@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/src/lattice/artifact.mjs

@@ -0,0 +1,1201 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { AREAS } from '../agent/schema.mjs';
+import { buildLatticeRuntimeSource } from './runtime.mjs';
+
+const FORMAT = 'lattice-security-artifact-v1';
+const SHA256 = /^[0-9a-f]{64}$/;
+const ORIGINAL_SOURCE_ARCHIVE_URL = /^https:\/\/registry\.npmjs\.org\/(?:@latticeai\/cli\/-\/cli-|@m2-ai\/lattice-cli\/-\/lattice-cli-)(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.tgz(?![\s\S])/;
+const AGENT_REVIEW_AREA_METADATA = {
+  'access-control': {
+    label: 'Access control',
+    summary: 'A customer-agent review placed this finding in the access-control area. The review narrative and proposed change remain local to the VSG report.',
+  },
+  supabase: {
+    label: 'Supabase data access',
+    summary: 'A customer-agent review placed this finding in the Supabase area. The review narrative and proposed change remain local to the VSG report.',
+  },
+  payments: {
+    label: 'Payments',
+    summary: 'A customer-agent review placed this finding in the payments area. The review narrative and proposed change remain local to the VSG report.',
+  },
+  'webhooks-integrations': {
+    label: 'Webhooks and integrations',
+    summary: 'A customer-agent review placed this finding in the webhooks and integrations area. The review narrative and proposed change remain local to the VSG report.',
+  },
+  'input-handling': {
+    label: 'Input handling',
+    summary: 'A customer-agent review placed this finding in the input-handling area. The review narrative and proposed change remain local to the VSG report.',
+  },
+  'secrets-config': {
+    label: 'Secrets and configuration',
+    summary: 'A customer-agent review placed this finding in the secrets and configuration area. The review narrative and proposed change remain local to the VSG report.',
+  },
+  'ai-features': {
+    label: 'AI features',
+    summary: 'A customer-agent review placed this finding in the AI-features area. The review narrative and proposed change remain local to the VSG report.',
+  },
+  'privacy-account-recovery': {
+    label: 'Privacy and account recovery',
+    summary: 'A customer-agent review placed this finding in the privacy and account-recovery area. The review narrative and proposed change remain local to the VSG report.',
+  },
+  'mobile-expo': {
+    label: 'Mobile and Expo',
+    summary: 'A customer-agent review placed this finding in the mobile and Expo area. The review narrative and proposed change remain local to the VSG report.',
+  },
+  'desktop-python': {
+    label: 'Desktop and Python',
+    summary: 'A customer-agent review placed this finding in the desktop and Python area. The review narrative and proposed change remain local to the VSG report.',
+  },
+  'supply-chain': {
+    label: 'Software supply chain',
+    summary: 'A customer-agent review placed this finding in the software supply-chain area. The review narrative and proposed change remain local to the VSG report.',
+  },
+};
+const BETTERLEAKS_RULE_CONTRACTS = [
+  {
+    ruleId: 'generic-api-key',
+    evidencePath: 'licensing/candidates/betterleaks-generic-api-key.json',
+    evidenceSha256: 'fa88c2b065ef0876b59eb488814983efe23c24eff90dac1a272aeb30e955096c',
+    sourceSha256: '89afa6d460ea97d7ca2330433b839b7aedf6afad83251ec40cc35b813e42c57a',
+    originSourceSha256: '7ffad1b698b30865fabbe9c8d0b8ac9ebb9606a255bac591b81e63304c0264d4',
+    initialImportSha256: '47a3216fd96cb2b89e3405e3a12b2e8572b0a0b834b72e2399289b30f40ca9cd',
+    attributionIds: ['betterleaks:generic-api-key', 'gitleaks:generic-api-key-origin'],
+    missingBlocker: 'betterleaks_generic_api_key_provenance_missing',
+    summary: 'A value matched the pinned Betterleaks generic API key pattern. Treat it as a possible credential until its issuing service and privileges are confirmed.',
+    remediation: 'Identify the issuing service. If the value is a real credential, revoke or rotate it, remove it from source and history, and load the replacement from a secret manager or private environment variable. If it is test data or a false positive, remove or replace the credential-shaped value, or use VSG acceptance only after documented review.',
+    retest: 'Run the same VSG secrets check again and confirm the finding is gone or explicitly accepted through the existing review workflow.',
+  },
+  {
+    ruleId: 'jwt',
+    evidencePath: 'licensing/candidates/betterleaks-jwt.json',
+    evidenceSha256: 'b0f411643bcc491ebb572b18387456bfe9ccf77c5a050b0a59d05d5a60e3c44f',
+    sourceSha256: '3d217c02a191f5d4f915bab9c0f486d2c297a694eb00fba58c13d4a4392276e7',
+    originSourceSha256: '487025fbac8fef09c102bbfe35ba686df70c274d347f534b9d0aeb69259829e5',
+    initialImportSha256: '7cc52e8ab224c5ecd371b47cefb2ff87d39f3f6a0ac91a462ed7ad1e8027593e',
+    attributionIds: ['betterleaks:jwt', 'gitleaks:jwt-origin'],
+    missingBlocker: 'betterleaks_jwt_provenance_missing',
+    summary: 'A value matched the pinned Betterleaks JSON Web Token pattern. Treat it as a possible bearer credential until its issuer, intended audience, expiry, and privileges are confirmed.',
+    remediation: 'Identify the token issuer and privileges. If the token is active or may grant access, revoke or rotate its signing or session credentials as appropriate, remove it from source and history, and load replacements from a secret manager or private environment variable.',
+    retest: 'Run the same VSG secrets check again and confirm the token is gone or explicitly accepted through the existing review workflow.',
+  },
+];
+const BETTERLEAKS_NOTICE_PATHS = [
+  'licensing/notices/betterleaks-1.9.0-MIT.txt',
+  'licensing/notices/gitleaks-generic-origin-782f3104-MIT.txt',
+];
+const QUALIFICATION_RECORDS = [
+  { path: 'licensing/candidates/commercial-rule-candidate.json',
+    sha256: '2b305facf86c308dee3131dbc9854abf5291e29546d4fd641bace4bb1b920a9c' },
+  { path: 'licensing/candidates/gitlab-sast-source-notice-bundle.json',
+    sha256: '95494e6442be48932743220de45124fb51dc578eddb8d72174f1038c6a2e4011' },
+];
+const SELECTED_RUNTIME_RECORDS = Object.freeze({
+  sastSourceEvidence: { path: 'licensing/candidates/gitlab-sast-source-evidence.json', sha256: '662c47108fe1acfd6ce3db5508fcfe81bb851f666bb5d4091e80d1f35ace0e91' },
+  sastIdentities: { path: 'licensing/candidates/gitlab-sast-rule-identities.json', sha256: '533f9211267df50f004cbb38deb49abbb210a23d6acbe7a6f11379fbbb24b1b2' },
+  yaraInventory: { path: 'licensing/candidates/yara-forge-20260927.json', sha256: '4a1eb672e488b99d3381979a9eb1de4890edee79cfbcded9502683d48dbc7d54' },
+  coverage: { path: 'licensing/candidates/selected-runtime-coverage.json', sha256: '92daa13869cd402c64da9d2e6e6fd6198ffd58587d4d2080804c821514f46a2d' },
+});
+const SELECTED_NOTICE_RECORDS = Object.freeze({
+  malpedia: { path: 'licensing/candidates/malpedia-source-license-evidence.json', sha256: '4729a9374e28fd1ac463860efa7b596269cb323b97488de4d27af53506940e50' },
+  apache: { path: 'licensing/candidates/apache-source-license-evidence.json', sha256: 'ab29e41e05a2c2dc333b2fbf05790c7497ba34a6aec125ed9a33f27756124350' },
+  cado: { path: 'licensing/candidates/cado-source-declaration-evidence.json', sha256: '810cadb12983588a7001fee92a328fb6ac66e9e766eb90ed06d4f083ad341e36' },
+  blackberry: { path: 'licensing/candidates/blackberry-source-declaration-evidence.json', sha256: '662602c01d6cc755ace812570591d8257de3462562e0ca4b57fa33c3a1ff7e8e' },
+  blackberryAdditional: { path: 'licensing/candidates/blackberry-additional-source-declaration-evidence.json', sha256: 'db922d1ab580eb09a01de5db83741f134a4446610a0762a4c91a0c298099de2f' },
+});
+const COMMERCIAL_RELEASE_RECORD = Object.freeze({
+  path: 'licensing/candidates/commercial-runtime-release.json',
+});
+const COMMERCIAL_RELEASE_EVIDENCE = Object.freeze([
+  ...QUALIFICATION_RECORDS,
+  SELECTED_RUNTIME_RECORDS.coverage,
+  { path: 'licensing/candidates/rule-license-evidence.json', sha256: '436466392799976cd3dd7788e3f28700b9c7828ac0586adc2979c57c7f239572' },
+  { path: 'licensing/candidates/runner-image-composition.json', sha256: '2bbb1193ab1e1a92a68f90e0e5fef1759da4030990392c819a4eb05d31fdeddd' },
+  { path: 'licensing/candidates/data-feed-evidence.json', sha256: '014af19a07a02e36063bdb140fcea627d09ef8c7bc90ea12c365bd3736a91042' },
+]);
+const TOP_LEVEL_FILES = new Set([
+  'LICENSE', 'NOTICE', 'package.json', 'licensing/commercial-components.json',
+  ...BETTERLEAKS_RULE_CONTRACTS.map((item) => item.evidencePath), ...BETTERLEAKS_NOTICE_PATHS,
+  ...QUALIFICATION_RECORDS.map((item) => item.path),
+  ...Object.values(SELECTED_RUNTIME_RECORDS).map((item) => item.path),
+  ...Object.values(SELECTED_NOTICE_RECORDS).map((item) => item.path),
+  COMMERCIAL_RELEASE_RECORD.path,
+  ...COMMERCIAL_RELEASE_EVIDENCE.map((item) => item.path),
+]);
+const SOURCE_PREFIXES = ['bin/', 'src/', 'rules/', 'playbook/', 'tools/registry/', 'licensing/notices/candidate-sources/sha256/'];
+const RULE_TEST_SPECIMEN = /^rules\/vsg-[^/]+\.(?:ts|tsx|js|py)$/i;
+const FORBIDDEN_PARTS = new Set(['.git', '.vsg', 'node_modules', '.cache', 'cache', 'reports', 'raw', 'bin-cache']);
+const ENTRY_POINT = 'bin/vsg.mjs';
+const EXPORTER_PATH = 'src/lattice/export.mjs';
+const TRANSPORT_PATH = 'src/lattice/transport.mjs';
+const EVALUATOR_PATH = 'lattice-runtime.mjs';
+const RELEASE_BLOCKERS = [
+  'commercial_component_rights_not_cleared',
+  'third_party_attribution_catalog_incomplete',
+  'replacement_rule_coverage_not_approved',
+  'artifact_release_approval_missing',
+];
+
+const posix = (value) => value.split(path.sep).join('/');
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+const canonical = (value) => {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(',')}}`;
+};
+
+function fail(message) {
+  throw new Error(`Lattice artifact rejected: ${message}`);
+}
+
+function validateOriginalSourceArchiveUrl(value) {
+  if (value !== undefined && (typeof value !== 'string' || !ORIGINAL_SOURCE_ARCHIVE_URL.test(value))) {
+    fail('originalSourceArchiveUrl must be a canonical stable-version public @latticeai/cli or @m2-ai/lattice-cli npm tarball URL.');
+  }
+}
+
+function safeRelative(rel) {
+  return typeof rel === 'string' && rel.length > 0 && !/[\\:]/.test(rel) && rel === posix(rel) && !path.posix.isAbsolute(rel)
+    && rel.split('/').every((part) => part && part !== '.' && part !== '..' && !FORBIDDEN_PARTS.has(part.toLowerCase()));
+}
+
+function git(sourceRoot, args, options = {}) {
+  try {
+    return execFileSync('git', ['-C', sourceRoot, ...args], { encoding: 'utf8', maxBuffer: 32 * 1024 * 1024, ...options }).trim();
+  } catch (error) {
+    fail(`Git could not verify the source (${error.message}).`);
+  }
+}
+
+function hashDirectory(sourceRoot, prefix, tracked) {
+  const hash = crypto.createHash('sha256');
+  for (const rel of tracked.filter((item) => item.startsWith(prefix)).sort()) {
+    hash.update(rel.slice(prefix.length));
+    hash.update('\0');
+    hash.update(fs.readFileSync(path.join(sourceRoot, ...rel.split('/'))));
+    hash.update('\0');
+  }
+  return hash.digest('hex');
+}
+
+function trackedFiles(sourceRoot) {
+  const raw = execFileSync('git', ['-C', sourceRoot, 'ls-files', '-z'], { encoding: 'buffer', maxBuffer: 32 * 1024 * 1024 });
+  return raw.toString('utf8').split('\0').filter(Boolean).map(posix);
+}
+
+function sourceAllowlist(sourceRoot, tracked) {
+  const files = tracked.filter((rel) => !RULE_TEST_SPECIMEN.test(rel)
+    && (TOP_LEVEL_FILES.has(rel) || SOURCE_PREFIXES.some((prefix) => rel.startsWith(prefix)))).sort();
+  for (const required of [ENTRY_POINT, EXPORTER_PATH, TRANSPORT_PATH, 'src/core/gate.mjs', 'package.json', 'LICENSE', 'NOTICE', 'licensing/commercial-components.json']) {
+    if (!files.includes(required)) fail(`required source file ${required} is missing.`);
+  }
+  for (const rel of files) {
+    if (!safeRelative(rel)) fail(`unsafe source path ${rel}.`);
+    const stat = fs.lstatSync(path.join(sourceRoot, ...rel.split('/')));
+    if (!stat.isFile() || stat.isSymbolicLink()) fail(`source path ${rel} is not a regular file.`);
+  }
+  return files;
+}
+
+function yamlScalar(value) {
+  const text = value.trim();
+  if (text.startsWith('"')) {
+    try { return JSON.parse(text); } catch { fail(`invalid quoted rule metadata ${text}.`); }
+  }
+  if (text.startsWith("'") && text.endsWith("'")) return text.slice(1, -1).replace(/''/g, "'");
+  return text;
+}
+
+function foldedValue(lines, start, indent) {
+  const parts = [];
+  for (let index = start + 1; index < lines.length; index++) {
+    const line = lines[index];
+    if (line.trim() && line.match(/^ */)[0].length <= indent) break;
+    if (line.trim()) parts.push(line.trim());
+  }
+  return parts.join(' ');
+}
+
+function originalRules(sourceRoot, tracked) {
+  const rules = {};
+  const provenance = {};
+  for (const rel of tracked.filter((item) => /^rules\/vsg-[^/]+\.ya?ml$/.test(item)).sort()) {
+    const bytes = fs.readFileSync(path.join(sourceRoot, ...rel.split('/')));
+    const lines = bytes.toString('utf8').split(/\r?\n/);
+    for (let start = 0; start < lines.length; start++) {
+      const idMatch = /^  - id:\s*(\S+)\s*$/.exec(lines[start]);
+      if (!idMatch) continue;
+      const end = lines.findIndex((line, index) => index > start && /^  - id:\s*/.test(line));
+      const block = lines.slice(start, end < 0 ? lines.length : end);
+      const scalar = (name) => {
+        const index = block.findIndex((line) => new RegExp(`^ {4,8}${name}:\\s*`).test(line));
+        if (index < 0) return '';
+        const raw = block[index].replace(new RegExp(`^ {4,8}${name}:\\s*`), '');
+        return /^[>|][+-]?$/.test(raw.trim()) ? foldedValue(block, index, block[index].match(/^ */)[0].length) : yamlScalar(raw);
+      };
+      const ruleId = idMatch[1];
+      const title = scalar('vsg-title');
+      const summary = scalar('message');
+      const remediation = scalar('vsg-fix');
+      const cwe = /CWE-[1-9][0-9]{0,5}/i.exec(scalar('cwe'))?.[0]?.toUpperCase();
+      if (!title || !summary || !remediation) fail(`original rule ${ruleId} lacks trusted presentation metadata.`);
+      rules[ruleId] = {
+        ruleId, title, summary, remediation,
+        retest: `Run VSG rule ${ruleId} again after applying the repair.`,
+        attributionIds: ['m2ai:vsg-original'],
+      };
+      provenance[ruleId] = { sourcePath: rel, sourceSha256: sha256(bytes), cweIds: cwe ? [cwe] : [] };
+    }
+  }
+  return { rules, provenance };
+}
+
+function builtinRules(sourceRoot, tracked) {
+  const rules = {};
+  const provenance = {};
+  const sources = [
+    {
+      rel: 'src/checks/_lib/secrets.mjs',
+      definitions: [
+    {
+      ruleId: 'supabase-public-key',
+      title: 'Supabase public key',
+      summary: 'A Supabase anon or publishable API key is intended for public clients and does not grant elevated access. Keep Row Level Security and least-privilege grants enabled.',
+      remediation: 'No secret rotation is needed for this public key. Confirm the project uses Row Level Security and least-privilege grants.',
+      retest: 'Run the VSG secrets check again and confirm the key remains classified as a public Supabase key.',
+    },
+    {
+      ruleId: 'supabase-demo-jwt',
+      title: 'Supabase local demo key',
+      summary: 'A JWT whose issuer is "supabase-demo" is the public development key every local Supabase stack ships with. It unlocks nothing outside a local stack, so it is not a secret. Reported once.',
+      remediation: 'No action needed. Make sure no real project key sits next to it.',
+      retest: 'Run the VSG secrets check again and confirm only the local Supabase demo key is reported.',
+    },
+      ],
+    },
+    {
+      rel: 'src/checks/secrets-tree/env.mjs',
+      definitions: [
+        {
+          ruleId: 'committed-env-file',
+          title: 'Environment file exposed to the repository',
+          summary: 'An environment file can contain private configuration or credentials. A committed file remains in repository history; an unignored file can be added by a later commit.',
+          remediation: 'Keep credentials in private environment variables or a secret manager. Add the file to .gitignore, remove committed copies from the repository, rotate credentials they contained, and keep only placeholders in an example file.',
+          retest: 'Run the VSG secrets check again and confirm the environment file is ignored or contains placeholders only.',
+        },
+        {
+          ruleId: 'public-env-secret',
+          title: 'Secret-named variable exposed to the browser',
+          summary: 'A variable with a public browser prefix has a name that indicates a secret. The finding contains the variable name and location, not its value.',
+          remediation: 'Rename the variable without the public prefix and read it only in server code. Rotate the credential because it may already be present in a shipped browser bundle.',
+          retest: 'Run the VSG secrets check again and confirm no secret-named public variable remains.',
+        },
+        {
+          ruleId: 'public-env-public-by-design',
+          title: 'Public-by-design browser key',
+          summary: 'The variable matches a known public browser key or DSN shape and is intended for client exposure. It is not treated as a secret by this check.',
+          remediation: 'No secret rotation is needed for a public-by-design key. Confirm provider-side origin restrictions and least-privilege settings where supported.',
+          retest: 'Run the VSG secrets check again and confirm the value remains classified as public by design.',
+        },
+      ],
+    },
+    {
+      rel: 'src/checks/deps-vuln/index.mjs',
+      definitions: [
+        ['unpinned-requirements', 'Python requirement is not pinned', 'An unpinned Python requirement can resolve to a different version on each install, so vulnerability matching cannot identify the installed version reliably.', 'Pin each requirement to an exact version or use a lock file, then rerun the dependency check.'],
+        ['enrichment-degraded', 'Exploit data could not be fully checked', 'The vulnerability scan completed, but one or more external exploit-data sources could not be checked.', 'Rerun when the data sources are available and review the check coverage before release.'],
+      ],
+    },
+    {
+      rel: 'src/checks/desktop-config/index.mjs',
+      definitions: [
+        ['vsg/desktop/update-unverified', 'Desktop updater has no visible integrity check', 'An updater downloads content and runs or replaces files without a visible signature or hash check in the surrounding code.', 'Verify downloaded updates with a detached signature or pinned hash before running or extracting them, and refuse older versions.'],
+        ['vsg/desktop/binaries-scanned', 'Desktop build binaries were included in the malware check', 'Windows executables or installers in build output or configured artifacts were included in the malware scan.', 'Confirm the malware check completed against the exact files intended for release.'],
+        ['vsg/desktop/no-code-signing', 'No Windows code-signing step was found', 'No supported code-signing command or action was found in the packaging scripts or CI files.', 'Sign the executable and installer in the build and keep signing keys in a secrets store.'],
+      ],
+    },
+    {
+      rel: 'src/checks/install-posture/index.mjs',
+      definitions: [
+        ['install-posture/firewall-present', 'CI install uses a dependency firewall', 'A CI workflow that installs dependencies also references Aikido Safe Chain or Socket Firewall.', 'Keep the firewall before every package installation step.'],
+        ['install-posture/firewall-absent', 'CI install has no dependency firewall', 'A CI workflow installs dependencies without an Aikido Safe Chain or Socket Firewall check.', 'Add a dependency firewall before package installation in the workflow.'],
+        ['install-posture/pnpm-allow-all-builds', 'pnpm allows every dependency build script', 'dangerouslyAllowAllBuilds permits every dependency to run its install-time build script.', 'Remove dangerouslyAllowAllBuilds and allow only the packages that need build scripts.'],
+        ['install-posture/pnpm-no-only-built', 'pnpm build scripts have no explicit allowlist', 'The lockfile has packages with build scripts, but no onlyBuiltDependencies allowlist was found.', 'Add onlyBuiltDependencies listing the packages that need a build step.'],
+        ['install-posture/npm-ignore-scripts-set', 'npm install scripts are disabled', 'The project configures npm to skip dependency lifecycle scripts during install.', 'No action is needed for this finding; run required build scripts explicitly after reviewing them.'],
+        ['install-posture/npm-ignore-scripts-unset', 'npm install scripts are enabled', 'npm can run install-time scripts from every dependency during installation.', 'Set ignore-scripts=true in .npmrc and run required build scripts explicitly after review.'],
+      ],
+    },
+    {
+      rel: 'src/checks/supabase-static/index.mjs',
+      definitions: [
+        ['supabase-rls-disabled', 'Supabase table has row level security disabled', 'A public-schema table is reachable through the Supabase API without row-level policies restricting access.', 'Enable row level security and add policies that restrict rows to the intended users and operations.'],
+        ['supabase-storage-policy-open', 'Supabase storage policy grants broad access', 'A storage.objects policy uses an unconditional expression and does not restrict objects by bucket or owner.', 'Replace the policy with one scoped to the intended bucket and authenticated owner.'],
+        ['supabase-policy-unconditional', 'Supabase policy allows access to every row', 'A row-level security policy uses a literal true condition for an exposed role.', 'Replace the policy with an owner or tenant condition, or remove the policy if the table should be private.'],
+        ['supabase-definer-search-path', 'Security definer function has no fixed search path', 'A security definer function without a fixed search_path may resolve attacker-controlled objects while running with its owner privileges.', 'Set search_path to an empty value and schema-qualify every referenced object.'],
+        ['supabase-view-security-invoker', 'Supabase view may bypass row level security', 'A public view runs with its owner privileges because security_invoker is not enabled.', 'Set security_invoker=true and verify that the underlying row-level policies match the intended access.'],
+        ['supabase-public-bucket', 'Supabase storage bucket is public', 'A public bucket allows anyone with an object URL to download its files without signing in.', 'Make the bucket private and use signed URLs or owner-scoped storage policies unless its contents are intentionally public.'],
+      ],
+    },
+    {
+      rel: 'src/checks/mobile-config/index.mjs',
+      definitions: [
+        { ruleId: 'vsg/mobile/updates-unsigned', sourceMarker: 'updates-unsigned', title: 'Expo updates are not code-signed', summary: 'The app uses expo-updates but the configuration has no update signing certificate.', remediation: 'Configure update code signing and sign each published update while keeping the private key out of the repository.', retest: 'Run the mobile configuration check again and confirm published updates are signed.' },
+        { ruleId: 'vsg/mobile/android-cleartext', sourceMarker: 'android-cleartext', title: 'Android cleartext traffic is allowed', summary: 'The Android configuration permits plain HTTP traffic that can be read or changed on the network.', remediation: 'Disable cleartext traffic and use HTTPS endpoints.', retest: 'Run the mobile configuration check again and confirm cleartext traffic is disabled.' },
+        { ruleId: 'vsg/mobile/ios-ats-disabled', sourceMarker: 'ios-ats-disabled', title: 'iOS App Transport Security is disabled', summary: 'The iOS configuration allows arbitrary network loads instead of requiring secure transport.', remediation: 'Remove NSAllowsArbitraryLoads and use HTTPS for every endpoint.', retest: 'Run the mobile configuration check again and confirm App Transport Security is enabled.' },
+        { ruleId: 'vsg/mobile/ios-ats-exceptions', sourceMarker: 'ios-ats-exceptions', title: 'iOS App Transport Security has exception domains', summary: 'The iOS configuration weakens transport requirements for one or more listed hosts.', remediation: 'Remove each exception after the host supports modern TLS and review any remaining exception before release.', retest: 'Run the mobile configuration check again and review each remaining exception.' },
+        { ruleId: 'vsg/mobile/permission-READ_SMS', sourceMarker: 'READ_SMS', title: 'App requests permission to read text messages', summary: 'The Android app requests access to SMS messages, which can expose private communications.', remediation: 'Remove the permission unless a reviewed feature requires it.', retest: 'Run the mobile configuration check again and confirm the permission is removed or justified.' },
+        { ruleId: 'vsg/mobile/permission-RECEIVE_SMS', sourceMarker: 'RECEIVE_SMS', title: 'App requests permission to receive text messages', summary: 'The Android app can receive SMS messages, which may expose authentication codes or private communications.', remediation: 'Remove the permission unless a reviewed feature requires it.', retest: 'Run the mobile configuration check again and confirm the permission is removed or justified.' },
+        { ruleId: 'vsg/mobile/permission-READ_CALL_LOG', sourceMarker: 'READ_CALL_LOG', title: 'App requests permission to read call history', summary: 'The Android app requests access to the user call log.', remediation: 'Remove the permission unless a reviewed feature requires it.', retest: 'Run the mobile configuration check again and confirm the permission is removed or justified.' },
+        { ruleId: 'vsg/mobile/permission-SYSTEM_ALERT_WINDOW', sourceMarker: 'SYSTEM_ALERT_WINDOW', title: 'App requests permission to draw over other apps', summary: 'The Android app can display overlays above other applications, a capability commonly used in overlay attacks.', remediation: 'Remove the permission unless a reviewed feature requires it.', retest: 'Run the mobile configuration check again and confirm the permission is removed or justified.' },
+        { ruleId: 'vsg/mobile/permission-REQUEST_INSTALL_PACKAGES', sourceMarker: 'REQUEST_INSTALL_PACKAGES', title: 'App requests permission to install other packages', summary: 'The Android app can prompt to install additional applications.', remediation: 'Remove the permission unless a reviewed feature requires it.', retest: 'Run the mobile configuration check again and confirm the permission is removed or justified.' },
+        { ruleId: 'vsg/mobile/permission-MANAGE_EXTERNAL_STORAGE', sourceMarker: 'MANAGE_EXTERNAL_STORAGE', title: 'App requests broad shared-storage access', summary: 'The Android app requests access to all files in shared storage.', remediation: 'Use scoped storage or a narrower file picker permission where possible.', retest: 'Run the mobile configuration check again and confirm only the necessary storage access remains.' },
+        { ruleId: 'vsg/mobile/permission-ACCESS_BACKGROUND_LOCATION', sourceMarker: 'ACCESS_BACKGROUND_LOCATION', title: 'App requests background location access', summary: 'The Android app can read location while it is in the background.', remediation: 'Remove background location access unless a reviewed feature requires it.', retest: 'Run the mobile configuration check again and confirm the permission is removed or justified.' },
+        { ruleId: 'vsg/mobile/deep-link-schemes', sourceMarker: 'deep-link-schemes', title: 'App declares custom deep-link schemes', summary: 'Custom URL schemes can be claimed by another app, so incoming parameters must be treated as untrusted.', remediation: 'Prefer verified HTTPS app links and validate parameters before sensitive actions.', retest: 'Run the mobile configuration check again and review each deep-link handler.' },
+        { ruleId: 'vsg/mobile/intent-filters', sourceMarker: 'intent-filters', title: 'App declares Android intent filters', summary: 'Intent filters expose app entry points to links and other applications.', remediation: 'Validate incoming data and use verified app links where supported.', retest: 'Run the mobile configuration check again and review each intent handler.' },
+      ],
+    },
+    {
+      rel: 'src/checks/dep-change/index.mjs',
+      definitions: [
+        { ruleId: 'dep-change/version-removed', sourceMarker: "key: 'version-removed'", title: 'Dependency version was removed from its registry', summary: 'A locked dependency version is no longer available from its registry.', remediation: 'Treat the package as untrusted, review registry advisories, and pin a version that remains available.' },
+        { ruleId: 'dep-change/provenance-dropped', sourceMarker: "key: 'provenance-dropped'", title: 'Dependency release lost build provenance', summary: 'A new release no longer carries the provenance record present in the prior release.', remediation: 'Pin the last reviewed version until the maintainer explains the provenance change.' },
+        { ruleId: 'dep-change/fresh-risky-change', sourceMarker: "key: 'fresh-risky-change'", title: 'New dependency release combines freshness with a risky change', summary: 'A very recent release also adds an install script or a recently created dependency.', remediation: 'Wait for review or pin the previous version, and inspect any new install scripts.' },
+        { ruleId: 'dep-change/published-recently', sourceMarker: "['published-recently'", title: 'Dependency release was published recently', summary: 'A package release is less than 72 hours old.', remediation: 'Let the release age or review its changes before adopting it.' },
+        { ruleId: 'dep-change/publisher-changed', sourceMarker: "['publisher-changed'", title: 'Dependency publisher changed', summary: 'The package registry reports a publisher change for this release.', remediation: 'Confirm the new publisher is a legitimate maintainer before upgrading.' },
+        { ruleId: 'dep-change/new-install-script', sourceMarker: "['new-install-script'", title: 'Dependency release adds an install script', summary: 'The new release adds an install-time script that may execute during installation.', remediation: 'Review the script and consider disabling install scripts for this dependency.' },
+        { ruleId: 'dep-change/new-dependencies', sourceMarker: "['new-dependencies'", title: 'Dependency release adds dependencies', summary: 'The new release introduces one or more dependencies that were not present before.', remediation: 'Review the new dependencies and their release history before upgrading.' },
+        { ruleId: 'dep-change/low-reputation', sourceMarker: "['low-reputation'", title: 'New dependency has low registry reputation', summary: 'A newly added dependency has limited download history or other low-reputation signals.', remediation: 'Confirm the package identity and that the dependency is required.' },
+        { ruleId: 'dep-change/yanked-release', sourceMarker: "['yanked-release'", title: 'Dependency release was yanked', summary: 'The package registry marks the selected dependency release as yanked.', remediation: 'Upgrade to a release that has not been yanked.' },
+      ],
+    },
+    {
+      rel: 'src/checks/agent-surface/unicode.mjs',
+      definitions: [
+        ['tag-characters', 'Hidden Unicode tag characters', 'Unicode tag characters can be invisible in editors while remaining readable to language models.', 'Delete the characters and review how they entered the repository.'],
+        ['bidi-controls', 'Hidden bidirectional control characters', 'Bidirectional controls can make displayed text differ from the underlying order of text.', 'Delete the control characters.'],
+        ['zero-width', 'Hidden zero-width characters', 'Zero-width characters can hide text or split keywords while remaining invisible to reviewers.', 'Delete the characters unless they are intentional and documented.'],
+        ['variation-selectors', 'Hidden variation selectors', 'Variation selectors outside emoji sequences can encode hidden data.', 'Delete the characters unless they are part of an intentional emoji sequence.'],
+      ],
+    },
+    {
+      rel: 'src/checks/agent-surface/config.mjs',
+      definitions: [
+        ['autorun-fetch-exec', 'Auto-run configuration downloads and executes content', 'A developer tool auto-run configuration can fetch content and execute it without an explicit review step.', 'Remove automatic execution or require an explicit, reviewed local action.'],
+        ['autorun-present', 'Developer tool auto-run configuration is present', 'A developer tool auto-run configuration can run when the repository is opened.', 'Review the configured command and remove it if it is not required.'],
+        ['mcp-unpinned', 'MCP server package is not pinned', 'An MCP server configuration references a package without an immutable version.', 'Pin the MCP server package to an exact reviewed version.'],
+        ['mcp-plain-http', 'MCP server uses plain HTTP', 'An MCP server endpoint uses unencrypted HTTP transport.', 'Use HTTPS for the MCP server endpoint.'],
+      ],
+    },
+    {
+      rel: 'src/checks/agent-surface/instructions.mjs',
+      definitions: [
+        ['instruction-fetch-exec', 'Agent instructions fetch and execute remote content', 'Repository instructions direct an agent to fetch remote content and run it.', 'Remove the instruction or replace it with a reviewed, locally verifiable procedure.'],
+        ['instruction-credentials', 'Agent instructions request credential access', 'Repository instructions direct an agent to read credential material.', 'Remove the request and keep credentials in approved secret storage.'],
+        ['instruction-hidden-markup', 'Agent instructions contain hidden markup', 'Hidden markup can conceal instructions from a human reviewer while remaining available to a parser or agent.', 'Remove the hidden markup and review the surrounding instructions.'],
+        ['instruction-hidden-comment', 'Agent instructions contain a hidden comment', 'A hidden comment can carry instructions that are not visible in the rendered document.', 'Remove the comment and review the surrounding instructions.'],
+      ],
+    },
+    {
+      rel: 'src/live/analyze.mjs',
+      definitions: [
+        { ruleId: 'header-strict-transport-security', sourceMarker: "'strict-transport-security':", title: 'HSTS header is missing', summary: 'Without HSTS, a browser can be downgraded to plain HTTP by a network attacker.', remediation: 'Send Strict-Transport-Security on every HTTPS response.' },
+        { ruleId: 'header-content-security-policy', sourceMarker: "'content-security-policy':", title: 'Content Security Policy is missing', summary: 'A Content Security Policy limits what an injected script can do.', remediation: 'Send a policy that restricts script sources and use nonces or hashes for inline scripts.' },
+        { ruleId: 'header-x-content-type-options', sourceMarker: "'x-content-type-options':", title: 'X-Content-Type-Options header is missing', summary: 'Without nosniff, browsers may guess content types and run uploaded files as scripts.', remediation: 'Send X-Content-Type-Options: nosniff.' },
+        { ruleId: 'header-frame-protection', sourceMarker: "'frame-protection':", title: 'Clickjacking protection is missing', summary: 'Another site may embed the page and trick visitors into interacting with hidden controls.', remediation: 'Set frame-ancestors or X-Frame-Options to restrict framing.' },
+        { ruleId: 'header-referrer-policy', sourceMarker: "'referrer-policy':", title: 'Referrer-Policy header is missing', summary: 'Full URLs can leak through the Referer header when visitors navigate to other sites.', remediation: 'Set a Referrer-Policy such as strict-origin-when-cross-origin.' },
+        { ruleId: 'header-permissions-policy', sourceMarker: "'permissions-policy':", title: 'Permissions-Policy header is missing', summary: 'Browser features such as camera, microphone and geolocation are not restricted by a Permissions-Policy.', remediation: 'Disable browser features the site does not use.' },
+        { ruleId: 'header-hsts-short', sourceMarker: "ruleId: 'header-hsts-short'", title: 'HSTS max-age is shorter than 180 days', summary: 'A short HSTS lifetime leaves returning visitors unprotected when it expires.', remediation: 'Set an HSTS max-age of at least 180 days.' },
+        { ruleId: 'header-csp-unsafe-inline', sourceMarker: "ruleId: 'header-csp-unsafe-inline'", title: 'Content Security Policy permits unsafe inline scripts', summary: 'unsafe-inline weakens the protection against injected scripts.', remediation: 'Use a nonce or hash for required inline scripts and remove unsafe-inline.' },
+        ['cookie-flags', 'Cookie is missing security flags', 'A cookie without the appropriate flags may be exposed to scripts, plain HTTP or cross-site requests.', 'Set Secure and SameSite; also set HttpOnly for session and token cookies.'],
+        ['cors-reflected-credentials', 'CORS reflects an untrusted origin with credentials', 'A site can read credentialed responses from a visitor browser when the server reflects an arbitrary origin.', 'Allow only explicit trusted origins and never combine broad origin reflection with credentials.'],
+        ['cors-wildcard', 'CORS allows every origin', 'The Access-Control-Allow-Origin wildcard grants browser access to responses from any origin.', 'Allow only the origins that need access.'],
+        ['cors-reflected', 'CORS reflects the requested origin', 'The server echoes the requested origin instead of checking it against an explicit allowlist.', 'Allow only explicit trusted origins and reject other Origin values.'],
+      ],
+    },
+    {
+      rel: 'src/live/exposure.mjs',
+      definitions: [
+        { ruleId: 'exposed-env', sourceMarker: "kind: 'env'", title: 'Environment file is publicly readable', summary: 'A deployed environment file is readable without authentication and can contain private configuration or credentials.', remediation: 'Remove the file from the web root and rotate every value it held.' },
+        { ruleId: 'exposed-vcs', sourceMarker: "kind: 'vcs'", title: 'Version control metadata is publicly readable', summary: 'A deployed version control metadata file is readable without authentication.', remediation: 'Remove repository metadata from the deployment and rotate secrets that may have been committed.' },
+        { ruleId: 'exposed-metadata', sourceMarker: "kind: 'metadata'", title: 'Development metadata file is publicly readable', summary: 'A deployed metadata file is readable without authentication.', remediation: 'Remove the file from the deployment.' },
+        { ruleId: 'exposed-backup', sourceMarker: "kind: 'backup'", title: 'Backup or database dump is publicly readable', summary: 'A deployed backup or database dump is readable without authentication.', remediation: 'Remove the file from the web root and review or rotate any exposed contents.' },
+        { ruleId: 'exposed-credentials', sourceMarker: "kind: 'credentials'", title: 'Password file is publicly readable', summary: 'A deployed password file containing password hashes is readable without authentication.', remediation: 'Remove the file from the web root and change every password it lists.' },
+      ],
+    },
+    {
+      rel: 'src/checks/live-basic/index.mjs',
+      definitions: [
+        ['source-map', 'Browser source map is publicly readable', 'A publicly served source map can reveal readable source code and internal implementation details.', 'Do not deploy browser source maps publicly, or restrict them to authenticated developers.'],
+      ],
+    },
+    {
+      rel: 'src/checks/live-js-secrets/index.mjs',
+      definitions: [
+        ['supabase-service-role-jwt', 'Supabase service role key is served to visitors', 'A service role JWT in served JavaScript bypasses Row Level Security and grants broad project access.', 'Rotate the Supabase JWT secret or service key and use it only in server code.'],
+      ],
+    },
+    {
+      rel: 'src/checks/dns-mail/index.mjs',
+      definitions: [
+        ['spf-missing', 'Domain has no SPF record', 'Without SPF, receiving mail servers cannot verify which systems may send email for the domain.', 'Publish an SPF TXT record that names the approved mail provider.'],
+        ['dmarc-missing', 'Domain has no DMARC record', 'Without DMARC, receiving systems have no policy for mail that fails SPF and DKIM.', 'Publish a DMARC record, then move from monitoring to quarantine or reject after reviewing reports.'],
+        ['dmarc-none', 'DMARC policy is monitoring only', 'A DMARC p=none policy records failures but does not ask receivers to quarantine or reject spoofed mail.', 'After reviewing reports, move to quarantine and then reject.'],
+        ['caa-missing', 'Domain has no CAA record', 'Without CAA, the domain does not publish a DNS restriction on which certificate authorities may issue certificates.', 'Publish CAA records naming the certificate authorities used by the domain.'],
+      ],
+    },
+    {
+      rel: 'src/checks/posture/index.mjs',
+      definitions: [
+        ['branch-protection', 'Default branch has no protection', 'Writers can push directly to the default branch or force-push without the reviewed controls checked by VSG.', 'Enable branch protection or a repository ruleset requiring pull requests and checks.'],
+        ['secret_scanning', 'GitHub secret scanning is disabled', 'GitHub is not scanning this repository for exposed credentials.', 'Enable secret scanning in repository security settings.'],
+        ['secret_scanning_push_protection', 'GitHub push protection is disabled', 'GitHub is not blocking commits that contain detected secrets.', 'Enable push protection in repository security settings.'],
+        ['dependabot-alerts', 'Dependabot alerts are disabled', 'GitHub is not alerting on vulnerable dependencies in this repository.', 'Enable Dependabot alerts in repository security settings.'],
+        ['actions-default-write', 'GitHub Actions default token has write access', 'Workflows without explicit permissions receive a repository token with write access.', 'Set the default workflow permission to read and grant write access only to jobs that need it.'],
+      ],
+    },
+    {
+      rel: 'src/agent/schema.mjs',
+      producerRel: 'src/agent/ingest.mjs',
+      producerMarker: 'ruleId: clean(f.area, 60)',
+      definitions: (() => {
+        const declaredAreas = Object.keys(AGENT_REVIEW_AREA_METADATA);
+        if (AREAS.length !== declaredAreas.length || AREAS.some((area) => !Object.hasOwn(AGENT_REVIEW_AREA_METADATA, area))) {
+          fail('agent-review area metadata must exactly match the canonical schema areas.');
+        }
+        return AREAS.map((ruleId) => {
+          const { label, summary } = AGENT_REVIEW_AREA_METADATA[ruleId];
+          return {
+            ruleId,
+            sourceMarker: `'${ruleId}'`,
+            title: `Agent review: ${label}`,
+            summary,
+            remediation: `Review the finding, cited code and reproduction result locally. Validate the proposed change and tests for the ${label.toLowerCase()} boundary; the area label alone does not establish exploitability.`,
+            retest: `Run the VSG review again and verify no unresolved finding remains in the ${label.toLowerCase()} area and all required checks ran.`,
+          };
+        });
+      })(),
+    },
+  ];
+  for (const { rel, producerRel = null, producerMarker = null, definitions } of sources) {
+    if (!tracked.includes(rel)) fail(`built-in rule source ${rel} is missing.`);
+    const bytes = fs.readFileSync(path.join(sourceRoot, ...rel.split('/')));
+    const source = bytes.toString('utf8');
+    let producerBytes = bytes;
+    if (producerRel) {
+      if (!tracked.includes(producerRel)) fail(`built-in rule producer source ${producerRel} is missing.`);
+      producerBytes = fs.readFileSync(path.join(sourceRoot, ...producerRel.split('/')));
+      if (!producerMarker || !producerBytes.toString('utf8').includes(producerMarker)) fail(`built-in rule producer ${producerRel} no longer matches its source metadata.`);
+    }
+    for (const item of definitions) {
+      const definition = Array.isArray(item)
+        ? { ruleId: item[0], title: item[1], summary: item[2], remediation: item[3], retest: `Run the VSG check again after applying the repair.` }
+        : item;
+      const marker = definition.sourceMarker ?? definition.ruleId;
+      if (!source.includes(marker)) fail(`built-in rule ${definition.ruleId} no longer matches its tracked source metadata.`);
+      if (rules[definition.ruleId]) fail(`built-in rule ${definition.ruleId} is defined more than once.`);
+      const { sourceMarker: _sourceMarker, ...trusted } = definition;
+      rules[definition.ruleId] = { ...trusted, attributionIds: ['m2ai:vsg-original'] };
+      provenance[definition.ruleId] = producerRel
+        ? { sourcePath: producerRel, sourceSha256: sha256(producerBytes), areaSourcePath: rel, areaSourceSha256: sha256(bytes), cweIds: [] }
+        : { sourcePath: rel, sourceSha256: sha256(bytes), cweIds: [] };
+    }
+  }
+  return { rules, provenance };
+}
+
+function betterleaksRule(sourceRoot, tracked, contract) {
+  const required = [contract.evidencePath, ...BETTERLEAKS_NOTICE_PATHS];
+  const included = required.filter((rel) => tracked.includes(rel));
+  if (included.length === 0) {
+    return { rules: {}, credits: {}, provenance: {}, blockers: [contract.missingBlocker] };
+  }
+  if (included.length !== required.length) fail(`Betterleaks ${contract.ruleId} provenance is incomplete.`);
+  const evidenceBytes = fs.readFileSync(path.join(sourceRoot, ...contract.evidencePath.split('/')));
+  if (sha256(evidenceBytes) !== contract.evidenceSha256) fail(`Betterleaks ${contract.ruleId} provenance metadata was tampered with.`);
+  let evidence;
+  try { evidence = JSON.parse(evidenceBytes); } catch { fail(`Betterleaks ${contract.ruleId} provenance metadata is invalid JSON.`); }
+  const registryPath = 'tools/registry/betterleaks.json';
+  if (!tracked.includes(registryPath)) fail('the pinned Betterleaks registry record is missing.');
+  const registryBytes = fs.readFileSync(path.join(sourceRoot, ...registryPath.split('/')));
+  let registry;
+  try { registry = JSON.parse(registryBytes); } catch { fail('the pinned Betterleaks registry record is invalid JSON.'); }
+  const commercial = JSON.parse(fs.readFileSync(path.join(sourceRoot, 'licensing', 'commercial-components.json'), 'utf8'));
+  const component = commercial.components?.find((item) => item.component === 'betterleaks');
+  const expected = evidence.component;
+  if (evidence.schemaVersion !== 1 || evidence.status !== 'engineering-provenance-record-not-legal-clearance'
+    || expected?.name !== 'betterleaks' || expected.version !== '1.9.0' || expected.registryPath !== registryPath
+    || expected.registrySha256 !== '502e6635125c26a2c895cbcf05b45f50424da771d559db01aa9125c9004a27eb'
+    || evidence.rule?.id !== contract.ruleId || evidence.rule.source?.sha256 !== contract.sourceSha256
+    || evidence.rule.generatedDefault?.sha256 !== 'a8f553eb634ac3c5c1ca3f0dc95e2b8abdea7d14b622604c5af07f30ce7926ef'
+    || evidence.rule.defaultEmbedding?.sha256 !== '9e0b14688a364aa12519f1e0caa1f66ce03d365f8484fc720b9cb63f4ab68bae'
+    || evidence.origin?.project !== 'gitleaks' || evidence.origin.sourceSha256 !== contract.originSourceSha256
+    || evidence.origin.initialBetterleaksImportSha256 !== contract.initialImportSha256
+    || !Array.isArray(evidence.licenses) || evidence.licenses.length !== 2) {
+    fail(`Betterleaks ${contract.ruleId} provenance metadata does not match the fixed candidate contract.`);
+  }
+  if (registry.version !== expected.version || sha256(registryBytes) !== expected.registrySha256
+    || component?.version !== expected.version || component.registryPath !== registryPath
+    || component.registrySha256 !== expected.registrySha256
+    || component.sourceLicense?.sha256 !== 'caea114592a8f8e5e05a116d63a99e0ccd79a3ff74f4ddf270bcf4c929eb021e') {
+    fail('the Betterleaks registry, commercial record, and catalog provenance do not match.');
+  }
+  const expectedCredits = new Map([
+    [contract.attributionIds[0], {
+      path: BETTERLEAKS_NOTICE_PATHS[0],
+      sha256: 'caea114592a8f8e5e05a116d63a99e0ccd79a3ff74f4ddf270bcf4c929eb021e',
+    }],
+    [contract.attributionIds[1], {
+      path: BETTERLEAKS_NOTICE_PATHS[1],
+      sha256: 'e3884b252b3bfc045e55be43a34d1e80da070bc6f804ac95bf4660e97d62ebc6',
+    }],
+  ]);
+  const credits = {};
+  const notices = [];
+  for (const license of evidence.licenses) {
+    const fixed = expectedCredits.get(license.attributionId);
+    if (!fixed || license.spdxExpression !== 'MIT' || license.noticePath !== fixed.path
+      || license.noticeSha256 !== fixed.sha256 || license.noticeBytes !== 1069
+      || typeof license.displayName !== 'string' || !license.displayName
+      || !/^https:\/\//.test(license.sourceUrl ?? '') || !/^https:\/\//.test(license.licenseUrl ?? '')
+      || typeof license.modificationNotice !== 'string' || !license.modificationNotice) {
+      fail(`Betterleaks ${contract.ruleId} credit metadata does not match the fixed notice contract.`);
+    }
+    const noticeBytes = fs.readFileSync(path.join(sourceRoot, ...fixed.path.split('/')));
+    if (noticeBytes.byteLength !== license.noticeBytes || sha256(noticeBytes) !== fixed.sha256) {
+      fail(`packaged notice ${fixed.path} does not match its verified upstream bytes.`);
+    }
+    credits[license.attributionId] = {
+      attributionId: license.attributionId,
+      displayName: license.displayName,
+      sourceUrl: license.sourceUrl,
+      licenseName: 'MIT',
+      licenseUrl: license.licenseUrl,
+      modificationNotice: license.modificationNotice,
+    };
+    notices.push({ path: fixed.path, sha256: fixed.sha256, bytes: license.noticeBytes });
+  }
+  if (Object.keys(credits).length !== 2) fail(`Betterleaks ${contract.ruleId} credits are incomplete.`);
+  const ruleId = evidence.rule.id;
+  return {
+    rules: {
+      [ruleId]: {
+        ruleId,
+        title: evidence.rule.displayName,
+        summary: contract.summary,
+        remediation: contract.remediation,
+        retest: contract.retest,
+        attributionIds: [...expectedCredits.keys()],
+      },
+    },
+    credits,
+    provenance: {
+      [ruleId]: {
+        sourcePath: contract.evidencePath,
+        sourceSha256: contract.evidenceSha256,
+        component: { name: expected.name, version: expected.version, registryPath, registrySha256: expected.registrySha256 },
+        upstreamSources: [evidence.rule.source, ...(evidence.rule.filterSource ? [evidence.rule.filterSource] : []), evidence.rule.generatedDefault, evidence.rule.defaultEmbedding, {
+          path: evidence.origin.sourcePath, url: evidence.origin.sourceUrl, sha256: evidence.origin.sourceSha256,
+        }],
+        notices,
+        cweIds: [],
+      },
+    },
+    blockers: [],
+  };
+}
+
+function qualificationEvidence(sourceRoot, tracked) {
+  const present = QUALIFICATION_RECORDS.filter((item) => tracked.includes(item.path));
+  if (present.length === 0) return null; // Legacy artifacts contain neither record.
+  if (present.length !== QUALIFICATION_RECORDS.length) fail('qualification evidence records must be packaged together.');
+  const parsed = [];
+  const records = present.map((item) => {
+    const bytes = fs.readFileSync(path.join(sourceRoot, ...item.path.split('/')));
+    if (sha256(bytes) !== item.sha256) fail(`qualification evidence ${item.path} does not match its reviewed bytes.`);
+    parsed.push(JSON.parse(bytes));
+    return { ...item, bytes: bytes.byteLength };
+  });
+  const [candidate, notices] = parsed;
+  if (canonical(candidate.releaseEligibility) !== canonical({ unchanged: true, status: 'blocked', blockers: RELEASE_BLOCKERS })
+    || candidate.yara.sourceQualification.runtimePackaged !== false
+    || candidate.yara.sourceQualification.commerciallyCleared !== false
+    || notices.installed !== false || notices.commerciallyApproved !== false) {
+    fail('qualification evidence cannot grant runtime packaging or commercial approval.');
+  }
+  const selectedRuleRuntimeImplemented = Object.values(SELECTED_RUNTIME_RECORDS).every((record) => tracked.includes(record.path));
+  return {
+    status: 'packaged-engineering-evidence-only', records,
+    sastSelectedFiles: candidate.sast.selectedRuleCount,
+    yaraSelectedRules: candidate.yara.conditionalCandidateCount,
+    yaraExcludedHolds: candidate.yara.holdCount,
+    yaraStrictCompile: candidate.yara.sourceQualification.strictCompile,
+    selectedSourcesDelivered: false, selectedRuleRuntimePackaged: false,
+    selectedRuleRuntimeImplemented,
+    selectedSourceAcquisition: selectedRuleRuntimeImplemented ? 'fixed-upstream-files-and-archive-in-disposable-linux-volumes' : null,
+    boundedCoveragePassed: selectedRuleRuntimeImplemented,
+    coverageEquivalenceProven: false, commerciallyCleared: false, releaseApproval: null,
+  };
+}
+
+function commercialApprovalMaterial(sourceRoot, artifactFiles) {
+  const files = artifactFiles.filter((rel) => rel !== COMMERCIAL_RELEASE_RECORD.path
+    && rel !== EVALUATOR_PATH && rel !== 'lattice-catalog.json').sort();
+  const hash = crypto.createHash('sha256');
+  for (const rel of files) {
+    hash.update(rel);
+    hash.update('\0');
+    hash.update(fs.readFileSync(path.join(sourceRoot, ...rel.split('/'))));
+    hash.update('\0');
+  }
+  return { algorithm: 'sha256-path-nul-bytes-nul', sha256: hash.digest('hex'), files: files.length };
+}
+
+function commercialReleaseEvidence(sourceRoot, tracked, artifactFiles) {
+  if (!tracked.includes(COMMERCIAL_RELEASE_RECORD.path)) return null;
+  const bytes = fs.readFileSync(path.join(sourceRoot, ...COMMERCIAL_RELEASE_RECORD.path.split('/')));
+  let record;
+  try { record = JSON.parse(bytes); } catch { fail('commercial runtime release record is invalid JSON.'); }
+  const approvedSource = commercialApprovalMaterial(sourceRoot, artifactFiles);
+  const evidence = COMMERCIAL_RELEASE_EVIDENCE.map((expected) => {
+    if (!tracked.includes(expected.path)) fail(`commercial release evidence ${expected.path} is missing.`);
+    const evidenceBytes = fs.readFileSync(path.join(sourceRoot, ...expected.path.split('/')));
+    if (sha256(evidenceBytes) !== expected.sha256) fail(`commercial release evidence ${expected.path} changed from its reviewed bytes.`);
+    return { ...expected, bytes: evidenceBytes.byteLength };
+  });
+  const expectedEvidence = COMMERCIAL_RELEASE_EVIDENCE.map(({ path: evidencePath, sha256: digest }) => ({ path: evidencePath, sha256: digest }));
+  if (record.schemaVersion !== 1 || record.status !== 'owner-approved-commercial-runtime-release'
+    || record.owner !== 'M2 AI, LLC' || record.formationJurisdiction !== 'Texas'
+    || record.reviewProfile?.legalAdviceClaimed !== false
+    || record.authorization?.publicDomainAssumptions !== false
+    || record.authorization?.checkoutApproved !== false
+    || record.authorization?.paidPublicationApproved !== false
+    || record.authorization?.commercialRuntimeExecutionApproved !== true
+    || record.authorization?.protectedHostedValidationApproved !== true
+    || canonical(record.approvedSource) !== canonical(approvedSource)
+    || record.runtimeBoundary?.rulePayloadDistributionByM2 !== false
+    || record.runtimeBoundary?.fallback?.restrictedSemgrepRules !== false
+    || record.runtimeBoundary?.fallback?.mixedYaraForgePack !== false
+    || record.runtimeBoundary?.fallback?.callerYaraRules !== false
+    || record.selectedSources?.sast?.ruleFiles !== 161
+    || record.selectedSources?.yara?.selectedRules !== 4536
+    || record.selectedSources?.yara?.heldRules !== 574
+    || record.selectedSources?.yara?.selectionDigest !== '33aa825b1f9c843e7129f26b5b57e85d6121562cdeb577e40aef9360601585f6'
+    || canonical(record.evidence) !== canonical(expectedEvidence)
+    || record.coverageDecision?.sastBoundedCoveragePassed !== true
+    || record.coverageDecision?.yaraSelectedPackExecutionPassed !== true
+    || record.coverageDecision?.cleanControlsPassed !== true
+    || record.coverageDecision?.coverageEquivalenceClaimed !== false
+    || record.coverageDecision?.approvedForCommercialRuntime !== true
+    || record.releaseEligibility?.status !== 'approved'
+    || canonical(record.releaseEligibility?.closedGates) !== canonical(RELEASE_BLOCKERS)
+    || record.releaseEligibility?.checkoutEnabled !== false
+    || record.releaseEligibility?.paidPublicationEnabled !== false) {
+    fail('commercial runtime release record exceeds or does not meet the fixed owner-approved boundary.');
+  }
+  return {
+    record,
+    ref: { path: COMMERCIAL_RELEASE_RECORD.path, sha256: sha256(bytes), bytes: bytes.byteLength },
+    approvedSource,
+    evidence,
+  };
+}
+
+function fixedJsonRecord(sourceRoot, tracked, record, label) {
+  if (!tracked.includes(record.path)) fail(`${label} record ${record.path} is missing.`);
+  const bytes = fs.readFileSync(path.join(sourceRoot, ...record.path.split('/')));
+  if (sha256(bytes) !== record.sha256) fail(`${label} record ${record.path} changed from its reviewed bytes.`);
+  let value;
+  try { value = JSON.parse(bytes); } catch { fail(`${label} record ${record.path} is invalid JSON.`); }
+  return { value, ref: { ...record, bytes: bytes.byteLength } };
+}
+
+function packagedNotice(sourceRoot, tracked, ref, label) {
+  if (!ref || !SHA256.test(ref.sha256 ?? '') || ref.path !== `licensing/notices/candidate-sources/sha256/${ref.sha256}.txt`
+    || !Number.isSafeInteger(ref.bytes) || ref.bytes <= 0 || !tracked.includes(ref.path)) {
+    fail(`${label} notice reference is incomplete or is not packaged.`);
+  }
+  const bytes = fs.readFileSync(path.join(sourceRoot, ...ref.path.split('/')));
+  if (bytes.byteLength !== ref.bytes || sha256(bytes) !== ref.sha256) fail(`${label} notice bytes do not match the reviewed record.`);
+  return { path: ref.path, sha256: ref.sha256, bytes: ref.bytes };
+}
+
+function sastRuleId(sourcePath) {
+  const parts = sourcePath.replace(/\.ya?ml$/i, '').split('/');
+  let file = parts.pop().replaceAll('_', '-');
+  const prefix = parts.map((part) => part.replaceAll('_', '-')).join('_');
+  // These two upstream Python rules use a dotted namespace in the declared rule id.
+  if (prefix === 'python_crypto' && /^rule-crypto-hazmat-hash-(?:md5|sha1)$/.test(file)) {
+    file = file.replace('rule-crypto-hazmat', 'rule-crypto.hazmat');
+  }
+  return `${prefix}_${file}`;
+}
+
+function selectedRuntimeCatalog(sourceRoot, tracked) {
+  const present = Object.values(SELECTED_RUNTIME_RECORDS).filter((record) => tracked.includes(record.path));
+  if (present.length === 0) return null; // Legacy/local fixture artifacts do not opt into the selected runtime.
+  if (present.length !== Object.keys(SELECTED_RUNTIME_RECORDS).length) {
+    fail('selected runtime records must be packaged together.');
+  }
+  const parsed = {};
+  const refs = {};
+  for (const [name, record] of Object.entries(SELECTED_RUNTIME_RECORDS)) {
+    if (!tracked.includes(record.path)) fail(`selected runtime record ${record.path} is missing.`);
+    const bytes = fs.readFileSync(path.join(sourceRoot, ...record.path.split('/')));
+    if (sha256(bytes) !== record.sha256) fail(`selected runtime record ${record.path} changed from its reviewed bytes.`);
+    parsed[name] = JSON.parse(bytes);
+    refs[name] = { ...record, bytes: bytes.byteLength };
+  }
+  const { sastSourceEvidence: sast, sastIdentities: identities, yaraInventory: inventory, coverage } = parsed;
+  if (sast.sourceCommit !== '53bf5cf6df3c51b6c02110f5a638b5e6213666cd'
+    || sast.sourceArchiveSha256 !== '32b51522401d1a19e2f68277235eef1f31ddd3560ae54343b6a6a78c4d2fbb23'
+    || sast.selectedRules !== 161 || !Array.isArray(sast.files) || sast.files.length !== 163
+    || identities.ruleCount !== 161 || identities.ruleIdsSha256 !== '338143b7ac9e7bfd90f432b7aec070aa710584eaecfeb6174339a8852e1ae611'
+    || !Array.isArray(identities.ruleIds) || identities.ruleIds.length !== 161
+    || sha256(JSON.stringify(identities.ruleIds)) !== identities.ruleIdsSha256) {
+    fail('selected SAST runtime records do not match the fixed 161-rule contract.');
+  }
+  const candidateDecisions = new Set(['candidate-attribution', 'candidate-attribution-sharealike', 'candidate-explicit-apache']);
+  const normalized = (rule) => ({
+    rule: rule.rule, blockSha256: rule.blockSha256, author: rule.author, sourceUrl: rule.sourceUrl,
+    candidateLicense: rule.candidateLicense, decision: rule.decision, licenseMetadata: rule.licenseMetadata,
+  });
+  const selectedYara = inventory.rules.filter((rule) => candidateDecisions.has(rule.decision)).map(normalized).sort((a, b) => a.rule.localeCompare(b.rule));
+  const heldYara = inventory.rules.filter((rule) => !candidateDecisions.has(rule.decision)).map(normalized).sort((a, b) => a.rule.localeCompare(b.rule));
+  const selectionDigest = sha256(canonical(selectedYara));
+  const holdDigest = sha256(canonical(heldYara));
+  if (inventory.archiveVersion !== '20260927' || inventory.archiveSha256 !== '16180800cc2f077638d2e13a33bd68609d0b6eedd1fbfdbae6d5d4a1c53f826f'
+    || selectedYara.length !== 4536 || heldYara.length !== 574
+    || selectionDigest !== '33aa825b1f9c843e7129f26b5b57e85d6121562cdeb577e40aef9360601585f6'
+    || holdDigest !== '22150df654bf4396c085336f1c00f8d0483cdc61713a81db32a115c586ef98e2') {
+    fail('selected YARA runtime records do not match the fixed 4,536-rule contract.');
+  }
+  if (coverage.status !== 'real-selected-runtime-coverage-evidence-not-release-clearance'
+    || coverage.sast?.boundedCoveragePassed !== true || coverage.yara?.boundedCoveragePassed !== true
+    || coverage.coverageDecision?.status !== 'approved-for-protected-test-qualification'
+    || coverage.coverageDecision?.publicCommercialReleaseApproved !== false || coverage.coverageDecision?.checkoutApproved !== false) {
+    fail('selected runtime coverage record exceeds or does not meet the protected-test qualification boundary.');
+  }
+
+  const rules = {};
+  const provenance = {};
+  const licenseFiles = new Map(sast.files.filter((item) => item.path === 'LICENSE' || item.path === 'rules/lgpl/LICENSE').map((item) => [item.path, item]));
+  const sastFilesByRule = new Map();
+  for (const file of sast.files.filter((item) => /\.ya?ml$/i.test(item.path ?? ''))) {
+    const ruleId = sastRuleId(file.path);
+    if (sastFilesByRule.has(ruleId)) fail(`selected SAST source identity ${ruleId} is duplicated.`);
+    const licenseFile = licenseFiles.get(file.licensePath);
+    if (!licenseFile || file.licenseSha256 !== licenseFile.sha256 || file.modified !== false || file.headerPreserved !== true
+      || !SHA256.test(file.sha256 ?? '') || !/^https:\/\//.test(file.sourceUrl ?? '')) {
+      fail(`selected SAST source evidence for ${ruleId} is incomplete.`);
+    }
+    sastFilesByRule.set(ruleId, { ...file, licenseFile });
+  }
+  if (sastFilesByRule.size !== 161 || identities.ruleIds.some((ruleId) => !sastFilesByRule.has(ruleId))) {
+    fail('selected SAST source files do not map exactly to the 161 selected rule identities.');
+  }
+  const sastNotice = {};
+  for (const [licensePath, file] of licenseFiles) {
+    sastNotice[licensePath] = packagedNotice(sourceRoot, tracked, {
+      path: `licensing/notices/candidate-sources/sha256/${file.sha256}.txt`,
+      sha256: file.sha256,
+      bytes: file.bytes,
+    }, `selected SAST ${file.declaredLicense}`);
+  }
+  const credits = {
+    'gitlab-sast:mit': {
+      attributionId: 'gitlab-sast:mit', displayName: 'GitLab SAST Rules selected MIT sources',
+      sourceUrl: `https://gitlab.com/gitlab-org/security-products/sast-rules/-/tree/${sast.sourceCommit}`,
+      licenseName: 'MIT', licenseUrl: 'https://opensource.org/license/mit',
+      modificationNotice: 'Selected source files are used byte-for-byte from the pinned source commit.',
+      notices: [sastNotice.LICENSE],
+    },
+    'gitlab-sast:lgpl-3.0': {
+      attributionId: 'gitlab-sast:lgpl-3.0', displayName: 'GitLab SAST Rules selected LGPL-3.0 sources',
+      sourceUrl: `https://gitlab.com/gitlab-org/security-products/sast-rules/-/tree/${sast.sourceCommit}/rules/lgpl/javascript`,
+      licenseName: 'LGPL-3.0', licenseUrl: 'https://www.gnu.org/licenses/lgpl-3.0.html',
+      modificationNotice: 'Selected source files are used byte-for-byte from the pinned source commit and remain separately replaceable.',
+      notices: [sastNotice['rules/lgpl/LICENSE']],
+    },
+  };
+  for (const ruleId of identities.ruleIds) {
+    const sourceFile = sastFilesByRule.get(ruleId);
+    const attributionId = sourceFile.declaredLicense === 'LGPL-3.0' ? 'gitlab-sast:lgpl-3.0'
+      : sourceFile.declaredLicense === 'MIT' ? 'gitlab-sast:mit' : null;
+    if (!attributionId) fail(`selected SAST source ${sourceFile.path} has an unsupported declared license.`);
+    rules[ruleId] = {
+      ruleId,
+      title: `SAST detection: ${ruleId}`,
+      summary: 'The selected static-analysis rule found a security-sensitive code pattern.',
+      remediation: 'Review the affected code path, remove the unsafe pattern or add the required validation and authorization, then rerun the same Lattice Security check.',
+      retest: `Run the selected SAST rule ${ruleId} again after applying the repair.`,
+      attributionIds: [attributionId],
+    };
+    provenance[ruleId] = {
+      sourcePath: sourceFile.path,
+      sourceSha256: sourceFile.sha256,
+      sourceUrl: sourceFile.sourceUrl,
+      sourceCommit: sast.sourceCommit,
+      sourceEvidence: refs.sastSourceEvidence,
+      declaredLicense: sourceFile.declaredLicense,
+      licenseSourcePath: sourceFile.licensePath,
+      notices: [sastNotice[sourceFile.licensePath]],
+      cweIds: [],
+    };
+  }
+
+  const noticeRecords = {};
+  const noticeRefs = {};
+  for (const [name, record] of Object.entries(SELECTED_NOTICE_RECORDS)) {
+    const loaded = fixedJsonRecord(sourceRoot, tracked, record, `selected ${name}`);
+    noticeRecords[name] = loaded.value;
+    noticeRefs[name] = loaded.ref;
+  }
+  const sourceLicenses = new Map();
+  for (const license of inventory.sourceLicenseTexts ?? []) {
+    const notice = packagedNotice(sourceRoot, tracked, {
+      path: `licensing/notices/candidate-sources/sha256/${license.textSha256}.txt`,
+      sha256: license.textSha256,
+      bytes: fs.statSync(path.join(sourceRoot, 'licensing', 'notices', 'candidate-sources', 'sha256', `${license.textSha256}.txt`)).size,
+    }, `selected YARA ${license.metadataUrl}`);
+    if (sourceLicenses.has(license.metadataUrl)) fail(`selected YARA license source ${license.metadataUrl} is duplicated.`);
+    sourceLicenses.set(license.metadataUrl, { ...license, notice });
+  }
+  const malpedia = noticeRecords.malpedia;
+  const malpediaNotices = [
+    packagedNotice(sourceRoot, tracked, malpedia.declaration, 'Malpedia source declaration'),
+    packagedNotice(sourceRoot, tracked, malpedia.legalcode, 'Malpedia legalcode'),
+  ];
+  if (malpedia.status !== 'source-license-declaration-evidence-not-rights-clearance' || malpedia.commerciallyCleared !== false
+    || malpedia.selection?.rules !== 1582 || malpedia.selection?.digest !== '1abee35347277118e5a744e8837bb6ac88147196ef80bd527dc833f6b840b042') {
+    fail('Malpedia selected-source declaration evidence does not match the fixed non-clearance record.');
+  }
+  const apache = noticeRecords.apache;
+  const apacheNotice = packagedNotice(sourceRoot, tracked, apache.legalcode, 'selected original-author Apache legalcode');
+  if (apache.status !== 'source-license-declaration-evidence-not-rights-clearance' || apache.commerciallyCleared !== false
+    || apache.selection?.rules !== 27 || apache.selection?.sha256 !== '7049543e6494f9dc40b0591b975c53d03f8823522d3679f81e04a457c32d1108'
+    || !Array.isArray(apache.declarations) || apache.declarations.length !== 27 || apache.unmappedRules?.length !== 0) {
+    fail('selected original-author Apache declaration evidence does not match the fixed non-clearance record.');
+  }
+  const apacheDeclarations = new Map(apache.declarations.map((item) => [item.rule, item]));
+  for (const ref of apache.originalEvidenceRecords ?? []) {
+    const fixed = Object.values(SELECTED_NOTICE_RECORDS).find((item) => item.path === ref.path);
+    if (!fixed || fixed.sha256 !== ref.sha256 || noticeRefs[Object.keys(SELECTED_NOTICE_RECORDS).find((key) => SELECTED_NOTICE_RECORDS[key].path === ref.path)]?.bytes !== ref.bytes) {
+      fail(`selected Apache original evidence ${ref.path} does not match its packaged record.`);
+    }
+  }
+  for (const rule of selectedYara) {
+    let attributionId;
+    let licenseEvidence;
+    if (rule.decision === 'candidate-attribution') {
+      const sourceLicense = sourceLicenses.get(rule.licenseMetadata?.license_url);
+      if (!sourceLicense || sourceLicense.observedLicense !== rule.candidateLicense) {
+        fail(`selected YARA rule ${rule.rule} lacks its origin-specific license text.`);
+      }
+      attributionId = `yara-source:${sha256(sourceLicense.metadataUrl).slice(0, 16)}`;
+      if (!credits[attributionId]) credits[attributionId] = {
+        attributionId,
+        displayName: `Selected YARA rules from ${new URL(sourceLicense.metadataUrl).hostname}`,
+        sourceUrl: sourceLicense.metadataUrl,
+        licenseName: sourceLicense.observedLicense,
+        licenseUrl: sourceLicense.metadataUrl,
+        modificationNotice: 'Lattice executes a frozen selection from the pinned aggregate. The original source and exact observed license text remain identified; aggregate adaptation status is not asserted.',
+        notices: [sourceLicense.notice],
+      };
+      licenseEvidence = { kind: 'origin-license-text', sourceUrl: sourceLicense.metadataUrl, notices: [sourceLicense.notice] };
+    } else if (rule.decision === 'candidate-attribution-sharealike') {
+      attributionId = 'yara-source:malpedia-cc-by-sa-4.0';
+      if (!credits[attributionId]) credits[attributionId] = {
+        attributionId,
+        displayName: 'Malpedia signator rules selected sources',
+        sourceUrl: `${malpedia.sourceRepository}/tree/${malpedia.sourceCommit}/rules`,
+        licenseName: 'CC-BY-SA-4.0',
+        licenseUrl: malpedia.legalcode.sourceUrl,
+        modificationNotice: 'The aggregate block is source-identified, but equality to the original and adaptation status are not established. This record does not assert completed attribution, change-notice, source-distribution, or ShareAlike compliance.',
+        notices: malpediaNotices,
+        evidenceRecords: [noticeRefs.malpedia],
+      };
+      licenseEvidence = { kind: 'rules-folder-declaration', evidenceRecord: noticeRefs.malpedia, notices: malpediaNotices };
+    } else if (rule.decision === 'candidate-explicit-apache') {
+      const declaration = apacheDeclarations.get(rule.rule);
+      if (!declaration || declaration.blockSha256 !== rule.blockSha256 || declaration.aggregatorSourceUrl !== rule.sourceUrl
+        || declaration.declaredLicense !== 'Apache-2.0' || !/^https:\/\//.test(declaration.originalSourceUrl ?? '')
+        || (declaration.sourceUrl !== undefined && !/^https:\/\//.test(declaration.sourceUrl))) {
+        fail(`selected YARA rule ${rule.rule} lacks an exact original-author Apache declaration.`);
+      }
+      const evidenceRecord = Object.values(noticeRefs).find((ref) => ref.path === declaration.evidenceRecord);
+      if (!evidenceRecord) fail(`selected YARA rule ${rule.rule} references an unpackaged original-author evidence record.`);
+      attributionId = `yara-apache:${sha256(rule.rule).slice(0, 16)}`;
+      credits[attributionId] = {
+        attributionId,
+        displayName: `${rule.author} selected YARA source`,
+        sourceUrl: declaration.originalSourceUrl,
+        licenseName: 'Apache-2.0',
+        licenseUrl: apache.legalcode.sourceUrl,
+        modificationNotice: 'The original-author page declares Apache-2.0. Equality to the aggregate block, adaptation status, and completed distribution obligations are not asserted.',
+        notices: [apacheNotice],
+        evidenceRecords: [evidenceRecord],
+      };
+      licenseEvidence = {
+        kind: declaration.sourceKind,
+        originalSourceUrl: declaration.originalSourceUrl,
+        ...(declaration.sourceUrl ? { declarationSourceUrl: declaration.sourceUrl } : {}),
+        declarationSha256: declaration.declarationSha256,
+        evidenceRecord,
+        notices: [apacheNotice],
+      };
+    } else {
+      fail(`selected YARA rule ${rule.rule} has an unsupported selection decision.`);
+    }
+    rules[rule.rule] = {
+      ruleId: rule.rule,
+      title: `YARA detection: ${rule.rule}`,
+      summary: `A selected YARA rule by ${rule.author} matched the scanned file.`,
+      remediation: 'Do not ship the matched file until it has been removed or rebuilt from a trusted source and the same selected YARA check no longer matches.',
+      retest: `Run selected YARA rule ${rule.rule} again after replacing or removing the file.`,
+      attributionIds: [attributionId],
+      author: rule.author,
+      sourceUrl: rule.sourceUrl,
+      licenseName: rule.candidateLicense,
+    };
+    provenance[rule.rule] = {
+      sourcePath: refs.yaraInventory.path,
+      sourceSha256: refs.yaraInventory.sha256,
+      sourceUrl: rule.sourceUrl,
+      sourceBlockSha256: rule.blockSha256,
+      author: rule.author,
+      licenseName: rule.candidateLicense,
+      decision: rule.decision,
+      licenseEvidence,
+      cweIds: [],
+    };
+  }
+
+  return {
+    contract: {
+      schemaVersion: 2,
+      fallback: { semgrepRules: 'forbidden', yaraForgeMixedPack: 'forbidden', yaraExtraRules: 'forbidden' },
+      coverage: refs.coverage,
+      notices: Object.values(noticeRefs),
+      sast: {
+        source: {
+          mode: 'files',
+          sourceCommit: sast.sourceCommit,
+          files: sast.files.length,
+          totalBytes: sast.files.reduce((sum, file) => sum + file.bytes, 0),
+          manifestSha256: sha256(JSON.stringify(sast.files.map((file) => ({ path: file.path, url: file.sourceUrl, sha256: file.sha256, bytes: file.bytes })))),
+          maxBytes: 1024 * 1024,
+        },
+        sourceEvidence: refs.sastSourceEvidence,
+        identities: refs.sastIdentities,
+      },
+      yara: {
+        source: {
+          mode: 'archive',
+          url: 'https://github.com/YARAHQ/yara-forge/releases/download/20260927/yara-forge-rules-core.zip',
+          sha256: inventory.archiveSha256,
+          maxBytes: 16 * 1024 * 1024,
+        },
+        inventory: refs.yaraInventory,
+        selectionDigest,
+        holdDigest,
+      },
+    },
+    rules,
+    credits,
+    provenance,
+  };
+}
+
+function runtimeCatalog(sourceRoot, tracked, sourceCommit, release, originalSourceArchiveUrl) {
+  const original = originalRules(sourceRoot, tracked);
+  const builtins = builtinRules(sourceRoot, tracked);
+  const betterleaks = BETTERLEAKS_RULE_CONTRACTS.map((contract) => betterleaksRule(sourceRoot, tracked, contract));
+  const betterleaksRules = Object.assign({}, ...betterleaks.map((item) => item.rules));
+  const betterleaksCredits = Object.assign({}, ...betterleaks.map((item) => item.credits));
+  const betterleaksProvenance = Object.assign({}, ...betterleaks.map((item) => item.provenance));
+  const qualification = qualificationEvidence(sourceRoot, tracked);
+  const selected = selectedRuntimeCatalog(sourceRoot, tracked);
+  return {
+    format: 'lattice-security-catalog-v1',
+    ...(qualification ? { qualificationEvidence: qualification } : {}),
+    ...(selected ? { selectedRuntime: selected.contract } : {}),
+    ...(release ? { commercialRelease: { record: release.ref, evidence: release.evidence, checkoutEnabled: false, paidPublicationEnabled: false } } : {}),
+    rules: Object.fromEntries(Object.entries({ ...original.rules, ...builtins.rules, ...betterleaksRules, ...(selected?.rules ?? {}) }).sort(([a], [b]) => a.localeCompare(b))),
+    credits: {
+      'm2ai:vsg-original': {
+        attributionId: 'm2ai:vsg-original',
+        displayName: 'Vibe Security Gate original code and rules, M2 AI, LLC',
+        sourceUrl: originalSourceArchiveUrl ?? `https://github.com/rmach816/vibe-security-gate/tree/${sourceCommit}`,
+        licenseName: 'Apache-2.0',
+        licenseUrl: 'https://www.apache.org/licenses/LICENSE-2.0',
+        modificationNotice: null,
+      },
+      ...betterleaksCredits,
+      ...(selected?.credits ?? {}),
+    },
+    provenance: {
+      sourceCommit,
+      rules: Object.fromEntries(Object.entries({ ...original.provenance, ...builtins.provenance, ...betterleaksProvenance, ...(selected?.provenance ?? {}) }).sort(([a], [b]) => a.localeCompare(b))),
+    },
+    candidateBlockers: betterleaks.flatMap((item) => item.blockers),
+    checkClasses: [
+      'agent-review', 'agent-surface', 'code', 'dep-change', 'deps-vuln', 'licenses', 'live-basic',
+      'live-js-secrets', 'malware', 'project-scripts', 'sbom', 'secrets-history', 'secrets-tree',
+      'supabase-static', 'workflows',
+    ],
+  };
+}
+
+function parseRuntimeManifest(source) {
+  const match = /^export default \{manifest: (\{[^\r\n]+\}),\r?\n/.exec(source);
+  if (!match) fail('the evaluator must begin with its default-export manifest.');
+  try { return JSON.parse(match[1]); } catch { fail('the evaluator manifest is invalid.'); }
+}
+
+function copyFile(source, target) {
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(source, target, fs.constants.COPYFILE_EXCL);
+}
+
+function walkArtifact(root, dir = root, rel = '') {
+  const files = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+    const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+    const child = path.join(dir, entry.name);
+    const stat = fs.lstatSync(child);
+    if (stat.isSymbolicLink()) fail(`linked path ${childRel} is forbidden.`);
+    if (entry.isDirectory()) files.push(...walkArtifact(root, child, childRel));
+    else if (entry.isFile()) files.push(childRel);
+    else fail(`non-file path ${childRel} is forbidden.`);
+  }
+  return files;
+}
+
+/** Builds a blocked candidate or owner-approved artifact from one immutable clean Git source commit. */
+export function buildLatticeArtifacts({ sourceRoot, outDir, originalSourceArchiveUrl }) {
+  validateOriginalSourceArchiveUrl(originalSourceArchiveUrl);
+  sourceRoot = fs.realpathSync(path.resolve(sourceRoot));
+  outDir = path.resolve(outDir);
+  const top = git(sourceRoot, ['rev-parse', '--show-toplevel']);
+  if (path.resolve(top) !== path.resolve(sourceRoot)) fail('sourceRoot must be the Git worktree root.');
+  const status = git(sourceRoot, ['status', '--porcelain=v1', '--untracked-files=all']);
+  if (status) fail('sourceRoot must be clean before artifact generation.');
+  const sourceCommit = git(sourceRoot, ['rev-parse', 'HEAD']);
+  if (!/^[0-9a-f]{40}$/.test(sourceCommit)) fail('source commit is invalid.');
+  if (fs.existsSync(outDir)) fail('outDir must not already exist.');
+
+  const tracked = trackedFiles(sourceRoot);
+  const allowlist = sourceAllowlist(sourceRoot, tracked);
+  const release = commercialReleaseEvidence(sourceRoot, tracked, allowlist);
+  const packageJson = JSON.parse(fs.readFileSync(path.join(sourceRoot, 'package.json'), 'utf8'));
+  const commercialManifestDigest = sha256(fs.readFileSync(path.join(sourceRoot, 'licensing', 'commercial-components.json')));
+  const baseIdentity = {
+    vsgVersion: packageJson.version,
+    profileId: release ? 'lattice-security-commercial' : 'lattice-candidate-blocked',
+    profileVersion: '1.0.0',
+    rulesDigest: hashDirectory(sourceRoot, 'rules/', allowlist),
+    registryDigest: hashDirectory(sourceRoot, 'tools/registry/', tracked),
+    commercialManifestDigest,
+  };
+  const catalog = runtimeCatalog(sourceRoot, tracked, sourceCommit, release, originalSourceArchiveUrl);
+  const releaseEligibility = release ? {
+    status: 'approved',
+    blockers: [],
+    approval: { owner: release.record.owner, decidedOn: release.record.decidedOn, record: release.ref },
+    checkoutEnabled: false,
+    paidPublicationEnabled: false,
+  } : { status: 'blocked', blockers: RELEASE_BLOCKERS };
+  const runtime = buildLatticeRuntimeSource({ identity: baseIdentity, catalog, releaseEligibility });
+  const { format: _format, releaseEligibility: _runtimeEligibility, ...identity } = runtime.manifest;
+  const staging = fs.mkdtempSync(path.join(path.dirname(outDir), `${path.basename(outDir)}-staging-`));
+  try {
+    for (const rel of allowlist) copyFile(path.join(sourceRoot, ...rel.split('/')), path.join(staging, ...rel.split('/')));
+    fs.writeFileSync(path.join(staging, EVALUATOR_PATH), runtime.source, { encoding: 'utf8', flag: 'wx' });
+    fs.writeFileSync(path.join(staging, 'lattice-catalog.json'), `${JSON.stringify(catalog, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
+    const artifactFiles = [...allowlist, EVALUATOR_PATH, 'lattice-catalog.json'].sort();
+    const files = artifactFiles.map((rel) => {
+      const bytes = fs.readFileSync(path.join(staging, ...rel.split('/')));
+      return { path: rel, sha256: sha256(bytes), bytes: bytes.byteLength };
+    });
+    const manifest = {
+      format: FORMAT,
+      sourceCommit,
+      identity,
+      entryPoint: ENTRY_POINT,
+      exporterPath: EXPORTER_PATH,
+      transportPath: TRANSPORT_PATH,
+      evaluatorPath: EVALUATOR_PATH,
+      releaseEligibility,
+      files,
+    };
+    fs.writeFileSync(path.join(staging, 'artifact-manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`, { encoding: 'utf8', flag: 'wx' });
+    fs.renameSync(staging, outDir);
+    return manifest;
+  } catch (error) {
+    fs.rmSync(staging, { recursive: true, force: true });
+    throw error;
+  }
+}
+
+/** Reads and fully re-verifies an already built Lattice artifact without executing it. */
+export function readLatticeArtifact({ artifactRoot }) {
+  artifactRoot = fs.realpathSync(path.resolve(artifactRoot));
+  const manifestPath = path.join(artifactRoot, 'artifact-manifest.json');
+  let manifest;
+  try { manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8')); } catch (error) { fail(`artifact-manifest.json is missing or invalid (${error.message}).`); }
+  const keys = ['format', 'sourceCommit', 'identity', 'entryPoint', 'exporterPath', 'transportPath', 'evaluatorPath', 'releaseEligibility', 'files'];
+  const extra = Object.keys(manifest).find((key) => !keys.includes(key));
+  if (extra || manifest.format !== FORMAT) fail(extra ? `manifest field ${extra} is not allowed.` : 'manifest format is unsupported.');
+  if (!/^[0-9a-f]{40}$/.test(manifest.sourceCommit ?? '')) fail('sourceCommit is invalid.');
+  if (manifest.entryPoint !== ENTRY_POINT || manifest.exporterPath !== EXPORTER_PATH || manifest.transportPath !== TRANSPORT_PATH || manifest.evaluatorPath !== EVALUATOR_PATH) fail('runtime paths do not match the fixed interface.');
+  if (!['blocked', 'approved'].includes(manifest.releaseEligibility?.status)) fail('artifact release eligibility is unsupported.');
+  if (!Array.isArray(manifest.files) || manifest.files.length === 0) fail('manifest files are missing.');
+  const names = new Set();
+  const lower = new Set();
+  for (const item of manifest.files) {
+    if (!item || !safeRelative(item.path) || names.has(item.path) || lower.has(item.path.toLowerCase())) fail(`file path ${item?.path ?? ''} is unsafe, duplicate, or case-colliding.`);
+    if (RULE_TEST_SPECIMEN.test(item.path)) fail(`rule test specimen ${item.path} is not allowed in a runtime artifact.`);
+    names.add(item.path); lower.add(item.path.toLowerCase());
+    if (!SHA256.test(item.sha256 ?? '') || !Number.isSafeInteger(item.bytes) || item.bytes < 0) fail(`file metadata for ${item.path} is invalid.`);
+    const file = path.join(artifactRoot, ...item.path.split('/'));
+    const stat = fs.lstatSync(file);
+    if (!stat.isFile() || stat.isSymbolicLink()) fail(`declared path ${item.path} is not a regular file.`);
+    const bytes = fs.readFileSync(file);
+    if (bytes.byteLength !== item.bytes || sha256(bytes) !== item.sha256) fail(`declared file ${item.path} was tampered with.`);
+  }
+  const actual = walkArtifact(artifactRoot).filter((rel) => rel !== 'artifact-manifest.json').sort();
+  if (actual.length !== names.size || actual.some((rel) => !names.has(rel))) fail('artifact contains an undeclared file.');
+  if (manifest.files.some((item, index) => index > 0 && manifest.files[index - 1].path >= item.path)) fail('manifest files must use deterministic path order.');
+  const runtimeManifest = parseRuntimeManifest(fs.readFileSync(path.join(artifactRoot, EVALUATOR_PATH), 'utf8'));
+  if (canonical(runtimeManifest) !== canonical({ format: 'lattice-security-runtime-v1', ...manifest.identity, releaseEligibility: manifest.releaseEligibility })) fail('evaluator identity does not match the artifact manifest.');
+  for (const key of ['rulesDigest', 'registryDigest', 'commercialManifestDigest', 'evaluatorDigest', 'catalogDigest']) {
+    if (!SHA256.test(manifest.identity?.[key] ?? '')) fail(`identity ${key} is invalid.`);
+  }
+  const packageJson = JSON.parse(fs.readFileSync(path.join(artifactRoot, 'package.json'), 'utf8'));
+  if (packageJson.version !== manifest.identity.vsgVersion) fail('VSG version does not match packaged metadata.');
+  if (sha256(fs.readFileSync(path.join(artifactRoot, 'licensing', 'commercial-components.json'))) !== manifest.identity.commercialManifestDigest) fail('commercial manifest identity does not match its bytes.');
+  const paths = manifest.files.map((item) => item.path);
+  const release = commercialReleaseEvidence(artifactRoot, paths, paths);
+  const expectedEligibility = release ? {
+    status: 'approved',
+    blockers: [],
+    approval: { owner: release.record.owner, decidedOn: release.record.decidedOn, record: release.ref },
+    checkoutEnabled: false,
+    paidPublicationEnabled: false,
+  } : { status: 'blocked', blockers: RELEASE_BLOCKERS };
+  if (canonical(manifest.releaseEligibility) !== canonical(expectedEligibility)) fail('artifact release eligibility does not match its reviewed release record.');
+  if (hashDirectory(artifactRoot, 'rules/', paths) !== manifest.identity.rulesDigest) fail('rules identity does not match packaged bytes.');
+  if (hashDirectory(artifactRoot, 'tools/registry/', paths) !== manifest.identity.registryDigest) fail('registry identity does not match packaged bytes.');
+  const catalog = JSON.parse(fs.readFileSync(path.join(artifactRoot, 'lattice-catalog.json'), 'utf8'));
+  if (sha256(canonical(catalog)) !== manifest.identity.catalogDigest) fail('catalog identity does not match its bytes.');
+  if (canonical(catalog.qualificationEvidence ?? null) !== canonical(qualificationEvidence(artifactRoot, paths))) {
+    fail('catalog qualification evidence does not match packaged records.');
+  }
+  const expectedReleaseCatalog = release ? { record: release.ref, evidence: release.evidence, checkoutEnabled: false, paidPublicationEnabled: false } : null;
+  if (canonical(catalog.commercialRelease ?? null) !== canonical(expectedReleaseCatalog)) {
+    fail('catalog commercial release evidence does not match packaged records.');
+  }
+  return manifest;
+}