@saulwade/swl-ses 2.6.0 → 2.8.0

package/schemas/w4-certification-verdict.schema.json

@@ -0,0 +1,224 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://swl-ses.dev/schemas/w4-certification-verdict.schema.json",
+  "title": "SWL W4 CertificationVerdict (ADR-0053 § Contrato swl-ses <-> swl-eval, F32/T-06)",
+  "$comment": "Schema de validación interna consumido sólo por scripts/lib/w4-veredicto.js, scripts/lib/w4-verificar-veredicto.js y sus tests (excepción documentada de reglas/registro-componentes-nuevos.md § Excepciones — no se distribuye como módulo instalable ni se expone directamente a usuarios). Define el CertificationVerdict sanitizado que swl-eval emite hacia swl-ses: nunca el payload crudo del corpus, nunca PII, nunca tokens. $defs.sha256/gitSha/identifier/matrixEntry están duplicados intencionalmente de schemas/w4-certification-request.schema.json; $defs.dimensionName de scripts/lib/w4-scorer-certificacion.js#NOMBRES_DIMENSIONES; $defs.category de schemas/w4-corpus.schema.json#/properties/categories/const — la prueba de no-drift vive en tests/lib/w4-veredicto.test.js.",
+  "x-swl-officialValidator": {
+    "module": "scripts/lib/w4-veredicto.js",
+    "function": "validateCertificationVerdict",
+    "mandatory": true,
+    "runtimeOnlyChecks": [
+      "dimensiones-cubre-las-6-de-adr-0050-sin-duplicados-ni-faltantes",
+      "metaslo-dimension-es-literal-meta-SLO",
+      "firma-dev-nota-es-constante-fija",
+      "corpusagregados-pass-mas-fail-igual-totalcasos",
+      "corpusagregados-porcategoria-claves-subconjunto-de-categorias-conocidas",
+      "failures-dimension-enum-de-las-6-sin-meta-slo"
+    ]
+  },
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "kind", "schemaVersion", "runId", "request", "certifica", "dimensiones",
+    "metaSlo", "metadata", "corpusAgregados", "failures", "firma", "emitidoEn"
+  ],
+  "properties": {
+    "kind": { "const": "swl-certification-verdict" },
+    "schemaVersion": { "const": "1.0.0" },
+    "runId": { "$ref": "#/$defs/identifier" },
+    "request": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["commit", "tarballDigest", "matrix"],
+      "properties": {
+        "commit": { "$ref": "#/$defs/gitSha" },
+        "tarballDigest": { "$ref": "#/$defs/sha256" },
+        "matrix": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": { "$ref": "#/$defs/matrixEntry" }
+        }
+      }
+    },
+    "certifica": { "type": "boolean" },
+    "dimensiones": {
+      "type": "array",
+      "minItems": 6,
+      "maxItems": 6,
+      "items": { "$ref": "#/$defs/dimensionVerdict" }
+    },
+    "metaSlo": { "$ref": "#/$defs/metaSloVerdict" },
+    "metadata": { "$ref": "#/$defs/metadata" },
+    "corpusAgregados": { "$ref": "#/$defs/corpusAgregados" },
+    "failures": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/failureEntry" }
+    },
+    "firma": { "$ref": "#/$defs/firma" },
+    "emitidoEn": { "$ref": "#/$defs/timestampIso" }
+  },
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "gitSha": { "type": "string", "pattern": "^[a-f0-9]{40}$" },
+    "identifier": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$" },
+    "timestampIso": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z$"
+    },
+    "runtime": {
+      "$comment": "Duplicado de w4-certification-request.schema.json#/$defs/runtime (Core-3).",
+      "enum": ["claude-code", "codex-cli", "gemini-cli"]
+    },
+    "os": {
+      "$comment": "Duplicado de w4-certification-request.schema.json#/$defs/os.",
+      "enum": ["win32", "linux", "darwin"]
+    },
+    "matrixEntry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["runtime", "os", "model"],
+      "properties": {
+        "runtime": { "$ref": "#/$defs/runtime" },
+        "os": { "$ref": "#/$defs/os" },
+        "model": { "$ref": "#/$defs/identifier" }
+      }
+    },
+    "dimensionName": {
+      "$comment": "Duplicado de scripts/lib/w4-scorer-certificacion.js#NOMBRES_DIMENSIONES (orden canónico de ADR-0050, sin meta-SLO).",
+      "enum": [
+        "Inteligencia operacional", "Autonomía efectiva", "Enforcement de gates",
+        "Seguridad del harness", "Confiabilidad cross-runtime", "Runtime individual"
+      ]
+    },
+    "category": {
+      "$comment": "Duplicado de schemas/w4-corpus.schema.json#/properties/categories/const (scripts/lib/w4-corpus-generador.js#CATEGORIAS).",
+      "enum": [
+        "herramientas-nativas", "escritura-shell", "secretos-fragmentados", "traversal",
+        "symlinks", "rutas-unc", "unicode-confusable", "approvals-reutilizadas",
+        "planes-alterados", "escalacion-subagente", "contaminacion-memoria", "fallos-escritura"
+      ]
+    },
+    "medidoValue": {
+      "$comment": "C5: sanitización enforzada por schema, no sólo por el emisor — 'medido' nunca transporta strings, booleanos crudos ni arreglos; sólo un número, null (sin medición), o un mapa plano de claves a números (scripts/lib/w4-veredicto.js#aplanarMedido).",
+      "oneOf": [
+        { "type": "number" },
+        { "type": "null" },
+        { "type": "object", "additionalProperties": { "type": "number" } }
+      ]
+    },
+    "dimensionVerdict": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["dimension", "slo", "medido", "pass"],
+      "properties": {
+        "dimension": { "$ref": "#/$defs/dimensionName" },
+        "slo": { "type": "string", "minLength": 1 },
+        "medido": { "$ref": "#/$defs/medidoValue" },
+        "pass": { "type": "boolean" }
+      }
+    },
+    "metaSloVerdict": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["dimension", "slo", "medido", "pass"],
+      "properties": {
+        "dimension": { "const": "meta-SLO" },
+        "slo": { "type": "string", "minLength": 1 },
+        "medido": { "$ref": "#/$defs/medidoValue" },
+        "pass": { "type": "boolean" }
+      }
+    },
+    "scalarMap": {
+      "$comment": "C5/metadata 'solo escalares': jamás un sub-objeto ni un arreglo.",
+      "type": ["object", "null"],
+      "additionalProperties": { "type": ["number", "boolean", "string"] }
+    },
+    "metadata": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["cobertura", "mutation", "cve", "rollback"],
+      "properties": {
+        "cobertura": { "$ref": "#/$defs/scalarMap" },
+        "mutation": { "$ref": "#/$defs/scalarMap" },
+        "cve": { "$ref": "#/$defs/scalarMap" },
+        "rollback": { "$ref": "#/$defs/scalarMap" }
+      }
+    },
+    "categoryAgg": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["total", "fail"],
+      "properties": {
+        "total": { "type": "integer", "minimum": 0 },
+        "fail": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "corpusAgregados": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "totalCasos", "selladosHumano", "mutationsTotal", "promptInjectionsTotal",
+        "pass", "fail", "porCategoria"
+      ],
+      "properties": {
+        "totalCasos": { "type": "integer", "minimum": 0 },
+        "selladosHumano": { "type": "integer", "minimum": 0 },
+        "mutationsTotal": { "type": "integer", "minimum": 0 },
+        "promptInjectionsTotal": { "type": "integer", "minimum": 0 },
+        "pass": { "type": "integer", "minimum": 0 },
+        "fail": { "type": "integer", "minimum": 0 },
+        "porCategoria": {
+          "type": "object",
+          "propertyNames": { "$ref": "#/$defs/category" },
+          "additionalProperties": { "$ref": "#/$defs/categoryAgg" }
+        }
+      }
+    },
+    "failureEntry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["casoId", "categoria", "dimension"],
+      "properties": {
+        "casoId": {
+          "type": "string",
+          "pattern": "^(?:mutation|injection)-[a-z][a-z-]*-[0-9]{6}$"
+        },
+        "categoria": { "$ref": "#/$defs/category" },
+        "dimension": { "$ref": "#/$defs/dimensionName" }
+      }
+    },
+    "firmaDev": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["modo", "tipo", "nota"],
+      "properties": {
+        "modo": { "const": "dev" },
+        "tipo": { "const": "no-certificante" },
+        "nota": {
+          "const": "verificador dev, adaptador de attestation simulado — este veredicto nunca certifica ni implica origen verificado (ADR-0053 C6)"
+        }
+      }
+    },
+    "firmaReal": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["modo", "tipo", "bundleDigest"],
+      "properties": {
+        "modo": { "const": "real" },
+        "tipo": { "const": "certificante" },
+        "bundleDigest": { "$ref": "#/$defs/sha256" }
+      }
+    },
+    "firma": {
+      "$comment": "C6: discriminado por 'modo' con if/then/else — dev y real son shapes mutuamente excluyentes.",
+      "if": {
+        "type": "object",
+        "properties": { "modo": { "const": "dev" } },
+        "required": ["modo"]
+      },
+      "then": { "$ref": "#/$defs/firmaDev" },
+      "else": { "$ref": "#/$defs/firmaReal" }
+    }
+  }
+}

package/schemas/w4-corpus.schema.json

@@ -0,0 +1,172 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://swl-ses.dev/schemas/w4-corpus.schema.json",
+  "title": "SWL W4 Adversarial Corpus (modo dev)",
+  "$comment": "Schema de validación interna consumido sólo por scripts/lib/w4-corpus-generador.js y sus tests (excepción documentada de reglas/registro-componentes-nuevos.md § Excepciones — no se distribuye como módulo instalable ni se expone directamente a usuarios). Define el corpus adversarial determinista por semilla de F32/T-02 (ADR-0050 § corpus adversarial, ADR-0053 § Decisión pieza 2). generator.seedProvenance sólo acepta 'public-dev' en schemaVersion 1.0.0: este documento NUNCA es el corpus de certificación (ese es T-03, cifrado en reposo con semilla/casos sellados como *environment secret*). $defs.runtime/os/identifier/sha256/matrixEntry están duplicados intencionalmente de schemas/w4-certification-request.schema.json y $defs.capability de schemas/policy-operation.schema.json (mismo patrón ya usado entre esos dos schemas hermanos) — la prueba de no-drift vive en tests/lib/w4-corpus-generador.test.js.",
+  "x-swl-officialValidator": {
+    "module": "scripts/lib/w4-corpus-generador.js",
+    "function": "validateCorpus",
+    "mandatory": true,
+    "runtimeOnlyChecks": [
+      "caseid-category-consistency",
+      "streamindex-strictly-increasing",
+      "category-coverage-both-arrays",
+      "counts-match-arrays"
+    ]
+  },
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "kind", "schemaVersion", "generator", "matrixEntry", "counts",
+    "categories", "mutations", "promptInjections"
+  ],
+  "properties": {
+    "kind": { "const": "swl-adversarial-corpus" },
+    "schemaVersion": { "const": "1.0.0" },
+    "generator": { "$ref": "#/$defs/generator" },
+    "matrixEntry": { "$ref": "#/$defs/matrixEntry" },
+    "counts": { "$ref": "#/$defs/counts" },
+    "categories": {
+      "const": [
+        "herramientas-nativas", "escritura-shell", "secretos-fragmentados", "traversal",
+        "symlinks", "rutas-unc", "unicode-confusable", "approvals-reutilizadas",
+        "planes-alterados", "escalacion-subagente", "contaminacion-memoria", "fallos-escritura"
+      ]
+    },
+    "mutations": {
+      "type": "array",
+      "minItems": 500,
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/mutationCase" }
+    },
+    "promptInjections": {
+      "type": "array",
+      "minItems": 1000,
+      "uniqueItems": true,
+      "items": { "$ref": "#/$defs/promptInjectionCase" }
+    }
+  },
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "identifier": { "type": "string", "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$" },
+    "runtime": {
+      "$comment": "Duplicado de w4-certification-request.schema.json#/$defs/runtime (Core-3).",
+      "enum": ["claude-code", "codex-cli", "gemini-cli"]
+    },
+    "os": {
+      "$comment": "Duplicado de w4-certification-request.schema.json#/$defs/os.",
+      "enum": ["win32", "linux", "darwin"]
+    },
+    "capability": {
+      "$comment": "Duplicado de policy-operation.schema.json#/$defs/capability.",
+      "enum": [
+        "delegate", "filesystem.mutate", "filesystem.read", "memory.read",
+        "memory.write", "network.access", "shell.exec", "skill.invoke"
+      ]
+    },
+    "matrixEntry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["runtime", "os", "model"],
+      "properties": {
+        "runtime": { "$ref": "#/$defs/runtime" },
+        "os": { "$ref": "#/$defs/os" },
+        "model": { "$ref": "#/$defs/identifier" }
+      }
+    },
+    "category": {
+      "enum": [
+        "herramientas-nativas", "escritura-shell", "secretos-fragmentados", "traversal",
+        "symlinks", "rutas-unc", "unicode-confusable", "approvals-reutilizadas",
+        "planes-alterados", "escalacion-subagente", "contaminacion-memoria", "fallos-escritura"
+      ]
+    },
+    "mutatedField": {
+      "enum": [
+        "capability", "cwd", "effect.absolutePath", "effect.argv",
+        "effect.namespace", "operationId", "payloadDigest", "taskId"
+      ]
+    },
+    "adversarialString": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 4096,
+      "pattern": "^(?!.*[\\u0000-\\u001f\\u007f\\u200b-\\u200d\\u202a-\\u202e\\u2060\\u2066-\\u2069]).+$"
+    },
+    "generator": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["algorithm", "seedFingerprint", "seedProvenance"],
+      "properties": {
+        "algorithm": { "const": "hmac-sha256-ctr" },
+        "seedFingerprint": { "$ref": "#/$defs/sha256" },
+        "seedProvenance": { "const": "public-dev" }
+      }
+    },
+    "categoryCount": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["mutations", "promptInjections"],
+      "properties": {
+        "mutations": { "type": "integer", "minimum": 1 },
+        "promptInjections": { "type": "integer", "minimum": 1 }
+      }
+    },
+    "counts": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["mutations", "promptInjections", "byCategory"],
+      "properties": {
+        "mutations": { "type": "integer", "minimum": 500 },
+        "promptInjections": { "type": "integer", "minimum": 1000 },
+        "byCategory": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "herramientas-nativas", "escritura-shell", "secretos-fragmentados", "traversal",
+            "symlinks", "rutas-unc", "unicode-confusable", "approvals-reutilizadas",
+            "planes-alterados", "escalacion-subagente", "contaminacion-memoria", "fallos-escritura"
+          ],
+          "properties": {
+            "herramientas-nativas": { "$ref": "#/$defs/categoryCount" },
+            "escritura-shell": { "$ref": "#/$defs/categoryCount" },
+            "secretos-fragmentados": { "$ref": "#/$defs/categoryCount" },
+            "traversal": { "$ref": "#/$defs/categoryCount" },
+            "symlinks": { "$ref": "#/$defs/categoryCount" },
+            "rutas-unc": { "$ref": "#/$defs/categoryCount" },
+            "unicode-confusable": { "$ref": "#/$defs/categoryCount" },
+            "approvals-reutilizadas": { "$ref": "#/$defs/categoryCount" },
+            "planes-alterados": { "$ref": "#/$defs/categoryCount" },
+            "escalacion-subagente": { "$ref": "#/$defs/categoryCount" },
+            "contaminacion-memoria": { "$ref": "#/$defs/categoryCount" },
+            "fallos-escritura": { "$ref": "#/$defs/categoryCount" }
+          }
+        }
+      }
+    },
+    "mutationCase": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["caseId", "category", "streamIndex", "targetCapability", "mutatedField", "mutatedValue"],
+      "properties": {
+        "caseId": { "type": "string", "pattern": "^mutation-[a-z][a-z-]*-[0-9]{6}$" },
+        "category": { "$ref": "#/$defs/category" },
+        "streamIndex": { "type": "integer", "minimum": 0 },
+        "targetCapability": { "$ref": "#/$defs/capability" },
+        "mutatedField": { "$ref": "#/$defs/mutatedField" },
+        "mutatedValue": { "$ref": "#/$defs/adversarialString" }
+      }
+    },
+    "promptInjectionCase": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["caseId", "category", "streamIndex", "text"],
+      "properties": {
+        "caseId": { "type": "string", "pattern": "^injection-[a-z][a-z-]*-[0-9]{6}$" },
+        "category": { "$ref": "#/$defs/category" },
+        "streamIndex": { "type": "integer", "minimum": 0 },
+        "text": { "$ref": "#/$defs/adversarialString" }
+      }
+    }
+  }
+}

package/schemas/w4-mutation-report.schema.json

@@ -0,0 +1,116 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://swl-ses.dev/schemas/w4-mutation-report.schema.json",
+  "title": "SWL W4 Mutation Report (motor de mutation testing, F32/T-07)",
+  "$comment": "Schema de validación interna consumido sólo por scripts/lib/w4-motor-mutacion.js y sus tests (excepción documentada de reglas/registro-componentes-nuevos.md § Excepciones — no se distribuye como módulo instalable ni se expone directamente a usuarios). Define el MutationReport que produce ejecutarMutationTesting() al aplicar los 5 operadores de mutación de texto (M1-M5) sobre los 20 módulos críticos de swl-ses (kernel W2 de F29/F30 + los 7 de F31) y correr sus tests reales contra cada mutante (ADR-0050 § 'mutation score de al menos 90%, con 100% de mutantes críticos eliminados'; REQ-32-07). El validador oficial es validateMutationReport en scripts/lib/w4-motor-mutacion.js — recomputa global/porModulo/criticos desde mutantes[] y rechaza cualquier discrepancia.",
+  "x-swl-officialValidator": {
+    "module": "scripts/lib/w4-motor-mutacion.js",
+    "function": "validateMutationReport",
+    "mandatory": true,
+    "runtimeOnlyChecks": [
+      "global-matches-mutantes",
+      "por-modulo-matches-mutantes",
+      "scores-recomputed-match",
+      "m5-siempre-critico",
+      "muerto-sin-evidencia-invalido",
+      "sobreviviente-con-evidencia-invalido"
+    ]
+  },
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["kind", "schemaVersion", "generatedAt", "global", "porModulo", "mutantes"],
+  "properties": {
+    "kind": { "const": "swl-mutation-report" },
+    "schemaVersion": { "const": "1.0.0" },
+    "generatedAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "Informativo — NUNCA parte de la comparación de reproducibilidad (esa excluye este campo explícitamente)."
+    },
+    "global": { "$ref": "#/$defs/globalSummary" },
+    "porModulo": {
+      "type": "array",
+      "minItems": 1,
+      "items": { "$ref": "#/$defs/moduloSummary" }
+    },
+    "mutantes": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/mutante" }
+    }
+  },
+  "$defs": {
+    "score": { "type": "number", "minimum": 0, "maximum": 100 },
+    "operador": { "enum": ["M1", "M2", "M3", "M4", "M5"] },
+    "estado": { "enum": ["muerto", "sobrevivio"] },
+    "criticosGlobal": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["total", "muertos", "score"],
+      "properties": {
+        "total": { "type": "integer", "minimum": 0 },
+        "muertos": { "type": "integer", "minimum": 0 },
+        "score": { "$ref": "#/$defs/score" }
+      }
+    },
+    "criticosModulo": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["total", "muertos"],
+      "properties": {
+        "total": { "type": "integer", "minimum": 0 },
+        "muertos": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "globalSummary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["totalMutantes", "muertos", "sobrevivientes", "score", "criticos"],
+      "properties": {
+        "totalMutantes": { "type": "integer", "minimum": 0 },
+        "muertos": { "type": "integer", "minimum": 0 },
+        "sobrevivientes": { "type": "integer", "minimum": 0 },
+        "score": { "$ref": "#/$defs/score" },
+        "criticos": { "$ref": "#/$defs/criticosGlobal" }
+      }
+    },
+    "moduloSummary": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["modulo", "testFiles", "totalMutantes", "muertos", "sobrevivientes", "score", "criticos"],
+      "properties": {
+        "modulo": { "type": "string", "minLength": 1 },
+        "testFiles": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "type": "string", "minLength": 1 }
+        },
+        "totalMutantes": { "type": "integer", "minimum": 0 },
+        "muertos": { "type": "integer", "minimum": 0 },
+        "sobrevivientes": { "type": "integer", "minimum": 0 },
+        "score": { "$ref": "#/$defs/score" },
+        "criticos": { "$ref": "#/$defs/criticosModulo" }
+      }
+    },
+    "mutante": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["modulo", "linea", "operador", "original", "mutado", "inicioAbs", "critico", "estado", "testQueLoMato", "detailCode"],
+      "properties": {
+        "modulo": { "type": "string", "minLength": 1 },
+        "linea": { "type": "integer", "minimum": 1 },
+        "operador": { "$ref": "#/$defs/operador" },
+        "original": { "type": "string" },
+        "mutado": { "type": "string" },
+        "inicioAbs": { "type": "integer", "minimum": 0 },
+        "critico": { "type": "boolean" },
+        "estado": { "$ref": "#/$defs/estado" },
+        "testQueLoMato": { "type": ["string", "null"] },
+        "detailCode": { "enum": ["SYNTAX_ERROR", "TIMEOUT", null] }
+      },
+      "if": { "properties": { "estado": { "const": "sobrevivio" } } },
+      "then": {
+        "properties": { "testQueLoMato": { "const": null }, "detailCode": { "const": null } }
+      }
+    }
+  }
+}