@vk.amogh/trace 2.1.0

package/src/trace_engine/runtime/observations.py

@@ -0,0 +1,18 @@
+"""Runtime test observations and HTTP exchange records."""
+
+from typing import Dict, Any, Optional, List
+from pydantic import BaseModel, Field
+
+
+class RuntimeObservation(BaseModel):
+    """Detailed observation from executing a test request against a target."""
+    request_method: str
+    request_url: str
+    request_headers: Dict[str, str] = Field(default_factory=dict)
+    request_body: Optional[str] = None
+    response_status: int
+    response_headers: Dict[str, str] = Field(default_factory=dict)
+    response_body: str = ""
+    latency_ms: float = 0.0
+    is_anomaly: bool = False
+    observation_notes: List[str] = Field(default_factory=list)

package/src/trace_engine/runtime/target.py

@@ -0,0 +1,23 @@
+"""Target runtime specification."""
+
+from urllib.parse import urlparse
+from pydantic import BaseModel, Field
+
+
+class Target(BaseModel):
+    """Runtime target specification for security validation."""
+    url: str
+    scheme: str = "http"
+    host: str = "127.0.0.1"
+    port: int = 8000
+    base_path: str = ""
+
+    @classmethod
+    def from_url(cls, url: str) -> "Target":
+        parsed = urlparse(url)
+        scheme = parsed.scheme or "http"
+        host = parsed.hostname or "127.0.0.1"
+        port = parsed.port or (443 if scheme == "https" else 80)
+        base_path = parsed.path.rstrip("/")
+        normalized_url = f"{scheme}://{host}:{port}{base_path}"
+        return cls(url=normalized_url, scheme=scheme, host=host, port=port, base_path=base_path)

package/src/trace_engine/security/__init__.py

@@ -0,0 +1,16 @@
+"""Security signals and hypotheses module."""
+
+from trace_engine.security.signals import SignalType, SecuritySignal
+from trace_engine.security.hypotheses import (
+    VulnerabilityCategory,
+    SecurityHypothesis,
+    HypothesisEngine,
+)
+
+__all__ = [
+    "SignalType",
+    "SecuritySignal",
+    "VulnerabilityCategory",
+    "SecurityHypothesis",
+    "HypothesisEngine",
+]

package/src/trace_engine/security/fusion.py

@@ -0,0 +1,126 @@
+"""Neuro-Symbolic Confidence Fusion Engine combining Neural, AST, and Dynamic Evidence via Bayesian calibration.
+
+Implements the 3-Signal Bayesian Evidence Fusion model:
+Confidence = 1 - (1 - P_SecureBERT) * (1 - P_AST_Dataflow) * (1 - P_Dynamic_Oracle)
+
+Levels:
+- Level 3 (Triple Match): SecureBERT (0.85) + AST dataflow sink + Dynamic probe error -> Confidence ~99.8% (Critical / Zero-False-Positive Verified).
+- Level 2 (Static + Dynamic Partial): Probe blocked by WAF, but AST source-to-sink dataflow is proven -> Confidence ~82% (High / Code-Audited).
+- Level 1 (Single Signal): Only SecureBERT flags it with no AST sink -> Soft hypothesis for agent exploration.
+"""
+
+import math
+from typing import Optional, Dict, Any, List
+from pydantic import BaseModel, Field
+from trace_engine.findings.model import FindingConfidence
+
+
+class ConfidenceEvidence(BaseModel):
+    """Signals supplied to the Bayesian Fusion Engine."""
+    neural_score: Optional[float] = Field(None, description="SecureBERT 2.0 probability [0.0 - 1.0]")
+    symbolic_ast_score: float = Field(0.5, description="AST dataflow & reachability confidence [0.0 - 1.0]")
+    dynamic_test_score: Optional[float] = Field(None, description="Active probe verification confidence [0.0 - 1.0]")
+    is_dynamically_confirmed: bool = Field(False, description="True if exploit payload was actively verified")
+    has_sanitizer: bool = Field(False, description="True if defensive guard/sanitizer was identified in AST")
+
+
+class FusedConfidenceResult(BaseModel):
+    """Calibrated result from Neuro-Symbolic Bayesian evidence fusion."""
+    posterior_probability: float = Field(..., description="Calibrated Bayesian posterior [0.0 - 1.0]")
+    confidence_level: FindingConfidence = Field(..., description="Discrete confidence category")
+    log_odds: float = Field(..., description="Log-odds score")
+    fusion_level: str = Field(..., description="Level 1, Level 2, or Level 3")
+    evidence_breakdown: Dict[str, float] = Field(default_factory=dict)
+    rationale: str = Field(..., description="Explanation of signal weights and fusion outcome")
+
+
+class NeuroSymbolicConfidenceEngine:
+    """Combines Neural (System 1 SecureBERT), Symbolic AST (System 2 Dataflow Sinks),
+    and Dynamic Verification signals into mathematically calibrated Bayesian confidence.
+    """
+
+    @classmethod
+    def fuse_evidence(cls, evidence: ConfidenceEvidence) -> FusedConfidenceResult:
+        """Calculates calibrated posterior probability from multiple independent security signals:
+        Confidence = 1 - (1 - P_SecureBERT) * (1 - P_AST_Dataflow) * (1 - P_Dynamic_Oracle)
+        """
+        # 1. Neural Signal (SecureBERT)
+        p_bert = 0.0
+        if evidence.neural_score is not None:
+            p_bert = max(0.0, min(0.99, evidence.neural_score))
+
+        # 2. Symbolic AST Signal (Dataflow Sinks & Control Flow)
+        p_ast = max(0.0, min(0.99, evidence.symbolic_ast_score))
+        if evidence.has_sanitizer:
+            p_ast = p_ast * 0.15  # 85% penalty if sanitizer or validator detected in AST
+
+        # 3. Dynamic Signal (Active Testpack Probes & Timing Oracle)
+        p_dyn = 0.0
+        if evidence.is_dynamically_confirmed:
+            p_dyn = 0.99
+        elif evidence.dynamic_test_score is not None:
+            p_dyn = max(0.0, min(0.99, evidence.dynamic_test_score))
+
+        # Bayesian Independence Fusion Formula:
+        # Confidence = 1 - (1 - P_SecureBERT) * (1 - P_AST_Dataflow) * (1 - P_Dynamic_Oracle)
+        prob_not_vuln = (1.0 - p_bert) * (1.0 - p_ast) * (1.0 - p_dyn)
+        raw_confidence = 1.0 - prob_not_vuln
+        posterior = round(max(0.01, min(0.999, raw_confidence)), 4)
+
+        # Log-odds representation:
+        p_clamped = max(0.001, min(0.999, posterior))
+        log_odds = round(math.log(p_clamped / (1.0 - p_clamped)), 3)
+
+        # Classify into Levels
+        signals_present = sum([
+            1 if p_bert >= 0.4 else 0,
+            1 if p_ast >= 0.4 else 0,
+            1 if p_dyn >= 0.4 else 0,
+        ])
+
+        if evidence.is_dynamically_confirmed or (signals_present >= 3 and posterior >= 0.95):
+            fusion_level = "Level 3 (Triple Match: Neural + AST + Dynamic Runtime Confirmation)"
+            level = FindingConfidence.CONFIRMED
+        elif (signals_present >= 2 and posterior >= 0.75) or posterior >= 0.80:
+            fusion_level = "Level 2 (Static + Dynamic Partial: Proven AST Dataflow Sink)"
+            level = FindingConfidence.HIGH
+        elif posterior >= 0.50:
+            fusion_level = "Level 1 (Single Signal: Exploratory Hypothesis)"
+            level = FindingConfidence.MEDIUM
+        else:
+            fusion_level = "Level 1 (Low Confidence / Mitigated Signal)"
+            level = FindingConfidence.POTENTIAL
+
+        breakdown = {
+            "p_securebert": round(p_bert, 3),
+            "p_ast_dataflow": round(p_ast, 3),
+            "p_dynamic_oracle": round(p_dyn, 3),
+            "fused_confidence": posterior,
+            "has_sanitizer": 1.0 if evidence.has_sanitizer else 0.0,
+        }
+
+        signals = []
+        if p_dyn >= 0.90:
+            signals.append("empirically verified by dynamic runtime oracle")
+        elif p_dyn > 0.3:
+            signals.append(f"dynamic response signature ({int(p_dyn*100)}%)")
+        if p_bert > 0.4:
+            signals.append(f"SecureBERT semantic match ({int(p_bert*100)}%)")
+        if p_ast > 0.4:
+            signals.append(f"AST unparameterized sink reachability ({int(p_ast*100)}%)")
+        if evidence.has_sanitizer:
+            signals.append("downweighted: input sanitizer detected in AST")
+
+        rationale = (
+            f"Bayesian Evidence Fusion: {fusion_level} with calibrated confidence {int(posterior*100)}%. "
+            f"Signals: {'; '.join(signals) if signals else 'baseline hypothesis'}."
+        )
+
+        return FusedConfidenceResult(
+            posterior_probability=posterior,
+            confidence_level=level,
+            log_odds=log_odds,
+            fusion_level=fusion_level,
+            evidence_breakdown=breakdown,
+            rationale=rationale,
+        )

package/src/trace_engine/security/hypotheses.py

@@ -0,0 +1,251 @@
+"""Security hypotheses generation from APM and deterministic signals."""
+
+from enum import Enum
+from typing import List, Dict, Any, Optional
+from pydantic import BaseModel, Field
+from trace_engine.apm.model import AttackPathModel
+from trace_engine.framework.base import Endpoint
+from trace_engine.security.signals import SecuritySignal, SignalType
+
+
+class VulnerabilityCategory(str, Enum):
+    BOLA = "BOLA"
+    BFLA = "BFLA"
+    AUTHENTICATION = "AUTHENTICATION"
+    SSRF = "SSRF"
+    INJECTION = "INJECTION"
+    MASS_ASSIGNMENT = "MASS_ASSIGNMENT"
+    PATH_TRAVERSAL = "PATH_TRAVERSAL"
+    SSTI = "SSTI"
+    CORS = "CORS"
+    DESERIALIZATION = "DESERIALIZATION"
+
+
+class SecurityHypothesis(BaseModel):
+    """A testable hypothesis about an attack path in the application."""
+    id: str
+    category: VulnerabilityCategory
+    endpoint_id: str
+    endpoint_display: str
+    title: str
+    description: str
+    recommended_test_pack: str
+    confidence_prior: float = 0.5  # Prior confidence from static signals alone
+    static_evidence: List[str] = Field(default_factory=list)
+
+
+class HypothesisEngine:
+    """Analyzes APM and endpoints to derive actionable security hypotheses."""
+
+    def derive_hypotheses(
+        self, apm: AttackPathModel, endpoints: List[Endpoint]
+    ) -> List[SecurityHypothesis]:
+        hypotheses: List[SecurityHypothesis] = []
+        hypo_idx = 1
+
+        for ep in endpoints:
+            ep_disp = ep.display_name()
+
+            # 1. BOLA Hypothesis: Endpoint accepts ID parameter, touches DB, but lacks ownership verification
+            if ep.object_identifier and ep.database_access:
+                hypotheses.append(
+                    SecurityHypothesis(
+                        id=f"HYP-BOLA-{hypo_idx:03d}",
+                        category=VulnerabilityCategory.BOLA,
+                        endpoint_id=ep.id,
+                        endpoint_display=ep_disp,
+                        title=f"Potential BOLA on {ep_disp}",
+                        description="Endpoint looks up objects by client-supplied ID with potential absence of tenant/user ownership check.",
+                        recommended_test_pack="bola",
+                        confidence_prior=0.75,
+                        static_evidence=[
+                            f"Path parameter matches object ID pattern: {[p.name for p in ep.parameters if p.location == 'path']}",
+                            "Database lookup confirmed in handler source",
+                            f"Declared auth required: {ep.auth_required}",
+                        ],
+                    )
+                )
+                hypo_idx += 1
+
+            # 2. BFLA Hypothesis: Endpoint has administrative or privileged semantics
+            if "admin" in ep.path.lower() or "admin" in [r.lower() for r in ep.roles]:
+                hypotheses.append(
+                    SecurityHypothesis(
+                        id=f"HYP-BFLA-{hypo_idx:03d}",
+                        category=VulnerabilityCategory.BFLA,
+                        endpoint_id=ep.id,
+                        endpoint_display=ep_disp,
+                        title=f"Potential BFLA on privileged endpoint {ep_disp}",
+                        description="Administrative/privileged action may fail to enforce strict RBAC check at runtime.",
+                        recommended_test_pack="bfla",
+                        confidence_prior=0.70,
+                        static_evidence=[
+                            f"Privileged path/role identifier present: {ep.roles or ['admin path']}",
+                            f"Source location: {ep.source}",
+                        ],
+                    )
+                )
+                hypo_idx += 1
+
+            # 3. Authentication Bypass / Missing Auth: State-changing endpoint without auth
+            if not ep.auth_required and (ep.state_changing or ep.sensitive_data):
+                if not ep.path.endswith("/login") and not ep.path.endswith("/register"):
+                    hypotheses.append(
+                        SecurityHypothesis(
+                            id=f"HYP-AUTH-{hypo_idx:03d}",
+                            category=VulnerabilityCategory.AUTHENTICATION,
+                            endpoint_id=ep.id,
+                            endpoint_display=ep_disp,
+                            title=f"Unauthenticated sensitive endpoint {ep_disp}",
+                            description="Sensitive or state-modifying endpoint does not declare authentication requirement.",
+                            recommended_test_pack="authentication",
+                            confidence_prior=0.80,
+                            static_evidence=[
+                                f"State-changing: {ep.state_changing}",
+                                f"Sensitive data indicator: {ep.sensitive_data}",
+                                "No auth middleware or dependency detected",
+                            ],
+                        )
+                    )
+                    hypo_idx += 1
+
+            # 4. SSRF Hypothesis: Endpoint takes URL or makes external network calls
+            if ep.external_network or any("url" in p.name.lower() for p in ep.parameters):
+                hypotheses.append(
+                    SecurityHypothesis(
+                        id=f"HYP-SSRF-{hypo_idx:03d}",
+                        category=VulnerabilityCategory.SSRF,
+                        endpoint_id=ep.id,
+                        endpoint_display=ep_disp,
+                        title=f"Potential SSRF on {ep_disp}",
+                        description="Endpoint handles URL parameter and communicates with outbound HTTP client.",
+                        recommended_test_pack="ssrf",
+                        confidence_prior=0.85,
+                        static_evidence=[
+                            "Outbound HTTP client calls detected in handler body",
+                            f"URL parameter detected: {[p.name for p in ep.parameters if 'url' in p.name.lower()]}",
+                        ],
+                    )
+                )
+                hypo_idx += 1
+
+            # 5. Mass Assignment Hypothesis: PATCH or PUT or POST on user or profile
+            if ep.method in ("PATCH", "PUT", "POST") and any(term in ep.path.lower() for term in ("user", "profile", "account")):
+                hypotheses.append(
+                    SecurityHypothesis(
+                        id=f"HYP-MASS-{hypo_idx:03d}",
+                        category=VulnerabilityCategory.MASS_ASSIGNMENT,
+                        endpoint_id=ep.id,
+                        endpoint_display=ep_disp,
+                        title=f"Potential Mass Assignment on {ep_disp}",
+                        description="Profile update endpoint may bind sensitive attributes (e.g. is_admin, role) directly from payload.",
+                        recommended_test_pack="mass_assignment",
+                        confidence_prior=0.65,
+                        static_evidence=[
+                            f"State modifying method {ep.method} on profile/user path",
+                            "Model payload deserialization detected",
+                        ],
+                    )
+                )
+                hypo_idx += 1
+
+            # 6. Injection Indicator Hypothesis: Search or query with DB access
+            if any(term in ep.path.lower() for term in ("search", "filter", "query")) and ep.database_access:
+                hypotheses.append(
+                    SecurityHypothesis(
+                        id=f"HYP-INJ-{hypo_idx:03d}",
+                        category=VulnerabilityCategory.INJECTION,
+                        endpoint_id=ep.id,
+                        endpoint_display=ep_disp,
+                        title=f"Potential Injection Indicator on {ep_disp}",
+                        description="Dynamic search query routed to database layer without verified parameterization.",
+                        recommended_test_pack="injection",
+                        confidence_prior=0.60,
+                        static_evidence=[
+                            "User query parameter routed to database handler",
+                            f"Endpoint parameters: {[p.name for p in ep.parameters]}",
+                        ],
+                    )
+                )
+                hypo_idx += 1
+
+            # 7. Path Traversal Hypothesis: Endpoints accepting file or path parameters
+            file_param_names = [p.name for p in ep.parameters if any(term in p.name.lower() for term in ("file", "path", "doc", "dir", "download", "name", "asset", "key"))]
+            if file_param_names or any(term in ep.path.lower() for term in ("file", "doc", "download", "asset", "static")):
+                hypotheses.append(
+                    SecurityHypothesis(
+                        id=f"HYP-TRAV-{hypo_idx:03d}",
+                        category=VulnerabilityCategory.PATH_TRAVERSAL,
+                        endpoint_id=ep.id,
+                        endpoint_display=ep_disp,
+                        title=f"Potential Path Traversal on {ep_disp}",
+                        description="Endpoint handles file or path parameters without verified filesystem boundary isolation.",
+                        recommended_test_pack="path_traversal",
+                        confidence_prior=0.65,
+                        static_evidence=[
+                            f"File/path parameter names detected: {file_param_names or [ep.path]}",
+                            f"Source location: {ep.source}",
+                        ],
+                    )
+                )
+                hypo_idx += 1
+
+            # 8. Server-Side Template Injection (SSTI) Hypothesis
+            template_param_names = [p.name for p in ep.parameters if any(term in p.name.lower() for term in ("template", "render", "msg", "format", "view", "preview"))]
+            if template_param_names or any(term in ep.path.lower() for term in ("template", "render", "preview", "email", "notify")):
+                hypotheses.append(
+                    SecurityHypothesis(
+                        id=f"HYP-SSTI-{hypo_idx:03d}",
+                        category=VulnerabilityCategory.SSTI,
+                        endpoint_id=ep.id,
+                        endpoint_display=ep_disp,
+                        title=f"Potential Template Injection on {ep_disp}",
+                        description="Endpoint processes dynamic template formatting or user-interpolated rendering.",
+                        recommended_test_pack="ssti",
+                        confidence_prior=0.60,
+                        static_evidence=[
+                            f"Template rendering parameter detected: {template_param_names or [ep.path]}",
+                        ],
+                    )
+                )
+                hypo_idx += 1
+
+            # 9. CORS Misconfiguration Hypothesis
+            if ep.auth_required and ep.sensitive_data:
+                hypotheses.append(
+                    SecurityHypothesis(
+                        id=f"HYP-CORS-{hypo_idx:03d}",
+                        category=VulnerabilityCategory.CORS,
+                        endpoint_id=ep.id,
+                        endpoint_display=ep_disp,
+                        title=f"Potential CORS Misconfiguration on {ep_disp}",
+                        description="Authenticated sensitive endpoint may reflect arbitrary cross-origin request headers with credentials.",
+                        recommended_test_pack="cors",
+                        confidence_prior=0.55,
+                        static_evidence=[
+                            f"Authenticated: {ep.auth_required}, Sensitive data: {ep.sensitive_data}",
+                        ],
+                    )
+                )
+                hypo_idx += 1
+
+            # 10. Insecure Deserialization Hypothesis
+            if ep.method in ("POST", "PUT", "PATCH") and any(term in ep.path.lower() for term in ("import", "upload", "state", "event", "session", "restore", "sync")):
+                hypotheses.append(
+                    SecurityHypothesis(
+                        id=f"HYP-DESER-{hypo_idx:03d}",
+                        category=VulnerabilityCategory.DESERIALIZATION,
+                        endpoint_id=ep.id,
+                        endpoint_display=ep_disp,
+                        title=f"Potential Insecure Deserialization on {ep_disp}",
+                        description="State or data restoration endpoint accepting structured object representations.",
+                        recommended_test_pack="deserialization",
+                        confidence_prior=0.60,
+                        static_evidence=[
+                            f"State restoration path pattern in method {ep.method}: {ep.path}",
+                        ],
+                    )
+                )
+                hypo_idx += 1
+
+        return hypotheses

package/src/trace_engine/security/signals.py

@@ -0,0 +1,28 @@
+"""Deterministic security signal models and static detectors."""
+
+from enum import Enum
+from typing import List, Optional, Dict, Any
+from pydantic import BaseModel, Field
+from trace_engine.parsing.locations import SourceLocation
+
+
+class SignalType(str, Enum):
+    MISSING_AUTH = "MISSING_AUTH"
+    UNTRUSTED_OBJECT_LOOKUP = "UNTRUSTED_OBJECT_LOOKUP"
+    PRIVILEGE_MISMATCH = "PRIVILEGE_MISMATCH"
+    USER_URL_OUTBOUND = "USER_URL_OUTBOUND"
+    DYNAMIC_QUERY_CONSTRUCTION = "DYNAMIC_QUERY_CONSTRUCTION"
+    MASS_ASSIGNMENT_SURFACE = "MASS_ASSIGNMENT_SURFACE"
+
+
+class SecuritySignal(BaseModel):
+    """A deterministic indicator of a potential vulnerability path in source code."""
+    id: str
+    signal_type: SignalType
+    endpoint_id: str
+    title: str
+    description: str
+    severity_potential: str  # "CRITICAL", "HIGH", "MEDIUM", "LOW"
+    source: SourceLocation
+    evidence_snippet: Optional[str] = None
+    properties: Dict[str, Any] = Field(default_factory=dict)

package/src/trace_engine/security/timing.py

@@ -0,0 +1,132 @@
+"""Statistical Timing Oracle using Welch's t-test for bulletproof blind injection verification."""
+
+import math
+from typing import List, Tuple, Dict, Any, Optional
+from pydantic import BaseModel, Field
+
+
+class TimingVerificationResult(BaseModel):
+    """Result of statistical timing hypothesis verification."""
+    is_confirmed: bool = Field(..., description="True if delay is statistically proven beyond network noise")
+    t_statistic: float = Field(..., description="Welch's t-statistic")
+    p_value: float = Field(..., description="Two-tailed p-value (significance level)")
+    degrees_of_freedom: float = Field(..., description="Welch-Satterthwaite degrees of freedom")
+    mean_baseline_sec: float = Field(..., description="Mean baseline latency in seconds")
+    mean_delay_sec: float = Field(..., description="Mean injected delay latency in seconds")
+    observed_shift_sec: float = Field(..., description="Observed latency delta (mean_delay - mean_baseline)")
+    confidence: float = Field(..., description="Bayesian probability score [0.0 - 1.0]")
+    summary: str = Field(..., description="Detailed statistical rationale")
+
+
+class StatisticalTimingOracle:
+    """Rigorous statistical testing engine for blind SQL, Command, and Code injection verification.
+
+    Applies Welch's two-sample t-test to eliminate false positives from network latency jitter and CPU throttling.
+    """
+
+    @staticmethod
+    def calculate_stats(samples: List[float]) -> Tuple[float, float]:
+        """Calculates sample mean and unbiased sample variance."""
+        n = len(samples)
+        if n < 2:
+            return (samples[0] if n == 1 else 0.0, 0.0)
+        mean = sum(samples) / n
+        variance = sum((x - mean) ** 2 for x in samples) / (n - 1)
+        return mean, max(variance, 1e-9)
+
+    @classmethod
+    def evaluate_timing_vulnerability(
+        cls,
+        baseline_latencies: List[float],
+        delay_latencies: List[float],
+        expected_delay_sec: float = 1.5,
+        alpha_threshold: float = 0.01,
+    ) -> TimingVerificationResult:
+        """Evaluates whether delay latencies represent a statistically significant vulnerability reaction.
+
+        Args:
+            baseline_latencies: List of latency measurements (seconds) for non-delay probes.
+            delay_latencies: List of latency measurements (seconds) for delay-injected probes.
+            expected_delay_sec: Nominal delay programmed into probe payload (e.g. 1.5s).
+            alpha_threshold: Significance level threshold (default 0.01 for 99% confidence).
+        """
+        n1 = len(baseline_latencies)
+        n2 = len(delay_latencies)
+
+        if n1 < 2 or n2 < 2:
+            return TimingVerificationResult(
+                is_confirmed=False,
+                t_statistic=0.0,
+                p_value=1.0,
+                degrees_of_freedom=0.0,
+                mean_baseline_sec=sum(baseline_latencies) / max(1, n1),
+                mean_delay_sec=sum(delay_latencies) / max(1, n2),
+                observed_shift_sec=0.0,
+                confidence=0.1,
+                summary="Insufficient sample size for statistical verification (minimum 2 samples required per group).",
+            )
+
+        mean1, var1 = cls.calculate_stats(baseline_latencies)
+        mean2, var2 = cls.calculate_stats(delay_latencies)
+
+        delta = mean2 - mean1
+        se = math.sqrt((var1 / n1) + (var2 / n2))
+
+        # Welch-Satterthwaite degrees of freedom
+        numerator = ((var1 / n1) + (var2 / n2)) ** 2
+        denominator = (((var1 / n1) ** 2) / (n1 - 1)) + (((var2 / n2) ** 2) / (n2 - 1))
+        df = max(1.0, numerator / max(denominator, 1e-9))
+
+        t_stat = delta / max(se, 1e-9)
+
+        # Approximate p-value using standard normal / t-distribution tail
+        # For large df, t approximates normal. For small df, Cornish-Fisher / Student approximation
+        p_val = cls._approximate_p_value(t_stat, df)
+
+        # Requirements for confirmation:
+        # 1. Statistically significant difference (p < alpha_threshold, default 0.01)
+        # 2. Positive direction (t > 2.5)
+        # 3. Magnitude matches at least 85% of nominal programmed sleep time (Delta t >= 0.85 * delay)
+        shift_ratio = delta / max(expected_delay_sec, 0.1)
+        confirmed = (t_stat > 2.5) and (p_val < alpha_threshold) and (shift_ratio >= 0.85)
+
+        confidence = 0.99 if confirmed else (0.40 if t_stat > 2.0 and delta > 0 else 0.10)
+
+        if confirmed:
+            summary = (
+                f"Statistical Timing Oracle CONFIRMED blind injection: Mean latency shifted by +{delta:.2f}s "
+                f"(nominal {expected_delay_sec:.1f}s, ratio={shift_ratio:.1%}) with Welch's t={t_stat:.2f} (df={df:.1f}, p={p_val:.2e} < {alpha_threshold}). "
+                f"Null hypothesis (network jitter) rejected with >99% confidence."
+            )
+        else:
+            summary = (
+                f"Statistical Timing Oracle INCONCLUSIVE: Observed latency shift +{delta:.2f}s "
+                f"(t={t_stat:.2f}, p={p_val:.4f}). Did not satisfy 85% expected delay shift ({expected_delay_sec:.1f}s) "
+                f"or significance threshold ({alpha_threshold})."
+            )
+
+        return TimingVerificationResult(
+            is_confirmed=confirmed,
+            t_statistic=round(t_stat, 3),
+            p_value=round(p_val, 6),
+            degrees_of_freedom=round(df, 1),
+            mean_baseline_sec=round(mean1, 3),
+            mean_delay_sec=round(mean2, 3),
+            observed_shift_sec=round(delta, 3),
+            confidence=confidence,
+            summary=summary,
+        )
+
+    @staticmethod
+    def _approximate_p_value(t: float, df: float) -> float:
+        """Approximates two-tailed p-value for Student's / Welch's t-distribution."""
+        if t <= 0:
+            return 1.0
+
+        # Normal approximation with tail correction for degrees of freedom
+        # Z = t * (1 - 1/(4*df))
+        z = t * (1.0 - (1.0 / (4.0 * max(df, 1.0))))
+        # Error function complementary approximation
+        erf_arg = z / math.sqrt(2.0)
+        p = math.erfc(erf_arg)
+        return max(1e-12, min(1.0, p))

package/src/trace_engine/testpacks/__init__.py

@@ -0,0 +1,18 @@
+"""Security test pack system."""
+
+from trace_engine.testpacks.base import (
+    TestPack,
+    TestContext,
+    TestExecutionResult,
+    UserIdentity,
+)
+from trace_engine.testpacks.registry import TestPackRegistry, default_registry
+
+__all__ = [
+    "TestPack",
+    "TestContext",
+    "TestExecutionResult",
+    "UserIdentity",
+    "TestPackRegistry",
+    "default_registry",
+]