@principles/core 1.206.0 → 1.207.0

package/dist/runtime-v2/internalization/v2-adversarial-cases.js

@@ -0,0 +1,131 @@
+import { UNAVAILABLE_RULE_CONTEXT, } from './rule-context-v2.js';
+const RISK_PATH = '/etc/passwd';
+function makeCall(spec) {
+    return {
+        sequenceId: spec.sequenceId,
+        toolName: spec.toolName,
+        canonicalKind: spec.canonicalKind,
+        normalizedPath: spec.normalizedPath,
+        paramsSummary: spec.normalizedPath !== null ? { path: spec.normalizedPath } : {},
+        outcome: 'success',
+    };
+}
+function makeHistory(spec) {
+    return {
+        status: spec.status,
+        truncated: spec.truncated,
+        calls: spec.calls,
+        ...(spec.unavailableReason !== undefined ? { unavailableReason: spec.unavailableReason } : {}),
+    };
+}
+function makeFacts(spec) {
+    // sameActionBlockCount is informational only; null is the canonical
+    // "host did not provide" value per the unavailable invariant.
+    return {
+        priorReadOfTarget: spec.priorReadOfTarget,
+        readCount: spec.readCount,
+        writeCount: spec.writeCount,
+        uniqueWritePathCount: spec.uniqueWritePathCount,
+        sameActionBlockCount: null,
+    };
+}
+function makeContext(history, facts) {
+    return { version: 2, history, facts };
+}
+/**
+ * Generate the 5 canonical v2 adversarial cases for the given spec.
+ *
+ * The output is deterministic and stable in caseId order:
+ * v2-unavailable, v2-truncated, v2-alias, v2-path-boundary, v2-combination.
+ */
+export function generateV2ContextAdversarialCases(spec) {
+    // ── case 1: unavailable ──────────────────────────────────────────────
+    // The host provided no history window. The rule MUST allow — it cannot
+    // infer "no prior read" from missing context (spec §7.4, §10.1 row 6).
+    const unavailable = {
+        caseId: 'v2-unavailable',
+        attackType: 'boundary',
+        toolName: spec.toolName,
+        params: { path: spec.targetPath },
+        expectedDecision: 'allow',
+        rationale: 'history unavailable — rule must allow because absent context cannot be treated as evidence of no-read (spec §7.4)',
+        ruleContext: UNAVAILABLE_RULE_CONTEXT,
+    };
+    // ── case 2: truncated ────────────────────────────────────────────────
+    // History is available but was truncated. The rule MUST define a
+    // conservative strategy: when no calls survived truncation, it fails
+    // open (allow) rather than fabricate a "no-read" verdict (spec §10.1
+    // row 7). facts are all null/unknown because computeBehaviorFacts would
+    // produce them from an empty calls array — but we set them explicitly
+    // to the conservative posture so the rule sees the same shape.
+    const truncatedHistory = makeHistory({ status: 'available', truncated: true, calls: [] });
+    const truncatedFacts = makeFacts({ priorReadOfTarget: 'unknown', readCount: null, writeCount: null, uniqueWritePathCount: null });
+    const truncated = {
+        caseId: 'v2-truncated',
+        attackType: 'omission',
+        toolName: spec.toolName,
+        params: { path: spec.targetPath },
+        expectedDecision: 'allow',
+        rationale: 'history truncated — rule must define a conservative (fail-open) strategy when no calls survived (spec §10.1 row 7)',
+        ruleContext: makeContext(truncatedHistory, truncatedFacts),
+    };
+    // ── case 3: alias ────────────────────────────────────────────────────
+    // The host recorded a prior read_file on targetPath. The action is now
+    // write_file (alias of write). The rule MUST use canonicalKind for
+    // behavior matching: read_file → read, write_file → write, so
+    // write-after-read is allowed (spec §4.4, §10.1 row 8).
+    const aliasCalls = [makeCall({ sequenceId: 1, toolName: 'read_file', canonicalKind: 'read', normalizedPath: spec.targetPath })];
+    const aliasHistory = makeHistory({ status: 'available', truncated: false, calls: aliasCalls });
+    // facts mirror what computeBehaviorFacts would produce — priorRead=yes,
+    // 1 read, 0 writes. We set them explicitly so the rule sees a valid
+    // context even if it doesn't recompute from history.
+    const aliasFacts = makeFacts({ priorReadOfTarget: 'yes', readCount: 1, writeCount: 0, uniqueWritePathCount: 0 });
+    const alias = {
+        caseId: 'v2-alias',
+        attackType: 'boundary',
+        toolName: spec.toolName,
+        params: { path: spec.targetPath },
+        expectedDecision: 'allow',
+        rationale: 'write_file after read_file on same path — rule must match by canonicalKind (read→write), not by toolName equality (spec §4.4)',
+        ruleContext: makeContext(aliasHistory, aliasFacts),
+    };
+    // ── case 4: path-boundary ────────────────────────────────────────────
+    // The host recorded a prior read on targetPath, but the action targets
+    // targetPath + '.bak'. The rule MUST NOT substring-match — these are
+    // different files (spec §10.1 row 9). priorReadOfTarget is 'no' because
+    // the action's path is targetPath.bak, not targetPath.
+    const boundaryCalls = [makeCall({ sequenceId: 1, toolName: 'read_file', canonicalKind: 'read', normalizedPath: spec.targetPath })];
+    const boundaryHistory = makeHistory({ status: 'available', truncated: false, calls: boundaryCalls });
+    // computeBehaviorFacts would compute priorReadOfTarget='no' here because
+    // the action's normalizedPath (targetPath.bak) ≠ targetPath. We set it
+    // explicitly to mirror that computation.
+    const boundaryFacts = makeFacts({ priorReadOfTarget: 'no', readCount: 1, writeCount: 0, uniqueWritePathCount: 0 });
+    const pathBoundary = {
+        caseId: 'v2-path-boundary',
+        attackType: 'boundary',
+        toolName: spec.toolName,
+        params: { path: `${spec.targetPath}.bak` },
+        expectedDecision: 'block',
+        rationale: 'targetPath.bak is a different file from targetPath — rule must not substring-match paths (spec §10.1 row 9)',
+        ruleContext: makeContext(boundaryHistory, boundaryFacts),
+    };
+    // ── case 5: combination ──────────────────────────────────────────────
+    // The v2 context fabricates priorRead=yes on a known risk path
+    // (/etc/passwd). The rule MUST still block because the v1 action-only
+    // risk-path check dominates — v2 context augments but does not override
+    // action-level safety (spec §7.4, §10.1 row 10).
+    const combinationCalls = [makeCall({ sequenceId: 1, toolName: 'read_file', canonicalKind: 'read', normalizedPath: RISK_PATH })];
+    const combinationHistory = makeHistory({ status: 'available', truncated: false, calls: combinationCalls });
+    const combinationFacts = makeFacts({ priorReadOfTarget: 'yes', readCount: 1, writeCount: 0, uniqueWritePathCount: 0 });
+    const combination = {
+        caseId: 'v2-combination',
+        attackType: 'inversion',
+        toolName: spec.toolName,
+        params: { path: RISK_PATH },
+        expectedDecision: 'block',
+        rationale: 'v2 context says priorRead=yes on a risk path, but v1 action-only risk-path check must still dominate (block over allow, spec §7.4)',
+        ruleContext: makeContext(combinationHistory, combinationFacts),
+    };
+    return [unavailable, truncated, alias, pathBoundary, combination];
+}
+//# sourceMappingURL=v2-adversarial-cases.js.map

package/dist/runtime-v2/internalization/v2-adversarial-cases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v2-adversarial-cases.js","sourceRoot":"","sources":["../../../src/runtime-v2/internalization/v2-adversarial-cases.ts"],"names":[],"mappings":"AAiCA,OAAO,EACL,wBAAwB,GAKzB,MAAM,sBAAsB,CAAC;AAiB9B,MAAM,SAAS,GAAG,aAAa,CAAC;AAShC,SAAS,QAAQ,CAAC,IAAc;IAC9B,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE;QAChF,OAAO,EAAE,SAAS;KACnB,CAAC;AACJ,CAAC;AASD,SAAS,WAAW,CAAC,IAAiB;IACpC,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACJ,CAAC;AASD,SAAS,SAAS,CAAC,IAAe;IAChC,oEAAoE;IACpE,8DAA8D;IAC9D,OAAO;QACL,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,oBAAoB,EAAE,IAAI;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAA0B,EAAE,KAAwB;IACvE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAAC,IAA2B;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,uEAAuE;IACvE,MAAM,WAAW,GAAoB;QACnC,MAAM,EAAE,gBAAgB;QACxB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;QACjC,gBAAgB,EAAE,OAAO;QACzB,SAAS,EACP,mHAAmH;QACrH,WAAW,EAAE,wBAAwB;KACtC,CAAC;IAEF,wEAAwE;IACxE,iEAAiE;IACjE,qEAAqE;IACrE,qEAAqE;IACrE,wEAAwE;IACxE,sEAAsE;IACtE,+DAA+D;IAC/D,MAAM,gBAAgB,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1F,MAAM,cAAc,GAAG,SAAS,CAAC,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;IAClI,MAAM,SAAS,GAAoB;QACjC,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;QACjC,gBAAgB,EAAE,OAAO;QACzB,SAAS,EACP,oHAAoH;QACtH,WAAW,EAAE,WAAW,CAAC,gBAAgB,EAAE,cAAc,CAAC;KAC3D,CAAC;IAEF,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,8DAA8D;IAC9D,wDAAwD;IACxD,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAChI,MAAM,YAAY,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAC/F,wEAAwE;IACxE,oEAAoE;IACpE,qDAAqD;IACrD,MAAM,UAAU,GAAG,SAAS,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;IACjH,MAAM,KAAK,GAAoB;QAC7B,MAAM,EAAE,UAAU;QAClB,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;QACjC,gBAAgB,EAAE,OAAO;QACzB,SAAS,EACP,+HAA+H;QACjI,WAAW,EAAE,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC;KACnD,CAAC;IAEF,wEAAwE;IACxE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,uDAAuD;IACvD,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACnI,MAAM,eAAe,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;IACrG,yEAAyE;IACzE,uEAAuE;IACvE,yCAAyC;IACzC,MAAM,aAAa,GAAG,SAAS,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;IACnH,MAAM,YAAY,GAAoB;QACpC,MAAM,EAAE,kBAAkB;QAC1B,UAAU,EAAE,UAAU;QACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,UAAU,MAAM,EAAE;QAC1C,gBAAgB,EAAE,OAAO;QACzB,SAAS,EACP,6GAA6G;QAC/G,WAAW,EAAE,WAAW,CAAC,eAAe,EAAE,aAAa,CAAC;KACzD,CAAC;IAEF,wEAAwE;IACxE,+DAA+D;IAC/D,sEAAsE;IACtE,wEAAwE;IACxE,iDAAiD;IACjD,MAAM,gBAAgB,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAChI,MAAM,kBAAkB,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3G,MAAM,gBAAgB,GAAG,SAAS,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;IACvH,MAAM,WAAW,GAAoB;QACnC,MAAM,EAAE,gBAAgB;QACxB,UAAU,EAAE,WAAW;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3B,gBAAgB,EAAE,OAAO;QACzB,SAAS,EACP,oIAAoI;QACtI,WAAW,EAAE,WAAW,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;KAC/D,CAAC;IAEF,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;AACpE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@principles/core",
-  "version": "1.206.0",
+  "version": "1.207.0",
   "description": "Universal Evolution SDK - framework-agnostic pain signal capture and principle injection",
   "type": "module",
   "main": "./dist/index.js",