@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/src/lattice/selected-runtime.mjs

@@ -0,0 +1,189 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { UsageError } from '../core/errors.mjs';
+import { packageRoot } from '../core/paths.mjs';
+import { readLatticeArtifact } from './artifact.mjs';
+
+const SHA256 = /^[0-9a-f]{64}$/;
+const CANDIDATE_DECISIONS = new Set(['candidate-attribution', 'candidate-attribution-sharealike', 'candidate-explicit-apache']);
+const FALLBACK_POLICY = Object.freeze({
+  semgrepRules: 'forbidden',
+  yaraForgeMixedPack: 'forbidden',
+  yaraExtraRules: 'forbidden',
+});
+const FIXED = Object.freeze({
+  sastCommit: '53bf5cf6df3c51b6c02110f5a638b5e6213666cd',
+  sastArchiveSha256: '32b51522401d1a19e2f68277235eef1f31ddd3560ae54343b6a6a78c4d2fbb23',
+  sastRuleIdsSha256: '338143b7ac9e7bfd90f432b7aec070aa710584eaecfeb6174339a8852e1ae611',
+  sastFilesManifestSha256: '1168e04dffc4e25f2983c15619ca2f3711fd85673f232bb3fc5794e27594b389',
+  yaraArchiveSha256: '16180800cc2f077638d2e13a33bd68609d0b6eedd1fbfdbae6d5d4a1c53f826f',
+  yaraSelectionDigest: '33aa825b1f9c843e7129f26b5b57e85d6121562cdeb577e40aef9360601585f6',
+  yaraHoldDigest: '22150df654bf4396c085336f1c00f8d0483cdc61713a81db32a115c586ef98e2',
+});
+
+const canonical = (value) => {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(',')}}`;
+};
+const sha256 = (value) => crypto.createHash('sha256').update(value).digest('hex');
+const fail = (message) => { throw new UsageError(`[selected_runtime_unavailable] ${message}`); };
+
+function readJson(file, label) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch (error) { fail(`${label} is missing or invalid (${error.message}).`); }
+}
+
+function safeRelative(value) {
+  if (typeof value !== 'string' || !value || value.includes('\\') || path.posix.isAbsolute(value)) return false;
+  const parts = value.split('/');
+  return parts.every((part) => part && part !== '.' && part !== '..');
+}
+
+function manifestFile(ref, manifest, artifactRoot, label) {
+  if (!ref || typeof ref !== 'object' || !safeRelative(ref.path) || !SHA256.test(ref.sha256 ?? '') || !Number.isSafeInteger(ref.bytes) || ref.bytes < 0) {
+    fail(`${label} must contain a safe manifest path, SHA-256, and byte count.`);
+  }
+  const item = manifest.files?.find((candidate) => candidate?.path === ref.path);
+  if (!item || item.sha256 !== ref.sha256 || item.bytes !== ref.bytes) fail(`${label} does not match a declared artifact file.`);
+  const file = path.join(artifactRoot, ...ref.path.split('/'));
+  let stat;
+  try { stat = fs.lstatSync(file); } catch (error) { fail(`${label} cannot be read (${error.message}).`); }
+  if (!stat.isFile() || stat.isSymbolicLink()) fail(`${label} is not a regular file.`);
+  const bytes = fs.readFileSync(file);
+  if (bytes.byteLength !== ref.bytes || sha256(bytes) !== ref.sha256) fail(`${label} was tampered with.`);
+  return { ref: Object.freeze({ path: ref.path, sha256: ref.sha256, bytes: ref.bytes }), value: readJson(file, label) };
+}
+
+function archiveSource(value, expected, label) {
+  if (!value || value.mode !== 'archive' || value.url !== expected.url || value.sha256 !== expected.sha256 || value.maxBytes !== expected.maxBytes) {
+    fail(`${label} does not match the fixed upstream acquisition contract.`);
+  }
+  return Object.freeze({ mode: 'archive', url: value.url, sha256: value.sha256, maxBytes: value.maxBytes });
+}
+
+function normalizedYaraRule(rule) {
+  return {
+    rule: rule.rule,
+    blockSha256: rule.blockSha256,
+    author: rule.author,
+    sourceUrl: rule.sourceUrl,
+    candidateLicense: rule.candidateLicense,
+    decision: rule.decision,
+    licenseMetadata: rule.licenseMetadata,
+  };
+}
+
+/** Validates the metadata-only selectedRuntime contract against an already verified artifact. */
+export function validateSelectedRuntime({ catalog, manifest, artifactRoot }) {
+  const selected = catalog?.selectedRuntime;
+  if (!selected || selected.schemaVersion !== 2) fail('catalog.selectedRuntime is missing or unsupported.');
+  if (canonical(selected.fallback) !== canonical(FALLBACK_POLICY)) fail('selectedRuntime fallback policy is not the fixed refusal policy.');
+  const coverage = manifestFile(selected.coverage, manifest, artifactRoot, 'selectedRuntime.coverage');
+  if (coverage.value.status !== 'real-selected-runtime-coverage-evidence-not-release-clearance'
+    || coverage.value.sast?.boundedCoveragePassed !== true || coverage.value.yara?.boundedCoveragePassed !== true
+    || coverage.value.coverageDecision?.status !== 'approved-for-protected-test-qualification'
+    || coverage.value.coverageDecision?.publicCommercialReleaseApproved !== false
+    || coverage.value.coverageDecision?.checkoutApproved !== false) {
+    fail('selectedRuntime coverage evidence does not match the protected-test qualification boundary.');
+  }
+
+  const sastEvidence = manifestFile(selected.sast?.sourceEvidence, manifest, artifactRoot, 'selectedRuntime.sast.sourceEvidence');
+  const sastIdentities = manifestFile(selected.sast?.identities, manifest, artifactRoot, 'selectedRuntime.sast.identities');
+  const evidence = sastEvidence.value;
+  const identities = sastIdentities.value;
+  if (evidence.sourceCommit !== FIXED.sastCommit || evidence.sourceArchiveSha256 !== FIXED.sastArchiveSha256
+    || evidence.selectedRules !== 161 || !Array.isArray(evidence.files) || evidence.files.length !== 163
+    || evidence.files.filter((item) => /\.ya?ml$/i.test(item.path ?? '')).length !== 161) {
+    fail('selectedRuntime SAST evidence does not match the fixed 161-rule source manifest.');
+  }
+  if (identities.sourceCommit !== FIXED.sastCommit || identities.ruleCount !== 161 || identities.sourceFiles !== 161
+    || identities.ruleIdsSha256 !== FIXED.sastRuleIdsSha256 || !Array.isArray(identities.ruleIds)
+    || identities.ruleIds.length !== 161 || sha256(JSON.stringify(identities.ruleIds)) !== FIXED.sastRuleIdsSha256) {
+    fail('selectedRuntime SAST identities do not match the fixed rule catalog.');
+  }
+  const sortedSastIds = [...identities.ruleIds].sort();
+  if (new Set(sortedSastIds).size !== 161 || JSON.stringify(sortedSastIds) !== JSON.stringify(identities.ruleIds)) {
+    fail('selectedRuntime SAST identities must be unique and deterministically sorted.');
+  }
+  const sastSourceFiles = evidence.files.map((item) => ({ path: item.path, url: item.sourceUrl, sha256: item.sha256, bytes: item.bytes }));
+  const sastTotalBytes = sastSourceFiles.reduce((sum, item) => sum + item.bytes, 0);
+  const sastContract = selected.sast?.source;
+  if (!sastContract || sastContract.mode !== 'files' || sastContract.sourceCommit !== FIXED.sastCommit
+    || sastContract.files !== 163 || sastContract.totalBytes !== 398399 || sastContract.maxBytes !== 1024 * 1024
+    || sastContract.manifestSha256 !== FIXED.sastFilesManifestSha256
+    || sha256(JSON.stringify(sastSourceFiles)) !== FIXED.sastFilesManifestSha256 || sastTotalBytes !== sastContract.totalBytes) {
+    fail('selectedRuntime SAST source files do not match the fixed upstream acquisition contract.');
+  }
+  for (const item of sastSourceFiles) {
+    if (!safeRelative(item.path) || !/^https:\/\/gitlab\.com\//.test(item.url ?? '') || !SHA256.test(item.sha256 ?? '')
+      || !Number.isSafeInteger(item.bytes) || item.bytes <= 0) fail('selectedRuntime SAST source file contract is invalid.');
+  }
+  const sastSource = Object.freeze({
+    mode: 'files', sourceCommit: FIXED.sastCommit, files: Object.freeze(sastSourceFiles.map((item) => Object.freeze(item))),
+    fileCount: 163, totalBytes: sastTotalBytes, manifestSha256: FIXED.sastFilesManifestSha256, maxBytes: 1024 * 1024,
+  });
+
+  const yaraInventory = manifestFile(selected.yara?.inventory, manifest, artifactRoot, 'selectedRuntime.yara.inventory');
+  const yaraSource = archiveSource(selected.yara?.source, {
+    mode: 'archive',
+    url: 'https://github.com/YARAHQ/yara-forge/releases/download/20260927/yara-forge-rules-core.zip',
+    sha256: FIXED.yaraArchiveSha256,
+    maxBytes: 16 * 1024 * 1024,
+  }, 'selectedRuntime.yara.source');
+  const inventory = yaraInventory.value;
+  if (inventory.archiveVersion !== '20260927' || inventory.archiveSha256 !== FIXED.yaraArchiveSha256
+    || inventory.totalRules !== 5110 || !Array.isArray(inventory.rules) || inventory.rules.length !== 5110) {
+    fail('selectedRuntime YARA inventory does not match the fixed source identity.');
+  }
+  const selectedRules = inventory.rules.filter((rule) => CANDIDATE_DECISIONS.has(rule.decision)).map(normalizedYaraRule).sort((a, b) => a.rule.localeCompare(b.rule));
+  const heldRules = inventory.rules.filter((rule) => !CANDIDATE_DECISIONS.has(rule.decision)).map(normalizedYaraRule).sort((a, b) => a.rule.localeCompare(b.rule));
+  if (selectedRules.length !== 4536 || heldRules.length !== 574
+    || sha256(canonical(selectedRules)) !== FIXED.yaraSelectionDigest || sha256(canonical(heldRules)) !== FIXED.yaraHoldDigest
+    || selected.yara.selectionDigest !== FIXED.yaraSelectionDigest || selected.yara.holdDigest !== FIXED.yaraHoldDigest) {
+    fail('selectedRuntime YARA selection or hold identity changed.');
+  }
+  const yaraRuleIds = selectedRules.map((rule) => rule.rule);
+  if (new Set(yaraRuleIds).size !== yaraRuleIds.length) fail('selectedRuntime YARA identities are not unique.');
+  const excludedRules = Object.freeze(heldRules.map((rule) => Object.freeze({ rule: rule.rule, reason: `frozen selection hold: ${rule.decision}` })));
+
+  return Object.freeze({
+    schemaVersion: 2,
+    fallback: FALLBACK_POLICY,
+    coverage: coverage.ref,
+    sast: Object.freeze({
+      source: sastSource,
+      sourceEvidence: sastEvidence.ref,
+      identities: sastIdentities.ref,
+      sourceFiles: sastSource.files,
+      selectedRuleIds: Object.freeze(identities.ruleIds),
+      ruleIdsSha256: FIXED.sastRuleIdsSha256,
+      rulesRoots: Object.freeze(['javascript', 'python', 'rules/lgpl/javascript']),
+    }),
+    yara: Object.freeze({
+      source: yaraSource,
+      inventory: yaraInventory.ref,
+      selectedRuleIds: Object.freeze(yaraRuleIds),
+      excludedRules,
+      selectionDigest: FIXED.yaraSelectionDigest,
+      holdDigest: FIXED.yaraHoldDigest,
+    }),
+  });
+}
+
+/** Loads the selected runtime only for an identifiable, fully verified artifact. */
+export function loadSelectedRuntime({ runtimeRoot = packageRoot } = {}) {
+  runtimeRoot = fs.realpathSync(path.resolve(runtimeRoot));
+  const manifestPath = path.join(runtimeRoot, 'artifact-manifest.json');
+  const catalogPath = path.join(runtimeRoot, 'lattice-catalog.json');
+  const hasManifest = fs.existsSync(manifestPath);
+  const hasCatalog = fs.existsSync(catalogPath);
+  if (!hasManifest && !hasCatalog) return null;
+  if (!hasManifest || !hasCatalog) fail('artifact-manifest.json and lattice-catalog.json must be present together.');
+  const verifiedManifest = readLatticeArtifact({ artifactRoot: runtimeRoot });
+  const catalog = readJson(catalogPath, 'lattice-catalog.json');
+  const selectedRuntime = validateSelectedRuntime({ catalog, manifest: verifiedManifest, artifactRoot: runtimeRoot });
+  return Object.freeze({ kind: 'lattice-artifact', root: runtimeRoot, catalogDigest: verifiedManifest.identity.catalogDigest, selectedRuntime });
+}
+
+export { FALLBACK_POLICY };

package/dist/security-runtime/src/lattice/source-acquirer.mjs

@@ -0,0 +1,51 @@
+import crypto from 'node:crypto';
+import path from 'node:path';
+import { packageRoot } from '../core/paths.mjs';
+
+const FETCHER = path.join(packageRoot, 'src', 'lattice', 'source-fetcher.mjs');
+const VOLUME = /^vsg-selected-[a-z0-9-]{1,80}$/;
+const lastJson = (stdout) => {
+  for (const line of String(stdout).split('\n').reverse()) {
+    if (!line.startsWith('{')) continue;
+    try { return JSON.parse(line); } catch { /* keep looking */ }
+  }
+  return null;
+};
+
+/** Downloads one fixed public source archive into a disposable Docker volume, uses it offline, then removes the volume. */
+export async function withTransientDockerSource(ctx, { image, source, label }, use) {
+  if (!image || !source || typeof use !== 'function') throw new Error('Selected-source acquisition inputs are incomplete.');
+  const suffix = crypto.randomBytes(6).toString('hex');
+  const safeLabel = String(label ?? 'rules').toLowerCase().replace(/[^a-z0-9-]/g, '-').replace(/^-+|-+$/g, '').slice(0, 24) || 'rules';
+  const volume = `vsg-selected-${safeLabel}-${process.pid}-${suffix}`;
+  if (!VOLUME.test(volume)) throw new Error('Selected-source volume name is invalid.');
+  const created = await ctx.runProcess({ command: 'docker', args: ['volume', 'create', volume], timeoutMs: 30_000 });
+  if (created.status !== 'ran' || created.exitCode !== 0 || created.stdout.trim() !== volume) {
+    throw new Error('Docker could not create the disposable selected-source volume.');
+  }
+  try {
+    const acquired = await ctx.runProcess({
+      command: 'docker',
+      args: [
+        'run', '--pull', 'never', '--rm', '--init', '-i', '--network', 'bridge', '--read-only',
+        '--tmpfs', '/tmp:rw,nosuid,nodev,size=64m', '--memory', '512m', '--cpus', '1', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges',
+        '-v', `${FETCHER}:/vsg/source-fetcher.mjs:ro`, '-v', `${volume}:/asset`,
+        image, 'node', '/vsg/source-fetcher.mjs',
+      ],
+      input: JSON.stringify(source), timeoutMs: 180_000, maxOutputBytes: 1024 * 1024,
+    });
+    const receipt = acquired.status === 'ran' ? lastJson(acquired.stdout) : null;
+    const identityMatches = source.mode === 'files'
+      ? receipt?.mode === 'files' && receipt.manifestSha256 === source.manifestSha256 && receipt.files === source.fileCount && receipt.bytes === source.totalBytes
+      : receipt?.mode === 'archive' && receipt.sha256 === source.sha256;
+    if (acquired.status !== 'ran' || acquired.exitCode !== 0 || !receipt?.ok || !identityMatches || !Number.isSafeInteger(receipt.bytes)) {
+      throw new Error(`Selected-source acquisition failed${receipt?.error ? `: ${receipt.error}` : '.'}`);
+    }
+    return await use({ volume, path: source.mode === 'files' ? '/vsg/selected-source/files' : '/vsg/selected-source/source.bin', receipt });
+  } finally {
+    const removed = await ctx.runProcess({ command: 'docker', args: ['volume', 'rm', '-f', volume], timeoutMs: 30_000 });
+    if (removed.status !== 'ran' || removed.exitCode !== 0) {
+      throw new Error('Docker could not remove the disposable selected-source volume.');
+    }
+  }
+}

package/dist/security-runtime/src/lattice/source-fetcher.mjs

@@ -0,0 +1,88 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+if (process.platform !== 'linux') throw new Error('The selected-source fetcher runs only inside Linux.');
+
+const SHA256 = /^[0-9a-f]{64}$/;
+const sha256 = (bytes) => crypto.createHash('sha256').update(bytes).digest('hex');
+
+function safeRelative(value) {
+  return typeof value === 'string' && value.length > 0 && !value.includes('\\') && !path.posix.isAbsolute(value)
+    && value.split('/').every((part) => part && part !== '.' && part !== '..');
+}
+
+async function fetchBytes(url, maxBytes) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 120_000);
+  let response;
+  try {
+    response = await fetch(url, { redirect: 'follow', signal: controller.signal, headers: { 'user-agent': 'Vibe-Security-Gate/selected-runtime', accept: 'application/octet-stream' } });
+  } finally {
+    clearTimeout(timer);
+  }
+  if (!response.ok) throw new Error(`Selected-source request failed with HTTP ${response.status}.`);
+  const declared = Number(response.headers.get('content-length'));
+  if (Number.isFinite(declared) && declared > maxBytes) throw new Error('Selected-source response exceeds the fixed size bound.');
+  const bytes = Buffer.from(await response.arrayBuffer());
+  if (bytes.byteLength < 1 || bytes.byteLength > maxBytes) throw new Error('Selected-source response size is outside the fixed bound.');
+  return bytes;
+}
+
+async function main() {
+  const input = JSON.parse(fs.readFileSync(0, 'utf8') || '{}');
+  if (!Number.isSafeInteger(input.maxBytes) || input.maxBytes < 1 || input.maxBytes > 256 * 1024 * 1024) {
+    throw new Error('Selected-source acquisition contract is invalid.');
+  }
+  if (input.mode === 'files') {
+    if (!Array.isArray(input.files) || input.files.length < 1 || input.files.length > 1000 || !SHA256.test(input.manifestSha256 ?? '')) {
+      throw new Error('Selected-source file manifest is invalid.');
+    }
+    const normalized = [];
+    const names = new Set();
+    let expectedTotal = 0;
+    for (const item of input.files) {
+      if (!item || !safeRelative(item.path) || names.has(item.path.toLowerCase()) || !/^https:\/\//.test(item.url ?? '')
+        || !SHA256.test(item.sha256 ?? '') || !Number.isSafeInteger(item.bytes) || item.bytes < 1) {
+        throw new Error('Selected-source file entry is invalid or duplicated.');
+      }
+      names.add(item.path.toLowerCase());
+      expectedTotal += item.bytes;
+      normalized.push({ path: item.path, url: item.url, sha256: item.sha256, bytes: item.bytes });
+    }
+    if (expectedTotal !== input.totalBytes || expectedTotal > input.maxBytes || sha256(JSON.stringify(normalized)) !== input.manifestSha256) {
+      throw new Error('Selected-source file manifest identity is invalid.');
+    }
+    const root = '/asset/files';
+    fs.mkdirSync(root, { recursive: true, mode: 0o700 });
+    let received = 0;
+    for (let offset = 0; offset < normalized.length; offset += 8) {
+      const batch = normalized.slice(offset, offset + 8);
+      const results = await Promise.all(batch.map(async (item) => {
+        const bytes = await fetchBytes(item.url, item.bytes);
+        if (bytes.byteLength !== item.bytes || sha256(bytes) !== item.sha256) throw new Error(`Selected-source file changed: ${item.path}.`);
+        return { item, bytes };
+      }));
+      for (const { item, bytes } of results) {
+        const destination = path.join(root, ...item.path.split('/'));
+        fs.mkdirSync(path.dirname(destination), { recursive: true, mode: 0o700 });
+        fs.writeFileSync(destination, bytes, { flag: 'wx', mode: 0o600 });
+        received += bytes.byteLength;
+      }
+    }
+    process.stdout.write(`${JSON.stringify({ ok: true, mode: 'files', manifestSha256: input.manifestSha256, files: normalized.length, bytes: received })}\n`);
+    return;
+  }
+  if (input.mode !== 'archive' || !/^https:\/\//.test(input.url ?? '') || !SHA256.test(input.sha256 ?? '')) {
+    throw new Error('Selected-source archive contract is invalid.');
+  }
+  const bytes = await fetchBytes(input.url, input.maxBytes);
+  if (sha256(bytes) !== input.sha256) throw new Error('Selected-source response SHA-256 does not match the fixed contract.');
+  fs.writeFileSync('/asset/source.bin', bytes, { flag: 'wx', mode: 0o600 });
+  process.stdout.write(`${JSON.stringify({ ok: true, mode: 'archive', sha256: input.sha256, bytes: bytes.byteLength })}\n`);
+}
+
+main().catch((error) => {
+  process.stdout.write(`${JSON.stringify({ ok: false, error: error.message })}\n`);
+  process.exitCode = 1;
+});

package/dist/security-runtime/src/lattice/transport.mjs

@@ -0,0 +1,232 @@
+const SCHEMA_VERSION = '1.1';
+const TRANSPORT_VERSION = '3.0';
+const ONE_MIB = 1_048_576;
+const TWO_MIB = 2_097_152;
+const MAX_FINDINGS = 5_000;
+const MAX_CHECKS = 100;
+const REPORT_KEYS = ['schemaVersion', 'runId', 'mode', 'auditMode', 'startedAt', 'completedAt', 'source', 'runtime', 'checks', 'findings'];
+const SOURCE_KEYS = ['repositoryIdentity', 'commitSha', 'contentHash', 'dirty'];
+const RUNTIME_KEYS = ['vsgVersion', 'profileId', 'profileVersion', 'rulesDigest', 'registryDigest', 'commercialManifestDigest', 'evaluatorDigest', 'catalogDigest'];
+const CHECK_KEYS = ['id', 'status', 'required', 'coverageCodes', 'attributionIds'];
+const FINDING_KEYS = ['fingerprint', 'severity', 'category', 'confidence', 'status', 'ruleId', 'cweIds', 'location', 'packageRef', 'advisoryIds', 'attributionIds', 'policyInputs'];
+const LOCATION_KEYS = ['path', 'line', 'column'];
+const POLICY_KEYS = ['knownExploited', 'fixAvailable'];
+const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+const CONFIDENCES = ['high', 'medium', 'low', 'unknown', 'confirmed'];
+const FINDING_STATUSES = ['open', 'accepted'];
+const CHECK_STATUSES = ['ran', 'missing', 'skipped', 'failed', 'not_applicable'];
+const MODES = ['scan', 'deep', 'release', 'report'];
+const AUDIT_MODES = ['scan', 'deep', 'release'];
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const SHA256 = /^[0-9a-f]{64}$/;
+const COMMIT_SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:/@+-]{0,159}$/;
+const SAFE_VERSION = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,79}$/;
+const CWE = /^CWE-[1-9][0-9]{0,5}$/;
+const encoder = new TextEncoder();
+
+export class LatticeTransportError extends Error {
+  constructor(path, message, code = 'invalid_request') {
+    super(`${path}: ${message}`);
+    this.name = 'LatticeTransportError';
+    this.path = path;
+    this.code = code;
+  }
+}
+
+const fail = (path, message, code) => { throw new LatticeTransportError(path, message, code); };
+
+function object(value, path, keys) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) fail(path, 'must be an object');
+  const own = Object.keys(value);
+  const missing = keys.find((key) => !own.includes(key));
+  if (missing) fail(`${path}.${missing}`, 'is required');
+  const extra = own.find((key) => !keys.includes(key));
+  if (extra) fail(`${path}.${extra}`, 'field is not allowed');
+  return value;
+}
+
+function string(value, path, max = 256) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > max || /[\u0000-\u001f\u007f]/.test(value)) fail(path, `must be a non-empty string of at most ${max} characters`);
+  return value;
+}
+
+function enumValue(value, path, values) {
+  if (!values.includes(value)) fail(path, `must be one of ${values.join(', ')}`);
+  return value;
+}
+
+function boolean(value, path) {
+  if (typeof value !== 'boolean') fail(path, 'must be a boolean');
+  return value;
+}
+
+function nullableInteger(value, path) {
+  if (value !== null && (!Number.isSafeInteger(value) || value < 1)) fail(path, 'must be null or a positive safe integer');
+  return value;
+}
+
+function uniqueStrings(value, path, maxItems, maxLength = 256) {
+  if (!Array.isArray(value) || value.length > maxItems) fail(path, `must be an array of at most ${maxItems} strings`);
+  const result = value.map((item, index) => string(item, `${path}[${index}]`, maxLength));
+  if (new Set(result).size !== result.length) fail(path, 'must not contain duplicates');
+  return result;
+}
+
+function iso(value, path) {
+  string(value, path, 40);
+  if (Number.isNaN(Date.parse(value)) || new Date(value).toISOString() !== value) fail(path, 'must be a canonical UTC timestamp');
+  return value;
+}
+
+function relativePath(value, pathName) {
+  string(value, pathName, 512);
+  if (value.includes('\\') || value.startsWith('/') || /^[A-Za-z]:/.test(value) || value.includes('://') || value.split('/').some((part) => !part || part === '.' || part === '..')) fail(pathName, 'must be a normalized repository-relative path');
+  return value;
+}
+
+function tableBuilder() {
+  const values = [];
+  const indexes = new Map();
+  return {
+    values,
+    index(value) {
+      const prior = indexes.get(value);
+      if (prior !== undefined) return prior;
+      const next = values.length;
+      values.push(value);
+      indexes.set(value, next);
+      return next;
+    },
+  };
+}
+
+function validateReport(report) {
+  object(report, 'report', REPORT_KEYS);
+  if (report.schemaVersion !== SCHEMA_VERSION) fail('report.schemaVersion', `must equal ${SCHEMA_VERSION}`);
+  if (!UUID.test(report.runId)) fail('report.runId', 'must be a UUID');
+  enumValue(report.mode, 'report.mode', MODES);
+  enumValue(report.auditMode, 'report.auditMode', AUDIT_MODES);
+  if (report.mode !== 'report' && report.mode !== report.auditMode) fail('report.auditMode', 'must equal report.mode for non-report runs');
+  iso(report.startedAt, 'report.startedAt');
+  iso(report.completedAt, 'report.completedAt');
+  if (Date.parse(report.completedAt) < Date.parse(report.startedAt)) fail('report.completedAt', 'must not precede startedAt');
+
+  const source = object(report.source, 'report.source', SOURCE_KEYS);
+  string(source.repositoryIdentity, 'report.source.repositoryIdentity', 512);
+  if (/^[A-Za-z]:|^\/|\\|\.\.|@|[?#]/.test(source.repositoryIdentity)) fail('report.source.repositoryIdentity', 'must be a canonical repository identity');
+  if (source.commitSha !== null && !COMMIT_SHA.test(source.commitSha)) fail('report.source.commitSha', 'must be null or a Git object digest');
+  if (!SHA256.test(source.contentHash)) fail('report.source.contentHash', 'must be a SHA-256 digest');
+  boolean(source.dirty, 'report.source.dirty');
+
+  const runtime = object(report.runtime, 'report.runtime', RUNTIME_KEYS);
+  string(runtime.vsgVersion, 'report.runtime.vsgVersion', 80);
+  if (!SAFE_ID.test(runtime.profileId)) fail('report.runtime.profileId', 'has an invalid format');
+  if (!SAFE_VERSION.test(runtime.profileVersion)) fail('report.runtime.profileVersion', 'has an invalid format');
+  for (const key of ['rulesDigest', 'registryDigest', 'commercialManifestDigest', 'evaluatorDigest', 'catalogDigest']) if (!SHA256.test(runtime[key])) fail(`report.runtime.${key}`, 'must be a SHA-256 digest');
+
+  if (!Array.isArray(report.checks) || report.checks.length > MAX_CHECKS) fail('report.checks', `must be an array of at most ${MAX_CHECKS} checks`);
+  const checkIds = new Set();
+  report.checks.forEach((check, index) => {
+    const path = `report.checks[${index}]`;
+    object(check, path, CHECK_KEYS);
+    if (typeof check.id !== 'string' || !SAFE_ID.test(check.id)) fail(`${path}.id`, 'has an invalid format');
+    if (checkIds.has(check.id)) fail('report.checks', 'must not contain duplicate check ids');
+    checkIds.add(check.id);
+    enumValue(check.status, `${path}.status`, CHECK_STATUSES);
+    boolean(check.required, `${path}.required`);
+    const coverageCodes = uniqueStrings(check.coverageCodes, `${path}.coverageCodes`, 20, 160);
+    if (coverageCodes.some((value) => !SAFE_ID.test(value))) fail(`${path}.coverageCodes`, 'contains an invalid identifier');
+    const checkAttributionIds = uniqueStrings(check.attributionIds, `${path}.attributionIds`, 50, 160);
+    if (checkAttributionIds.some((value) => !SAFE_ID.test(value))) fail(`${path}.attributionIds`, 'contains an invalid identifier');
+  });
+
+  if (!Array.isArray(report.findings) || report.findings.length > MAX_FINDINGS) fail('report.findings', `must be an array of at most ${MAX_FINDINGS} findings`);
+  const fingerprints = new Set();
+  report.findings.forEach((finding, index) => {
+    const path = `report.findings[${index}]`;
+    object(finding, path, FINDING_KEYS);
+    if (!SHA256.test(finding.fingerprint)) fail(`${path}.fingerprint`, 'must be a SHA-256 digest');
+    if (fingerprints.has(finding.fingerprint)) fail('report.findings', 'must not contain duplicate fingerprints');
+    fingerprints.add(finding.fingerprint);
+    enumValue(finding.severity, `${path}.severity`, SEVERITIES);
+    if (typeof finding.category !== 'string' || !SAFE_ID.test(finding.category)) fail(`${path}.category`, 'has an invalid format');
+    enumValue(finding.confidence, `${path}.confidence`, CONFIDENCES);
+    enumValue(finding.status, `${path}.status`, FINDING_STATUSES);
+    if (typeof finding.ruleId !== 'string' || !SAFE_ID.test(finding.ruleId)) fail(`${path}.ruleId`, 'has an invalid format');
+    const findingCwes = uniqueStrings(finding.cweIds, `${path}.cweIds`, 20, 10);
+    if (findingCwes.some((value) => !CWE.test(value))) fail(`${path}.cweIds`, 'contains an invalid CWE identifier');
+    if (finding.location !== null) {
+      const location = object(finding.location, `${path}.location`, LOCATION_KEYS);
+      relativePath(location.path, `${path}.location.path`);
+      nullableInteger(location.line, `${path}.location.line`);
+      nullableInteger(location.column, `${path}.location.column`);
+      if (location.line !== null && location.line > 10_000_000) fail(`${path}.location.line`, 'is too large');
+      if (location.column !== null && location.column > 1_000_000) fail(`${path}.location.column`, 'is too large');
+    }
+    if (finding.packageRef !== null && (typeof finding.packageRef !== 'string' || finding.packageRef.length > 300 || !SAFE_ID.test(finding.packageRef))) fail(`${path}.packageRef`, 'has an invalid format');
+    const findingAdvisories = uniqueStrings(finding.advisoryIds, `${path}.advisoryIds`, 50, 160);
+    if (findingAdvisories.some((value) => !SAFE_ID.test(value))) fail(`${path}.advisoryIds`, 'contains an invalid identifier');
+    const findingAttributions = uniqueStrings(finding.attributionIds, `${path}.attributionIds`, 50, 160);
+    if (findingAttributions.some((value) => !SAFE_ID.test(value))) fail(`${path}.attributionIds`, 'contains an invalid identifier');
+    const policy = object(finding.policyInputs, `${path}.policyInputs`, POLICY_KEYS);
+    boolean(policy.knownExploited, `${path}.policyInputs.knownExploited`);
+    boolean(policy.fixAvailable, `${path}.policyInputs.fixAvailable`);
+  });
+}
+
+/** Encodes strict semantic report 1.1 into the frozen compact transport 3.0 shape. */
+export function encodeLatticeReportV3(report) {
+  validateReport(report);
+  const semanticBodyBytes = encoder.encode(JSON.stringify({ outcome: 'completed', report })).byteLength;
+  if (semanticBodyBytes > TWO_MIB) fail('$', `decoded JSON exceeds ${TWO_MIB} bytes`, 'payload_too_large');
+
+  const categories = tableBuilder();
+  const ruleIds = tableBuilder();
+  const cweIds = tableBuilder();
+  const paths = tableBuilder();
+  const packageRefs = tableBuilder();
+  const advisoryIds = tableBuilder();
+  const attributionIds = tableBuilder();
+  const tuples = report.findings.map((finding) => [
+    finding.fingerprint,
+    SEVERITIES.indexOf(finding.severity),
+    categories.index(finding.category),
+    CONFIDENCES.indexOf(finding.confidence),
+    FINDING_STATUSES.indexOf(finding.status),
+    ruleIds.index(finding.ruleId),
+    finding.cweIds.map((value) => cweIds.index(value)),
+    finding.location === null ? null : [paths.index(finding.location.path), finding.location.line, finding.location.column],
+    finding.packageRef === null ? null : packageRefs.index(finding.packageRef),
+    finding.advisoryIds.map((value) => advisoryIds.index(value)),
+    finding.attributionIds.map((value) => attributionIds.index(value)),
+    finding.policyInputs.knownExploited,
+    finding.policyInputs.fixAvailable,
+  ]);
+  const compact = {
+    transportVersion: TRANSPORT_VERSION,
+    schemaVersion: SCHEMA_VERSION,
+    runId: report.runId,
+    mode: report.mode,
+    auditMode: report.auditMode,
+    startedAt: report.startedAt,
+    completedAt: report.completedAt,
+    source: report.source,
+    runtime: report.runtime,
+    checks: report.checks,
+    findingStrings: {
+      categories: categories.values,
+      ruleIds: ruleIds.values,
+      cweIds: cweIds.values,
+      paths: paths.values,
+      packageRefs: packageRefs.values,
+      advisoryIds: advisoryIds.values,
+      attributionIds: attributionIds.values,
+    },
+    findings: tuples,
+  };
+  const storedBytes = encoder.encode(JSON.stringify(compact)).byteLength;
+  const wireBytes = encoder.encode(JSON.stringify({ outcome: 'completed', report: compact })).byteLength;
+  if (storedBytes > ONE_MIB || wireBytes > ONE_MIB) fail('$', `compact JSON exceeds ${ONE_MIB} bytes`, 'payload_too_large');
+  return compact;
+}