@dailephd/my-dev-kit-lab 0.2.0 → 0.2.2

package/dist/src/securityValidation/attackScenarios/scenarios/networkAssumptionScenario.js

@@ -0,0 +1,129 @@
+import { makeEvidence } from "../exploitEvidence.js";
+import { collectBoundedSourceFiles, lineNumberAt } from "../boundedSourceScan.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 4 — network / local-first assumption scenario.
+//
+// Careful, narrow claim only: a bounded static scan of local-first source
+// paths (manifests, src/, scripts/) finding no obvious unexpected network-API
+// usage. This is NOT proof of runtime network isolation — subprocess-invoked
+// tools (npm audit/outdated, OSV-Scanner, Semgrep's npx fallback) legitimately
+// contact the network when those check groups are selected, and this
+// scenario does not and cannot verify their runtime behavior. No network
+// calls, probes, or instrumentation are performed by this scenario itself.
+// ---------------------------------------------------------------------------
+const NETWORK_API_PATTERNS = [
+    { id: "fetch-call", regex: /\bfetch\s*\(/g },
+    { id: "http-module-import", regex: /(?:require\(\s*["']https?["']\s*\)|from\s+["']https?["'])/g },
+    { id: "net-tls-module-import", regex: /(?:require\(\s*["'](?:net|tls)["']\s*\)|from\s+["'](?:net|tls)["'])/g },
+    { id: "axios-import", regex: /(?:require\(\s*["']axios["']\s*\)|from\s+["']axios["'])/g },
+    { id: "got-import", regex: /(?:require\(\s*["']got["']\s*\)|from\s+["']got["'])/g },
+    { id: "request-import", regex: /(?:require\(\s*["']request["']\s*\)|from\s+["']request["'])/g },
+    { id: "undici-import", regex: /(?:require\(\s*["']undici["']\s*\)|from\s+["']undici["'])/g },
+    { id: "node-fetch-import", regex: /(?:require\(\s*["']node-fetch["']\s*\)|from\s+["']node-fetch["'])/g },
+    { id: "websocket-usage", regex: /new\s+WebSocket\s*\(/g },
+];
+// Paths where network-touching behavior is expected and intentional (they
+// shell out to npm/OSV-Scanner/etc, not a local-first-source violation).
+const KNOWN_NETWORK_INTENTIONAL_PREFIXES = [
+    "src/securityValidation/dependencies/",
+    "src/securityValidation/staticScans/",
+];
+function isKnownIntentionalPath(relativePath) {
+    return KNOWN_NETWORK_INTENTIONAL_PREFIXES.some((p) => relativePath.startsWith(p));
+}
+function scanFileForNetworkApis(relativePath, content) {
+    const matches = [];
+    const intentional = isKnownIntentionalPath(relativePath);
+    for (const { id, regex } of NETWORK_API_PATTERNS) {
+        const re = new RegExp(regex.source, regex.flags);
+        let match;
+        while ((match = re.exec(content)) !== null) {
+            if (match[0].length === 0) {
+                re.lastIndex += 1;
+                continue;
+            }
+            matches.push({ id, file: relativePath, line: lineNumberAt(content, match.index), intentional });
+        }
+    }
+    return matches;
+}
+export const NETWORK_ASSUMPTION_SCENARIO = {
+    id: "network-local-first-bounded-scan",
+    title: "Network assumption: bounded static scan finds no unexpected network API usage in local-first source",
+    description: "Bounded static scan of local-first source paths (manifests, src/, scripts/) for obvious network API usage (fetch/http/https/net/tls/axios/got/request/undici/node-fetch/WebSocket). Known network-using validation commands (npm audit, npm outdated, OSV-Scanner) are treated as expected, not violations. This does not prove runtime network isolation.",
+    checkId: "network",
+    applicableProfiles: [],
+    severityBaseline: "informational",
+    verdictImpact: "target-project-blocker",
+    expectedSafeBehavior: "No obvious unexpected network API usage is found in the bounded local-first source paths inspected.",
+    evidenceRequirements: ["observation"],
+    run: async (ctx) => {
+        const files = collectBoundedSourceFiles(ctx.target.targetRoot);
+        const isolationCaveat = makeEvidence({
+            kind: "observation",
+            source: "scope statement",
+            confidence: "high",
+            expectedBehavior: "This is a bounded static check of local-first source paths only. It does not prove runtime network isolation of subprocess-invoked tools (npm, CodeQL, Semgrep, OSV-Scanner) or any other process spawned during validation.",
+            observedBehavior: "Static-source-only claim; no runtime network instrumentation was performed.",
+        });
+        if (files.length === 0) {
+            return {
+                status: "passed",
+                confidence: "low",
+                evidence: [
+                    isolationCaveat,
+                    makeEvidence({
+                        kind: "observation",
+                        source: "bounded network scan file collection",
+                        confidence: "low",
+                        expectedBehavior: "At least one file would be scanned for a meaningful bounded-scan claim.",
+                        observedBehavior: "0 files matched the bounded glob set. No findings because there was nothing to scan.",
+                    }),
+                ],
+            };
+        }
+        const allMatches = [];
+        for (const file of files) {
+            allMatches.push(...scanFileForNetworkApis(file.relativePath, file.content));
+        }
+        allMatches.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+        const unexpected = allMatches.filter((m) => !m.intentional);
+        const intentional = allMatches.filter((m) => m.intentional);
+        const evidence = [
+            isolationCaveat,
+            makeEvidence({
+                kind: "observation",
+                source: "bounded network API scan",
+                confidence: "medium",
+                expectedBehavior: "Bounded scan of manifests/src/scripts for direct network API usage.",
+                observedBehavior: `${files.length} file(s) scanned; ${unexpected.length} unexpected match(es), ${intentional.length} known-intentional match(es).`,
+            }),
+            makeEvidence({
+                kind: "observation",
+                source: "known network-using validation commands",
+                confidence: "high",
+                expectedBehavior: "npm audit / npm outdated (deps check) may contact the npm registry; OSV-Scanner may contact the OSV API; Semgrep's npx fallback may contact the npm registry. These are expected when those check groups are selected via --checks and are not local-first source violations.",
+                observedBehavior: `${intentional.length} match(es) found under known network-using paths (${KNOWN_NETWORK_INTENTIONAL_PREFIXES.join(", ")}).`,
+            }),
+            ...unexpected.slice(0, 20).map((m) => makeEvidence({
+                kind: "observation",
+                source: `pattern '${m.id}'`,
+                filePath: m.file,
+                line: m.line,
+                confidence: "medium",
+                expectedBehavior: "No unexpected direct network API usage in local-first source paths.",
+                observedBehavior: `Detected '${m.id}' usage in ${m.file}:${m.line}.`,
+            })),
+        ];
+        if (unexpected.length > 0) {
+            return {
+                status: "failed",
+                confidence: "medium",
+                evidence,
+                severity: "major",
+                recommendation: `Review ${unexpected.length} unexpected network-API usage(s) in local-first source paths and confirm they are intentional, or move them under a clearly network-using module.`,
+            };
+        }
+        return { status: "passed", confidence: "medium", evidence };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/outputBoundaryScenario.js

@@ -0,0 +1,69 @@
+import path from "node:path";
+import { makeEvidence } from "../exploitEvidence.js";
+import { getPayloadsForGroup } from "../payloadCorpus.js";
+import { reportDirIsInsideExternalTarget } from "./targetSandboxScenario.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — output/generated-artifact boundary scenario.
+//
+// Two parts:
+//  1. A real safety check: does the *default* (no --out) report output
+//     directory resolve inside an external target's working tree? That is
+//     the one genuinely dangerous default-behavior case (Batch 1/2 already
+//     made --out itself user-directed and unrestricted by design, so an
+//     explicit --out escaping is not itself a finding here).
+//  2. Deterministic, non-destructive classification of the "output-boundary"
+//     payload corpus (paths with spaces, relative, absolute, home-dir) to
+//     produce evidence that path resolution behaves predictably — this does
+//     not write any files.
+// ---------------------------------------------------------------------------
+export const OUTPUT_BOUNDARY_SCENARIO = {
+    id: "output-boundary-report-dir",
+    title: "Output boundary: generated reports are not written inside an external target",
+    description: "Confirms the default report output directory does not resolve inside an external target's working tree, and classifies output-boundary payload path resolution without writing any files.",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "major",
+    verdictImpact: "release-blocker",
+    expectedSafeBehavior: "The default report output directory resolves outside any external target's working tree; payload path resolution is deterministic.",
+    evidenceRequirements: ["filesystem", "observation"],
+    run: async (ctx) => {
+        const evidence = [];
+        const insideTarget = reportDirIsInsideExternalTarget(ctx.config.reportDir, ctx.target.targetRoot, ctx.target.isSelf);
+        evidence.push(makeEvidence({
+            kind: "filesystem",
+            source: "default report output directory",
+            filePath: path.resolve(ctx.config.reportDir),
+            confidence: "high",
+            expectedBehavior: "Default report output directory must not resolve inside an external target project.",
+            observedBehavior: ctx.target.isSelf
+                ? "Self-validation: report directory is expected to be under the tool root."
+                : insideTarget
+                    ? `Report directory resolves inside external target root '${ctx.target.targetRoot}'.`
+                    : `Report directory resolves outside external target root '${ctx.target.targetRoot}'.`,
+        }));
+        const payloads = getPayloadsForGroup("output-boundary");
+        for (const p of payloads) {
+            const resolved = path.resolve(ctx.toolRoot, p.value);
+            evidence.push(makeEvidence({
+                kind: "observation",
+                source: `output-boundary payload '${p.id}'`,
+                confidence: "medium",
+                observedBehavior: `Resolved deterministically without any file write.`,
+                rawPreview: `${p.value} -> ${resolved}`,
+            }));
+        }
+        if (insideTarget) {
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                recommendation: "Ensure the default report output directory is derived from the tool root, not the target root, for external-target validation.",
+            };
+        }
+        return {
+            status: "passed",
+            confidence: "high",
+            evidence,
+        };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/packageBoundaryScenario.js

@@ -0,0 +1,118 @@
+import { makeEvidence } from "../exploitEvidence.js";
+import { runSecurityCommand, resolveNpmCommand } from "../../commandRunner.js";
+import { parseNpmPackDryRun } from "../../packageChecks/parseNpmPackDryRun.js";
+import { detectForbiddenContents, isCriticalForbidden } from "../../packageChecks/forbiddenPackageContents.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — package boundary scenario.
+//
+// Reuses the existing npm-pack-dry-run parser and forbidden-content detector
+// (src/securityValidation/packageChecks/) rather than re-implementing tarball
+// parsing. This scenario adds structured, evidence-first attack-scenario
+// framing on top of the same underlying data the "package" check group
+// already produces — it does not publish or create real package artifacts.
+//
+// v0.2.2 Batch 5: escalates the result severity to "blocker" (via
+// AttackScenarioRunOutcome.severity) when any matched file is
+// isCriticalForbidden() (.env, .pem, .key, .p12, lab-output/, .my-dev-kit/) —
+// reusing the exact same critical-file rule the underlying package check
+// already applies, so a real secret-shaped leak in the tarball reliably
+// triggers the "not-ready" verdict via blocker severity, not just "major".
+// ---------------------------------------------------------------------------
+export const PACKAGE_BOUNDARY_SCENARIO = {
+    id: "package-boundary-forbidden-content",
+    title: "Package boundary: npm tarball excludes forbidden/local-only content",
+    description: "Runs npm pack --dry-run against the target and verifies the resulting tarball file list does not include forbidden paths (.env, reports/security/, lab-output/, .my-dev-kit/, tarballs, node_modules, etc).",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "major",
+    verdictImpact: "target-project-blocker",
+    expectedSafeBehavior: "The npm pack --dry-run file list contains no files matching the forbidden content patterns.",
+    evidenceRequirements: ["package-content", "command"],
+    skipCondition: (ctx) => {
+        if (!ctx.target.hasPackageJson) {
+            return "Target has no package.json; npm pack --dry-run based package boundary check is not applicable.";
+        }
+        return undefined;
+    },
+    run: async (ctx) => {
+        const npm = resolveNpmCommand();
+        const cmd = await runSecurityCommand({
+            command: npm,
+            args: ["pack", "--dry-run"],
+            cwd: ctx.target.targetRoot,
+            timeoutMs: ctx.config.commandTimeoutMs,
+        });
+        const commandEvidence = makeEvidence({
+            kind: "command",
+            source: "npm pack --dry-run",
+            commandCwd: ctx.target.targetRoot,
+            commandSummary: `${npm} pack --dry-run`,
+            exitCode: cmd.exitCode,
+            confidence: "high",
+        });
+        const packOutput = [cmd.stdout, cmd.stderr].find((stream) => /tarball contents/i.test(stream)) ??
+            [cmd.stdout, cmd.stderr].filter(Boolean).join("\n");
+        const parsed = parseNpmPackDryRun(packOutput);
+        if (parsed.parseError && parsed.files.length === 0) {
+            return {
+                status: "blocked",
+                confidence: "low",
+                evidence: [
+                    commandEvidence,
+                    makeEvidence({
+                        kind: "skipped-tool",
+                        source: "npm pack --dry-run",
+                        confidence: "low",
+                        observedBehavior: parsed.parseError,
+                        expectedBehavior: "npm pack --dry-run should list tarball contents for evaluation.",
+                    }),
+                ],
+                recommendation: "Ensure npm is available and the target package.json is valid, then re-run.",
+            };
+        }
+        const { matches, findings } = detectForbiddenContents({
+            files: parsed.files,
+            forbiddenPatterns: ctx.config.forbiddenPackagePatterns,
+            allowedExceptions: ctx.config.allowedPackageExceptions,
+            checkId: "attack-boundary-package",
+        });
+        if (matches.length === 0) {
+            return {
+                status: "passed",
+                confidence: "high",
+                evidence: [
+                    commandEvidence,
+                    makeEvidence({
+                        kind: "package-content",
+                        source: "npm pack --dry-run file list",
+                        confidence: "high",
+                        observedBehavior: `${parsed.files.length} file(s) inspected; none matched a forbidden pattern.`,
+                        expectedBehavior: "No forbidden paths in the tarball file list.",
+                    }),
+                ],
+            };
+        }
+        const evidence = [
+            commandEvidence,
+            ...matches.slice(0, 20).map((m, i) => {
+                const finding = findings[i];
+                return makeEvidence({
+                    kind: "package-content",
+                    source: "npm pack --dry-run file list",
+                    filePath: m.file,
+                    confidence: "high",
+                    expectedBehavior: "Forbidden paths must not appear in the published tarball.",
+                    observedBehavior: `Included '${m.file}' matching forbidden pattern '${m.pattern}' (${finding?.severity ?? "major"} severity).`,
+                });
+            }),
+        ];
+        const hasCriticalMatch = matches.some((m) => isCriticalForbidden(m.file));
+        return {
+            status: "failed",
+            confidence: "high",
+            evidence,
+            severity: hasCriticalMatch ? "blocker" : "major",
+            recommendation: `Add ${matches.length} matched path(s) to .npmignore or the package.json "files" allowlist before publishing.`,
+        };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/pathTraversalScenario.js

@@ -0,0 +1,119 @@
+import { makeEvidence } from "../exploitEvidence.js";
+import { getPayloadsForGroup } from "../payloadCorpus.js";
+import { resolveWithinRoot } from "../../../core/pathSafety.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 3 — path traversal scenario.
+//
+// Exercises the existing src/core/pathSafety.ts containment helper
+// (resolveWithinRoot) — used for writes that must stay within a declared
+// root — against the deterministic path-traversal payload corpus, plus a
+// small set of legitimate paths that must continue to be accepted (spaces,
+// safe relative/absolute-within-root paths). Pure path-math only; nothing is
+// read or written to disk.
+// ---------------------------------------------------------------------------
+const LEGITIMATE_PATH_CASES = [
+    { id: "relative-with-spaces", value: "safe sub dir/output.txt", shouldReject: false },
+    { id: "relative-nested", value: "a/b/c/output.json", shouldReject: false },
+];
+export const PATH_TRAVERSAL_SCENARIO = {
+    id: "path-traversal-containment",
+    title: "Path traversal: containment helper rejects escape payloads and accepts legitimate paths",
+    description: "Verifies resolveWithinRoot() rejects the deterministic path-traversal payload corpus and continues to accept legitimate relative paths, including ones with spaces.",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "blocker",
+    verdictImpact: "tool-framework-blocker",
+    expectedSafeBehavior: "Every path-traversal payload throws when passed to resolveWithinRoot(); every legitimate path resolves without throwing.",
+    evidenceRequirements: ["filesystem", "observation"],
+    run: async (ctx) => {
+        const evidence = [];
+        const unrejectedTraversals = [];
+        const wronglyRejectedLegit = [];
+        // Payloads whose escape depends on a URL-decode step that never happens
+        // at the filesystem-path layer (resolveWithinRoot does no decoding, by
+        // design — Node's path module treats "%2f" as a literal filename
+        // character, not a separator). These correctly resolve *inside* root and
+        // are recorded as informational evidence only, not a rejection failure.
+        const payloadsNotApplicableToRawPathResolution = new Set(["path-traversal-encoded"]);
+        // On POSIX (Linux/macOS), "\" is a literal filename character, not a
+        // path separator — Node's posix path implementation never parses
+        // "..\\..\\Windows\\..." as parent-directory components, so it
+        // legitimately resolves inside root there. On win32, "\" IS a separator
+        // and the payload must still be rejected, so this exclusion only applies
+        // off-Windows (verified by the CI cross-platform matrix: this scenario
+        // was passing on windows-latest but failing on ubuntu-latest/macos-latest
+        // for exactly this platform-semantics reason before this fix).
+        if (process.platform !== "win32") {
+            payloadsNotApplicableToRawPathResolution.add("path-traversal-windows-parent");
+        }
+        const traversalPayloads = getPayloadsForGroup("path-traversal");
+        for (const p of traversalPayloads) {
+            let rejected = false;
+            let observed = "";
+            try {
+                const resolved = resolveWithinRoot(ctx.target.targetRoot, p.value);
+                observed = `Resolved to '${resolved}' without being rejected.`;
+            }
+            catch {
+                rejected = true;
+                observed = "Rejected (threw), as expected.";
+            }
+            if (!rejected && !payloadsNotApplicableToRawPathResolution.has(p.id)) {
+                unrejectedTraversals.push(p.id);
+            }
+            evidence.push(makeEvidence({
+                kind: "filesystem",
+                source: `resolveWithinRoot() with payload '${p.id}'`,
+                confidence: "high",
+                expectedBehavior: payloadsNotApplicableToRawPathResolution.has(p.id)
+                    ? "No path separators present without decoding; resolving inside root is safe (not an escape)."
+                    : "Path-traversal payloads must be rejected (thrown), never silently resolved.",
+                observedBehavior: observed,
+                rawPreview: p.value,
+            }));
+        }
+        for (const c of LEGITIMATE_PATH_CASES) {
+            let accepted = false;
+            let observed = "";
+            try {
+                const resolved = resolveWithinRoot(ctx.target.targetRoot, c.value);
+                accepted = true;
+                observed = `Resolved to '${resolved}' as expected.`;
+            }
+            catch (err) {
+                observed = `Unexpectedly rejected: ${err instanceof Error ? err.message : String(err)}`;
+            }
+            if (!accepted) {
+                wronglyRejectedLegit.push(c.id);
+            }
+            evidence.push(makeEvidence({
+                kind: "filesystem",
+                source: `resolveWithinRoot() with legitimate path '${c.id}'`,
+                confidence: "high",
+                expectedBehavior: "Legitimate relative paths (including ones with spaces) must be accepted.",
+                observedBehavior: observed,
+                rawPreview: c.value,
+            }));
+        }
+        if (unrejectedTraversals.length > 0 || wronglyRejectedLegit.length > 0) {
+            const parts = [];
+            if (unrejectedTraversals.length > 0) {
+                parts.push(`${unrejectedTraversals.length} traversal payload(s) were not rejected: ${unrejectedTraversals.join(", ")}`);
+            }
+            if (wronglyRejectedLegit.length > 0) {
+                parts.push(`${wronglyRejectedLegit.length} legitimate path(s) were wrongly rejected: ${wronglyRejectedLegit.join(", ")}`);
+            }
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                recommendation: parts.join("; "),
+            };
+        }
+        return {
+            status: "passed",
+            confidence: "high",
+            evidence,
+        };
+    },
+};

package/dist/src/securityValidation/attackScenarios/scenarios/reportPoisoningScenario.js

@@ -0,0 +1,176 @@
+import { makeEvidence, stripUnsafeControlChars } from "../exploitEvidence.js";
+import { getPayloadsForGroup } from "../payloadCorpus.js";
+import { renderJsonReport, renderTextReport, sanitizeForTextReport } from "../../report/renderSecurityReport.js";
+import { SAFE_BASELINE_CONTENT, detectJsonStructuralInjection } from "../reportSchemaGuard.js";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 4 — report poisoning scenario.
+//
+// Registered under checkId "boundary" — the AttackScenario contract supports
+// only one primary check id per scenario, and report-rendering safety is a
+// boundary-of-trust concern (untrusted scanned/attacker content must not
+// escape into trusted report structure), same family as Batch 3's
+// configInjectionScenario (which covers a narrower slice of this: malformed
+// CLI config + basic JSON-breakout safety). This scenario is the dedicated,
+// broader check: ANSI/terminal escapes, fake section headers, HTML/script-
+// like content, markdown-link-like content, and JSON structural integrity —
+// all exercised through the real renderJsonReport()/renderTextReport()
+// functions with controlled, non-destructive mock findings (no payload is
+// ever written into target source files).
+// ---------------------------------------------------------------------------
+const REAL_VERDICT_BLOCK = ["=".repeat(72), "21. RELEASE VERDICT", "=".repeat(72)].join("\n");
+function makePoisonedReport(payloadValue) {
+    const now = new Date().toISOString();
+    return {
+        metadata: {
+            toolRoot: "/tool/root",
+            toolPackageName: "my-dev-kit-lab",
+            toolPackageVersion: "0.2.1",
+            targetRoot: "/tool/root",
+            targetDescription: "self (my-dev-kit-lab)",
+            packageName: "my-dev-kit-lab",
+            packageVersion: "0.2.1",
+            branch: "feature/security-validate-config-surface",
+            commit: "abc1234",
+            isSelf: true,
+            generatedAt: now,
+            totalDurationMs: 1,
+        },
+        sections: [],
+        allChecks: [
+            {
+                id: "report-poisoning-fixture",
+                name: payloadValue,
+                category: "artifact-safety",
+                status: "failed",
+                severity: "major",
+                startedAt: now,
+                finishedAt: now,
+                durationMs: 0,
+                findings: [
+                    {
+                        id: "report-poisoning-fixture-finding",
+                        title: payloadValue,
+                        severity: "major",
+                        category: "artifact-safety",
+                        description: payloadValue,
+                        recommendation: payloadValue,
+                        releaseImpact: "Should fix before release",
+                    },
+                ],
+                skippedReason: payloadValue,
+            },
+        ],
+        allFindings: [],
+        verdict: "ready-except-optional-manual-checks",
+        recommendedNextStep: payloadValue,
+        attackResults: [
+            {
+                scenarioId: "report-poisoning-fixture-scenario",
+                scenarioTitle: payloadValue,
+                checkId: "boundary",
+                profileId: "node-cli-package",
+                status: "failed",
+                severity: "major",
+                confidence: "low",
+                evidence: [
+                    makeEvidence({ kind: "observation", source: "fixture", confidence: "low", rawPreview: payloadValue }),
+                ],
+                category: "artifact-safety",
+                recommendation: payloadValue,
+                skippedReason: payloadValue,
+            },
+        ],
+    };
+}
+export const REPORT_POISONING_SCENARIO = {
+    id: "report-poisoning-safety",
+    title: "Report poisoning: renderer treats payload content as untrusted data, never trusted structure",
+    description: "Renders text and JSON reports with report-poisoning payloads (ANSI escapes, fake section headers, JSON breakout, HTML/script-like, markdown-link-like) embedded in check/finding/attack-result fields, and confirms: JSON stays parseable with no extra top-level keys, text rendering never crashes, the real RELEASE VERDICT block is structurally intact, and no raw ANSI control bytes reach the final text output.",
+    checkId: "boundary",
+    applicableProfiles: [],
+    severityBaseline: "major",
+    verdictImpact: "tool-framework-blocker",
+    expectedSafeBehavior: "Report-poisoning payloads are rendered as inert content; they never corrupt JSON structure, crash rendering, or forge a trusted verdict/section.",
+    evidenceRequirements: ["output", "observation"],
+    run: async () => {
+        const evidence = [];
+        const problems = [];
+        const payloads = getPayloadsForGroup("report-poisoning");
+        // Baseline-diff check (v0.2.2 Batch 6): compare each poisoned render's
+        // top-level JSON keys against an identically-shaped render carrying an
+        // inert placeholder instead of the payload. A payload can only widen the
+        // top-level shape by actually breaking out of its string context —
+        // legitimate additive schema fields appear in both and are never
+        // flagged, so this doesn't need to know the current field list at all.
+        const baselineJson = renderJsonReport(makePoisonedReport(SAFE_BASELINE_CONTENT));
+        for (const payload of payloads) {
+            let jsonOk = true;
+            let jsonExtraKeys = [];
+            let textOk = true;
+            let textError;
+            let verdictBlockIntact = true;
+            let rawAnsiLeaked = false;
+            const report = makePoisonedReport(payload.value);
+            try {
+                const json = renderJsonReport(report);
+                const injection = detectJsonStructuralInjection(baselineJson, json);
+                jsonExtraKeys = injection.injectedTopLevelKeys;
+                jsonOk = injection.parseable && jsonExtraKeys.length === 0;
+            }
+            catch {
+                jsonOk = false;
+            }
+            let text = "";
+            try {
+                text = renderTextReport(report);
+            }
+            catch (err) {
+                textOk = false;
+                textError = err instanceof Error ? err.message : String(err);
+            }
+            if (textOk) {
+                verdictBlockIntact = text.includes(REAL_VERDICT_BLOCK);
+                rawAnsiLeaked = /\x1b\[[0-9;]*[a-zA-Z]/.test(text);
+            }
+            const payloadProblem = !jsonOk || !textOk || !verdictBlockIntact || rawAnsiLeaked;
+            if (payloadProblem) {
+                problems.push(payload.id);
+            }
+            evidence.push(makeEvidence({
+                kind: "output",
+                source: `renderJsonReport()/renderTextReport() with payload '${payload.id}'`,
+                confidence: "high",
+                expectedBehavior: "JSON parseable with no extra top-level keys; text rendering does not crash; real verdict block intact; no raw ANSI bytes in text output.",
+                observedBehavior: `jsonOk=${jsonOk}${jsonExtraKeys.length > 0 ? ` (extraKeys=${jsonExtraKeys.join(",")})` : ""}, textOk=${textOk}${textError ? ` (${textError})` : ""}, verdictBlockIntact=${verdictBlockIntact}, rawAnsiLeaked=${rawAnsiLeaked}`,
+                rawPreview: payload.value,
+            }));
+        }
+        // Direct regression check on the sanitizer itself, independent of the
+        // full report pipeline above.
+        const ansiPayload = payloads.find((p) => p.id === "report-poisoning-ansi-escape");
+        if (ansiPayload) {
+            const sanitized = sanitizeForTextReport(ansiPayload.value);
+            const stillHasAnsi = /\x1b\[[0-9;]*[a-zA-Z]/.test(sanitized);
+            const stillHasAnsiViaStrip = /\x1b\[[0-9;]*[a-zA-Z]/.test(stripUnsafeControlChars(ansiPayload.value));
+            if (stillHasAnsi || stillHasAnsiViaStrip) {
+                problems.push("ansi-sanitizer-regression");
+            }
+            evidence.push(makeEvidence({
+                kind: "observation",
+                source: "sanitizeForTextReport() / stripUnsafeControlChars() direct check",
+                confidence: "high",
+                expectedBehavior: "ANSI escape sequences are removed by the sanitizer.",
+                observedBehavior: stillHasAnsi || stillHasAnsiViaStrip ? "ANSI bytes survived sanitization." : "ANSI bytes removed.",
+            }));
+        }
+        if (problems.length > 0) {
+            return {
+                status: "failed",
+                confidence: "high",
+                evidence,
+                recommendation: `Report rendering is not safe against payload(s): ${problems.join(", ")}. Fix before treating generated reports as safe to share.`,
+            };
+        }
+        return { status: "passed", confidence: "high", evidence };
+    },
+};