@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/src/lattice/execution.mjs

@@ -0,0 +1,45 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { UsageError } from '../core/errors.mjs';
+import { packageRoot } from '../core/paths.mjs';
+import { readLatticeArtifact } from './artifact.mjs';
+
+const ARTIFACT_MARKERS = Object.freeze([
+  'artifact-manifest.json',
+  'lattice-runtime.mjs',
+  'lattice-catalog.json',
+]);
+
+const MISSING_COMMERCIAL_COVERAGE = Object.freeze([
+  'commercial_component_rights_not_cleared',
+  'third_party_attribution_catalog_incomplete',
+  'replacement_rule_coverage_not_approved',
+  'artifact_release_approval_missing',
+]);
+
+function markerPresent(marker) {
+  try {
+    fs.lstatSync(path.join(packageRoot, marker));
+    return true;
+  } catch (error) {
+    if (error?.code === 'ENOENT') return false;
+    throw new UsageError(`[commercial_artifact_unavailable] cannot inspect runtime marker ${marker} (${error?.code ?? 'filesystem_error'}).`);
+  }
+}
+
+/** Refuses scanner/setup execution from an identifiable candidate or partial artifact. */
+export function assertStandaloneExecution({ allowQualification = false } = {}) {
+  const present = ARTIFACT_MARKERS.filter(markerPresent);
+  if (!present.length) return;
+  if (present.length === ARTIFACT_MARKERS.length) {
+    try {
+      const manifest = readLatticeArtifact({ artifactRoot: packageRoot });
+      if (manifest.releaseEligibility?.status === 'approved') return;
+      if (manifest.releaseEligibility?.status === 'blocked'
+        && allowQualification && process.env.VSG_COMMERCIAL_QUALIFICATION === '1'
+        && JSON.stringify(manifest.releaseEligibility.blockers) === JSON.stringify(MISSING_COMMERCIAL_COVERAGE)) return;
+    } catch { /* use the fixed denial below */ }
+  }
+  throw new UsageError(`[commercial_artifact_unavailable] candidate artifact execution is blocked; missing commercial coverage: ${MISSING_COMMERCIAL_COVERAGE.join(', ')}; runtime markers present: ${present.join(', ')}.`);
+}
+

package/dist/security-runtime/src/lattice/export.mjs

@@ -0,0 +1,215 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { captureReviewContext } from '../core/pipeline.mjs';
+import { readLatticeArtifact } from './artifact.mjs';
+import { captureRuntimeProvenance } from './provenance.mjs';
+
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const SHA256 = /^[0-9a-f]{64}$/;
+const SHA1 = /^[0-9a-f]{40}$/;
+const AUDIT_MODES = ['scan', 'deep', 'release'];
+const MODES = [...AUDIT_MODES, 'report'];
+const CONFIDENCES = new Set(['confirmed', 'high', 'medium', 'low']);
+const SEVERITIES = new Set(['critical', 'high', 'medium', 'low', 'info']);
+const PUBLIC_ID = /^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$/;
+const SENSITIVE = /-----BEGIN [A-Z ]*PRIVATE KEY-----|\bAKIA[0-9A-Z]{16}\b|\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{30,}\b|\bgithub_pat_[A-Za-z0-9_]{30,}\b|\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{16,}\b|\bxox[abprs]-[A-Za-z0-9-]{10,}\b|\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/;
+
+export class LatticeReportError extends Error {
+  constructor(message, code = 'invalid_report') {
+    super(`Lattice report rejected: ${message}`);
+    this.name = 'LatticeReportError';
+    this.code = code;
+  }
+}
+
+function fail(message, code = 'invalid_report') {
+  throw new LatticeReportError(message, code);
+}
+
+function readJson(file, label) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch (error) { fail(`${label} is missing or invalid (${error.message}).`); }
+}
+
+const canonical = (value) => {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(',')}}`;
+};
+
+function validateRepositoryIdentity(value) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > 512 || SENSITIVE.test(value) || /^[A-Za-z]:|^\/|\\|\.\.|@|[?#]|[\u0000-\u001f]/.test(value)) fail('repositoryIdentity must be a canonical public repository identity.');
+  const parts = value.split('/');
+  if (parts.length < 3 || !parts[0].includes('.') || parts.some((part) => !/^[A-Za-z0-9_.-]+$/.test(part)) || /^(?:localhost|0\.0\.0\.0|127\.|10\.|192\.168\.|169\.254\.|172\.(?:1[6-9]|2[0-9]|3[01])\.)/i.test(parts[0])) fail('repositoryIdentity must name a public host, owner, and repository.');
+  return value;
+}
+
+function validateSnapshot(snapshot) {
+  if (!snapshot || snapshot.schemaVersion !== 1 || !snapshot.start || !snapshot.end) fail('scan start/end source evidence is missing.');
+  for (const [name, item] of Object.entries({ start: snapshot.start, end: snapshot.end })) {
+    if (item.schemaVersion !== 1 || typeof item.runId !== 'string' || !item.runId || typeof item.repo !== 'string' || !path.isAbsolute(item.repo)
+      || !SHA256.test(item.sourceHash ?? '') || !Number.isSafeInteger(item.fileCount) || item.fileCount < 0
+      || (item.commitSha !== null && !SHA1.test(item.commitSha ?? '')) || typeof item.dirty !== 'boolean') {
+      fail(`scan ${name} source evidence is invalid.`);
+    }
+  }
+  if (canonical(snapshot.start) !== canonical(snapshot.end)) fail('repository source changed while the scan was running.', 'source_changed');
+  return snapshot.start;
+}
+
+function validateRuntimeSnapshot(snapshot, artifact, artifactRoot) {
+  if (!snapshot || snapshot.schemaVersion !== 1 || !snapshot.start || !snapshot.end) fail('scan start/end runtime evidence is missing.');
+  if (canonical(snapshot.start) !== canonical(snapshot.end)) fail('executing VSG runtime changed while the scan was running.');
+  if (snapshot.start.kind !== 'lattice-artifact') fail('scan was not executed by the verified Lattice artifact entrypoint.');
+  const expected = captureRuntimeProvenance({ runtimeRoot: artifactRoot, entrypoint: path.join(artifactRoot, ...artifact.entryPoint.split('/')) });
+  if (canonical(snapshot.start) !== canonical(expected)) fail('originating VSG runtime does not match the supplied artifact.');
+  return snapshot.start;
+}
+
+function normalizedCheck(check, index) {
+  if (!check || typeof check.id !== 'string' || !check.id || check.id.length > 128 || !PUBLIC_ID.test(check.id) || SENSITIVE.test(check.id)) fail(`check ${index} has an invalid id.`);
+  const statuses = { ran: 'ran', not_run: 'missing', not_applicable: 'not_applicable' };
+  const status = statuses[check.status];
+  if (!status) fail(`check ${check.id} has an unsupported status.`);
+  const coverageStatus = /^degraded:/.test(check.reason ?? '') ? `${check.status}_degraded` : check.status;
+  return {
+    id: check.id,
+    status,
+    required: check.required === true,
+    coverageCodes: [`vsg.${check.id}.${coverageStatus}`],
+    attributionIds: [],
+  };
+}
+
+function ruleIdOf(finding) {
+  const value = finding.sources?.find((source) => typeof source?.ruleId === 'string' && source.ruleId)?.ruleId ?? finding.check;
+  if (typeof value !== 'string' || !value || value.length > 160 || !PUBLIC_ID.test(value) || SENSITIVE.test(value)) fail(`finding ${finding.fingerprint ?? '?'} has no bounded public rule identity.`);
+  return value;
+}
+
+function advisoryIdsOf(finding) {
+  const values = [];
+  const add = (value) => {
+    for (const match of String(value ?? '').matchAll(/\b(?:CVE-\d{4}-\d{4,}|GHSA-[23456789cfghjmpqrvwx]{4}-[23456789cfghjmpqrvwx]{4}-[23456789cfghjmpqrvwx]{4}|OSV-[A-Za-z0-9._-]+)\b/gi)) values.push(match[0].toUpperCase());
+  };
+  for (const source of finding.sources ?? []) add(source.ruleId);
+  for (const ref of finding.refs ?? []) add(ref);
+  return [...new Set(values)].slice(0, 50);
+}
+
+function packageRefOf(location) {
+  if (!location?.package) return null;
+  const ecosystem = String(location.ecosystem ?? 'package').replace(/[^A-Za-z0-9._-]/g, '').slice(0, 64) || 'package';
+  const name = String(location.package).replace(/[\u0000-\u001f]/g, '').slice(0, 160);
+  const version = location.version == null ? '' : `@${String(location.version).replace(/[\u0000-\u001f]/g, '').slice(0, 80)}`;
+  const value = `${ecosystem}:${name}${version}`;
+  if (value.length > 300 || !PUBLIC_ID.test(value) || SENSITIVE.test(value)) fail('finding package reference is invalid or contains sensitive data.');
+  return value;
+}
+
+function locationOf(location, fingerprint) {
+  if (!location?.file) return null;
+  const value = String(location.file).replace(/\\/g, '/');
+  if (!value || value.length > 512 || /[\u0000-\u001f\u007f]/.test(value) || SENSITIVE.test(value) || value.startsWith('/') || /^[A-Za-z]:/.test(value) || value.includes('://') || value.split('/').some((part) => !part || part === '.' || part === '..')) fail(`finding ${fingerprint} contains a non-relative or sensitive source path.`);
+  const line = location.line == null ? null : Number(location.line);
+  if (line !== null && (!Number.isSafeInteger(line) || line < 1 || line > 10_000_000)) fail(`finding ${fingerprint} has an invalid line.`);
+  return { path: value, line, column: null };
+}
+
+function cweIdsOf(finding, ruleId, catalog) {
+  const values = [
+    ...[].concat(finding.cweIds ?? []),
+    ...[].concat(finding.cwe ?? []),
+    ...[].concat(catalog.provenance?.rules?.[ruleId]?.cweIds ?? []),
+  ];
+  const normalized = values.map((value) => {
+    const text = String(value).trim().toUpperCase();
+    const number = /^(?:CWE-)?([1-9][0-9]{0,5})$/.exec(text)?.[1];
+    if (!number) fail(`finding ${finding.fingerprint ?? '?'} contains an invalid CWE identity.`);
+    return `CWE-${Number(number)}`;
+  });
+  return [...new Set(normalized)].sort((a, b) => Number(a.slice(4)) - Number(b.slice(4)));
+}
+
+function normalizedFinding(finding, index, catalog) {
+  if (!finding || !SHA256.test(finding.fingerprint ?? '')) fail(`finding ${index} has an invalid fingerprint.`);
+  if (!SEVERITIES.has(finding.severity)) fail(`finding ${finding.fingerprint} has an invalid severity.`);
+  if (!CONFIDENCES.has(finding.confidence)) fail(`finding ${finding.fingerprint} has an invalid confidence.`);
+  if (typeof finding.category !== 'string' || !finding.category || finding.category.length > 128) fail(`finding ${finding.fingerprint} has an invalid category.`);
+  if (!finding.exploited || typeof finding.exploited.kev !== 'boolean' || typeof finding.fix !== 'string') fail(`finding ${finding.fingerprint} lacks normalized policy inputs.`);
+  const ruleId = ruleIdOf(finding);
+  const trustedRule = catalog.rules?.[ruleId];
+  return {
+    fingerprint: finding.fingerprint,
+    severity: finding.severity,
+    category: finding.category,
+    confidence: finding.confidence,
+    status: finding.status === 'accepted' ? 'accepted' : 'open',
+    ruleId,
+    cweIds: cweIdsOf(finding, ruleId, catalog),
+    location: locationOf(finding.location, finding.fingerprint),
+    packageRef: packageRefOf(finding.location),
+    advisoryIds: advisoryIdsOf(finding),
+    attributionIds: trustedRule ? [...trustedRule.attributionIds] : [],
+    policyInputs: {
+      knownExploited: finding.exploited.kev,
+      fixAvailable: finding.fix.trim().length > 0,
+    },
+  };
+}
+
+/** Produces the strict semantic 1.1 publication DTO from one retained VSG run. */
+export function exportLatticeReport({ repo, outDir, runId, mode, artifactRoot, repositoryIdentity }) {
+  repo = fs.realpathSync(path.resolve(repo));
+  outDir = path.resolve(outDir);
+  if (!UUID.test(runId ?? '')) fail('runId must be a UUID.');
+  if (!MODES.includes(mode)) fail('mode is unsupported.');
+  repositoryIdentity = validateRepositoryIdentity(repositoryIdentity);
+  const artifact = readLatticeArtifact({ artifactRoot });
+  const catalog = readJson(path.join(artifactRoot, 'lattice-catalog.json'), 'lattice-catalog.json');
+  const findingsDoc = readJson(path.join(outDir, 'findings.json'), 'findings.json');
+  const coverageDoc = readJson(path.join(outDir, 'coverage.json'), 'coverage.json');
+  if (!Array.isArray(findingsDoc.findings) || !Array.isArray(findingsDoc.checks) || !Array.isArray(coverageDoc.checks)) fail('retained output is not a complete VSG run.');
+  if (findingsDoc.findings.length > 5_000 || findingsDoc.checks.length > 100) fail('retained output exceeds the report collection limits.');
+  if (canonical(findingsDoc.checks) !== canonical(coverageDoc.checks)) fail('findings and coverage check evidence does not match.');
+  if (canonical(findingsDoc.sourceSnapshot) !== canonical(coverageDoc.sourceSnapshot)) fail('findings and coverage source evidence was tampered with.');
+  if (canonical(findingsDoc.runtimeSnapshot) !== canonical(coverageDoc.runtimeSnapshot)) fail('findings and coverage runtime evidence was tampered with.');
+  const source = validateSnapshot(findingsDoc.sourceSnapshot);
+  validateRuntimeSnapshot(findingsDoc.runtimeSnapshot, artifact, path.resolve(artifactRoot));
+  if (findingsDoc.vsgVersion !== artifact.identity.vsgVersion) fail('originating VSG version does not match the supplied artifact.');
+  if (path.resolve(source.repo) !== repo) fail('retained evidence belongs to a different repository.', 'source_changed');
+  const current = captureReviewContext(repo, source.runId, outDir);
+  if (canonical(current) !== canonical(source)) fail('retained evidence is stale for the current repository source.', 'source_changed');
+
+  let auditMode;
+  if (mode === 'report') {
+    if (!['deep', 'release'].includes(findingsDoc.mode)) fail('report publication must retain a deep or release parent audit mode.');
+    auditMode = findingsDoc.mode;
+  } else {
+    if (findingsDoc.mode !== mode) fail('requested mode does not match the originating audit mode.');
+    auditMode = mode;
+  }
+  const startedAt = findingsDoc.startedAt;
+  const completedAt = findingsDoc.finishedAt;
+  if (typeof startedAt !== 'string' || typeof completedAt !== 'string' || Number.isNaN(Date.parse(startedAt)) || Number.isNaN(Date.parse(completedAt)) || new Date(startedAt).toISOString() !== startedAt || new Date(completedAt).toISOString() !== completedAt) fail('run timestamps are missing or invalid.');
+  const checks = findingsDoc.checks.map(normalizedCheck);
+  if (new Set(checks.map((check) => check.id)).size !== checks.length) fail('duplicate check ids are forbidden.');
+  const findings = findingsDoc.findings.map((finding, index) => normalizedFinding(finding, index, catalog));
+  if (new Set(findings.map((finding) => finding.fingerprint)).size !== findings.length) fail('duplicate finding fingerprints are forbidden.');
+  return {
+    schemaVersion: '1.1',
+    runId,
+    mode,
+    auditMode,
+    startedAt,
+    completedAt,
+    source: {
+      repositoryIdentity,
+      commitSha: source.commitSha,
+      contentHash: source.sourceHash,
+      dirty: source.dirty,
+    },
+    runtime: artifact.identity,
+    checks,
+    findings,
+  };
+}

package/dist/security-runtime/src/lattice/provenance.mjs

@@ -0,0 +1,70 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { readLatticeArtifact } from './artifact.mjs';
+
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+
+function hashTree(root) {
+  const hash = crypto.createHash('sha256');
+  const walk = (dir, rel = '') => {
+    if (!fs.existsSync(dir)) return;
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+      const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+      const child = path.join(dir, entry.name);
+      const stat = fs.lstatSync(child);
+      if (stat.isSymbolicLink()) throw new Error(`Runtime provenance rejected linked path ${childRel}.`);
+      if (entry.isDirectory()) walk(child, childRel);
+      else if (entry.isFile()) {
+        hash.update(childRel);
+        hash.update('\0');
+        hash.update(fs.readFileSync(child));
+        hash.update('\0');
+      }
+    }
+  };
+  walk(root);
+  return hash.digest('hex');
+}
+
+function fileDigest(file) {
+  return fs.existsSync(file) && fs.statSync(file).isFile() ? sha256(fs.readFileSync(file)) : null;
+}
+
+/** Captures the immutable VSG package that is actually executing the scan. */
+export function captureRuntimeProvenance({ runtimeRoot, entrypoint = process.argv[1] }) {
+  runtimeRoot = fs.realpathSync(path.resolve(runtimeRoot));
+  const manifestPath = path.join(runtimeRoot, 'artifact-manifest.json');
+  const packageJson = JSON.parse(fs.readFileSync(path.join(runtimeRoot, 'package.json'), 'utf8'));
+  if (fs.existsSync(manifestPath)) {
+    const manifest = readLatticeArtifact({ artifactRoot: runtimeRoot });
+    const expectedEntrypoint = fs.realpathSync(path.join(runtimeRoot, ...manifest.entryPoint.split('/')));
+    let actualEntrypoint;
+    try { actualEntrypoint = fs.realpathSync(path.resolve(entrypoint)); } catch { throw new Error('Lattice runtime provenance requires its exact verified artifact entrypoint.'); }
+    if (actualEntrypoint !== expectedEntrypoint) throw new Error('Lattice runtime provenance requires its exact verified artifact entrypoint.');
+    return {
+      schemaVersion: 1,
+      kind: 'lattice-artifact',
+      vsgVersion: manifest.identity.vsgVersion,
+      entrypointSha256: fileDigest(expectedEntrypoint),
+      rulesDigest: manifest.identity.rulesDigest,
+      registryDigest: manifest.identity.registryDigest,
+      commercialManifestDigest: manifest.identity.commercialManifestDigest,
+      artifactManifestSha256: sha256(fs.readFileSync(manifestPath)),
+      artifactIdentity: manifest.identity,
+      artifactSourceCommit: manifest.sourceCommit,
+    };
+  }
+  return {
+    schemaVersion: 1,
+    kind: 'source-checkout',
+    vsgVersion: packageJson.version,
+    entrypointSha256: fileDigest(path.join(runtimeRoot, 'bin', 'vsg.mjs')),
+    rulesDigest: hashTree(path.join(runtimeRoot, 'rules')),
+    registryDigest: hashTree(path.join(runtimeRoot, 'tools', 'registry')),
+    commercialManifestDigest: fileDigest(path.join(runtimeRoot, 'licensing', 'commercial-components.json')),
+    artifactManifestSha256: null,
+    artifactIdentity: null,
+    artifactSourceCommit: null,
+  };
+}

package/dist/security-runtime/src/lattice/runtime.mjs

@@ -0,0 +1,158 @@
+import crypto from 'node:crypto';
+import { applyPolicy, requiredFor } from '../core/gate.mjs';
+import { CATEGORIES, CONFIDENCES, SEVERITIES } from '../core/findings.mjs';
+
+const STATUSES = ['open', 'accepted'];
+const POLICY_CONFIDENCES = [...CONFIDENCES, 'unknown'];
+const AUDIT_MODES = ['scan', 'deep', 'release'];
+const FIXED_DETECTION = { workflows: ['.github/workflows'], lockfiles: ['package-lock.json'], supabase: true };
+
+const canonical = (value) => {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(',')}}`;
+};
+
+const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
+
+function blockingTable() {
+  const table = {};
+  for (const category of CATEGORIES) {
+    for (const severity of SEVERITIES) {
+      for (const confidence of POLICY_CONFIDENCES) {
+        for (const status of STATUSES) {
+          for (const knownExploited of [false, true]) {
+            for (const fixAvailable of [false, true]) {
+              const finding = {
+                category, severity, confidence, status,
+                exploited: { kev: knownExploited },
+                fix: fixAvailable ? 'available' : '',
+                blocking: false,
+                blockReason: '',
+              };
+              applyPolicy([finding]);
+              if (finding.blocking) {
+                table[[category, severity, confidence, status, Number(knownExploited), Number(fixAvailable)].join('|')] = finding.blockReason;
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  return table;
+}
+
+function requiredProfiles() {
+  return Object.fromEntries(AUDIT_MODES.map((mode) => [
+    mode,
+    requiredFor(mode, FIXED_DETECTION, { config: { requiredChecks: { remove: [] } } }).required,
+  ]));
+}
+
+/** Builds the dependency-free object-expression module loaded by the Lattice website. */
+export function buildLatticeRuntimeSource({ identity, catalog, releaseEligibility }) {
+  const policy = blockingTable();
+  const profiles = requiredProfiles();
+  const evaluatorMaterial = { policy, profiles, severities: SEVERITIES };
+  const evaluatorDigest = sha256(canonical(evaluatorMaterial));
+  const catalogDigest = sha256(canonical(catalog));
+  const manifest = {
+    format: 'lattice-security-runtime-v1',
+    ...identity,
+    evaluatorDigest,
+    catalogDigest,
+    releaseEligibility,
+  };
+  const source = `export default ${`{manifest: ${JSON.stringify(manifest)},
+  evaluate(report) {
+    const policy = ${JSON.stringify(policy)};
+    const profiles = ${JSON.stringify(profiles)};
+    const severities = ${JSON.stringify(SEVERITIES)};
+    if (!report || typeof report !== 'object' || !Array.isArray(report.findings) || !Array.isArray(report.checks)) throw new Error('Invalid security report.');
+    const auditMode = report.mode === 'report' ? report.auditMode : report.mode;
+    const required = profiles[auditMode];
+    if (!required) throw new Error('Unsupported audit mode.');
+    const checks = new Map(report.checks.map((check) => [check.id, check]));
+    const missingRequiredChecks = required.filter((id) => {
+      const status = checks.get(id)?.status;
+      return status !== 'ran' && status !== 'not_applicable';
+    }).length;
+    const counts = Object.fromEntries(severities.map((severity) => [severity, 0]));
+    let blocking = 0;
+    for (const finding of report.findings) {
+      if (!severities.includes(finding.severity)) throw new Error('Unsupported finding severity.');
+      counts[finding.severity]++;
+      const inputs = finding.policyInputs;
+      if (!inputs || typeof inputs.knownExploited !== 'boolean' || typeof inputs.fixAvailable !== 'boolean') throw new Error('Missing finding policy inputs.');
+      const key = [finding.category, finding.severity, finding.confidence, finding.status, Number(inputs.knownExploited), Number(inputs.fixAvailable)].join('|');
+      if (policy[key]) blocking++;
+    }
+    const verdict = blocking > 0 ? 'BLOCKED' : missingRequiredChecks > 0 ? 'INCOMPLETE' : 'PASS';
+    const coverageCodes = [...new Set(report.checks.flatMap((check) => Array.isArray(check.coverageCodes) ? check.coverageCodes : []))].sort();
+    return {
+      verdict,
+      counts: {
+        ...counts,
+        requiredChecks: required.length,
+        completedRequiredChecks: required.length - missingRequiredChecks,
+        missingRequiredChecks,
+      },
+      coverageCodes,
+      evaluatorDigest: ${JSON.stringify(evaluatorDigest)},
+      catalogDigest: ${JSON.stringify(catalogDigest)},
+    };
+  },
+  present(report, baseline) {
+    const catalog = ${JSON.stringify(catalog)};
+    const profiles = ${JSON.stringify(profiles)};
+    const ruleIds = [...new Set(report.findings.map((finding) => finding.ruleId))];
+    const trustedId = (id) => {
+      if (catalog.rules[id]) return id;
+      const selectedYara = /^forge[0-9]+:([A-Za-z0-9_]+)$/.exec(id);
+      return selectedYara && catalog.rules[selectedYara[1]] ? selectedYara[1] : null;
+    };
+    const resolvedRuleIds = ruleIds.map((id) => [id, trustedId(id)]);
+    for (const [, id] of resolvedRuleIds) if (!id) throw new Error('Missing trusted rule presentation.');
+    const rules = resolvedRuleIds.map(([reportRuleId, id]) => ({
+      ...catalog.rules[id],
+      ruleId: reportRuleId,
+      reportRuleId,
+      catalogRuleId: id,
+    }));
+    const attributionIds = [...new Set([
+      ...report.findings.flatMap((finding) => finding.attributionIds || []),
+      ...rules.flatMap((rule) => rule.attributionIds || []),
+    ])];
+    for (const id of attributionIds) if (!catalog.credits[id]) throw new Error('Missing trusted attribution credit.');
+    const credits = attributionIds.map((id) => catalog.credits[id]);
+    let comparison = null;
+    if (baseline) {
+      const reasons = [];
+      if (report.source?.dirty || baseline.source?.dirty) reasons.push('dirty_source');
+      const missing = (value) => {
+        const auditMode = value.mode === 'report' ? value.auditMode : value.mode;
+        const checks = new Map(value.checks.map((check) => [check.id, check.status]));
+        return !profiles[auditMode] || profiles[auditMode].some((id) => !['ran', 'not_applicable'].includes(checks.get(id)));
+      };
+      if (missing(report) || missing(baseline)) reasons.push('incomplete_checks');
+      if (report.runtime?.profileId !== baseline.runtime?.profileId || report.runtime?.profileVersion !== baseline.runtime?.profileVersion) reasons.push('profile_changed');
+      if (JSON.stringify(report.runtime) !== JSON.stringify(baseline.runtime)) reasons.push('runtime_identity_changed');
+      if (report.source?.repositoryIdentity !== baseline.source?.repositoryIdentity) reasons.push('source_identity_changed');
+      const current = new Set(report.findings.map((finding) => finding.fingerprint));
+      const prior = new Set(baseline.findings.map((finding) => finding.fingerprint));
+      comparison = {
+        baselineRunId: baseline.runId,
+        currentRunId: report.runId,
+        comparable: reasons.length === 0,
+        unverifiedReasons: [...new Set(reasons)],
+        fixedFindingFingerprints: [...prior].filter((id) => !current.has(id)).sort(),
+        newFindingFingerprints: [...current].filter((id) => !prior.has(id)).sort(),
+        persistentFindingFingerprints: [...current].filter((id) => prior.has(id)).sort(),
+      };
+    }
+    return { rules, credits, comparison };
+  },
+}`};\n`;
+  return { source, manifest, evaluatorDigest, catalogDigest };
+}