@portll/cobolwork 0.2.76 → 0.2.140

package/lib/reach.mjs

@@ -10,9 +10,8 @@
 // effect is unstated, and the scan says so rather than ranking anything. See docs/spec/reach.md.
 //
 // Both are annotations, not re-rankings: severity is urgency, reach is who can drive it, effect is
-// what driving it runs as. Three axes a consumer combines, kept apart so each names the fact that
-// moved it. Neither ever becomes "exploitable" - that word needs a witness on the running system,
-// which is not what reading source and records produces.
+// what driving it runs as. Three axes kept apart so each names the fact that moved it;
+// lib/exploitability.mjs joins them with the route into a verdict.
 import { readFileSync, realpathSync } from 'node:fs';
 import { basename, sep, delimiter } from 'node:path';
 
@@ -82,24 +81,42 @@ export function reachResolver({ feeds = [], site = {} } = {}) {
     return null;
   };
   const privilegedOf = (kind, name) => (kind === 'transaction' ? privTx.has(up(name)) : kind === 'job' ? privJob.has(up(name)) : false);
-  return { declared, effectDeclared, accessOf, privilegedOf };
+  // Which record said so, for a verdict to cite: the feed with its extract and date, or the site file.
+  const siteName = site.path ? basename(site.path) : 'the site file';
+  const cite = (f) => `${f.file} (${f.extract}, retrieved ${f.retrieved})`;
+  const accessFrom = (kind, name) => {
+    const f = good.find((x) => x[`${kind}s`][up(name)]);
+    return f ? cite(f) : accessOf(kind, name) ? siteName : null;
+  };
+  const privilegedFrom = (kind, name) => {
+    const f = good.find((x) => x.privileged[`${kind}s`].includes(up(name)));
+    return f ? cite(f) : privilegedOf(kind, name) ? siteName : null;
+  };
+  return { declared, effectDeclared, accessOf, privilegedOf, accessFrom, privilegedFrom };
 }
 
+export const entryKind = (e) => (e.transaction ? 'transaction' : e.job !== undefined ? 'job' : null);
+const entryKey = (e) => (e.transaction ? e.transaction : e.job || '');
+export const entryName = (e) => (e.transaction
+  ? `transaction ${e.transaction}${e.urimap ? ` through URIMAP ${e.urimap}${e.uri ? ` (${e.uri})` : ''}` : ''}`
+  : `job ${e.job || '?'} step ${e.step || '(unnamed)'}`);
+
 // The access of one startedBy entry, whichever kind it is.
-const accessOfEntry = (e, resolver) => (e.transaction ? resolver.accessOf('transaction', e.transaction) : (e.job !== undefined ? resolver.accessOf('job', e.job || '') : null));
+export const accessOfEntry = (e, resolver) => (entryKind(e) ? resolver.accessOf(entryKind(e), entryKey(e)) : null);
+export const accessFromEntry = (e, resolver) => (entryKind(e) ? resolver.accessFrom(entryKind(e), entryKey(e)) : null);
+export const privilegedFromEntry = (e, resolver) => (entryKind(e) ? resolver.privilegedFrom(entryKind(e), entryKey(e)) : null);
 
 // Stamp `reach` on every finding an entry point reaches, and count the three ways. `open` if any
-// entry that reaches it is open, `restricted` if every entry that resolves is restricted and none
-// is open, `undeclared` if none of its entries is a declared fact. A finding no entry reaches
-// carries no reach - there is nothing to say.
+// entry that reaches it is open; `restricted` only if every entry is restricted and none went
+// unlisted, since an entry nobody declared may be open; otherwise `undeclared`. A finding no entry
+// reaches carries no reach - there is nothing to say.
 export function stampReach(findings, resolver) {
   const by = { open: 0, restricted: 0, undeclared: 0 };
   for (const f of findings) {
     const entries = f.startedBy || [];
     if (!entries.length) continue;
-    let open = false, restricted = false;
-    for (const e of entries) { const a = accessOfEntry(e, resolver); if (a === 'open') open = true; else if (a === 'restricted') restricted = true; }
-    f.reach = open ? 'open' : restricted ? 'restricted' : 'undeclared';
+    const access = entries.map((e) => accessOfEntry(e, resolver));
+    f.reach = access.includes('open') ? 'open' : !f.startedByMore && access.every((a) => a === 'restricted') ? 'restricted' : 'undeclared';
     by[f.reach]++;
   }
   return by;
@@ -113,7 +130,7 @@ export function stampEffect(findings, resolver) {
   for (const f of findings) {
     const entries = f.startedBy || [];
     if (!entries.length) continue;
-    if (entries.some((e) => (e.transaction ? resolver.privilegedOf('transaction', e.transaction) : (e.job !== undefined ? resolver.privilegedOf('job', e.job || '') : false)))) {
+    if (entries.some((e) => entryKind(e) && resolver.privilegedOf(entryKind(e), entryKey(e)))) {
       f.effect = 'privileged';
       by.privileged++;
     }

package/lib/revision.json

@@ -1 +1 @@
-{"commit":"13889f659145667b2c02bd2c4b2f18092fd64071","tag":"v0.2.76"}
+{"commit":"54c9654b8c13bc22c8d5683b02551362d95f0d0a","tag":"v0.2.140"}

package/lib/sarif.mjs

@@ -211,6 +211,7 @@ export function toSarif(report, { toolVersion = '0.1.0' } = {}) {
             // Who can drive the finding and what it runs as, when the estate declared the facts.
             ...(f.reach ? { reach: f.reach } : {}),
             ...(f.effect ? { effect: f.effect } : {}),
+            ...(f.exploitability ? { exploitability: f.exploitability } : {}),
           } } : {}),
           locations: [{ physicalLocation: { artifactLocation: { uri: uriOf(f.path), uriBaseId: '%SRCROOT%' }, region: { startLine: f.line || 1 } } }],
           ...(f.related ? { relatedLocations: f.related.map((r) => ({ physicalLocation: { artifactLocation: { uri: uriOf(r.path), uriBaseId: '%SRCROOT%' }, region: { startLine: r.line || 1 } }, message: { text: textOf(r.detail) } })) } : {}),

package/lib/sbom.mjs

@@ -0,0 +1,235 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// A CycloneDX 1.6 bill of materials for a COBOL estate (docs/spec/evidence.md §11): every source
+// file by digest, what each program copies and calls, what each job runs, and the platforms a
+// program uses, without versions the source does not state.
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { basename, dirname, extname, resolve, sep } from 'node:path';
+import { parseSource, detectFormat } from './parser.mjs';
+import { parseJcl } from './jcl.mjs';
+import { optionCards } from './options.mjs';
+import { inScope, isBms, isCopybook, isJcl, isProgram, readSource, relPath } from './sources.mjs';
+import { TOOL_VERSION } from './version.mjs';
+import { revisionOf } from './revision.mjs';
+import { treeFor } from './kernel/source-tree.mjs';
+
+// The namespace of cobolwork's version 5 UUIDs (RFC 4122 §4.3), fixed so a serial number repeats.
+const NAMESPACE = Buffer.from('6f1d2b8e5c3a4e7f9a0b1c2d3e4f5a6b', 'hex');
+
+function uuidv5(name) {
+  const h = createHash('sha1').update(NAMESPACE).update(name, 'utf8').digest().subarray(0, 16);
+  h[6] = (h[6] & 0x0f) | 0x50;
+  h[8] = (h[8] & 0x3f) | 0x80;
+  const x = h.toString('hex');
+  return `${x.slice(0, 8)}-${x.slice(8, 12)}-${x.slice(12, 16)}-${x.slice(16, 20)}-${x.slice(20)}`;
+}
+
+const sha256 = (b) => createHash('sha256').update(b).digest('hex');
+const order = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+
+// A routine a platform provides, which its platform component already stands for.
+const platformRoutine = (n) => n === 'CBLTDLI' || n === 'AIBTDLI' || /^MQ[A-Z0-9]{2,}$/.test(n) || /^CEE[A-Z0-9]+$/.test(n);
+
+// IBM programs a job step runs rather than one the estate builds.
+const SYSTEM_PROGRAMS = new Set(['ADRDSSU', 'AMASPZAP', 'ASMA90', 'BPXBATCH', 'DFHCSDUP', 'DFHEAP1$', 'DFHECP1$', 'DFSRRC00', 'DFSORT', 'DSNTEP2', 'DSNTEP4',
+  'DSNHPC', 'DSNTIAD', 'DSNTIAUL', 'DSNUTILB', 'FTP', 'HEWL', 'IEWBLINK', 'IEWL', 'ICEGENER', 'ICEMAN', 'ICETOOL', 'IDCAMS', 'IEBCOMPR',
+  'IEBCOPY', 'IEBDG', 'IEBGENER', 'IEBUPDTE', 'IEFBR14', 'IEHLIST', 'IEHPROGM', 'IGYCRCTL', 'IKJEFT01', 'IKJEFT1A', 'IKJEFT1B',
+  'SDSF', 'SORT']);
+const TSO_BATCH = new Set(['IKJEFT01', 'IKJEFT1A', 'IKJEFT1B']);
+// The IMS region types whose PARM names the application program second: PARM='BMP,PGM,PSB'.
+const IMS_REGIONS = new Set(['BMP', 'DLI', 'DBB', 'IFP', 'JBP', 'JMP']);
+
+// What a step runs beyond its PGM: the program a TSO batch step's DSN RUN names, or an IMS region's
+// application program.
+function programsRunBy(step) {
+  const pgm = String(step.pgm || '').toUpperCase();
+  const out = [];
+  if (TSO_BATCH.has(pgm)) {
+    for (const dd of step.dds || []) {
+      if (dd.name !== 'SYSTSIN') continue;
+      const text = (dd.inStream || []).map((l) => l.text).join(' ');
+      for (const m of text.matchAll(/\bRUN\s+PROG(?:RAM)?\s*\(\s*([A-Z0-9#@$]{1,8})\s*\)/gi)) out.push(m[1].toUpperCase());
+    }
+  } else if (pgm === 'DFSRRC00' && step.parm) {
+    const [region, app] = String(step.parm).replace(/^['(]|[')]$/g, '').split(',').map((x) => x.trim().toUpperCase());
+    if (IMS_REGIONS.has(region) && /^[A-Z0-9#@$]{1,8}$/.test(app || '')) out.push(app);
+  }
+  return out;
+}
+
+// The literal operand of a CICS option, `PROGRAM('X')`; the field's name where a field is given.
+function cicsOperand(toks, option) {
+  const at = toks.findIndex((t, i) => t.t === 'word' && t.u === option && toks[i + 1] && toks[i + 1].v === '(');
+  if (at < 0) return null;
+  const inner = [];
+  for (let i = at + 2, depth = 1; i < toks.length; i++) {
+    if (toks[i].v === '(') depth++;
+    else if (toks[i].v === ')' && --depth === 0) break;
+    inner.push(toks[i]);
+  }
+  if (inner.length === 1 && inner[0].t === 'lit') return { literal: String(inner[0].v).trim().toUpperCase() };
+  return inner.length ? { field: inner.map((t) => t.v).join('') } : null;
+}
+
+function platformsOf(src, calls) {
+  const s = new Set();
+  if (/EXEC\s+CICS\b/i.test(src)) s.add('CICS');
+  if (/EXEC\s+SQL\b/i.test(src)) s.add('Db2');
+  if (/EXEC\s+DLI\b/i.test(src)) s.add('IMS');
+  for (const c of calls) {
+    if (c.kind !== 'L') continue;
+    const n = String(c.name).toUpperCase();
+    if (n === 'CBLTDLI' || n === 'AIBTDLI') s.add('IMS');
+    if (/^MQ[A-Z0-9]{2,}$/.test(n)) s.add('MQ');
+    if (/^CEE[A-Z0-9]+$/.test(n)) s.add('Language Environment');
+  }
+  return [...s];
+}
+
+function kindOf(file, src) {
+  if (isProgram(file)) return /PROCEDURE\s+DIVISION|PROGRAM-ID/i.test(src) ? 'program' : 'copybook';
+  if (isCopybook(file)) return 'copybook';
+  if (isJcl(file)) return /^\/\/\S*\s+PROC\b/m.test(src) && !/^\/\/\S*\s+JOB\b/m.test(src) ? 'proc' : 'jcl';
+  if (isBms(file)) return 'bms';
+  const ext = extname(file).toLowerCase();
+  if (ext === '.csd') return 'csd';
+  if (ext === '.ddl' || ext === '.sql') return 'ddl';
+  return null;
+}
+
+export function sbom(root, opts = {}) {
+  const tree = treeFor(root, opts);
+  const idx = tree.index;
+  const top = resolve(root);
+  const within = (p) => resolve(p).startsWith(top + sep);
+  const refOf = (p) => (within(p) ? relPath(root, p) : `copylib:${basename(p)}`);
+
+  const entries = [];
+  const programIds = new Map();
+  const mapsets = new Map();
+  const procIds = new Map();
+  for (const f of tree.list().filter(inScope(opts)).sort()) {
+    let bytes;
+    let src;
+    try { bytes = readFileSync(f); src = readSource(f).text; } catch { continue; }
+    const kind = kindOf(f, src);
+    if (!kind) continue;
+    const entry = { file: f, ref: relPath(root, f), bytes, src, kind };
+    if (kind === 'program') {
+      try {
+        const res = parseSource(src, f, { format: 'auto', includeDirs: idx.copyDirs, fileIndex: idx.index, mainDir: dirname(f), copyFormat: 'auto', systemDirs: opts.systemDirs || [] });
+        entry.programs = res.programs;
+        entry.copies = res.copies;
+        for (const p of res.programs) if (p.id) programIds.set(String(p.id).toUpperCase(), entry.ref);
+      } catch { entry.unparsed = true; }
+    } else if (kind === 'jcl' || kind === 'proc') {
+      try { entry.jcl = parseJcl(src, f); } catch { entry.unparsed = true; }
+      if (kind === 'proc') {
+        const m = /^\/\/([A-Z0-9#@$]{1,8})\s+PROC\b/im.exec(src);
+        procIds.set((m ? m[1] : basename(f, extname(f))).toUpperCase(), entry.ref);
+      }
+    } else if (kind === 'bms') {
+      const m = /^([A-Z0-9#@$]{1,8})\s+DFHMSD\b/im.exec(src);
+      mapsets.set((m ? m[1] : basename(f, extname(f))).toUpperCase(), entry.ref);
+    }
+    entries.push(entry);
+  }
+
+  const components = new Map();
+  const dependencies = new Map();
+  const depend = (from, to) => { if (!dependencies.has(from)) dependencies.set(from, new Set()); dependencies.get(from).add(to); };
+  // A program the estate does not hold is a component of its own, so an edge to it is not lost.
+  const runs = (from, name) => {
+    const target = programIds.get(name);
+    if (target) { if (target !== from) depend(from, target); return; }
+    if (platformRoutine(name)) return;
+    const ref = `program:${name}`;
+    depend(from, ref);
+    if (!components.has(ref)) {
+      components.set(ref, { 'bom-ref': ref, type: 'application', name, properties: [{ name: 'cobolwork:kind', value: SYSTEM_PROGRAMS.has(name) ? 'system-program' : 'external-program' }] });
+    }
+  };
+
+  for (const e of entries) {
+    const properties = [{ name: 'cobolwork:kind', value: e.kind }];
+    if (e.unparsed) properties.push({ name: 'cobolwork:unparsed', value: 'true' });
+    if (e.kind === 'program' && e.programs && e.programs.length) {
+      const ids = e.programs.map((p) => p.id).filter(Boolean);
+      if (ids.length) properties.push({ name: 'cobolwork:program-id', value: ids.join(',') });
+      properties.push({ name: 'cobolwork:format', value: detectFormat(e.src) });
+      const options = optionCards(e.src).flatMap((c) => c.options);
+      if (options.length) properties.push({ name: 'cobolwork:options', value: options.join(' ') });
+      for (const c of e.copies || []) {
+        if (c.status !== 'resolved' || !c.path) continue;
+        const ref = refOf(c.path);
+        depend(e.ref, ref);
+        if (!within(c.path) && !components.has(ref)) {
+          let b = null;
+          try { b = readFileSync(c.path); } catch { /* read at parse time, gone since */ }
+          components.set(ref, { 'bom-ref': ref, type: 'file', name: ref, ...(b ? { hashes: [{ alg: 'SHA-256', content: sha256(b) }] } : {}), properties: [{ name: 'cobolwork:kind', value: 'copybook' }, { name: 'cobolwork:source', value: 'copy library' }] });
+        }
+      }
+      const calls = e.programs.flatMap((p) => p.calls || []);
+      const unresolved = new Set();
+      for (const c of calls) {
+        if (c.kind !== 'L') { unresolved.add(String(c.name)); continue; }
+        runs(e.ref, String(c.name).toUpperCase());
+      }
+      for (const x of e.programs.flatMap((p) => p.execs || [])) {
+        if (x.kind !== 'CICS') continue;
+        const words = x.toks.filter((t) => t.t === 'word').map((t) => t.u);
+        if (words[0] === 'LINK' || words[0] === 'XCTL') {
+          const op = cicsOperand(x.toks, 'PROGRAM');
+          if (op && op.literal) runs(e.ref, op.literal); else if (op) unresolved.add(op.field);
+        } else if ((words[0] === 'SEND' || words[0] === 'RECEIVE') && words[1] === 'MAP') {
+          const op = cicsOperand(x.toks, 'MAPSET') || cicsOperand(x.toks, 'MAP');
+          const target = op && op.literal ? mapsets.get(op.literal) : null;
+          if (target) depend(e.ref, target);
+        }
+      }
+      if (unresolved.size) properties.push({ name: 'cobolwork:unresolved-call', value: [...unresolved].sort(order).join(',') });
+      for (const p of platformsOf(e.src, calls)) {
+        const ref = `platform:${p}`;
+        depend(e.ref, ref);
+        if (!components.has(ref)) components.set(ref, { 'bom-ref': ref, type: 'platform', name: p });
+      }
+    }
+    if (e.jcl) {
+      const inStream = new Set((e.jcl.procs || []).map((p) => String(p.name || '').toUpperCase()));
+      const missing = new Set();
+      for (const step of e.jcl.steps || []) {
+        if (step.pgm && /^[A-Z0-9#@$]{1,8}$/i.test(step.pgm)) runs(e.ref, String(step.pgm).toUpperCase());
+        for (const name of programsRunBy(step)) runs(e.ref, name);
+        if (!step.proc) continue;
+        const name = String(step.proc).toUpperCase();
+        const proc = procIds.get(name);
+        if (proc) { if (proc !== e.ref) depend(e.ref, proc); } else if (!inStream.has(name)) missing.add(name);
+      }
+      if (missing.size) properties.push({ name: 'cobolwork:unresolved-proc', value: [...missing].sort(order).join(',') });
+    }
+    components.set(e.ref, { 'bom-ref': e.ref, type: 'file', name: e.ref, hashes: [{ alg: 'SHA-256', content: sha256(e.bytes) }], properties });
+  }
+
+  const list = [...components.values()].sort((a, b) => order(a['bom-ref'], b['bom-ref']));
+  const digests = list.filter((c) => c.hashes).map((c) => c.hashes[0].content).sort(order);
+  const name = opts.name || basename(top);
+  let revision = null;
+  try { revision = revisionOf(top); } catch { /* not a repository, or git is missing */ }
+  const epoch = process.env.SOURCE_DATE_EPOCH;
+  return {
+    bomFormat: 'CycloneDX',
+    specVersion: '1.6',
+    serialNumber: `urn:uuid:${uuidv5(`${name}\n${digests.join('\n')}`)}`,
+    version: 1,
+    metadata: {
+      ...(epoch && /^\d+$/.test(epoch) ? { timestamp: new Date(Number(epoch) * 1000).toISOString() } : {}),
+      tools: { components: [{ type: 'application', name: 'cobolwork', version: TOOL_VERSION }] },
+      component: {
+        'bom-ref': `estate:${name}`, type: 'application', name,
+        ...(revision ? { version: revision.commit, properties: [{ name: 'cobolwork:dirty', value: String(revision.dirty) }] } : {}),
+      },
+    },
+    components: list,
+    dependencies: [...dependencies.entries()].sort(([a], [b]) => order(a, b)).map(([ref, set]) => ({ ref, dependsOn: [...set].sort(order) })),
+  };
+}

package/lib/scan.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-or-later
 import { join } from 'node:path';
-import { sortFindings, tally, evidenceMap, EVIDENCE } from './kernel/findings.mjs';
+import { sortFindings, tally, evidenceMap, EVIDENCE, EXPLOITABILITY } from './kernel/findings.mjs';
 import { directoryTree } from './kernel/source-tree.mjs';
 import { REGISTRY, RULE_SETS, ALL_RULES, reportKey } from './kernel/registry.mjs';
 import { inventory } from './inventory.mjs';
@@ -12,6 +12,7 @@ import { printable } from './kernel/printable.mjs';
 import { rollup } from './sets/flow.mjs';
 import { loadSite } from './site.mjs';
 import { reachFeedPaths, loadReachFeed, reachResolver, stampReach, stampEffect } from './reach.mjs';
+import { stampExploitability, byVerdict, HANDLING, witnessFeedPaths, loadWitnessFeed, applyWitness } from './exploitability.mjs';
 
 import { FLOW_MODEL, SCHEMA_VERSION, TOOL_VERSION } from './version.mjs';
 
@@ -34,11 +35,46 @@ const underRepo = (repo, p) => (repo ? `${repo}/${p}` : p);
 // Frameworks that did not load; a reason can quote the unparsed file.
 const COMPLIANCE_UNLOADED = FRAMEWORKS_UNLOADED.map((f) => ({ id: f.id, why: printable(f.why) }));
 
+// The estate facts of several repositories' reports as one summary: counts add, feeds are the same
+// for every repository so the first names them, and a note says which repositories it covers.
+function mergeEstate(reports) {
+  const all = reports.map(({ repo, r }) => ({ repo, s: r.summary }));
+  const addUp = (k) => {
+    const have = all.filter((x) => x.s[k]);
+    if (!have.length) return null;
+    const out = {};
+    for (const { s } of have) for (const [f, n] of Object.entries(s[k])) out[f] = (out[f] || 0) + n;
+    return out;
+  };
+  const union = (k) => [...new Set(all.flatMap((x) => x.s[k] || []))];
+  const first = (k) => all.find((x) => x.s[k])?.s[k];
+  const without = (k) => all.filter((x) => x.s[k]).map((x) => x.repo);
+  const of = (names) => `${names.length} of ${all.length} repositories (${names.join(', ')})`;
+  const reachless = without('reachNote');
+  const effectless = without('effectNote');
+  const driven = all.filter((x) => x.s.reachNote).reduce((n, x) => n + (x.s.byExploitability?.['attacker-driven'] || 0), 0);
+  // A result is unmatched only where no repository's finding carries it.
+  const unmatchedIn = all.map((x) => new Set(x.s.witnessUnmatched || []));
+  const unmatched = first('witnessFeeds') ? [...unmatchedIn[0]].filter((fp) => unmatchedIn.every((u) => u.has(fp))) : [];
+  const overruled = all.flatMap((x) => (x.s.witnessOverruled || []).map((o) => ({ ...o, path: underRepo(x.repo, o.path) })));
+  const merged = {
+    byReach: addUp('byReach'), byEffect: addUp('byEffect'),
+    reachFeeds: first('reachFeeds'), reachFeedProblems: union('reachFeedProblems'),
+    reachNote: reachless.length ? `no reachability facts declared in ${of(reachless)}, so no finding there was judged reachable${driven ? `, and the ${driven} an attacker drives are labelled attacker-driven rather than exploitable` : ''}: name open/restricted transactions and jobs in each repository's cobolwork.site.json, or bring a COBOLWORK_REACH extract` : null,
+    effectNote: effectless.length ? `no authority facts declared in ${of(effectless)}, so no finding there was judged to run privileged: name privilegedTransactions/privilegedJobs in each repository's cobolwork.site.json, or bring them in the COBOLWORK_REACH extract` : null,
+    witnessFeeds: first('witnessFeeds'), byWitness: addUp('byWitness'), witnessFeedProblems: union('witnessFeedProblems'),
+    witnessUnmatched: unmatched, witnessOverruled: overruled,
+  };
+  return Object.fromEntries(Object.entries(merged).filter(([, v]) => (Array.isArray(v) ? v.length : v)));
+}
+
 function scanEach(root, opts) {
-  const reports = opts.repos.map(repo => ({ repo, r: scanAll(join(root, repo), { ...opts, repos: null, repoName: repo }) }));
+  // A feed is refused anywhere inside the scanned root, not only inside the repository being read.
+  const reports = opts.repos.map(repo => ({ repo, r: scanAll(join(root, repo), { ...opts, repos: null, repoName: repo, feedRoot: opts.feedRoot || root }) }));
   const findings = [];
   const checked = [];
-  const prefixed = (repo, f) => ({ ...f, path: underRepo(repo, f.path), ...(f.related ? { related: f.related.map(x => ({ ...x, path: underRepo(repo, x.path) })) } : {}) });
+  const fixedAt = (repo, x) => (x?.fixAt ? { exploitability: { ...x, fixAt: { ...x.fixAt, path: underRepo(repo, x.fixAt.path) } } } : {});
+  const prefixed = (repo, f) => ({ ...f, path: underRepo(repo, f.path), ...(f.related ? { related: f.related.map(x => ({ ...x, path: underRepo(repo, x.path) })) } : {}), ...fixedAt(repo, f.exploitability) });
   for (const { repo, r } of reports) {
     for (const f of r.findings) findings.push(prefixed(repo, f));
     for (const f of r.checked || []) checked.push(prefixed(repo, f));
@@ -51,7 +87,9 @@ function scanEach(root, opts) {
   for (const f of findings) bySeverity[f.sev] = (bySeverity[f.sev] || 0) + 1;
   const byEvidence = {};
   for (const f of findings) byEvidence[f.evidence] = (byEvidence[f.evidence] || 0) + 1;
-  const perRepo = Object.fromEntries(reports.map(({ repo, r }) => [repo, { findings: r.summary.findings, filesScanned: r.summary.filesScanned, coverageIncomplete: r.summary.coverageIncomplete, nosrc: r.summary.nosrc }]));
+  const byExploitability = byVerdict(findings);
+  const perRepo = Object.fromEntries(reports.map(({ repo, r }) => [repo, { findings: r.summary.findings, filesScanned: r.summary.filesScanned, coverageIncomplete: r.summary.coverageIncomplete, nosrc: r.summary.nosrc,
+    ...(r.summary.byExploitability ? { byExploitability: r.summary.byExploitability } : {}) }]));
   const filesScanned = sum('filesScanned');
   return {
     tool: 'cobolwork',
@@ -68,6 +106,9 @@ function scanEach(root, opts) {
       ...(reports[0]?.r.summary.advisoryCoverage ? { advisoryCoverage: reports[0].r.summary.advisoryCoverage } : {}),
       // The schema has no repository field for a set, so the repository leads the reason.
       setsIncomplete: reports.flatMap(({ repo, r }) => (r.summary.setsIncomplete || []).map((x) => ({ ...x, why: `${repo}: ${x.why}` }))),
+      ...mergeEstate(reports),
+      ...(byExploitability ? { byExploitability } : {}),
+      ...(byExploitability?.exploitable || byExploitability?.confirmed ? { handling: HANDLING } : {}),
     },
     findings,
     ...(checked.length ? { checked } : {}),
@@ -77,6 +118,7 @@ function scanEach(root, opts) {
     ruleImpact: Object.fromEntries(Object.entries(ALL_RULES).filter(([, v]) => v.impact).map(([k, v]) => [k, v.impact])),
     ruleRemedy: Object.fromEntries(Object.entries(ALL_RULES).filter(([, v]) => v.remedy).map(([k, v]) => [k, v.remedy])),
     evidence: EVIDENCE,
+    exploitabilityVerdicts: EXPLOITABILITY,
     // Which clause each rule bears on, and what the mapping does not claim. A reader who takes
     // this to an auditor needs both halves.
     ruleCompliance: complianceMap(Object.keys(ALL_RULES)),
@@ -85,6 +127,50 @@ function scanEach(root, opts) {
   };
 }
 
+// Who can reach each finding and what it runs as, from the estate's own facts - a brought
+// COBOLWORK_REACH extract, or the keys in cobolwork.site.json - never from the source, and the
+// exploitability verdict those join into with the route. Returns the summary keys that report them.
+// Reach and effect annotate rather than re-rank; where no fact is declared, a note says so rather
+// than the report reading as a clean bill.
+export function applyEstateFacts(findings, checked, root, opts = {}) {
+  const site = loadSite(root, opts.site || null);
+  const feedRoot = opts.feedRoot || root;
+  const reachFeeds = reachFeedPaths(opts).map((p) => loadReachFeed(p, { root: feedRoot }));
+  const reach = reachResolver({ feeds: reachFeeds, site });
+  const withEntries = findings.some((f) => (f.startedBy || []).length);
+  const byReach = reach.declared ? stampReach(findings, reach) : null;
+  const byEffect = reach.effectDeclared ? stampEffect(findings, reach) : null;
+  // A rule that escalates only under elevated authority takes its higher severity where the estate
+  // says the entry that reaches it runs privileged.
+  for (const f of findings) {
+    const raise = ALL_RULES[f.rule]?.whenPrivileged;
+    if (raise && f.effect === 'privileged') f.sev = raise;
+  }
+  stampExploitability(findings, reach, checked);
+  const witnessFeeds = witnessFeedPaths(opts).map((p) => loadWitnessFeed(p, { root: feedRoot }));
+  const witnessed = applyWitness(findings, checked, witnessFeeds);
+  if (witnessed.overruled.length) sortFindings(findings);
+  const byExploitability = byVerdict(findings);
+  const driven = byExploitability ? byExploitability['attacker-driven'] : 0;
+  const loaded = witnessFeeds.filter((f) => !f.problem);
+  return {
+    ...(byReach ? { byReach } : {}),
+    ...(byEffect ? { byEffect } : {}),
+    ...(reachFeeds.some(f => !f.problem) ? { reachFeeds: reachFeeds.filter(f => !f.problem).map(f => ({ file: f.file, extract: f.extract, retrieved: f.retrieved })) } : {}),
+    ...(reachFeeds.some(f => f.problem) ? { reachFeedProblems: reachFeeds.filter(f => f.problem).map(f => `${f.file}: ${f.problem}`) } : {}),
+    ...(!reach.declared && withEntries ? { reachNote: `no reachability facts declared, so no finding was judged reachable${driven ? `, and the ${driven} an attacker drives are labelled attacker-driven rather than exploitable` : ''}: name open/restricted transactions and jobs in cobolwork.site.json, or bring a COBOLWORK_REACH extract` } : {}),
+    ...(!reach.effectDeclared && withEntries ? { effectNote: 'no authority facts declared, so no finding was judged to run privileged: name privilegedTransactions/privilegedJobs in cobolwork.site.json, or bring them in the COBOLWORK_REACH extract' } : {}),
+    ...(byExploitability ? { byExploitability } : {}),
+    ...(byExploitability?.exploitable || byExploitability?.confirmed ? { handling: HANDLING } : {}),
+    ...(loaded.length ? { witnessFeeds: loaded.map((f) => ({ file: f.file, witness: f.witness, recorded: f.recorded })), byWitness: witnessed.byWitness } : {}),
+    ...(witnessFeeds.some((f) => f.problem || f.refused.length) ? { witnessFeedProblems: witnessFeeds.flatMap((f) => (f.problem ? [`${f.file}: ${f.problem}`] : f.refused.map((r) => `${f.file}: ${r.why}`))) } : {}),
+    // A result no path finding carries: the code changed since the test, or the route is gone.
+    ...(witnessed.unmatched.length ? { witnessUnmatched: witnessed.unmatched } : {}),
+    // Routes the reading refuted that the estate reproduced: the check model was wrong about them.
+    ...(witnessed.overruled.length ? { witnessOverruled: witnessed.overruled } : {}),
+  };
+}
+
 // A set that throws is reported as not having run, and the other sets' findings stand.
 function runSet(set, root, o) {
   try { return set.scan(root, o); } catch (e) {
@@ -153,21 +239,7 @@ export function scanAll(root, opts = {}) {
   const checked = parts.find((p) => p.tool === 'cobolwork-flow')?.checked || [];
   stampFingerprints(checked, { root, repo: opts.repoName || '' });
 
-  // Who can reach a finding: whether the transactions and jobs that start it are open to any user
-  // or restricted, from the estate's own facts - a brought COBOLWORK_REACH extract, or the
-  // open/restricted keys in cobolwork.site.json - never from the source. Undeclared until it says.
-  const site = loadSite(root, opts.site || null);
-  const reachFeeds = reachFeedPaths(opts).map((p) => loadReachFeed(p, { root }));
-  const reach = reachResolver({ feeds: reachFeeds, site });
-  const withEntries = findings.some((f) => (f.startedBy || []).length);
-  const byReach = reach.declared ? stampReach(findings, reach) : null;
-  const byEffect = reach.effectDeclared ? stampEffect(findings, reach) : null;
-  // A rule that escalates only under elevated authority takes its higher severity where the estate
-  // says the entry that reaches it runs privileged.
-  for (const f of findings) {
-    const raise = ALL_RULES[f.rule]?.whenPrivileged;
-    if (raise && f.effect === 'privileged') f.sev = raise;
-  }
+  const estate = applyEstateFacts(findings, checked, root, opts);
 
   const byRule = tally(findings);
   const bySeverity = {};
@@ -200,14 +272,7 @@ export function scanAll(root, opts = {}) {
       ...(parts.find(p => p.tool === 'cobolwork-build')?.summary.advisoryCoverage ? { advisoryCoverage: parts.find(p => p.tool === 'cobolwork-build').summary.advisoryCoverage } : {}),
       crossProgram: parts.find(p => p.tool === 'cobolwork-flow')?.summary.crossProgram ?? 0,
       ...(parts.find(p => p.tool === 'cobolwork-flow')?.summary.entryPoints?.roots ? rollup(findings) : {}),
-      // Reach annotates, it does not re-rank: severity is urgency, reach is who can drive it. When
-      // no fact is declared, the report says so rather than reading as a clean bill.
-      ...(byReach ? { byReach } : {}),
-      ...(byEffect ? { byEffect } : {}),
-      ...(reachFeeds.some(f => !f.problem) ? { reachFeeds: reachFeeds.filter(f => !f.problem).map(f => ({ file: f.file, extract: f.extract, retrieved: f.retrieved })) } : {}),
-      ...(reachFeeds.some(f => f.problem) ? { reachFeedProblems: reachFeeds.filter(f => f.problem).map(f => `${f.file}: ${f.problem}`) } : {}),
-      ...(!reach.declared && withEntries ? { reachNote: 'no reachability facts declared, so no finding was judged reachable: name open/restricted transactions and jobs in cobolwork.site.json, or bring a COBOLWORK_REACH extract' } : {}),
-      ...(!reach.effectDeclared && withEntries ? { effectNote: 'no authority facts declared, so no finding was judged to run privileged: name privilegedTransactions/privilegedJobs in cobolwork.site.json, or bring them in the COBOLWORK_REACH extract' } : {}),
+      ...estate,
       ruleSets: only,
       // Which flow model produced these rows, and which cobolwork. A finding that appears or
       // disappears between two reports is attributable to the model rather than to the code scanned.
@@ -260,6 +325,7 @@ export function scanAll(root, opts = {}) {
     ruleImpact: Object.fromEntries(Object.entries(ALL_RULES).filter(([, v]) => v.impact).map(([k, v]) => [k, v.impact])),
     ruleRemedy: Object.fromEntries(Object.entries(ALL_RULES).filter(([, v]) => v.remedy).map(([k, v]) => [k, v.remedy])),
     evidence: EVIDENCE,
+    exploitabilityVerdicts: EXPLOITABILITY,
     // Which clause each rule bears on, and what the mapping does not claim. A reader who takes
     // this to an auditor needs both halves.
     ruleCompliance: complianceMap(Object.keys(ALL_RULES)),