@hoanghainh/komagu 2.2.1 → 2.4.0

package/operate/simulate/scenarios/times-car-breach.json

@@ -0,0 +1,74 @@
+{
+  "$schema": "https://raw.githubusercontent.com/hoanghainh1188/komagu/main/contracts/schemas/bas-scenario.schema.json",
+  "id": "times-car-breach",
+  "version": "1.0.0",
+  "title": "Times Car Mass BOLA / IDOR Scraping Simulation",
+  "status": "approved",
+  "approved_by": "sec-team@komagu.io",
+  "approved_at": "2026-03-15T00:00:00Z",
+  "incident": {
+    "name": "Times Car (Times Mobility) 2024 Mass Data Exposure",
+    "date": "2024",
+    "summary": "Simulates automated cross-user account/license harvesting by iterating through consecutive resource IDs with an unauthorized peer credential.",
+    "references": [
+      "https://scan.netsecurity.ne.jp/article/2024/04/17/50873.html",
+      "Times Car 2024 breach: 6.6M customer accounts and ID images exposed."
+    ]
+  },
+  "mappings": {
+    "cwe": ["CWE-639", "CWE-284"],
+    "owasp_api": ["API1:2023"],
+    "mitre_attack": ["T1059", "T1552"]
+  },
+  "parameters": {
+    "endpoint_pattern": {
+      "type": "string",
+      "default": "/api/legacy-orders/{id}",
+      "description": "Target endpoint path containing {id} parameter."
+    },
+    "attacker_token": {
+      "type": "string",
+      "default": "mock-attacker-bob-token",
+      "description": "Bearer token used to test cross-tenant unauthorized access."
+    },
+    "sample_ids": {
+      "type": "list",
+      "default": ["1", "2", "3", "101", "102"],
+      "description": "List of sample resource IDs to probe."
+    }
+  },
+  "steps": [
+    {
+      "name": "Iterate Cross-User Endpoints",
+      "description": "Requests resource IDs using attacker credential, expecting 403 or 404.",
+      "type": "http_request",
+      "destructive": false,
+      "repeat": {
+        "param_name": "sample_ids",
+        "as_var": "id"
+      },
+      "request": {
+        "method": "GET",
+        "path": "{endpoint_pattern}",
+        "headers": {
+          "Authorization": "Bearer {attacker_token}",
+          "User-Agent": "Komagu-BAS-TimesCarSimulator/1.0",
+          "Accept": "application/json"
+        }
+      },
+      "expect_secure": {
+        "status_codes": [403, 404]
+      },
+      "expect_vulnerable": {
+        "status_codes": [200, 201, 204]
+      }
+    }
+  ],
+  "scoring": {
+    "strategy": "ratio",
+    "recommendations": {
+      "remediation": "Enforce Komagu Boilerplate 1 (Object-Level Authorization) with declarative @RequireOwnership decorators or integrate Kong perimeter WAF with strict 404 invariants.",
+      "passed": "Endpoint securely enforces tenant isolation (404 Not Found invariant maintained)."
+    }
+  }
+}

package/operate/simulate/scenarios.py

@@ -107,6 +107,24 @@ class TimesCarBreachScenario(BaseScenario):
         self.sample_ids = sample_ids or ["1", "2", "3", "101", "102"]
 
     def run(self) -> ScenarioResult:
+        from operate.simulate.engine import DeclarativeScenario
+        from operate.simulate.loader import BUILTIN_SCENARIOS_DIR, load_scenario_file
+
+        scenario_path = BUILTIN_SCENARIOS_DIR / "times-car-breach.json"
+        if scenario_path.is_file():
+            data = load_scenario_file(scenario_path)
+            runner = DeclarativeScenario(
+                data,
+                target=self.target,
+                param_overrides={
+                    "endpoint_pattern": self.endpoint_pattern,
+                    "attacker_token": self.attacker_token,
+                    "sample_ids": self.sample_ids,
+                },
+                timeout=self.timeout,
+            )
+            return runner.run()
+
         total = len(self.sample_ids)
         blocked = 0
         leaked = 0
@@ -212,6 +230,24 @@ class MetabaseZeroDayScenario(BaseScenario):
         ]
 
     def run(self) -> ScenarioResult:
+        from operate.simulate.engine import DeclarativeScenario
+        from operate.simulate.loader import BUILTIN_SCENARIOS_DIR, load_scenario_file
+
+        scenario_path = BUILTIN_SCENARIOS_DIR / "metabase-cve-2026-72898.json"
+        if scenario_path.is_file():
+            data = load_scenario_file(scenario_path)
+            runner = DeclarativeScenario(
+                data,
+                target=self.target,
+                param_overrides={
+                    "query_path": self.query_path,
+                    "target_param": self.target_param,
+                    "payloads": self.payloads,
+                },
+                timeout=self.timeout,
+            )
+            return runner.run()
+
         total = len(self.payloads)
         blocked = 0
         leaked = 0
@@ -315,6 +351,22 @@ class IDCFrontierRansomwareScenario(BaseScenario):
         self.target_dir = Path(target_dir).resolve()
 
     def run(self) -> ScenarioResult:
+        from operate.simulate.engine import DeclarativeScenario
+        from operate.simulate.loader import BUILTIN_SCENARIOS_DIR, load_scenario_file
+
+        scenario_path = BUILTIN_SCENARIOS_DIR / "idc-frontier-ransomware.json"
+        if scenario_path.is_file():
+            data = load_scenario_file(scenario_path)
+            runner = DeclarativeScenario(
+                data,
+                target=str(self.target_dir),
+                param_overrides={
+                    "target_dir": str(self.target_dir),
+                },
+                timeout=self.timeout,
+            )
+            return runner.run()
+
         total = 3
         blocked = 0
         leaked = 0

package/operate/tests/test_ai_redaction.py

@@ -0,0 +1,181 @@
+#!/usr/bin/env python3
+"""Secrets are masked in every code snippet the headless agents send to the model (#350)."""
+
+from __future__ import annotations
+
+import shutil
+import tempfile
+import unittest
+from pathlib import Path
+
+import time
+
+from operate.ai.context import _model_source, _read_snippet, _redact_lines, _verification_context
+
+JAVA_DAO = '''package com.acme.dao;
+public class AccountDao {
+    private static final String URL = "jdbc:sqlserver://db01;databaseName=ams;user=sa;password=Ams#2019!";
+    private static final String MONGO = "mongodb://svc:Mongo2020pw@mongo01:27017/ams";
+    private static final String ORA = "jdbc:oracle:thin:scott/Tiger2018@db02:1521/AMS";
+    // db.password=CommentPw7 (old config, kept for reference)
+    private String apiKey = "sk-live-abcdef123456";
+    public Account find(HttpServletRequest req) {
+        String password = req.getParameter("password");
+        String sql = "SELECT * FROM account WHERE id = " + req.getParameter("id");
+        return jdbc.query(sql);
+    }
+}
+'''
+
+PROPERTIES = '''spring.datasource.url=jdbc:oracle:thin:@db02:1521/AMS
+spring.datasource.username=ams_app
+spring.datasource.password=Oracle#Pw2021
+mail.smtp.password: smtpPw99
+app.jwt.secret=c2VjcmV0LWtleS1mb3ItYW1z
+app.token.placeholder=${APP_TOKEN}
+'''
+
+PRIVATE_KEY = '''-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAwJ1rdTw6kLqA
+Zm9vYmFyYmF6cXV4cXV1eHF1dXg=
+-----END RSA PRIVATE KEY-----
+class Signer {}
+'''
+
+JSP = '''<%-- legacy: ldap.bind.password=LdapPw55 --%>
+<%@ page import="java.sql.*" %>
+<% String id = request.getParameter("id"); %>
+'''
+
+SECRETS = ("Ams#2019!", "Mongo2020pw", "Tiger2018", "CommentPw7", "sk-live-abcdef123456", "Oracle#Pw2021", "smtpPw99",
+           "c2VjcmV0LWtleS1mb3ItYW1z", "MIIEowIBAAKCAQEAwJ1rdTw6kLqA", "Zm9vYmFyYmF6cXV4cXV1eHF1dXg=", "LdapPw55")
+
+
+class TestSnippetRedaction(unittest.TestCase):
+    def setUp(self) -> None:
+        self.target = Path(tempfile.mkdtemp(prefix="komagu_redact_"))
+        files = {"src/com/acme/dao/AccountDao.java": JAVA_DAO, "src/main/resources/application.properties": PROPERTIES,
+                 "src/com/acme/Signer.java": PRIVATE_KEY, "WebContent/user/detail.jsp": JSP}
+        for rel, text in files.items():
+            (self.target / rel).parent.mkdir(parents=True, exist_ok=True)
+            (self.target / rel).write_text(text, encoding="utf-8")
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.target, ignore_errors=True)
+
+    def assert_no_secret(self, text: str) -> None:
+        for secret in SECRETS:
+            self.assertNotIn(secret, text)
+
+    def test_java_source_snippet_masks_connection_strings_and_keys(self) -> None:
+        snip = _read_snippet(self.target, "src/com/acme/dao/AccountDao.java", 5)
+        self.assert_no_secret(snip)
+        self.assertIn("[REDACTED]", snip)
+
+    def test_code_the_auditor_needs_is_kept(self) -> None:
+        snip = _read_snippet(self.target, "src/com/acme/dao/AccountDao.java", 5)
+        self.assertIn('String password = req.getParameter("password");', snip)
+        self.assertIn('"SELECT * FROM account WHERE id = " + req.getParameter("id")', snip)
+        self.assertIn("jdbc:sqlserver://db01;databaseName=ams;user=sa;password=[REDACTED]", snip)
+        self.assertIn("mongodb://svc:[REDACTED]@mongo01:27017/ams", snip)
+        self.assertIn("jdbc:oracle:thin:scott/[REDACTED]@db02:1521/AMS", snip)
+
+    def test_config_line_inside_a_comment_is_masked(self) -> None:
+        snip = _read_snippet(self.target, "WebContent/user/detail.jsp", 2)
+        self.assert_no_secret(snip)
+        self.assertIn("ldap.bind.password=[REDACTED] --%>", snip)
+        self.assertIn('String id = request.getParameter("id");', snip)
+
+    def test_assignments_in_code_are_kept(self) -> None:
+        lines = ["user.password = req.body.password;", "if (token == null) return;", "token: req.headers.authorization,"]
+        (self.target / "app.js").write_text("\n".join(lines) + "\n", encoding="utf-8")
+        snip = _read_snippet(self.target, "app.js", 2)
+        for line in lines:
+            self.assertIn(line, snip)
+
+    def test_unquoted_properties_values_are_masked(self) -> None:
+        snip = _read_snippet(self.target, "src/main/resources/application.properties", 3)
+        self.assert_no_secret(snip)
+        self.assertIn("spring.datasource.username=ams_app", snip)
+        self.assertIn("app.token.placeholder=${APP_TOKEN}", snip)
+
+    def test_private_key_block_is_masked_with_line_numbers_kept(self) -> None:
+        snip = _read_snippet(self.target, "src/com/acme/Signer.java", 3)
+        self.assert_no_secret(snip)
+        self.assertIn("   5 | class Signer {}", snip)
+
+    def test_model_and_verifier_context_are_masked(self) -> None:
+        model = _model_source(self.target, "AccountDao", "src/com/acme/dao/AccountDao.java", 1)
+        self.assert_no_secret(model["code"])
+        ctx = _verification_context(self.target, {"location": {"file": "src/com/acme/dao/AccountDao.java", "start_line": 8},
+                                                  "evidence": [{"file": "src/main/resources/application.properties", "line": 3}]})
+        self.assert_no_secret(str(ctx))
+
+
+class TestJavaLegacySecretForms(unittest.TestCase):
+    """Forms found in a security review of the first version (#350); each must hide Hunter2x."""
+
+    LEAKS = (
+        '<property name="password" value="Hunter2x"/>',
+        '<property name="jdbc.password"\n          value="Hunter2x"/>',
+        "<param-name>db.password</param-name><param-value>Hunter2x</param-value>",
+        "<init-param>\n  <param-name>password</param-name>\n  <param-value>Hunter2x</param-value>",
+        "<password>Hunter2x</password>",
+        'conn.setPassword("Hunter2x");',
+        'props.setProperty("mail.smtp.password", "Hunter2x");',
+        'Connection c = DriverManager.getConnection(url, "sa", "Hunter2x");',
+        'return new PasswordAuthentication("svc", "Hunter2x".toCharArray());',
+        'String pw = "Hunter2x";',
+        'static final String DB_PASS = "Hunter2x";',
+        '<Connector port="8443" keystorePass="Hunter2x" truststorePass="Hunter2x"/>',
+        '{"password":"Hunter2x", "apikey" : "Hunter2x"}',
+        "$conf = array('password' => 'Hunter2x');",
+        "db_password: Hunter2x  # prod",
+        "mail.smtp.pass=Hunter2x",
+        "ssl.key.passphrase=Hunter2x",
+        "jdbc:sqlserver://db;user=sa;password={Hunter2x;x}",
+        'conn.setRequestProperty("Authorization", "Basic SHVudGVyMng6eHl6");',
+        'h.put("Authorization", "Bearer Hunter2xHunter2x.eyJzdWIiOiIxIn0.sig");',
+        "-----BEGIN PRIVATE KEY----- Hunter2xMIIEvQIBADANBgkq -----END PRIVATE KEY-----",
+    )
+    TOKENS = ("AKIAIOSFODNN7EXAMPLE", "ghp_" + "a" * 36, "sk-ant-api03-" + "b" * 40, "AIza" + "c" * 35)
+    KEPT = (
+        'String password = req.getParameter("password");',
+        "String sql = \"SELECT * FROM users WHERE login='\" + u + \"' AND pwd='\" + p + \"'\";",
+        "<select id=\"login\">SELECT * FROM users WHERE pwd = #{password}</select>",
+        "spring.datasource.password=${DB_PASS}",
+        "user.password = req.body.password;",
+        "if (token == null) return;",
+        'String header = "Bearer " + token;',
+        '<property name="username" value="ams_app"/>',
+        "Passenger p = passengerDao.find(id);",
+    )
+
+    def redact(self, text: str) -> str:
+        return "\n".join(_redact_lines(text.split("\n")))
+
+    def test_java_legacy_forms_are_masked(self) -> None:
+        for sample in self.LEAKS:
+            with self.subTest(sample=sample):
+                self.assertNotIn("Hunter2x", self.redact(sample))
+
+    def test_cloud_and_vcs_tokens_are_masked(self) -> None:
+        for token in self.TOKENS:
+            with self.subTest(token=token[:8]):
+                self.assertNotIn(token, self.redact(f'String key = cfg.get("{token}");'))
+
+    def test_code_the_auditor_needs_is_kept(self) -> None:
+        for line in self.KEPT:
+            with self.subTest(line=line):
+                self.assertEqual(self.redact(line), line)
+
+    def test_long_lines_are_fast_and_not_sent(self) -> None:
+        lines = ["a.b" * 300000 + "password", "a-" * 500000 + "://", "a-b." * 250000, "x" * 1000000]
+        start = time.monotonic()
+        out = _redact_lines(lines)
+        self.assertLess(time.monotonic() - start, 2.0)
+        self.assertTrue(all(o.startswith("[line of ") for o in out))
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/tests/test_api_inventory.py

@@ -0,0 +1,239 @@
+#!/usr/bin/env python3
+"""Tests for API Inventory Reconciliation & Shadow/Zombie API Detection (Issue #288).
+
+Verifies:
+1. api-inventory-diff.schema.json schema conformity.
+2. Route path parameter normalization (Express, Flask, OpenAPI, integers, UUIDs).
+3. 3-way reconciliation covering all 4 discrepancy cases:
+   - Shadow API: in code but not in spec.
+   - Shadow API: in live traffic but not in spec.
+   - Zombie API: marked deprecated in OpenAPI spec but still receiving traffic.
+   - Documented Missing in Code: in spec but not implemented.
+   - Dormant Code: implemented and documented, but zero traffic.
+4. Kong HTTP-Log (JSON lines) and NGINX Combined access log parsing.
+5. CLI execution and gating flags (--fail-on-shadow, --fail-on-zombie).
+6. Markdown and HTML report generation.
+
+Standard-library-only (Python 3.8+).
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import tempfile
+import unittest
+from pathlib import Path
+
+from assess.lsa.scripts.merge_findings import load_validator
+from operate.cli.commands.inventory import run_inventory
+from operate.inventory.api_inventory import (
+    diff_api_inventory,
+    load_code_routes,
+    load_openapi_spec,
+    load_traffic_log,
+    normalize_path,
+    normalize_route_key,
+    render_inventory_html,
+    render_inventory_md,
+)
+
+
+class TestApiInventory(unittest.TestCase):
+    def setUp(self) -> None:
+        self.validate_schema = load_validator("api-inventory-diff.schema.json")
+
+    def test_path_normalization(self) -> None:
+        """Verify unified path normalization across diverse frameworks."""
+        self.assertEqual(normalize_path("/api/orders/{id}"), "/api/orders/{}")
+        self.assertEqual(normalize_path("/users/<int:userId>"), "/users/{}")
+        self.assertEqual(normalize_path("/accounts/:accId/profile"), "/accounts/{}/profile")
+        self.assertEqual(normalize_path("/api/orders/42"), "/api/orders/{}")
+        self.assertEqual(
+            normalize_path("/items/12345678-abcd-1234-abcd-123456789abc"),
+            "/items/{}"
+        )
+        self.assertEqual(normalize_path("/trailing/slash/"), "/trailing/slash")
+        self.assertEqual(normalize_route_key("get", "/api/v1/orders/{id}?limit=10"), "GET /api/v1/orders/{}")
+
+    def test_four_way_reconciliation_cases(self) -> None:
+        """Verify detection of Shadow, Zombie, Dead Spec, and Dormant Code."""
+        # 1. Code routes
+        code_routes = [
+            {"method": "GET", "path": "/api/users/{id}", "location": "Controllers/Users.cs:10"},  # Normal
+            {"method": "POST", "path": "/api/internal/debug-dump", "location": "Controllers/Debug.cs:42"},  # Shadow (in code, not spec)
+            {"method": "GET", "path": "/api/legacy-v1/export", "location": "Controllers/Legacy.cs:15"},  # Zombie (deprecated in spec, receiving traffic)
+            {"method": "GET", "path": "/api/dormant-feature", "location": "Controllers/Dormant.cs:88"},  # Dormant (in code & spec, 0 traffic)
+        ]
+
+        # 2. OpenAPI Spec
+        spec_endpoints = [
+            {"method": "GET", "path": "/api/users/{id}", "normalized": "GET /api/users/{}", "deprecated": False},
+            {"method": "GET", "path": "/api/legacy-v1/export", "normalized": "GET /api/legacy-v1/export", "deprecated": True},  # Deprecated!
+            {"method": "GET", "path": "/api/dormant-feature", "normalized": "GET /api/dormant-feature", "deprecated": False},
+            {"method": "DELETE", "path": "/api/planned-ghost", "normalized": "DELETE /api/planned-ghost", "deprecated": False, "summary": "Ghost spec"},  # Missing in code
+        ]
+
+        # 3. Traffic Data
+        traffic_data = {
+            "GET /api/users/{}": {"method": "GET", "path": "/api/users/123", "normalized": "GET /api/users/{}", "traffic_hits": 50},
+            "GET /api/legacy-v1/export": {"method": "GET", "path": "/api/legacy-v1/export", "normalized": "GET /api/legacy-v1/export", "traffic_hits": 12},
+            "POST /api/untracked-admin": {"method": "POST", "path": "/api/untracked-admin", "normalized": "POST /api/untracked-admin", "traffic_hits": 5},  # Shadow in traffic only
+        }
+
+        diff = diff_api_inventory(code_routes, spec_endpoints, traffic_data)
+        errors = self.validate_schema(diff)
+        self.assertEqual(errors, [], f"Schema validation errors: {errors}")
+
+        s = diff["summary"]
+        self.assertEqual(s["shadow_count"], 2)  # debug-dump (code_only) + untracked-admin (traffic_only)
+        self.assertEqual(s["zombie_count"], 1)  # legacy-v1/export
+        self.assertEqual(s["missing_code_count"], 1)  # planned-ghost
+        self.assertEqual(s["dormant_count"], 1)  # dormant-feature
+
+        # Verify Shadow details
+        shadow_keys = {sh["normalized"]: sh["discovered_in"] for sh in diff["shadow_apis"]}
+        self.assertEqual(shadow_keys.get("POST /api/internal/debug-dump"), "code_only")
+        self.assertEqual(shadow_keys.get("POST /api/untracked-admin"), "traffic_only")
+
+        # Verify Zombie details
+        zombie_keys = [z["normalized"] for z in diff["zombie_apis"]]
+        self.assertIn("GET /api/legacy-v1/export", zombie_keys)
+        self.assertEqual(diff["zombie_apis"][0]["traffic_hits"], 12)
+
+        # Verify Missing code details
+        missing_keys = [m["normalized"] for m in diff["documented_missing_code"]]
+        self.assertIn("DELETE /api/planned-ghost", missing_keys)
+
+        # Verify Dormant code details
+        dormant_keys = [d["normalized"] for d in diff["dormant_code"]]
+        self.assertIn("GET /api/dormant-feature", dormant_keys)
+
+    def test_log_parsers(self) -> None:
+        """Verify parsing Kong JSON lines and Combined Nginx log formats."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            tmp = Path(tmpdir)
+
+            # 1. Kong HTTP-Log NDJSON
+            kong_log = tmp / "kong.log"
+            kong_log.write_text(
+                '{"request": {"method": "GET", "uri": "/api/orders/101"}, "started_at": 1730000000}\n'
+                '{"request": {"method": "GET", "uri": "/api/orders/102"}, "started_at": 1730000001}\n'
+                '{"request": {"method": "POST", "uri": "/api/checkout"}, "started_at": 1730000002}\n'
+            )
+            parsed_kong = load_traffic_log(kong_log)
+            self.assertEqual(parsed_kong["GET /api/orders/{}"]["traffic_hits"], 2)
+            self.assertEqual(parsed_kong["POST /api/checkout"]["traffic_hits"], 1)
+
+            # 2. Combined NGINX log
+            nginx_log = tmp / "nginx.log"
+            nginx_log.write_text(
+                '192.168.1.1 - - [01/Nov/2026:12:00:00 +0000] "GET /api/products/42 HTTP/1.1" 200 450\n'
+                '192.168.1.2 - - [01/Nov/2026:12:00:01 +0000] "DELETE /api/cart HTTP/1.1" 204 0\n'
+            )
+            parsed_nginx = load_traffic_log(nginx_log)
+            self.assertEqual(parsed_nginx["GET /api/products/{}"]["traffic_hits"], 1)
+            self.assertEqual(parsed_nginx["DELETE /api/cart"]["traffic_hits"], 1)
+
+    def test_cli_execution_and_gating(self) -> None:
+        """Verify komagu inventory command execution and gate checks."""
+        with tempfile.TemporaryDirectory() as tmpdir:
+            tmp = Path(tmpdir)
+            routes_file = tmp / "routes.json"
+            routes_file.write_text(json.dumps({
+                "routes": [
+                    {"method": "GET", "path": "/api/users/{id}", "location": "app.py:10"},
+                    {"method": "POST", "path": "/api/shadow-login", "location": "auth.py:50"},
+                ]
+            }))
+
+            spec_file = tmp / "openapi.json"
+            spec_file.write_text(json.dumps({
+                "openapi": "3.0.0",
+                "paths": {
+                    "/api/users/{id}": {"get": {"summary": "Get user"}},
+                    "/api/old-v0/auth": {"post": {"deprecated": True, "summary": "Old auth"}},
+                }
+            }))
+
+            traffic_file = tmp / "traffic.log"
+            traffic_file.write_text('{"request": {"method": "POST", "uri": "/api/old-v0/auth"}}\n')
+
+            out_file = tmp / "diff.json"
+
+            args = argparse.Namespace(
+                routes=routes_file,
+                openapi=spec_file,
+                traffic_log=traffic_file,
+                out=out_file,
+                fail_on_shadow=False,
+                fail_on_zombie=False,
+            )
+
+            # Normal run passes with exit code 0
+            rc = run_inventory(args)
+            self.assertEqual(rc, 0)
+            self.assertTrue(out_file.is_file())
+
+            diff_data = json.loads(out_file.read_text())
+            self.assertEqual(diff_data["summary"]["shadow_count"], 1)
+            self.assertEqual(diff_data["summary"]["zombie_count"], 1)
+
+            # Fail on shadow gate trips exit code 1
+            args_shadow_gate = argparse.Namespace(
+                routes=routes_file,
+                openapi=spec_file,
+                traffic_log=traffic_file,
+                out=out_file,
+                fail_on_shadow=True,
+                fail_on_zombie=False,
+            )
+            self.assertEqual(run_inventory(args_shadow_gate), 1)
+
+            # Fail on zombie gate trips exit code 1
+            args_zombie_gate = argparse.Namespace(
+                routes=routes_file,
+                openapi=spec_file,
+                traffic_log=traffic_file,
+                out=out_file,
+                fail_on_shadow=False,
+                fail_on_zombie=True,
+            )
+            self.assertEqual(run_inventory(args_zombie_gate), 1)
+
+    def test_report_rendering(self) -> None:
+        """Verify Markdown and HTML report generation for API inventory diff."""
+        mock_diff = {
+            "summary": {
+                "total_code_routes": 10,
+                "total_spec_endpoints": 8,
+                "total_traffic_endpoints": 9,
+                "shadow_count": 2,
+                "zombie_count": 1,
+                "missing_code_count": 0,
+                "dormant_count": 1,
+            },
+            "shadow_apis": [
+                {"method": "POST", "path": "/api/secret", "normalized": "POST /api/secret", "discovered_in": "code_only", "traffic_hits": 0, "location": "secret.py:1"}
+            ],
+            "zombie_apis": [
+                {"method": "GET", "path": "/api/v1/old", "normalized": "GET /api/v1/old", "location": "old.py:5", "traffic_hits": 15, "last_seen": "2026-11-01"}
+            ],
+            "documented_missing_code": [],
+            "dormant_code": [],
+        }
+
+        md_en = "\n".join(render_inventory_md(mock_diff, "en"))
+        self.assertIn("API Inventory Reconciliation", md_en)
+        self.assertIn("POST /api/secret", md_en)
+
+        md_ja = "\n".join(render_inventory_md(mock_diff, "ja"))
+        self.assertIn("APIインベントリ照合", md_ja)
+        self.assertIn("Shadow API", md_ja)
+
+        html_card = render_inventory_html(mock_diff)
+        self.assertIn("API Inventory &amp; Shadow / Zombie API Detection", html_card)
+        self.assertIn("POST /api/secret", html_card)
+
+
+if __name__ == "__main__":
+    unittest.main()