: f.stableId || f.id, change: planDigest });
     if (approvalRefusal) return { ...approvalRefusal, multiFile: true };
   }
   // The verification gates (syntax, rescan with no new finding, effective value changed as intended) run inside the lifecycle,
@@ -942,7 +965,8 @@ export const apply_fix = {
       if (dry_run) {
         return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, verificationRecord: verdict.verificationRecord ?? null, ...verificationFields(verdict.verificationRecord), materialClassification, ...(fixVerification ? additiveFields(fixVerification) : {}) };
       }
-      const approvalRefusal = _highImpactApprovalRefusal(ctx, materialClassification, fixMeta);
+      const changeDigest = _sha256(JSON.stringify(Object.entries(filesForMaterialClassification).sort(([a], [b]) => (a < b ? -1 : 1)).map(([k, v]) => [k, _sha256(v.before), _sha256(v.after)])));
+      const approvalRefusal = _highImpactApprovalRefusal(ctx, materialClassification, fixMeta, { tool: 'apply_fix', action: 'apply-patch', target: f.stableId || f.id, change: changeDigest });
       if (approvalRefusal) return approvalRefusal;
       const written = [];
       try {

package/src/pipeline/evidence-record.js

@@ -55,7 +55,7 @@ export function buildScanRecord({ root, scan, meta, argv = [], engineVersion, mo
     tool: { name: 'agentic-security', version: engineVersion || null },
     source: sourceState(root),
     invocation: { flags: invocationSummary(argv), mode: mode || (meta && meta.mode) || 'full' },
-    ignorePolicy: scan.scope ? { mode: scan.scope.policy.mode, ruleDigest: scan.scope.policy.ruleDigest, trackedFileSemantics: scan.scope.policy.trackedFileSemantics } : { mode: 'legacy-walk', ruleDigest: null, trackedFileSemantics: false },
+    ignorePolicy: scan.scope ? { mode: scan.scope.policy.mode, ruleDigest: scan.scope.policy.ruleDigest, trackedFileSemantics: scan.scope.policy.trackedFileSemantics, inventoryDigest: scan.scope.inventoryDigest ?? null } : { mode: 'legacy-walk', ruleDigest: null, trackedFileSemantics: false, inventoryDigest: null },
     rules: { rulesetVersion: scan._rulesetVersion || null, rulesetSource: scan._rulesetVersionSource || null },
     model: model ? { provider: model.provider, model: model.model, egress: model.egress, stages: model.stages } : { configured: false },
     capability: { status: h.status || null, conditions: Array.isArray(h.conditions) ? h.conditions.length : 0 },

package/src/posture/CLAUDE.md

@@ -73,6 +73,8 @@ function is not exported.
 
 Its contract is **recall-preserving, same precedent as `falsification.js` / `dataflow/proof-gate.js`**: it never removes a finding, never touches `severity`, and never asserts `unreachable` without positive evidence — a negative verdict additionally requires the intra-repo import graph to be hole-free *along the reachable set* (an unresolved relative import or a non-literal `require(x)` in a reachable file hides a possible edge, so every would-be `unreachable` degrades to `unknown`). `null`/`'unknown'` is a first-class state and is **not** the same as `false`. Wired in `engine.js` after the entry-point inventory is built and after every finding has been appended (multi-sink and cross-language chains included) so nothing escapes annotation; this is the one annotator that deliberately runs after `why-fired`.
 
+**Threat-model hardening (local, threat-model PRD).** `verification-separation.js` `consensusOf` now votes by independent evidence group (a shared `evidence.observationId`, `generator` or `lineage`, else one verifier), keeps the per-lens counts, reports `conflict` and a `refutationAuthority`; `refutationRemoves` lets a refutation take a critical finding out of the queue only with `sufficient` authority. `triage-memory.js`: a family/directory bucket is advisory (no confidence change); only an exact (stable id + file) decision applies, and for critical/high it also needs a reviewer, expiry, matching scope, unchanged fingerprint and the install's HMAC signature (`pastDecision.status`, `pastDecisionApplies`). `assurance/candidate-qualification.js`: the candidate packet and `evaluateCandidate`, which recomputes gates G-01..G-07 from case evidence (met, violated, unresolved, blocked) and never inherits a pass; `writeCandidateDecision` is atomic and idempotent.
+
 **Enforced verification separation (R7)** — `verification-separation.js`. The falsification pass could already try to *disprove* a finding; what it could not do was prove the checker was not the producer. This module supplies that structural guarantee:
 
 - `recordProducer(finding, producerId)` stamps provenance **write-once** — a later party cannot re-stamp itself as producer to manufacture separation.

package/src/posture/assurance/candidate-qualification.js

@@ -0,0 +1,155 @@
+// Candidate qualification (threat-model PRD FR-10.1, FR-10.2, section 6 "Candidate release gates").
+//
+// A release claim is qualified for an EXACT scanner, target artifact, deployment profile, policy and observation window, and only for
+// the cases it passes. The packet carries those identities and one record per required case (requirement, gate, expected and observed
+// outcome, verdict and reason code, artifact and policy bindings, evidence digests, expiry, owner). The decision is recomputed here from
+// the evidence, never read from the packet: a case whose bindings do not match the packet's target, that has expired, whose feed is
+// stale or whose legitimate control failed keeps its gate open, and the candidate is qualified only when every required gate is met.
+// A higher-level status never inherits a pass from a lower-level one: a gate with no case is unresolved, not met.
+//
+// Outcome per case: met (the expectation held), violated (it did not), unresolved (evidence missing, stale, expired or differently
+// scoped) or blocked (a prerequisite such as an attested runner or an independent population is unavailable). Pure apart from the
+// optional signed write, which is atomic.
+//
+// Evidence tiers stay separate qualifications (PRD section 1 and section 8). Each case carries `tier`: `local` (loopback fixtures on
+// this host, the default), `staging` (the owner-authorized staging deployment) or `independent` (an independently held population or
+// reviewer). A gate the caller declares in `requiredTiers` is met only by cases of that tier: local evidence never satisfies a staging
+// or independent gate by being more of it. A decision records the target it was computed for, and `revalidateDecision` refuses it for
+// any other artifact, policy or scanner bundle, so an upgrade invalidates candidate-bound evidence and a rollback is qualified only by
+// the earlier artifact's own unexpired decision (FR-10.4).
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const CANDIDATE_SCHEMA = 'agentic-security/candidate-packet';
+const CANDIDATE_VERSION = 1;
+export const GATES = Object.freeze({
+  'G-01': 'code regression', 'G-02': 'scan and graph coverage', 'G-03': 'prevention and repair', 'G-04': 'evidence and harness integrity',
+  'G-05': 'detection and response', 'G-06': 'independent accuracy', 'G-07': 'operability',
+});
+const EXPECT = new Set(['positive', 'negative', 'legitimate']);
+const TIERS = new Set(['local', 'staging', 'independent']);
+const DOMAIN = `${CANDIDATE_SCHEMA}@1\n`;
+const canon = (v) => {
+  if (v === null || typeof v !== 'object') return JSON.stringify(v ?? null);
+  if (Array.isArray(v)) return `[${v.map(canon).join(',')}]`;
+  // an undefined value is absent, exactly as JSON would carry it, so a packet and its JSON round trip have one digest
+  return `{${Object.keys(v).filter((k) => v[k] !== undefined).sort().map((k) => `${JSON.stringify(k)}:${canon(v[k])}`).join(',')}}`;
+};
+export const packetDigest = (p) => `sha256:${crypto.createHash('sha256').update(canon({ ...p, signature: undefined })).digest('hex')}`;
+
+/** Sign a packet with an Ed25519 private key; `verifyCandidatePacket` checks it with the key the caller trusts. */
+export function signCandidatePacket(packet, privateKeyPem) {
+  const body = { schema: CANDIDATE_SCHEMA, version: CANDIDATE_VERSION, ...packet };
+  delete body.signature;
+  return { ...body, signature: crypto.sign(null, Buffer.from(DOMAIN + canon(body)), privateKeyPem).toString('base64') };
+}
+export function verifyCandidatePacket(packet, publicKeyPem) {
+  if (!packet || packet.schema !== CANDIDATE_SCHEMA) return { ok: false, code: 'FORMAT' };
+  // a packet from a newer or older writer is refused by name, never read with this version's meaning
+  if (packet.version !== CANDIDATE_VERSION) return { ok: false, code: 'UNSUPPORTED_VERSION', version: packet.version ?? null };
+  const { signature, ...body } = packet;
+  try { return crypto.verify(null, Buffer.from(DOMAIN + canon(body)), publicKeyPem, Buffer.from(String(signature), 'base64')) ? { ok: true, code: 'VERIFIED' } : { ok: false, code: 'SIGNATURE' }; } catch { return { ok: false, code: 'SIGNATURE' }; }
+}
+
+/** Judge one case record against the packet's target. */
+function judgeCase(c, packet, now) {
+  const t = packet.target || {};
+  const miss = [];
+  for (const k of ['caseId', 'requirement', 'gate', 'expected', 'verdict', 'owner', 'expires']) if (c[k] === undefined || c[k] === null || c[k] === '') miss.push(k);
+  if (miss.length) return { outcome: 'unresolved', reason: `missing ${miss.join(', ')}`, owner: c.owner ?? null };
+  if (!GATES[c.gate] || !EXPECT.has(c.expected)) return { outcome: 'unresolved', reason: 'unknown gate or expectation' };
+  if (c.tier !== undefined && !TIERS.has(c.tier)) return { outcome: 'unresolved', reason: 'unknown evidence tier' };
+  if (c.blocked) return { outcome: 'blocked', reason: String(c.blocked) };
+  if (!(Date.parse(c.expires) > now)) return { outcome: 'unresolved', reason: 'the evidence has expired' };
+  if (c.artifactDigest && t.artifactDigest && c.artifactDigest !== t.artifactDigest) return { outcome: 'unresolved', reason: 'the evidence was produced against another artifact' };
+  if (c.policyDigest && t.policyDigest && c.policyDigest !== t.policyDigest) return { outcome: 'unresolved', reason: 'the evidence was produced under another policy' };
+  if (c.scannerBundle && packet.scanner?.bundleDigest && c.scannerBundle !== packet.scanner.bundleDigest) return { outcome: 'unresolved', reason: 'the evidence came from another scanner bundle' };
+  if (c.requiresArtifactBinding !== false && !c.artifactDigest) return { outcome: 'unresolved', reason: 'the evidence is not bound to an artifact' };
+  const o = c.observed;
+  if (!o || typeof o !== 'object') return { outcome: 'unresolved', reason: 'no observation is recorded' };
+  // the observation and the expectation stay separately inspectable; met/violated is derived, not asserted
+  if (c.kind === 'detection') {
+    // a detection case judges the signal, not the effect: positive means the rule must fire, negative that it must stay quiet,
+    // and an observation that does not say whether the rule fired leaves the case open
+    if (typeof o.detected !== 'boolean') return { outcome: 'unresolved', reason: 'the observation does not record whether the detection fired' };
+    if (c.expected === 'positive') return o.detected ? { outcome: 'met', reason: 'the detection fired on the reproduced effect' } : { outcome: 'violated', reason: 'the detection missed the reproduced effect' };
+    return o.detected ? { outcome: 'violated', reason: 'the detection fired where it must not' } : { outcome: 'met', reason: 'the detection stayed quiet where it must' };
+  }
+  const forbidden = o.forbiddenEffect === true; const legit = o.legitimateEffect === true;
+  if (c.expected === 'positive') return forbidden ? { outcome: 'met', reason: 'the vulnerable control reproduced the forbidden effect' } : { outcome: 'violated', reason: 'the vulnerable control did not reproduce the effect, so the fixture shows nothing' };
+  if (c.expected === 'negative') return forbidden ? { outcome: 'violated', reason: 'the forbidden effect occurred on the fixed artifact' } : { outcome: 'met', reason: 'no forbidden effect' };
+  return legit && !forbidden ? { outcome: 'met', reason: 'the legitimate operation succeeded' } : { outcome: 'violated', reason: 'the legitimate operation did not succeed' };
+}
+
+/**
+ * Recompute every gate from the packet's evidence.
+ * @param {object} packet
+ * @param {{requiredGates?:string[], requiredCases?:string[], requiredTiers?:Object<string,string>, now?:number, maxFeedAgeMs?:number}} o
+ * @returns {{status:'qualified'|'not-qualified', gates:object, cases:object[], blockers:object[], tiers:object}}
+ */
+export function evaluateCandidate(packet, { requiredGates = Object.keys(GATES), requiredCases = [], requiredTiers = {}, now = Date.now(), maxFeedAgeMs = 15 * 60 * 1000 } = {}) {
+  const cases = (packet.cases || []).map((c) => ({ caseId: c.caseId ?? null, gate: c.gate ?? null, requirement: c.requirement ?? null, owner: c.owner ?? null, tier: c.tier ?? 'local', ...judgeCase(c, packet, now) }));
+  const blockers = [];
+  for (const id of requiredCases) if (!cases.some((c) => c.caseId === id)) { cases.push({ caseId: id, gate: null, outcome: 'unresolved', reason: 'a required case has no record' }); blockers.push({ gate: null, caseId: id, reason: 'missing required case' }); }
+  // gate-level evidence that is not a case
+  const extra = {};
+  if (!packet.scope || packet.scope.status !== 'satisfied') extra['G-02'] = { outcome: 'unresolved', reason: packet.scope ? `the scope reconciliation is ${packet.scope.status}` : 'no scope reconciliation is in the packet' };
+  if (!packet.runner || packet.runner.attested !== true) extra['G-04'] = { outcome: 'blocked', reason: packet.runner?.reason || 'the runner did not attest the confinement the execution cases need' };
+  const ev = packet.evaluation;
+  if (!ev || ev.status !== 'measured') extra['G-06'] = { outcome: 'blocked', reason: ev?.reason || 'independent accuracy is unmeasured for this candidate' };
+  else if (ev.meetsFloors !== true) extra['G-06'] = { outcome: 'violated', reason: 'the measured population does not meet the registered floors' };
+  for (const f of packet.telemetry?.feeds || []) {
+    if (!f.lastHeartbeat || now - Date.parse(f.lastHeartbeat) > maxFeedAgeMs) { extra['G-05'] = { outcome: 'unresolved', reason: `feed ${f.name} is stale or has no heartbeat` }; break; }
+  }
+  const gates = {};
+  for (const g of requiredGates) {
+    const need = requiredTiers[g];
+    const ofGate = cases.filter((c) => c.gate === g);
+    // a case of another tier is reported, but it cannot meet a gate that names its tier
+    const mine = need ? ofGate.filter((c) => c.tier === need) : ofGate;
+    const rank = { violated: 3, blocked: 2, unresolved: 1, met: 0 };
+    let worst = mine.reduce((w, c) => (rank[c.outcome] > rank[w] ? c.outcome : w), 'met');
+    const reasons = mine.filter((c) => c.outcome !== 'met').map((c) => `${c.caseId}: ${c.reason}`);
+    if (extra[g]) { if (rank[extra[g].outcome] > rank[worst]) worst = extra[g].outcome; reasons.push(extra[g].reason); }
+    // no evidence is not a pass: a gate with no case and no gate-level evidence stays unresolved
+    if (need && !mine.length) { worst = rank[worst] > rank.unresolved ? worst : 'unresolved'; reasons.push(`no ${need} evidence for this gate${ofGate.length ? ` (${ofGate.length} case(s) of another tier do not count)` : ''}`); }
+    else if (!mine.length && !extra[g] && !(g === 'G-02' && packet.scope?.status === 'satisfied') && !(g === 'G-04' && packet.runner?.attested === true) && !(g === 'G-06' && ev?.status === 'measured')) { worst = 'unresolved'; reasons.push('no evidence for this gate'); }
+    gates[g] = { name: GATES[g], outcome: worst, reasons };
+    if (worst !== 'met') blockers.push({ gate: g, reason: reasons.join('; ') });
+  }
+  const tiers = { local: 0, staging: 0, independent: 0 };
+  for (const c of cases) if (tiers[c.tier] !== undefined) tiers[c.tier]++;
+  return { status: blockers.length ? 'not-qualified' : 'qualified', scope: packet.target ? { ...packet.target } : null, scannerBundle: packet.scanner?.bundleDigest ?? null, packetDigest: packetDigest(packet), gates, cases, blockers, tiers };
+}
+
+/**
+ * Is a recorded decision still the decision for this target? A decision qualifies only the artifact, policy and scanner bundle it was
+ * computed for and only until its earliest case expiry, so an upgrade or policy change invalidates it and a rollback is covered only by
+ * the earlier artifact's own decision.
+ * @param {object} decision  an `evaluateCandidate` result
+ * @param {{artifactDigest?:string, policyDigest?:string, scannerBundle?:string}} target
+ */
+export function revalidateDecision(decision, target, { packet = null, now = Date.now() } = {}) {
+  if (!decision || typeof decision !== 'object' || !decision.scope) return { valid: false, reason: 'no recorded decision scope' };
+  if (decision.status !== 'qualified') return { valid: false, reason: 'the recorded decision did not qualify the candidate' };
+  if (!target || !target.artifactDigest || decision.scope.artifactDigest !== target.artifactDigest) return { valid: false, reason: 'the artifact differs from the one the decision qualified' };
+  if (decision.scope.policyDigest && decision.scope.policyDigest !== target.policyDigest) return { valid: false, reason: 'the deployment policy differs from the one the decision qualified' };
+  if (decision.scannerBundle && target.scannerBundle && decision.scannerBundle !== target.scannerBundle) return { valid: false, reason: 'the scanner bundle differs from the one the decision qualified' };
+  if (packet) {
+    if (packetDigest(packet) !== decision.packetDigest) return { valid: false, reason: 'the packet is not the one the decision was computed from' };
+    const soonest = Math.min(...(packet.cases || []).map((c) => Date.parse(c.expires)).filter(Number.isFinite));
+    if (Number.isFinite(soonest) && !(soonest > now)) return { valid: false, reason: 'evidence the decision rests on has expired' };
+  }
+  return { valid: true, reason: 'the decision covers this artifact, policy and scanner bundle' };
+}
+
+/** Write a decision atomically; an identical retried write leaves the same bytes. */
+export function writeCandidateDecision(file, decision) {
+  const body = `${canon(decision)}\n`;
+  try { if (fs.readFileSync(file, 'utf8') === body) return { written: false, unchanged: true }; } catch { /* absent */ }
+  const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`);
+  fs.writeFileSync(tmp, body, { mode: 0o644 });
+  fs.renameSync(tmp, file);
+  return { written: true, unchanged: false };
+}

package/src/posture/assurance/release-package-cli.js

@@ -2,9 +2,16 @@
 //
 //   release-package build [path] --private-key <pem> [--output <file>] [--fix-records <file>] [--public-key-out <file>]
 //   release-package verify <package.json> --public-key <pem> [--require kind,kind]
+//   release-package qualify <candidate-packet.json> --public-key <pem> [--require-case id,id] [--require-gate G-01,G-03]
+//                           [--require-tier G-05=staging,...] [--output <decision.json>] [--format text|json]
+//
+// `qualify` is the strict candidate qualification of the threat-model PRD (FR-10.3): it verifies the packet's signature, recomputes
+// every gate from the case evidence (`candidate-qualification.js`) and exits 0 only when the candidate is qualified. It never changes
+// what an ordinary scan exits with.
 //
 // `io.git(root, ...args)` answers a read-only git query (or null); the caller supplies it so this layer never spawns a process itself.
-// Exit codes: 0 built or verified; 1 the scan state failed its integrity check, or a package was rejected; 2 a usage problem or unreadable input.
+// Exit codes: 0 built, verified or qualified; 1 the scan state failed its integrity check, a package was rejected or a candidate was not
+// qualified; 2 a usage problem or unreadable input.
 //
 // What goes in: the scan's health record and one record per finding (and, with --fix-records, one verification record per fix claimed). The proof tier of a
 // finding is whatever the scan recorded; a finding that recorded none is `taint-proven` when the taint engine found its path and `unproven` otherwise. An
@@ -18,8 +25,9 @@ import { buildSnapshotRef } from './evidence-registry.js';
 import { buildReleasePackage, signReleasePackage } from './release-package.js';
 import { releaseVerdict, verifyStatedVerdict } from './release-verdict.js';
 import { verifyReleasePackage } from './release-package-verify.js';
+import { evaluateCandidate, verifyCandidatePacket, writeCandidateDecision, GATES } from './candidate-qualification.js';
 
-const USAGE = 'Usage: agentic-security release-package build [path] --private-key <pem> [--output <file>] [--fix-records <file>] [--public-key-out <file>]\n       agentic-security release-package verify <package.json> --public-key <pem> [--require kind,kind]';
+const USAGE = 'Usage: agentic-security release-package build [path] --private-key <pem> [--output <file>] [--fix-records <file>] [--public-key-out <file>]\n       agentic-security release-package verify <package.json> --public-key <pem> [--require kind,kind]\n       agentic-security release-package qualify <candidate-packet.json> --public-key <pem> [--require-case id,id] [--require-gate G-01,G-03] [--require-tier G-05=staging] [--output <decision.json>] [--format text|json]';
 const DEFAULT_OUT = 'release-package.json';
 
 
@@ -104,11 +112,45 @@ async function verify(args, say) {
   return 1;
 }
 
+const listFlag = (v) => String(v ?? '').split(',').map((x) => x.trim()).filter(Boolean);
+
+async function qualify(args, say) {
+  const file = args._[2];
+  const keyFile = args.flags['public-key'];
+  if (!file || !keyFile) { say.err(USAGE); return 2; }
+  let packet; let key;
+  try { packet = JSON.parse(fs.readFileSync(path.resolve(file), 'utf8')); key = fs.readFileSync(path.resolve(String(keyFile)), 'utf8'); } catch (e) { say.err(`Could not read the input: ${e.message}`); return 2; }
+  const requiredGates = args.flags['require-gate'] ? listFlag(args.flags['require-gate']) : Object.keys(GATES);
+  const unknown = requiredGates.filter((g) => !GATES[g]);
+  if (unknown.length) { say.err(`Unknown gate: ${unknown.join(', ')}. Gates: ${Object.keys(GATES).join(', ')}.`); return 2; }
+  const requiredTiers = {};
+  for (const pair of listFlag(args.flags['require-tier'])) {
+    const [g, t] = pair.split('=');
+    if (!GATES[g] || !['local', 'staging', 'independent'].includes(t)) { say.err(`--require-tier takes gate=tier pairs (tier local, staging or independent), got ${pair}`); return 2; }
+    requiredTiers[g] = t;
+  }
+  const sig = verifyCandidatePacket(packet, key);
+  if (!sig.ok) { say.err(`${sig.code}: the candidate packet ${sig.code === 'UNSUPPORTED_VERSION' ? `has version ${sig.version}, which this scanner does not read` : 'did not verify under the given key'}`); say.err('candidate NOT QUALIFIED'); return 1; }
+  const d = evaluateCandidate(packet, { requiredGates, requiredCases: listFlag(args.flags['require-case']), requiredTiers });
+  if (args.flags.output) {
+    try { writeCandidateDecision(path.resolve(String(args.flags.output)), d); } catch (e) { say.err(`Could not write the decision: ${e.message}`); return 2; }
+  }
+  if (args.flags.format === 'json') say.out(JSON.stringify(d, null, 2));
+  else {
+    const t = d.scope || {};
+    say.out(`candidate ${d.status === 'qualified' ? 'QUALIFIED' : 'NOT QUALIFIED'} for ${t.service || t.repository || 'an unnamed target'} artifact ${String(t.artifactDigest || 'unbound').slice(0, 19)} (${t.deploymentProfile || 'no profile'})`);
+    for (const [g, x] of Object.entries(d.gates)) say.out(`  ${g} ${x.name}: ${x.outcome}${x.reasons.length ? ` (${x.reasons.join('; ')})` : ''}`);
+    say.out(`  cases by tier: local ${d.tiers.local}, staging ${d.tiers.staging}, independent ${d.tiers.independent}`);
+  }
+  return d.status === 'qualified' ? 0 : 1;
+}
+
 export async function cmdReleasePackage(args, io = {}) {
   const say = { out: io.out || ((s) => console.log(s)), err: io.err || ((s) => console.error(s)) };
   const sub = args._[1];
   if (sub === 'build') return build(args, say, io.git || (() => null));
   if (sub === 'verify') return verify(args, say);
+  if (sub === 'qualify') return qualify(args, say);
   say.err(USAGE);
   return 2;
 }