@dailephd/my-dev-kit-lab 0.2.1 → 0.3.0

package/dist/src/securityValidation/report/renderSecurityReport.js

@@ -1,7 +1,16 @@
 import { verdictToHumanLabel } from "../validate/verdict.js";
+import { stripUnsafeControlChars } from "../attackScenarios/exploitEvidence.js";
 // ---------------------------------------------------------------------------
 // Human-readable text report
 // ---------------------------------------------------------------------------
+// v0.2.2 Batch 4 — sanitizes text-report content that may originate from
+// scanned source, target output, or an attack-scenario payload before it is
+// printed. Strips ANSI/control bytes (report-poisoning defense); preserves
+// ordinary whitespace. JSON output needs no equivalent helper — JSON.stringify
+// already escapes control characters by construction.
+export function sanitizeForTextReport(raw) {
+    return stripUnsafeControlChars(raw);
+}
 function pad(label, width = 36) {
     return label.padEnd(width, " ");
 }
@@ -24,7 +33,7 @@ function divider(char = "-", width = 72) {
 }
 export function renderTextReport(report) {
     const lines = [];
-    const { metadata, allChecks, allFindings, verdict, recommendedNextStep } = report;
+    const { metadata, allChecks, allFindings, verdict, recommendedNextStep, attackResults, verdictReasonSummary } = report;
     lines.push(divider("="));
     lines.push("SECURITY VALIDATION REPORT");
     lines.push(divider("="));
@@ -41,6 +50,23 @@ export function renderTextReport(report) {
     lines.push(`Commit     : ${metadata.commit}`);
     lines.push(`Generated  : ${metadata.generatedAt}`);
     lines.push(`Duration   : ${formatDuration(metadata.totalDurationMs)}`);
+    if (metadata.profile) {
+        lines.push(`Profile    : ${metadata.profile}`);
+    }
+    if (metadata.selectedChecks && metadata.selectedChecks.length > 0) {
+        lines.push(`Checks     : ${metadata.selectedChecks.join(", ")}`);
+    }
+    if (metadata.failOnThreshold) {
+        const breachNote = metadata.failOnBreached === true
+            ? " — BREACHED"
+            : metadata.failOnBreached === false
+                ? " — not breached"
+                : "";
+        lines.push(`Fail-on    : ${metadata.failOnThreshold}${breachNote}`);
+    }
+    if (metadata.isFullReleaseGate === false) {
+        lines.push(`Scope      : NARROWED — selected checks do not include the full classic release gate (deps, package, static, cli-adversarial, fuzz). This run does not represent full release readiness.`);
+    }
     lines.push("");
     // --- 1. Executive Summary ---
     lines.push(divider());
@@ -60,7 +86,7 @@ export function renderTextReport(report) {
                 lines.push(`  ${sev.padEnd(16)} : ${count}`);
         }
     }
-    lines.push(`Next step  : ${recommendedNextStep}`);
+    lines.push(`Next step  : ${sanitizeForTextReport(recommendedNextStep)}`);
     lines.push("");
     // --- Check sections ---
     const sectionDefs = [
@@ -143,7 +169,7 @@ export function renderTextReport(report) {
             continue;
         }
         for (const check of sectionChecks) {
-            lines.push(`[${statusIcon(check.status)}] ${pad(check.name)} ${formatDuration(check.durationMs)}`);
+            lines.push(`[${statusIcon(check.status)}] ${pad(sanitizeForTextReport(check.name))} ${formatDuration(check.durationMs)}`);
             if (check.command) {
                 lines.push(`       Command: ${check.command}`);
             }
@@ -154,24 +180,87 @@ export function renderTextReport(report) {
                 lines.push(`       Exit code: ${String(check.exitCode)}`);
             }
             if (check.stdoutSummary) {
-                lines.push(`       Stdout: ${check.stdoutSummary.slice(0, 200)}`);
+                lines.push(`       Stdout: ${sanitizeForTextReport(check.stdoutSummary).slice(0, 200)}`);
             }
             if (check.stderrSummary) {
-                lines.push(`       Stderr: ${check.stderrSummary.slice(0, 200)}`);
+                lines.push(`       Stderr: ${sanitizeForTextReport(check.stderrSummary).slice(0, 200)}`);
             }
             if (check.status === "skipped" && check.skippedReason) {
-                lines.push(`       Reason: ${check.skippedReason}`);
+                lines.push(`       Reason: ${sanitizeForTextReport(check.skippedReason)}`);
             }
             if (check.findings.length > 0) {
                 for (const f of check.findings) {
-                    lines.push(`       [${f.severity.toUpperCase()}] ${f.title}`);
+                    lines.push(`       [${f.severity.toUpperCase()}] ${sanitizeForTextReport(f.title)}`);
                     if (f.description)
-                        lines.push(`              ${f.description.slice(0, 120)}`);
+                        lines.push(`              ${sanitizeForTextReport(f.description).slice(0, 120)}`);
                 }
             }
         }
         lines.push("");
     }
+    // --- Attack Scenario Framework (v0.2.2) ---
+    // Only rendered when the run selected attack-scenario-shaped checks.
+    // Batch 3 registered concrete scenarios for boundary/subprocess; secrets
+    // and network still resolve to an explicit "no scenarios registered"
+    // placeholder (scenarioId ending in "-no-scenarios-registered") — the
+    // pending-framework note is only shown when at least one such placeholder
+    // is present in this run, not unconditionally.
+    if (attackResults && attackResults.length > 0) {
+        const pendingResults = attackResults.filter((r) => r.scenarioId.endsWith("-no-scenarios-registered"));
+        const concreteResults = attackResults.filter((r) => !r.scenarioId.endsWith("-no-scenarios-registered"));
+        lines.push(divider());
+        lines.push("ATTACK SCENARIO FRAMEWORK (v0.2.2)");
+        lines.push(divider());
+        if (concreteResults.length > 0) {
+            lines.push(`${concreteResults.length} concrete attack scenario(s) executed.`);
+        }
+        if (pendingResults.length > 0) {
+            const pendingChecks = [...new Set(pendingResults.map((r) => r.checkId))].join(", ");
+            lines.push(`Concrete attack scenarios are still pending for: ${pendingChecks}. This is not evidence that those check groups are safe.`);
+        }
+        lines.push("");
+        for (const result of attackResults) {
+            lines.push(`[${statusIcon(result.status === "blocked" ? "failed" : result.status)}] ${pad(sanitizeForTextReport(result.scenarioTitle))} (check: ${result.checkId}, profile: ${result.profileId})`);
+            if (result.skippedReason) {
+                lines.push(`       Reason: ${sanitizeForTextReport(result.skippedReason)}`);
+            }
+            if (result.errorSummary) {
+                lines.push(`       Error: ${sanitizeForTextReport(result.errorSummary)}`);
+            }
+            if (result.recommendation) {
+                lines.push(`       Recommendation: ${sanitizeForTextReport(result.recommendation)}`);
+            }
+            if (result.evidence.length > 0) {
+                for (const e of result.evidence.slice(0, 10)) {
+                    const preview = e.redactedPreview ?? e.observedBehavior ?? "(no preview)";
+                    lines.push(`       [${e.kind}] ${sanitizeForTextReport(preview)}`);
+                }
+                if (result.evidence.length > 10) {
+                    lines.push(`       ... ${result.evidence.length - 10} more evidence item(s)`);
+                }
+            }
+        }
+        lines.push("");
+    }
+    // --- Verdict Reasoning (v0.2.2 Batch 5) ---
+    // Only rendered when the caller supplied the summary (additive; existing
+    // report construction that omits it is unaffected).
+    if (verdictReasonSummary) {
+        lines.push(divider());
+        lines.push("VERDICT REASONING (v0.2.2)");
+        lines.push(divider());
+        lines.push(`Release blockers          : ${verdictReasonSummary.releaseBlockerCount}`);
+        lines.push(`Target-project blockers   : ${verdictReasonSummary.targetProjectBlockerCount}`);
+        lines.push(`Tool-framework blockers   : ${verdictReasonSummary.toolFrameworkBlockerCount}`);
+        lines.push(`Environment inconclusive  : ${verdictReasonSummary.environmentInconclusiveCount}`);
+        lines.push(`Required evidence missing : ${verdictReasonSummary.requiredEvidenceMissingCount}`);
+        lines.push(`Scanner findings          : ${verdictReasonSummary.scannerFindingCount}`);
+        lines.push(`Adversarial scenario fail : ${verdictReasonSummary.adversarialScenarioFailureCount}`);
+        lines.push(`Adversarial scenario skip : ${verdictReasonSummary.adversarialScenarioSkippedCount}`);
+        lines.push(`Optional skipped tools    : ${verdictReasonSummary.optionalSkippedToolCount}`);
+        lines.push(`Informational evidence    : ${verdictReasonSummary.informationalEvidenceCount}`);
+        lines.push("");
+    }
     // --- 20. Findings by Severity ---
     lines.push(divider());
     lines.push("20. FINDINGS BY SEVERITY");
@@ -186,11 +275,11 @@ export function renderTextReport(report) {
                 continue;
             lines.push(`${sev.toUpperCase()} (${sevFindings.length}):`);
             for (const f of sevFindings) {
-                lines.push(`  [${f.id}] ${f.title}`);
+                lines.push(`  [${f.id}] ${sanitizeForTextReport(f.title)}`);
                 if (f.description)
-                    lines.push(`    ${f.description.slice(0, 120)}`);
+                    lines.push(`    ${sanitizeForTextReport(f.description).slice(0, 120)}`);
                 if (f.recommendation)
-                    lines.push(`    Recommendation: ${f.recommendation}`);
+                    lines.push(`    Recommendation: ${sanitizeForTextReport(f.recommendation)}`);
             }
         }
     }
@@ -205,7 +294,7 @@ export function renderTextReport(report) {
     lines.push(divider());
     lines.push("22. RECOMMENDED NEXT STEP");
     lines.push(divider());
-    lines.push(recommendedNextStep);
+    lines.push(sanitizeForTextReport(recommendedNextStep));
     lines.push("");
     lines.push(divider("="));
     return lines.join("\n");
@@ -214,7 +303,7 @@ export function renderTextReport(report) {
 // JSON report
 // ---------------------------------------------------------------------------
 export function renderJsonReport(report) {
-    const { metadata, allChecks, allFindings, verdict, recommendedNextStep } = report;
+    const { metadata, allChecks, allFindings, verdict, recommendedNextStep, attackResults, verdictReasonSummary } = report;
     const sanitizedChecks = allChecks.map((c) => ({
         id: c.id,
         name: c.name,
@@ -243,6 +332,33 @@ export function renderJsonReport(report) {
         recommendation: f.recommendation ?? undefined,
         releaseImpact: f.releaseImpact,
     }));
+    const sanitizedAttackResults = (attackResults ?? []).map((r) => ({
+        scenarioId: r.scenarioId,
+        scenarioTitle: r.scenarioTitle,
+        checkId: r.checkId,
+        profileId: r.profileId,
+        status: r.status,
+        severity: r.severity,
+        confidence: r.confidence,
+        category: r.category,
+        recommendation: r.recommendation ?? null,
+        skippedReason: r.skippedReason ?? null,
+        errorSummary: r.errorSummary ?? null,
+        evidence: r.evidence.map((e) => ({
+            id: e.id,
+            kind: e.kind,
+            source: e.source,
+            filePath: e.filePath ?? null,
+            line: e.line ?? null,
+            commandCwd: e.commandCwd ?? null,
+            commandSummary: e.commandSummary ?? null,
+            exitCode: e.exitCode ?? null,
+            expectedBehavior: e.expectedBehavior ?? null,
+            observedBehavior: e.observedBehavior ?? null,
+            redactedPreview: e.redactedPreview ?? null,
+            confidence: e.confidence,
+        })),
+    }));
     const output = {
         schemaVersion: 1,
         metadata,
@@ -256,12 +372,18 @@ export function renderJsonReport(report) {
             blockerFindings: allFindings.filter((f) => f.severity === "blocker").length,
             majorFindings: allFindings.filter((f) => f.severity === "major").length,
             minorFindings: allFindings.filter((f) => f.severity === "minor").length,
+            informationalFindings: allFindings.filter((f) => f.severity === "informational").length,
         },
         verdict,
         verdictLabel: verdictToHumanLabel(verdict),
         recommendedNextStep,
         checks: sanitizedChecks,
         findings: sanitizedFindings,
+        attackScenarios: {
+            count: sanitizedAttackResults.length,
+            results: sanitizedAttackResults,
+        },
+        verdictReasonSummary: verdictReasonSummary ?? null,
     };
     return JSON.stringify(output, null, 2);
 }

package/dist/src/securityValidation/types.js

@@ -32,3 +32,10 @@ export const SECURITY_CHECK_CATEGORIES = [
     "artifact-safety",
     "report-generation",
 ];
+export const VERDICT_IMPACTS = [
+    "release-blocker",
+    "target-project-blocker",
+    "tool-framework-blocker",
+    "adversarial-scenario-failure",
+    "informational-evidence",
+];

package/dist/src/securityValidation/validate/cliOptions.js

@@ -0,0 +1,182 @@
+import path from "node:path";
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 1 — security:validate command/config surface.
+//
+// This module parses and normalizes --checks, --profile, --format, --fail-on,
+// and --out. It intentionally does not implement attack scenarios, profile
+// behavior, or verdict-policy changes — those are later v0.2.2 batches. This
+// batch only builds a stable, extensible config surface.
+// ---------------------------------------------------------------------------
+export const SECURITY_CHECK_IDS = [
+    "deps",
+    "package",
+    "static",
+    "cli-adversarial",
+    "fuzz",
+    "boundary",
+    "subprocess",
+    "secrets",
+    "network",
+];
+// Checks with real behavior wired in Batch 1.
+export const IMPLEMENTED_SECURITY_CHECK_IDS = [
+    "deps",
+    "package",
+    "static",
+    "cli-adversarial",
+    "fuzz",
+];
+// Checks accepted as valid --checks values but not yet implemented. Selecting
+// one of these must never be reported as passed.
+export const PLANNED_SECURITY_CHECK_IDS = [
+    "boundary",
+    "subprocess",
+    "secrets",
+    "network",
+];
+export const DEFAULT_SECURITY_CHECKS = IMPLEMENTED_SECURITY_CHECK_IDS;
+export const SECURITY_PROFILE_IDS = ["node-cli-package", "local-tool", "npm-package"];
+export const DEFAULT_SECURITY_PROFILE = "node-cli-package";
+export const SECURITY_OUTPUT_FORMATS = ["text", "json"];
+export const DEFAULT_SECURITY_OUTPUT_FORMATS = ["text", "json"];
+// Distinct vocabulary from SecuritySeverity (blocker/major/minor/informational/skipped).
+// Batch 1 only carries this value through config; verdict-policy integration is later.
+export const SECURITY_FAIL_ON_THRESHOLDS = ["blocker", "high", "medium", "low"];
+export const DEFAULT_SECURITY_FAIL_ON_THRESHOLD = "blocker";
+const FLAGS_WITH_VALUE = {
+    "--target": "target",
+    "-t": "target",
+    "--out": "out",
+    "--report-prefix": "reportPrefix",
+    "--checks": "checks",
+    "--profile": "profile",
+    "--format": "format",
+    "--fail-on": "failOn",
+};
+export function parseSecurityValidateArgs(argv) {
+    const result = {};
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        const key = FLAGS_WITH_VALUE[arg];
+        if (!key)
+            continue;
+        if (i + 1 >= argv.length) {
+            throw new Error(`Missing value for ${arg}. Expected a value after ${arg}.`);
+        }
+        result[key] = argv[++i];
+    }
+    return result;
+}
+export function normalizeSecurityValidateConfig(raw, toolRoot) {
+    const checks = parseChecksOption(raw.checks);
+    const profile = parseProfileOption(raw.profile);
+    const formats = parseFormatOption(raw.format);
+    const failOn = parseFailOnOption(raw.failOn);
+    const out = raw.out !== undefined ? resolveOutDir(raw.out) : path.join(toolRoot, "reports", "security");
+    return {
+        target: raw.target,
+        out,
+        outWasDefault: raw.out === undefined,
+        reportPrefix: raw.reportPrefix,
+        checks: checks.value,
+        checksWereDefault: checks.wasDefault,
+        implementedChecks: checks.value.filter((c) => IMPLEMENTED_SECURITY_CHECK_IDS.includes(c)),
+        plannedChecksRequested: checks.value.filter((c) => PLANNED_SECURITY_CHECK_IDS.includes(c)),
+        profile: profile.value,
+        profileWasDefault: profile.wasDefault,
+        formats: formats.value,
+        formatsWereDefault: formats.wasDefault,
+        failOnThreshold: failOn.value,
+        failOnWasDefault: failOn.wasDefault,
+    };
+}
+// ---------------------------------------------------------------------------
+// v0.2.2 Batch 5 — profile-aware default checks
+// ---------------------------------------------------------------------------
+// Applies a profile's declared default check ids when the user provided
+// --profile but omitted --checks. Deliberately takes the profile's
+// defaultCheckIds as a plain parameter rather than importing
+// attackScenarios/attackProfile.ts here — that module already imports this
+// one (SecurityProfileId/SECURITY_PROFILE_IDS), so importing it back would
+// create a circular import. Callers (scripts/security/validate.ts) resolve
+// the profile definition via resolveAttackProfile() and pass its
+// defaultCheckIds in.
+//
+// No-op (returns config unchanged) unless BOTH:
+//   - the user did not pass --checks (checksWereDefault), AND
+//   - the user did pass --profile (profileWasDefault === false)
+// This guarantees the true no-flag case (no --profile, no --checks) and any
+// explicit --checks case are always unaffected.
+export function applyProfileDefaultChecksIfApplicable(config, profileDefaultCheckIds) {
+    if (!config.checksWereDefault || config.profileWasDefault) {
+        return config;
+    }
+    const uniqueRequested = new Set(profileDefaultCheckIds);
+    const ordered = SECURITY_CHECK_IDS.filter((id) => uniqueRequested.has(id));
+    return {
+        ...config,
+        checks: ordered,
+        implementedChecks: ordered.filter((c) => IMPLEMENTED_SECURITY_CHECK_IDS.includes(c)),
+        plannedChecksRequested: ordered.filter((c) => PLANNED_SECURITY_CHECK_IDS.includes(c)),
+    };
+}
+function splitAndNormalizeList(raw, flagName) {
+    const parts = raw.split(",").map((p) => p.trim());
+    if (parts.some((p) => p.length === 0)) {
+        throw new Error(`Invalid ${flagName} value: empty entries are not allowed. Got "${raw}".`);
+    }
+    return parts;
+}
+function parseChecksOption(raw) {
+    if (raw === undefined) {
+        return { value: [...DEFAULT_SECURITY_CHECKS], wasDefault: true };
+    }
+    const parts = splitAndNormalizeList(raw, "--checks");
+    const invalid = parts.filter((p) => !SECURITY_CHECK_IDS.includes(p));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid --checks value(s): ${invalid.join(", ")}. Valid values are: ${SECURITY_CHECK_IDS.join(", ")}.`);
+    }
+    const unique = new Set(parts);
+    const ordered = SECURITY_CHECK_IDS.filter((id) => unique.has(id));
+    return { value: ordered, wasDefault: false };
+}
+function parseProfileOption(raw) {
+    if (raw === undefined) {
+        return { value: DEFAULT_SECURITY_PROFILE, wasDefault: true };
+    }
+    const value = raw.trim();
+    if (!SECURITY_PROFILE_IDS.includes(value)) {
+        throw new Error(`Invalid --profile value: "${raw}". Valid values are: ${SECURITY_PROFILE_IDS.join(", ")}.`);
+    }
+    return { value: value, wasDefault: false };
+}
+function parseFormatOption(raw) {
+    if (raw === undefined) {
+        return { value: [...DEFAULT_SECURITY_OUTPUT_FORMATS], wasDefault: true };
+    }
+    const parts = splitAndNormalizeList(raw, "--format");
+    const invalid = parts.filter((p) => !SECURITY_OUTPUT_FORMATS.includes(p));
+    if (invalid.length > 0) {
+        throw new Error(`Invalid --format value(s): ${invalid.join(", ")}. Valid values are: ${SECURITY_OUTPUT_FORMATS.join(", ")}.`);
+    }
+    const unique = new Set(parts);
+    const ordered = SECURITY_OUTPUT_FORMATS.filter((id) => unique.has(id));
+    return { value: ordered, wasDefault: false };
+}
+function parseFailOnOption(raw) {
+    if (raw === undefined) {
+        return { value: DEFAULT_SECURITY_FAIL_ON_THRESHOLD, wasDefault: true };
+    }
+    const value = raw.trim();
+    if (!SECURITY_FAIL_ON_THRESHOLDS.includes(value)) {
+        throw new Error(`Invalid --fail-on value: "${raw}". Valid values are: ${SECURITY_FAIL_ON_THRESHOLDS.join(", ")}.`);
+    }
+    return { value: value, wasDefault: false };
+}
+function resolveOutDir(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.length === 0) {
+        throw new Error("Invalid --out value: path must not be empty.");
+    }
+    return path.resolve(trimmed);
+}

package/dist/src/securityValidation/validate/runSecurityValidation.js

@@ -6,10 +6,30 @@ import { runCodeqlCheck } from "../staticScans/codeql.js";
 import { runSemgrepCheck } from "../staticScans/semgrep.js";
 import { runAllFuzzTargets } from "../fuzz/fuzzHarness.js";
 import { ALL_FUZZ_TARGETS } from "../fuzz/fuzzTargets.js";
-import { calculateVerdict } from "./verdict.js";
+import { calculateVerdict, summarizeVerdictReasoning } from "./verdict.js";
 import { resolveValidationTarget, targetDescription as describeTarget } from "./resolveTarget.js";
 import { DEFAULT_SECURITY_CONFIG } from "../config.js";
 import { runCliSecuritySuiteCheck } from "./runCliSecuritySuiteCheck.js";
+import { DEFAULT_SECURITY_CHECKS, DEFAULT_SECURITY_PROFILE, IMPLEMENTED_SECURITY_CHECK_IDS, PLANNED_SECURITY_CHECK_IDS, } from "./cliOptions.js";
+import { runAttackScenarios } from "../attackScenarios/attackRunner.js";
+import { toSecurityCheckResult } from "../attackScenarios/attackResult.js";
+import { captureTargetSnapshot } from "../attackScenarios/targetSnapshot.js";
+const NOT_SELECTED_REASON = "Not selected via --checks.";
+function skippedCheck(id, name, category, skippedReason) {
+    const now = new Date().toISOString();
+    return {
+        id,
+        name,
+        category,
+        status: "skipped",
+        severity: "skipped",
+        startedAt: now,
+        finishedAt: now,
+        durationMs: 0,
+        findings: [],
+        skippedReason,
+    };
+}
 export async function runSecurityValidation(options) {
     const toolRoot = options.cwd;
     const config = {
@@ -20,9 +40,15 @@ export async function runSecurityValidation(options) {
     };
     // Resolve and validate the target project
     const target = resolveValidationTarget(options.targetPath, toolRoot);
+    // v0.2.2 Batch 3: read-only git-status snapshot taken before any checks run,
+    // so the target-sandbox attack scenario (which runs last, among the
+    // attack-scenario checks) can distinguish pre-existing target dirtiness
+    // from changes caused by this validation run.
+    const targetSnapshotBefore = captureTargetSnapshot(target.targetRoot, target.hasGit);
     const startedAt = new Date().toISOString();
     const allChecks = [];
     const allFindings = [];
+    const selectedChecks = new Set(options.selectedChecks ?? DEFAULT_SECURITY_CHECKS);
     function collect(check) {
         allChecks.push(check);
         allFindings.push(...check.findings);
@@ -34,57 +60,122 @@ export async function runSecurityValidation(options) {
     // --- Dependency checks (runs in target root) ---
     // If target has no package.json/lockfile, runDependencyChecks will surface that
     // as a structured finding rather than crashing.
-    try {
-        const depOutput = await runDependencyChecks({ cwd: target.targetRoot, config });
-        collectMany(depOutput.checks);
+    if (selectedChecks.has("deps")) {
+        try {
+            const depOutput = await runDependencyChecks({ cwd: target.targetRoot, config });
+            collectMany(depOutput.checks);
+        }
+        catch (err) {
+            collect(errorCheck("dependency-checks", "Dependency checks", "dependency-audit", err));
+        }
     }
-    catch (err) {
-        collect(errorCheck("dependency-checks", "Dependency checks", "dependency-audit", err));
+    else {
+        // Preserve the mandatory-check IDs verdict.ts relies on so deselecting this
+        // group still shows up as a skipped mandatory check, not a silent gap.
+        collect(skippedCheck("npm-audit-full", "npm audit (full)", "dependency-audit", NOT_SELECTED_REASON));
+        collect(skippedCheck("npm-audit-runtime", "npm audit (runtime)", "dependency-audit", NOT_SELECTED_REASON));
     }
     // --- Package content checks (runs in target root) ---
     // Not all projects are publishable npm packages; runPackageChecks handles
     // missing package.json gracefully.
-    try {
-        const pkgOutput = await runPackageChecks({ cwd: target.targetRoot, config });
-        collectMany(pkgOutput.checks);
+    if (selectedChecks.has("package")) {
+        try {
+            const pkgOutput = await runPackageChecks({ cwd: target.targetRoot, config });
+            collectMany(pkgOutput.checks);
+        }
+        catch (err) {
+            collect(errorCheck("package-content", "Package content checks", "package-content", err));
+        }
     }
-    catch (err) {
-        collect(errorCheck("package-content", "Package content checks", "package-content", err));
+    else {
+        collect(skippedCheck("npm-pack-dry-run", "npm pack --dry-run", "package-content", NOT_SELECTED_REASON));
     }
     // --- Static scans (scan target root; config from tool root) ---
-    try {
-        collect(await runCodeqlCheck({ cwd: toolRoot, targetRoot: target.targetRoot, timeoutMs: config.commandTimeoutMs }));
+    if (selectedChecks.has("static")) {
+        try {
+            collect(await runCodeqlCheck({ cwd: toolRoot, targetRoot: target.targetRoot, timeoutMs: config.commandTimeoutMs }));
+        }
+        catch (err) {
+            collect(errorCheck("codeql-scan", "CodeQL static analysis", "static-scan", err));
+        }
+        try {
+            collect(await runSemgrepCheck({
+                targetRoot: target.targetRoot,
+                toolRoot,
+                timeoutMs: config.commandTimeoutMs,
+            }));
+        }
+        catch (err) {
+            collect(errorCheck("semgrep-scan", "Semgrep static analysis", "static-scan", err));
+        }
     }
-    catch (err) {
-        collect(errorCheck("codeql-scan", "CodeQL static analysis", "static-scan", err));
+    else {
+        collect(skippedCheck("codeql-scan", "CodeQL static analysis", "static-scan", NOT_SELECTED_REASON));
+        collect(skippedCheck("semgrep-scan", "Semgrep static analysis", "static-scan", NOT_SELECTED_REASON));
     }
-    try {
-        collect(await runSemgrepCheck({
-            targetRoot: target.targetRoot,
+    // --- Security suite check ---
+    // Self-validation runs the lab's own test:security suite.
+    // External validation runs the target project's test:security script when present.
+    if (selectedChecks.has("cli-adversarial")) {
+        collect(await runCliSecuritySuiteCheck({
             toolRoot,
+            target,
             timeoutMs: config.commandTimeoutMs,
         }));
     }
-    catch (err) {
-        collect(errorCheck("semgrep-scan", "Semgrep static analysis", "static-scan", err));
+    else {
+        collect(skippedCheck("cli-adversarial-suite", "Target security test suite", "cli-adversarial", NOT_SELECTED_REASON));
     }
-    // --- Security suite check ---
-    // Self-validation runs the lab's own test:security suite.
-    // External validation runs the target project's test:security script when present.
-    collect(await runCliSecuritySuiteCheck({
-        toolRoot,
-        target,
-        timeoutMs: config.commandTimeoutMs,
-    }));
     // --- Fuzz smoke (always tool-internal; tests library parser/helper code) ---
-    try {
-        collect(await runAllFuzzTargets(ALL_FUZZ_TARGETS, {
-            seed: options.fuzzSeed ?? 0xdeadbeef,
-            iterations: options.fuzzIterations ?? 50,
-        }));
+    if (selectedChecks.has("fuzz")) {
+        try {
+            collect(await runAllFuzzTargets(ALL_FUZZ_TARGETS, {
+                seed: options.fuzzSeed ?? 0xdeadbeef,
+                iterations: options.fuzzIterations ?? 50,
+            }));
+        }
+        catch (err) {
+            collect(errorCheck("fuzz-smoke", "Fuzz smoke", "fuzz-smoke", err));
+        }
+    }
+    else {
+        collect(skippedCheck("fuzz-smoke", "Fuzz smoke", "fuzz-smoke", NOT_SELECTED_REASON));
     }
-    catch (err) {
-        collect(errorCheck("fuzz-smoke", "Fuzz smoke", "fuzz-smoke", err));
+    // --- Attack-scenario checks (boundary, subprocess, secrets, network) ---
+    // v0.2.2 Batch 2: routed through the attack-scenario runner. The registry
+    // is empty in Batch 2, so these currently resolve to explicit "no
+    // scenarios registered yet" skipped results — never "passed".
+    const profile = options.profile ?? DEFAULT_SECURITY_PROFILE;
+    const attackScenarioChecks = PLANNED_SECURITY_CHECK_IDS.filter((id) => selectedChecks.has(id));
+    let attackResults = [];
+    if (attackScenarioChecks.length > 0) {
+        try {
+            attackResults = await runAttackScenarios({
+                selectedChecks: attackScenarioChecks,
+                profile,
+                toolRoot,
+                target,
+                config,
+                targetSnapshotBefore,
+            });
+        }
+        catch (err) {
+            attackResults = attackScenarioChecks.map((checkId) => ({
+                scenarioId: `${checkId}-attack-runner-error`,
+                scenarioTitle: `Attack scenario runner error for '${checkId}'`,
+                checkId,
+                profileId: profile,
+                status: "blocked",
+                severity: "major",
+                confidence: "low",
+                evidence: [],
+                category: "cli-adversarial",
+                errorSummary: err instanceof Error ? err.message : String(err),
+            }));
+        }
+        for (const result of attackResults) {
+            collect(toSecurityCheckResult(result));
+        }
     }
     const finishedAt = new Date().toISOString();
     // --- Tool root metadata ---
@@ -102,6 +193,11 @@ export async function runSecurityValidation(options) {
         // Use defaults.
     }
     const { verdict, recommendedNextStep } = calculateVerdict(allChecks, allFindings);
+    const verdictReasonSummary = summarizeVerdictReasoning(allChecks, allFindings);
+    // "Full release gate" = every classic pre-v0.2.2 check group was selected.
+    // Attack-scenario checks (boundary/subprocess/secrets/network) are
+    // additional coverage, not part of that traditional baseline gate.
+    const isFullReleaseGate = IMPLEMENTED_SECURITY_CHECK_IDS.every((id) => selectedChecks.has(id));
     return {
         toolRoot,
         toolPackageName,
@@ -119,6 +215,9 @@ export async function runSecurityValidation(options) {
         findings: allFindings,
         verdict,
         recommendedNextStep,
+        attackResults,
+        verdictReasonSummary,
+        isFullReleaseGate,
     };
 }
 function errorCheck(id, name, category, err) {