@inerrata-corporation/errata 2.0.16-dev.3332 → 2.0.16-dev.3355

package/consolidate-worker.mjs

@@ -802,6 +802,12 @@ function identityId(input) {
     }
     case "Claim":
       return canonicalClaimId(input.text, input.scope);
+    case "WitnessedVulnerability":
+      return genericCanonicalId("dvuln", {
+        workspaceId: input.workspaceId,
+        target: input.target.replace(/\\/g, "/").replace(/^\.\//, ""),
+        statement: canonicalClaimId(input.statement.trim())
+      });
     case "DesignProblem":
       return `${DESIGN_PROBLEM_PREFIX}${canonicalClaimId(input.statement.trim())}`.slice(
         0,
@@ -15258,7 +15264,7 @@ var init_edge_rules = __esm({
       // anchor anything at anything, e.g. at a public `Package`, quietly re-creating
       // the code↔collective bridge the membrane exists to prevent.
       ANCHORED_AT: {
-        from: ["Problem", "Solution", "RootCause", "Claim"],
+        from: ["Problem", "Vulnerability", "Solution", "RootCause", "Claim"],
         to: ["Symbol"]
       },
       // ── Security spine (v1 taxonomy.ts SECURITY_FORWARD_ONLY commentary) ──
@@ -15303,7 +15309,7 @@ var init_edge_rules = __esm({
       // `Component` joined the target set with OM-agent-anchors: an agent-named
       // component ("React Router") is the same knowledge→named-unit anchor shape as
       // a Tool — the knowledge is ABOUT it, not dependent on it.
-      CONCERNS: { from: ["Problem", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool", "Component"] },
+      CONCERNS: { from: ["Problem", "Vulnerability", "Solution", "RootCause", "Claim", "Pattern"], to: ["Tool", "Component"] },
       OPERATES_ON: { from: ["Algorithm"], to: ["DataStructure"] },
       INVOLVES: { from: ["Problem", "Solution"], to: ["DataStructure"] },
       // ── Taxonomy (Track 4 Stream C: MITRE CWE `ChildOf` → `Weakness —IS_A→ Weakness`) ──
@@ -16410,7 +16416,8 @@ CREATE INDEX IF NOT EXISTS nodes_live ON nodes(label, valid_to);
 -- its table row. Partial, so it maintains a few thousand rows instead of adding
 -- a write to every node write. Its label list is FINGERPRINT_INDEXED_LABELS.
 DROP INDEX IF EXISTS nodes_live_fingerprint;
-CREATE INDEX IF NOT EXISTS nodes_instance_fingerprint ON nodes(label, last_updated_at, last_reinforced_at_seq, created_at_seq) WHERE valid_to IS NULL AND label IN ('Problem','Solution','RootCause');
+DROP INDEX IF EXISTS nodes_instance_fingerprint;
+CREATE INDEX IF NOT EXISTS nodes_instance_fingerprint_v2 ON nodes(label, last_updated_at, last_reinforced_at_seq, created_at_seq) WHERE valid_to IS NULL AND label IN ('Problem','Vulnerability','Solution','RootCause');
 CREATE INDEX IF NOT EXISTS nodes_logical ON nodes(logical_id, version);
 CREATE INDEX IF NOT EXISTS edges_live ON edges(valid_to);
 -- Expression index on the per-node relPath (stored in attrs_json) so the
@@ -16481,7 +16488,7 @@ function rowToEdge(r) {
     attrs: JSON.parse(r.attrs_json)
   };
 }
-var FINGERPRINT_INDEXED_LABELS = ["Problem", "Solution", "RootCause"];
+var FINGERPRINT_INDEXED_LABELS = ["Problem", "Vulnerability", "Solution", "RootCause"];
 var SqliteGraphStore = class {
   db;
   // Typed edge lookups build their SQL from the number of types asked for, and
@@ -17159,8 +17166,8 @@ var SqliteGraphStore = class {
       const r2 = this.db.prepare(
         `SELECT COUNT(*) AS n, MAX(last_updated_at) AS t,
                   MAX(COALESCE(last_reinforced_at_seq, created_at_seq, 0)) AS s
-             FROM nodes INDEXED BY nodes_instance_fingerprint
-            WHERE valid_to IS NULL AND label IN ('Problem','Solution','RootCause')`
+             FROM nodes INDEXED BY nodes_instance_fingerprint_v2
+            WHERE valid_to IS NULL AND label IN ('Problem','Vulnerability','Solution','RootCause')`
       ).get();
       return `${r2.n}:${r2.t ?? 0}:${r2.s ?? 0}`;
     }
@@ -19389,7 +19396,7 @@ function generalizeFileRefs(text, fileLexicon, level = 1) {
 }
 
 // src/instance-ingest.ts
-var INSTANCE_LABELS = ["Problem", "Solution", "RootCause"];
+var INSTANCE_LABELS = ["Problem", "Vulnerability", "Solution", "RootCause"];
 var INSTANCE_EDGES = ["CAUSED_BY", "SOLVED_BY"];
 var ANCHOR_EDGES = ["OCCURS_IN", "DEPENDS_ON", "PERTAIN_TO", "CONCERNS"];
 var ANCHOR_TARGET_LABELS = ["Language", "Package", "Domain", "Component"];
@@ -19509,6 +19516,10 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       attrs: {
         scope: stripCodebaseScope(n.attrs["scope"]),
         ...n.attrs["kind"] ? { kind: n.attrs["kind"] } : {},
+        ...n.attrs["privateFinding"] ? { privateFinding: true } : {},
+        ...n.attrs["assessment"] ? { assessment: n.attrs["assessment"] } : {},
+        ...n.attrs["sourceClass"] ? { sourceClass: n.attrs["sourceClass"] } : {},
+        ...n.attrs["resolutionWitnessed"] ? { resolutionWitnessed: true, resolvedAt: n.attrs["resolvedAt"] } : {},
         ...n.attrs["resolvedAs"] ? { resolvedAs: n.attrs["resolvedAs"] } : {},
         ...preserved.length > 0 ? { preservedSymbols: preserved } : {},
         ...internal.length > 0 ? { internalSymbols: internal } : {}
@@ -19523,6 +19534,7 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
   const semanticEndpoints = /* @__PURE__ */ new Map();
   const includedByLabel = /* @__PURE__ */ new Map();
   const composition = {
+    privateTargetMissing: 0,
     candidates: 0,
     shipped: 0,
     cloudSourced: 0,
@@ -19568,11 +19580,15 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
       if (walked.has(n.id)) continue;
       walked.add(n.id);
       composition.candidates++;
+      if ((n.attrs["privateFinding"] || n.label === "Vulnerability") && !opts.project) {
+        composition.privateTargetMissing++;
+        continue;
+      }
       if (n.attrs["source"] === "cloud") {
         composition.cloudSourced++;
         continue;
       }
-      if (label === "Problem" && n.attrs["resolvedAs"] === PROBLEM_RESOLUTION.FALSE_POSITIVE) {
+      if (n.attrs["resolvedAs"] === PROBLEM_RESOLUTION.FALSE_POSITIVE) {
         composition.falsePositive++;
         continue;
       }
@@ -19595,7 +19611,7 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
         composition.terminalRefused++;
         continue;
       }
-      if (!noveltyAgainst(n, ref, noveltyOpts).ready) {
+      if (!n.attrs["privateFinding"] && !noveltyAgainst(n, ref, noveltyOpts).ready) {
         composition.notNovel++;
         continue;
       }
@@ -19638,7 +19654,7 @@ function buildInstanceIngest(store, profile, daemonVersion, ignorePatterns = [],
     }
     if (targets.length === 0) continue;
     const shipped = shippedById.get(sourceId);
-    if (shipped) {
+    if (shipped && !shipped.attrs["privateFinding"]) {
       const anchors = (label) => targets.filter((x) => x.t.label === label).map(
         (x) => label === "Language" ? langAnchor(x.t) : label === "Component" ? `component:${x.wireId}` : x.wireId
       ).filter((a) => a != null).sort();