@veraxhq/verax 0.2.1 → 0.4.0

package/src/cli/commands/gates.js

@@ -0,0 +1,95 @@
+/**
+ * PHASE 19 — Capability Gates CLI Command
+ * 
+ * Evaluates all capability gates and reports PASS/FAIL.
+ */
+
+import {
+  evaluateAllCapabilityGates,
+  buildGateContext,
+} from '../../verax/core/capabilities/gates.js';
+import { resolve } from 'path';
+import { fileURLToPath } from 'url';
+import { dirname } from 'path';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+/**
+ * PHASE 19: `verax gates` command
+ * 
+ * @param {Object} options - Options
+ * @param {boolean} options.json - Output as JSON
+ * @param {boolean} options.verbose - Verbose output
+ */
+export async function gatesCommand(options = { json: false, verbose: false }) {
+  const { json = false, verbose = false } = options;
+  
+  // Pass explicit project root to ensure correct path resolution
+  const projectRoot = resolve(__dirname, '../../..');
+  const context = await buildGateContext({ projectRoot });
+  const result = evaluateAllCapabilityGates(context);
+  
+  if (json) {
+    console.log(JSON.stringify({
+      pass: result.pass,
+      summary: result.summary,
+      perCapability: result.perCapability,
+    }, null, 2));
+  } else {
+    // Human-readable output
+    console.log('\n' + '='.repeat(80));
+    console.log('CAPABILITY GATES EVALUATION');
+    console.log('='.repeat(80));
+    console.log(`\nStatus: ${result.pass ? '✅ PASS' : '❌ FAIL'}`);
+    console.log(`Total Capabilities: ${result.summary.total}`);
+    console.log(`Passing: ${result.summary.pass}`);
+    console.log(`Failing: ${result.summary.fail}`);
+    
+    if (!result.pass) {
+      console.log('\n' + '-'.repeat(80));
+      console.log('FAILING CAPABILITIES:');
+      console.log('-'.repeat(80));
+      
+      for (const failure of result.summary.allFailures) {
+        console.log(`\n❌ ${failure.capabilityId}`);
+        for (const gateFailure of failure.failures) {
+          console.log(`   └─ ${gateFailure.reasonCode}: ${gateFailure.message}`);
+        }
+        if (failure.warnings && failure.warnings.length > 0) {
+          for (const warning of failure.warnings) {
+            console.log(`   ⚠️  ${warning.reasonCode}: ${warning.message}`);
+          }
+        }
+      }
+      
+      if (verbose) {
+        console.log('\n' + '-'.repeat(80));
+        console.log('REQUIREMENTS BY MATURITY LEVEL:');
+        console.log('-'.repeat(80));
+        console.log('\nEXPERIMENTAL:');
+        console.log('  - Must exist in registry');
+        console.log('  - Must have at least 1 test matrix entry');
+        console.log('\nPARTIAL:');
+        console.log('  - All EXPERIMENTAL requirements');
+        console.log('  - Must have at least 1 realistic fixture mapping');
+        console.log('  - Must have documentation');
+        console.log('\nSTABLE:');
+        console.log('  - All PARTIAL requirements');
+        console.log('  - Must have determinism test coverage');
+        console.log('  - Must have artifact assertions in test matrix');
+        console.log('  - Must have guardrails coverage (if category requires it)');
+      }
+    } else {
+      console.log('\n✅ All capabilities meet their required gates!');
+    }
+    
+    console.log('='.repeat(80) + '\n');
+  }
+  
+  // Exit code: 0 if PASS, 2 if FAIL
+  if (!result.pass) {
+    process.exit(2);
+  }
+}
+

package/src/cli/commands/inspect.js

@@ -37,13 +37,15 @@ export async function inspectCommand(runPath, options = {}) {
   let summary, findings;
   
   try {
-    summary = JSON.parse(readFileSync(`${fullPath}/summary.json`, 'utf8'));
+  // @ts-expect-error - readFileSync with encoding returns string
+    summary = JSON.parse(readFileSync(`${fullPath}/summary.json`, 'utf-8'));
   } catch (error) {
     throw new DataError(`Failed to parse summary.json: ${error.message}`);
   }
   
   try {
-    findings = JSON.parse(readFileSync(`${fullPath}/findings.json`, 'utf8'));
+  // @ts-expect-error - readFileSync with encoding returns string
+    findings = JSON.parse(readFileSync(`${fullPath}/findings.json`, 'utf-8'));
   } catch (error) {
     throw new DataError(`Failed to parse findings.json: ${error.message}`);
   }

package/src/cli/commands/release-check.js

@@ -0,0 +1,215 @@
+/**
+ * PHASE 21.7 — Release Check CLI Command
+ * 
+ * Checks release readiness: GA status, Provenance, SBOM, Reproducibility.
+ * Exit codes: 0 = RELEASE-READY, 5 = RELEASE-BLOCKED, 70 = Internal corruption
+ */
+
+import { buildProvenance, writeProvenance } from '../../verax/core/release/provenance.builder.js';
+import { buildSBOM, writeSBOM } from '../../verax/core/release/sbom.builder.js';
+import { checkReproducibility, writeReproducibilityReport } from '../../verax/core/release/reproducibility.check.js';
+import { checkGAStatus } from '../../verax/core/ga/ga.enforcer.js';
+import { writeReleaseReport } from '../../verax/core/release/release-report-writer.js';
+import { findLatestRunId } from '../util/run-resolver.js';
+import { resolve } from 'path';
+import { existsSync, readFileSync } from 'fs';
+
+/**
+ * Check release readiness
+ * 
+ * @param {Object} options - Options
+ * @param {boolean} [options.json] - Output as JSON
+ */
+export async function releaseCheckCommand(options = {}) {
+  const { json = false } = options;
+  const projectDir = resolve(process.cwd());
+  
+  const status = {
+    ga: { ok: false, status: 'UNKNOWN', blockers: [] },
+    provenance: { ok: false, exists: false, blockers: [] },
+    sbom: { ok: false, exists: false, blockers: [] },
+    reproducibility: { ok: false, verdict: 'UNKNOWN', blockers: [] }
+  };
+  
+  // 1. Check GA status
+  try {
+    const runId = findLatestRunId(projectDir);
+    if (runId) {
+      const gaCheck = checkGAStatus(projectDir, runId);
+      status.ga.ok = gaCheck.ready;
+      status.ga.status = gaCheck.ready ? 'GA-READY' : 'GA-BLOCKED';
+      if (!gaCheck.ready && gaCheck.status?.blockers) {
+        status.ga.blockers = gaCheck.status.blockers.map(b => b.message);
+      }
+    } else {
+      status.ga.blockers.push('No runs found. Run a scan first.');
+    }
+  } catch (error) {
+    status.ga.blockers.push(`GA check failed: ${error.message}`);
+  }
+  
+  // 2. Check Provenance
+  try {
+    const provenancePath = resolve(projectDir, 'release', 'release.provenance.json');
+    if (existsSync(provenancePath)) {
+      status.provenance.exists = true;
+  // @ts-expect-error - readFileSync with encoding returns string
+      const provenance = JSON.parse(readFileSync(provenancePath, 'utf-8'));
+      
+      // Validate provenance structure
+      if (!provenance.version || !provenance.git || !provenance.env) {
+        status.provenance.blockers.push('Invalid provenance structure');
+      } else if (provenance.git.dirty) {
+        status.provenance.blockers.push('Provenance indicates dirty git repository');
+      } else if (provenance.gaStatus !== 'GA-READY') {
+        status.provenance.blockers.push(`GA status is ${provenance.gaStatus}, not GA-READY`);
+      } else {
+        status.provenance.ok = true;
+      }
+    } else {
+      // Try to build it
+      try {
+        const provenance = await buildProvenance(projectDir);
+        writeProvenance(projectDir, provenance);
+        status.provenance.exists = true;
+        status.provenance.ok = true;
+      } catch (error) {
+        status.provenance.blockers.push(`Cannot build provenance: ${error.message}`);
+      }
+    }
+  } catch (error) {
+    status.provenance.blockers.push(`Provenance check failed: ${error.message}`);
+  }
+  
+  // 3. Check SBOM
+  try {
+    const sbomPath = resolve(projectDir, 'release', 'sbom.json');
+    if (existsSync(sbomPath)) {
+      status.sbom.exists = true;
+  // @ts-expect-error - readFileSync with encoding returns string
+      const sbom = JSON.parse(readFileSync(sbomPath, 'utf-8'));
+      
+      // Validate SBOM structure
+      if (!sbom.bomFormat || !sbom.components || !Array.isArray(sbom.components)) {
+        status.sbom.blockers.push('Invalid SBOM structure');
+      } else if (sbom.components.length === 0) {
+        status.sbom.blockers.push('SBOM has no components');
+      } else {
+        status.sbom.ok = true;
+      }
+    } else {
+      // Try to build it
+      try {
+        const sbom = await buildSBOM(projectDir);
+        writeSBOM(projectDir, sbom);
+        status.sbom.exists = true;
+        status.sbom.ok = true;
+      } catch (error) {
+        status.sbom.blockers.push(`Cannot build SBOM: ${error.message}`);
+      }
+    }
+  } catch (error) {
+    status.sbom.blockers.push(`SBOM check failed: ${error.message}`);
+  }
+  
+  // 4. Check Reproducibility
+  try {
+    const report = await checkReproducibility(projectDir);
+    writeReproducibilityReport(projectDir, report);
+    
+    if (report.verdict === 'REPRODUCIBLE') {
+      status.reproducibility.ok = true;
+      status.reproducibility.verdict = 'REPRODUCIBLE';
+    } else {
+      status.reproducibility.verdict = 'NON_REPRODUCIBLE';
+      if (report.differences && report.differences.length > 0) {
+        status.reproducibility.blockers = report.differences.map(d => d.message);
+      } else {
+        status.reproducibility.blockers.push('Build is not reproducible');
+      }
+    }
+  } catch (error) {
+    status.reproducibility.blockers.push(`Reproducibility check failed: ${error.message}`);
+  }
+  
+  // Determine overall status
+  const allOk = status.ga.ok && status.provenance.ok && status.sbom.ok && status.reproducibility.ok;
+  const hasInternalCorruption = 
+    status.ga.blockers.some(b => b.includes('corruption') || b.includes('INTERNAL')) ||
+    status.provenance.blockers.some(b => b.includes('corruption')) ||
+    status.sbom.blockers.some(b => b.includes('corruption'));
+  
+  // Write release report
+  const releaseStatus = {
+    releaseReady: allOk,
+    status,
+    summary: {
+      ga: status.ga.ok ? 'OK' : 'BLOCKED',
+      provenance: status.provenance.ok ? 'OK' : 'BLOCKED',
+      sbom: status.sbom.ok ? 'OK' : 'BLOCKED',
+      reproducibility: status.reproducibility.ok ? 'OK' : 'BLOCKED'
+    }
+  };
+  const releaseReportPath = writeReleaseReport(projectDir, releaseStatus);
+  
+  // Output
+  if (json) {
+    console.log(JSON.stringify({
+      releaseReady: allOk,
+      status,
+      summary: {
+        ga: status.ga.ok ? 'OK' : 'BLOCKED',
+        provenance: status.provenance.ok ? 'OK' : 'BLOCKED',
+        sbom: status.sbom.ok ? 'OK' : 'BLOCKED',
+        reproducibility: status.reproducibility.ok ? 'OK' : 'BLOCKED'
+      },
+      reportPath: releaseReportPath
+    }, null, 2));
+  } else {
+    console.log('\n' + '='.repeat(80));
+    console.log('RELEASE READINESS CHECK');
+    console.log('='.repeat(80));
+    
+    console.log(`\nGA Status: ${status.ga.ok ? '✅ READY' : '❌ BLOCKED'}`);
+    if (status.ga.blockers.length > 0) {
+      for (const blocker of status.ga.blockers) {
+        console.log(`  - ${blocker}`);
+      }
+    }
+    
+    console.log(`\nProvenance: ${status.provenance.ok ? '✅ OK' : '❌ BLOCKED'}`);
+    if (status.provenance.blockers.length > 0) {
+      for (const blocker of status.provenance.blockers) {
+        console.log(`  - ${blocker}`);
+      }
+    }
+    
+    console.log(`\nSBOM: ${status.sbom.ok ? '✅ OK' : '❌ BLOCKED'}`);
+    if (status.sbom.blockers.length > 0) {
+      for (const blocker of status.sbom.blockers) {
+        console.log(`  - ${blocker}`);
+      }
+    }
+    
+    console.log(`\nReproducibility: ${status.reproducibility.ok ? '✅ REPRODUCIBLE' : '❌ NON_REPRODUCIBLE'}`);
+    if (status.reproducibility.blockers.length > 0) {
+      for (const blocker of status.reproducibility.blockers) {
+        console.log(`  - ${blocker}`);
+      }
+    }
+    
+    console.log(`\nOverall: ${allOk ? '✅ RELEASE-READY' : '❌ RELEASE-BLOCKED'}`);
+    console.log(`\nSee report: ${releaseReportPath}`);
+    console.log('='.repeat(80) + '\n');
+  }
+  
+  // Exit codes: 0 = RELEASE-READY, 2 = RELEASE-BLOCKED, 70 = Internal corruption
+  if (allOk) {
+    process.exit(0);
+  } else if (hasInternalCorruption) {
+    process.exit(70);
+  } else {
+    process.exit(2);
+  }
+}
+

package/src/cli/commands/run.js

@@ -17,6 +17,8 @@ import { detectFindings } from '../util/detection-engine.js';
 import { writeFindingsJson } from '../util/findings-writer.js';
 import { writeSummaryJson } from '../util/summary-writer.js';
 import { computeRuntimeBudget, withTimeout } from '../util/runtime-budget.js';
+import { saveDigest } from '../util/digest-engine.js';
+import { ARTIFACT_REGISTRY, getArtifactVersions } from '../../verax/core/artifacts/registry.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -24,7 +26,8 @@ const __dirname = dirname(__filename);
 function getVersion() {
   try {
     const pkgPath = resolve(__dirname, '../../../package.json');
-    const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+  // @ts-expect-error - readFileSync with encoding returns string
+    const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
     return pkg.version;
   } catch {
     return '0.2.0';
@@ -92,6 +95,8 @@ export async function runCommand(options) {
       try {
         const failedAt = new Date().toISOString();
         atomicWriteJson(paths.runStatusJson, {
+          contractVersion: 1,
+          artifactVersions: getArtifactVersions(),
           status: 'FAILED',
           runId,
           startedAt,
@@ -100,6 +105,7 @@ export async function runCommand(options) {
         });
         
         atomicWriteJson(paths.runMetaJson, {
+          contractVersion: ARTIFACT_REGISTRY.runMeta.contractVersion,
           veraxVersion: getVersion(),
           nodeVersion: process.version,
           platform: process.platform,
@@ -147,7 +153,7 @@ export async function runCommand(options) {
   
   try {
     // Generate run ID
-    runId = generateRunId();
+    runId = generateRunId(url);
     if (verbose && !json) console.log(`Run ID: ${runId}`);
     
     paths = getRunPaths(projectRoot, out, runId);
@@ -197,6 +203,8 @@ export async function runCommand(options) {
     startedAt = now.toISOString();
     
     atomicWriteJson(paths.runStatusJson, {
+      contractVersion: 1,
+      artifactVersions: getArtifactVersions(),
       status: 'RUNNING',
       runId,
       startedAt,
@@ -204,6 +212,7 @@ export async function runCommand(options) {
     
     // Write metadata
     atomicWriteJson(paths.runMetaJson, {
+      contractVersion: ARTIFACT_REGISTRY.runMeta.contractVersion,
       veraxVersion: getVersion(),
       nodeVersion: process.version,
       platform: process.platform,
@@ -291,7 +300,8 @@ export async function runCommand(options) {
               paths.evidenceDir,
               (progress) => {
                 events.emit(progress.event, progress);
-              }
+              },
+              {}
             ),
             'Observe'
           );
@@ -404,6 +414,8 @@ export async function runCommand(options) {
     
     // Write completed status
     atomicWriteJson(paths.runStatusJson, {
+      contractVersion: 1,
+      artifactVersions: getArtifactVersions(),
       status: 'COMPLETE',
       runId,
       startedAt,
@@ -412,6 +424,7 @@ export async function runCommand(options) {
     
     // Update metadata with completion time
     atomicWriteJson(paths.runMetaJson, {
+      contractVersion: ARTIFACT_REGISTRY.runMeta.contractVersion,
       veraxVersion: getVersion(),
       nodeVersion: process.version,
       platform: process.platform,
@@ -481,6 +494,11 @@ export async function runCommand(options) {
     // Write observe results
     writeObserveJson(paths.baseDir, observeData);
     
+    // H5: Write deterministic digest for reproducibility proof
+    if (observeData && observeData.digest) {
+      saveDigest(resolve(paths.baseDir, 'run.digest.json'), observeData.digest);
+    }
+    
     events.emit('phase:completed', {
       phase: 'Finalize Artifacts',
       message: 'Run artifacts written',
@@ -508,9 +526,27 @@ export async function runCommand(options) {
     
     // Print summary if not JSON mode
     if (!json) {
-      console.log('\nRun complete.');
-      console.log(`Run ID: ${runId}`);
-      console.log(`Artifacts: ${paths.baseDir}`);
+      const relativePath = paths.baseDir.replace(/\\/g, '/').split('/').slice(-1)[0];
+      console.log('');
+      console.log('VERAX — Silent Failure Detection');
+      console.log('');
+      console.log(`✔ URL: ${url}`);
+      console.log('');
+      console.log('Learn phase:');
+      console.log(`  → Extracted ${expectations.length} promises`);
+      console.log('');
+      console.log('Observe phase:');
+      console.log(`  → Executed ${observeData.stats?.attempted || 0} interactions`);
+      console.log(`  → Observed: ${observeData.stats?.observed || 0}/${observeData.stats?.attempted || 0}`);
+      console.log('');
+      console.log('Detect phase:');
+      console.log(`  → Silent failures: ${detectData.stats?.silentFailures || 0}`);
+      console.log(`  → Unproven: ${detectData.stats?.unproven || 0}`);
+      console.log(`  → Coverage gaps: ${detectData.stats?.coverageGaps || 0}`);
+      console.log('');
+      console.log('Artifacts written to:');
+      console.log(`  .verax/runs/${relativePath}/`);
+      console.log('');
     }
     
     return { runId, paths, success: true };
@@ -528,6 +564,8 @@ export async function runCommand(options) {
       try {
         const failedAt = new Date().toISOString();
         atomicWriteJson(paths.runStatusJson, {
+          contractVersion: 1,
+          artifactVersions: getArtifactVersions(),
           status: 'FAILED',
           runId,
           startedAt,
@@ -537,6 +575,7 @@ export async function runCommand(options) {
         
         // Update metadata
         atomicWriteJson(paths.runMetaJson, {
+          contractVersion: ARTIFACT_REGISTRY.runMeta.contractVersion,
           veraxVersion: getVersion(),
           nodeVersion: process.version,
           platform: process.platform,

package/src/cli/commands/security-check.js

@@ -0,0 +1,212 @@
+/**
+ * PHASE 21.8 — Security Check CLI Command
+ * 
+ * Checks security baseline: secrets, vulnerabilities, supply-chain.
+ * Exit codes: 0 = SECURITY-OK, 6 = SECURITY-BLOCKED, 70 = Internal corruption
+ */
+
+import { scanSecrets, writeSecretsReport } from '../../verax/core/security/secrets.scan.js';
+import { scanVulnerabilities, writeVulnReport } from '../../verax/core/security/vuln.scan.js';
+import { evaluateSupplyChainPolicy, writeSupplyChainReport } from '../../verax/core/security/supplychain.policy.js';
+import { writeSecurityReport } from '../../verax/core/security/security-report.js';
+import { resolve } from 'path';
+import { mkdirSync as _mkdirSync, existsSync } from 'fs';
+
+/**
+ * Security check command
+ * 
+ * @param {Object} options - Options
+ * @param {boolean} [options.json] - Output as JSON
+ */
+export async function securityCheckCommand(options = {}) {
+  const { json = false } = options;
+  const projectDir = resolve(process.cwd());
+  
+  const status = {
+    secrets: { ok: false, hasSecrets: false, blockers: [], tool: 'VERAX_SECRETS_SCANNER' },
+    vulnerabilities: { ok: false, blocking: false, blockers: [], warnings: [], tool: null, availability: 'UNKNOWN' },
+    supplychain: { ok: false, violations: [], blockers: [], tool: 'VERAX_SUPPLYCHAIN_POLICY' }
+  };
+  
+  // 1. Scan for secrets
+  try {
+    const secretsResult = await scanSecrets(projectDir);
+    writeSecretsReport(projectDir, secretsResult);
+    
+    status.secrets.ok = secretsResult.ok;
+    status.secrets.hasSecrets = secretsResult.hasSecrets;
+    
+    if (secretsResult.hasSecrets) {
+      const critical = secretsResult.findings.filter(f => f.severity === 'CRITICAL');
+      const high = secretsResult.findings.filter(f => f.severity === 'HIGH');
+      
+      if (critical.length > 0) {
+        status.secrets.blockers.push(`${critical.length} CRITICAL secret(s) detected`);
+      }
+      if (high.length > 0) {
+        status.secrets.blockers.push(`${high.length} HIGH severity secret(s) detected`);
+      }
+      
+      // Add sample findings (first 3)
+      const sampleFindings = secretsResult.findings.slice(0, 3).map(f => 
+        `${f.type} in ${f.file}:${f.line}`
+      );
+      status.secrets.blockers.push(`Sample findings: ${sampleFindings.join(', ')}`);
+    }
+  } catch (error) {
+    status.secrets.blockers.push(`Secrets scan failed: ${error.message}`);
+  }
+  
+  // 2. Scan vulnerabilities
+  let vulnResult = null;
+  try {
+    vulnResult = await scanVulnerabilities(projectDir);
+    writeVulnReport(projectDir, vulnResult);
+    
+    status.vulnerabilities.ok = !vulnResult.blocking;
+    status.vulnerabilities.blocking = vulnResult.blocking;
+    status.vulnerabilities.tool = vulnResult.tool || null;
+    status.vulnerabilities.availability = vulnResult.availability || 'UNKNOWN';
+    status.vulnerabilities.osvAvailable = vulnResult.osvAvailable || false;
+    
+    if (vulnResult.availability === 'NOT_AVAILABLE') {
+      status.vulnerabilities.warnings.push('OSV scanner not available, using npm audit fallback');
+    }
+    
+    if (vulnResult.blocking) {
+      if (vulnResult.summary.critical > 0) {
+        status.vulnerabilities.blockers.push(`${vulnResult.summary.critical} CRITICAL vulnerability/vulnerabilities`);
+      }
+      if (vulnResult.summary.high > 0) {
+        status.vulnerabilities.blockers.push(`${vulnResult.summary.high} HIGH severity vulnerability/vulnerabilities`);
+      }
+    }
+    
+    if (vulnResult.summary.medium > 0 && !vulnResult.blocking) {
+      status.vulnerabilities.warnings.push(`${vulnResult.summary.medium} MEDIUM severity vulnerability/vulnerabilities (non-blocking)`);
+    }
+  } catch (error) {
+    status.vulnerabilities.blockers.push(`Vulnerability scan failed: ${error.message}`);
+  }
+  
+  // 3. Check supply-chain policy
+  let supplyChainResult = null;
+  try {
+    supplyChainResult = await evaluateSupplyChainPolicy(projectDir);
+    writeSupplyChainReport(projectDir, supplyChainResult);
+    
+    status.supplychain.ok = supplyChainResult.ok;
+    status.supplychain.violations = supplyChainResult.violations;
+    
+    if (!supplyChainResult.ok) {
+      for (const violation of supplyChainResult.violations) {
+        status.supplychain.blockers.push(violation.message);
+      }
+    }
+  } catch (error) {
+    status.supplychain.blockers.push(`Supply-chain check failed: ${error.message}`);
+  }
+  
+  // Determine overall status
+  const allOk = status.secrets.ok && status.vulnerabilities.ok && status.supplychain.ok;
+  
+  // Write unified security report
+  let secretsReport = null;
+  try {
+    const secretsPath = resolve(projectDir, 'release', 'security.secrets.report.json');
+    if (existsSync(secretsPath)) {
+      const { readFileSync } = await import('fs');
+  // @ts-expect-error - readFileSync with encoding returns string
+      secretsReport = JSON.parse(readFileSync(secretsPath, 'utf-8'));
+    }
+  } catch {
+    // Ignore
+  }
+  
+  let vulnReportData = vulnResult;
+  let supplyChainReportData = supplyChainResult;
+  
+  const unifiedReport = {
+    securityOk: allOk,
+    status,
+    summary: {
+      secrets: status.secrets.ok ? 'OK' : 'BLOCKED',
+      vulnerabilities: status.vulnerabilities.ok ? 'OK' : (status.vulnerabilities.blocking ? 'BLOCKED' : (status.vulnerabilities.availability === 'NOT_AVAILABLE' ? 'NOT_AVAILABLE' : 'WARN')),
+      supplychain: status.supplychain.ok ? 'OK' : 'BLOCKED'
+    },
+    secretsReport,
+    vulnReport: vulnReportData,
+    supplyChainReport: supplyChainReportData
+  };
+  
+  const unifiedReportPath = writeSecurityReport(projectDir, unifiedReport);
+  const hasInternalCorruption = 
+    status.secrets.blockers.some(b => b.includes('corruption') || b.includes('Internal')) ||
+    status.vulnerabilities.blockers.some(b => b.includes('corruption')) ||
+    status.supplychain.blockers.some(b => b.includes('corruption'));
+  
+  // Output
+  if (json) {
+    console.log(JSON.stringify({
+      securityOk: allOk,
+      status,
+      summary: {
+        secrets: status.secrets.ok ? 'OK' : 'BLOCKED',
+        vulnerabilities: status.vulnerabilities.ok ? 'OK' : (status.vulnerabilities.blocking ? 'BLOCKED' : (status.vulnerabilities.availability === 'NOT_AVAILABLE' ? 'NOT_AVAILABLE' : 'WARN')),
+        supplychain: status.supplychain.ok ? 'OK' : 'BLOCKED'
+      },
+      unifiedReportPath: unifiedReportPath
+    }, null, 2));
+  } else {
+    console.log('\n' + '='.repeat(80));
+    console.log('SECURITY BASELINE CHECK');
+    console.log('='.repeat(80));
+    
+    console.log(`\nSecrets: ${status.secrets.ok ? '✅ OK' : '❌ BLOCKED'}`);
+    if (status.secrets.blockers.length > 0) {
+      for (const blocker of status.secrets.blockers) {
+        console.log(`  - ${blocker}`);
+      }
+    }
+    
+    console.log(`\nVulnerabilities: ${status.vulnerabilities.ok ? '✅ OK' : (status.vulnerabilities.blocking ? '❌ BLOCKED' : '⚠️  WARN')}`);
+    if (status.vulnerabilities.blockers.length > 0) {
+      for (const blocker of status.vulnerabilities.blockers) {
+        console.log(`  - ${blocker}`);
+      }
+    }
+    if (status.vulnerabilities.warnings.length > 0) {
+      for (const warning of status.vulnerabilities.warnings) {
+        console.log(`  ⚠️  ${warning}`);
+      }
+    }
+    
+    console.log(`\nSupply-chain: ${status.supplychain.ok ? '✅ OK' : '❌ BLOCKED'}`);
+    if (status.supplychain.blockers.length > 0) {
+      for (const blocker of status.supplychain.blockers) {
+        console.log(`  - ${blocker}`);
+      }
+    }
+    
+    console.log(`\nOverall: ${allOk ? '✅ SECURITY-OK' : '❌ SECURITY-BLOCKED'}`);
+    console.log(`\nSee unified report: ${unifiedReportPath}`);
+    console.log('='.repeat(80) + '\n');
+  }
+  
+  // Exit codes: 0 = SECURITY-OK, 6 = SECURITY-BLOCKED, 70 = Internal corruption
+  // NOT_AVAILABLE tools exit 0 only if policy allows (strict mode would exit 2)
+  const hasNotAvailable = status.vulnerabilities.availability === 'NOT_AVAILABLE';
+  const strictMode = process.env.VERAX_SECURITY_STRICT === '1';
+  
+  if (allOk) {
+    process.exit(0);
+  } else if (hasNotAvailable && !strictMode) {
+    // NOT_AVAILABLE is not a blocker unless strict mode
+    process.exit(0);
+  } else if (hasInternalCorruption) {
+    process.exit(70);
+  } else {
+    process.exit(6);
+  }
+}
+