@xaccefy/pi-casefile 0.10.0 → 0.10.1

package/README.md

@@ -26,10 +26,11 @@ Designed for **human + AI workflows**: every confirmed finding carries a reprodu
 
 | Tool | Purpose |
 |---|---|
-| `CaseAdd` / `CaseList` / `CaseUpdate` / `CaseContext` | case lifecycle and context retrieval |
+| `CaseAdd` / `CaseList` / `CaseSearch` / `CaseGet` / `CaseUpdate` / `CaseLink` / `CaseUnlink` / `CaseContext` | case lifecycle, search, links, and report context |
 | `EvidenceAdd` | attach raw evidence to a case |
+| `CoverageAdd` | record tested (asset × class) cells — found or clean |
 | `PromoteFinding` → harness replay → `ConfirmFinding` | gated finding pipeline |
-| Scratchpad | phase-scoped working notes, resume-safe |
+| `ScratchpadWrite` / `ScratchpadRead` / `ScratchpadClear` | working notes, resume-safe (no pipeline orchestration) |
 
 ## Install
 
@@ -43,7 +44,7 @@ Peer-depends on a Pi-compatible agent host (`@earendil-works/pi-coding-agent`, `
 
 ```bash
 bun install
-bun test --isolate   # 222 tests
+bun test --isolate
 bun run typecheck
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xaccefy/pi-casefile",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Offensive security case tracker for Pi Agent \u2014 bug bounties, CTFs, security audits",
   "keywords": [
     "pi-package",

package/src/confirmation.ts

@@ -17,7 +17,7 @@
  */
 
 import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
+import { lstatSync, readFileSync, statSync } from "node:fs";
 
 import { basename } from "node:path";
 
@@ -25,8 +25,11 @@ import {
   evidenceNonceMatches,
   type MainAgentVerdict,
   normalizeEvidence,
+  panelQuorumReached,
   parsePoCEvidence,
+  scanArtifactForSecrets,
   validateMainAgentVerdict,
+  validatePanelVotes,
 } from "./evidence.ts";
 import { type HarnessVerifyResult, sameRequest, verifyUrlBindingError } from "./harness-verify.ts";
 import type {
@@ -41,9 +44,11 @@ import type {
 } from "./ledger.ts";
 import { getCaseById, readWorkspaceArtifact } from "./ledger.ts";
 import {
+  appendCaseEvent,
   buildRecord,
   getDb,
   insertEvidenceItem,
+  stableShortId,
   upsertCase,
   validateCase,
   withImmediateTransaction,
@@ -58,10 +63,159 @@ const PROCESS_STARTED_AS_SUBAGENT = process.env.PI_SUBAGENT_CHILD === "1";
 /** Pending confirmation expires after 1h — re-run PromoteFinding for a fresh bundle. */
 export const PENDING_CONFIRM_TTL_MS = 60 * 60 * 1000;
 
-// Re-declared here as narrow internal helpers; ledger.ts keeps the shared copies.
-function stableShortId(input: string): string {
-  return createHash("sha1").update(input).digest("hex").slice(0, 10);
+// ── Report contract gate (confirmed → reported) ──────────────────────
+
+/** Typed, fail-closed error for an invalid report contract. */
+export class ReportContractError extends Error {
+  readonly code = "REPORT_CONTRACT_INVALID";
+  readonly violations: string[];
+
+  constructor(violations: string[]) {
+    super(
+      `report contract invalid (${violations.length} violation(s)):\n- ${violations.join("\n- ")}`,
+    );
+    this.name = "ReportContractError";
+    this.violations = violations;
+  }
+}
+
+/** The closed-schema contract companion path for a report markdown path. */
+export function reportContractPathFor(reportPath: string): string {
+  return reportPath.replace(/\.md$/i, ".contract.json");
+}
+
+/** Hard cap on the contract document — it is metadata, not a report carrier. */
+const REPORT_CONTRACT_MAX_BYTES = 64 * 1024;
+
+/** Keys the closed schema accepts; anything else is a violation. */
+const REPORT_CONTRACT_KEYS = new Set([
+  "case_id",
+  "title",
+  "severity",
+  "summary",
+  "impact",
+  "remediation",
+  "steps",
+  "evidence_ids",
+  "coverage_refs",
+]);
+
+/**
+ * Validate the closed-schema report contract for a confirmed case:
+ * - a regular, non-symlink JSON file of bounded size exists at contractPath;
+ * - only schema keys are present, and the required text fields are non-empty;
+ * - evidence_ids reference ONLY evidence items that exist on this case, and
+ *   include at least one observation and one reproduction item;
+ * - coverage_refs reference ONLY (asset, class) cells recorded on this case.
+ *
+ * Throws ReportContractError (fail closed) on any violation.
+ */
+export function validateReportContract(record: CaseRecord, contractPath: string): void {
+  const violations: string[] = [];
+  let stat: ReturnType<typeof statSync>;
+  try {
+    stat = statSync(contractPath);
+  } catch {
+    throw new ReportContractError([
+      `report contract not found: ${basename(contractPath)} (write the closed-schema JSON contract next to the report, then retry status='reported')`,
+    ]);
+  }
+  if (!stat.isFile()) violations.push("report contract path is not a regular file");
+  if (lstatSync(contractPath).isSymbolicLink()) {
+    violations.push("report contract must not be a symbolic link");
+  }
+  if (stat.size > REPORT_CONTRACT_MAX_BYTES) {
+    violations.push(
+      `report contract too large (${stat.size} bytes; max ${REPORT_CONTRACT_MAX_BYTES})`,
+    );
+  }
+  if (violations.length > 0) throw new ReportContractError(violations);
+
+  let doc: unknown;
+  try {
+    doc = JSON.parse(readFileSync(contractPath, "utf8"));
+  } catch (e) {
+    throw new ReportContractError([`report contract is not valid JSON: ${(e as Error).message}`]);
+  }
+  if (typeof doc !== "object" || doc === null || Array.isArray(doc)) {
+    throw new ReportContractError(["report contract must be a JSON object"]);
+  }
+  const contract = doc as Record<string, unknown>;
+  for (const key of Object.keys(contract)) {
+    if (!REPORT_CONTRACT_KEYS.has(key)) {
+      violations.push(`unknown key "${key}" — the report contract schema is closed`);
+    }
+  }
+  for (const required of ["case_id", "title", "severity", "summary", "impact", "remediation"]) {
+    const v = contract[required];
+    if (typeof v !== "string" || v.trim().length === 0) {
+      violations.push(`"${required}" must be a non-empty string`);
+    }
+  }
+  if (contract.case_id !== record.id) {
+    violations.push(`"case_id" must be ${record.id} (got ${String(contract.case_id)})`);
+  }
+  const SEVERITIES = ["info", "low", "medium", "high", "critical"];
+  if (
+    typeof contract.severity === "string" &&
+    !(record.severity
+      ? contract.severity === record.severity
+      : SEVERITIES.includes(contract.severity))
+  ) {
+    violations.push(
+      `"severity" must match the case severity (${record.severity ?? "unset"}) or be a valid severity`,
+    );
+  }
+  if (!Array.isArray(contract.steps) || contract.steps.length === 0) {
+    violations.push('"steps" must be a non-empty array of reproduction steps');
+  } else if (!contract.steps.every((s: unknown) => typeof s === "string" && s.trim().length > 0)) {
+    violations.push('"steps" entries must be non-empty strings');
+  }
+
+  const items = record.evidenceItems ?? [];
+  const knownIds = new Set(items.map((i) => i.id));
+  const evidenceIds = contract.evidence_ids;
+  if (!Array.isArray(evidenceIds) || evidenceIds.length === 0) {
+    violations.push('"evidence_ids" must be a non-empty array of evidence item ids');
+  } else {
+    if (!evidenceIds.every((id: unknown) => typeof id === "string" && knownIds.has(id))) {
+      violations.push('"evidence_ids" references evidence items that do not exist on this case');
+    }
+    const referenced = items.filter((i) => evidenceIds.includes(i.id));
+    if (!referenced.some((i) => i.role === "observation")) {
+      violations.push('"evidence_ids" must include at least one observation item');
+    }
+    if (!referenced.some((i) => i.role === "reproduction")) {
+      violations.push('"evidence_ids" must include at least one reproduction item');
+    }
+  }
+
+  const coverageRefs = contract.coverage_refs;
+  if (coverageRefs !== undefined && !Array.isArray(coverageRefs)) {
+    violations.push('"coverage_refs" must be an array of { asset, class } objects');
+  } else if (Array.isArray(coverageRefs)) {
+    const cells = new Set((record.coverageItems ?? []).map((c) => `${c.asset}\n${c.class}`));
+    for (const [index, ref] of coverageRefs.entries()) {
+      if (
+        typeof ref !== "object" ||
+        ref === null ||
+        typeof (ref as Record<string, unknown>).asset !== "string" ||
+        typeof (ref as Record<string, unknown>).class !== "string"
+      ) {
+        violations.push(`"coverage_refs[${index}]" must be an { asset, class } object`);
+      } else if (
+        !cells.has(`${(ref as { asset: string }).asset}\n${(ref as { class: string }).class}`)
+      ) {
+        violations.push(
+          `"coverage_refs[${index}]" references a coverage cell not recorded on this case`,
+        );
+      }
+    }
+  }
+
+  if (violations.length > 0) throw new ReportContractError(violations);
 }
+
 function validateRunEvidence(run: PocEvidenceRun, label: string): void {
   if (!run.completed) {
     throw new Error(`${label} did not complete; a crash is not evidence`);
@@ -392,9 +546,21 @@ export function storePendingConfirmation(id: string, bundle: PendingConfirmation
       );
     }
     if (bundle.caseId !== id) throw new Error("Pending confirmation caseId mismatch");
+    // Panel vote shape is machine-checked at store time — a malformed panel
+    // must never silently count toward a quorum later.
+    if (bundle.panelVotes !== undefined) {
+      const votes = validatePanelVotes(bundle.panelVotes);
+      if (!votes.ok) throw new Error(`Pending confirmation panel invalid: ${votes.error}`);
+    }
     if (bundle.mode === "intra_target") {
       const next = validateIntraTargetBundle(current, id, bundle);
       upsertCase(db, next);
+      appendCaseEvent(db, {
+        actor: "harness",
+        caseId: id,
+        eventType: "promotion_pending",
+        payload: { mode: "intra_target", evidence_sha256: bundle.targetRuns[0].evidenceSha256 },
+      });
       return next;
     }
     // Control-run requirements key off controlRun PRESENCE, not the OOB flag:
@@ -493,6 +659,15 @@ export function storePendingConfirmation(id: string, bundle: PendingConfirmation
     const next = buildRecord({ pendingConfirmation: bundle }, current);
     validateCase(next);
     upsertCase(db, next);
+    appendCaseEvent(db, {
+      actor: "harness",
+      caseId: id,
+      eventType: "promotion_pending",
+      payload: {
+        mode: bundle.callbackVerified?.attempted ? "oob" : "inter_host",
+        evidence_sha256: bundle.targetRuns[0].evidenceSha256,
+      },
+    });
     return next;
   });
 }
@@ -557,6 +732,18 @@ export function applyConfirmationResult(
           "CONFIRMED canary mismatch: this evidence has no canary template; record canary_assessment=not_applicable and explain why",
         );
       }
+      // Quorum panel pre-gate: CONFIRMED needs a 2/3 exploit panel or an
+      // explicit override note recording why the panel was skipped (or
+      // overruled). Votes are advisory — the main agent still commits — but a
+      // non-quorum CONFIRMED without a note is refused.
+      const quorum = panelQuorumReached(bundle.panelVotes);
+      if (!quorum.quorum && !verdict.panel_override_note?.trim()) {
+        throw new Error(
+          `PANEL QUORUM REQUIRED: CONFIRMED needs either a 2/3 exploit panel (got ${quorum.exploit} exploit / ${quorum.total} vote(s)) ` +
+            "or an explicit panel_override_note recording why the panel was skipped or overruled. " +
+            "Re-run PromoteFinding with panel_votes, or justify the solo confirmation in panel_override_note.",
+        );
+      }
     }
     const recorded: MainAgentVerdictRecord = {
       ...verdict,
@@ -594,6 +781,12 @@ export function applyConfirmationResult(
       next.pendingConfirmation = undefined;
       validateCase(next);
       upsertCase(db, next);
+      appendCaseEvent(db, {
+        caseId: id,
+        actor: "main_agent",
+        eventType: "confirmation_verdict",
+        payload: { verdict: verdict.verdict, model: verdict.model ?? null },
+      });
       return { record: next, changed: true };
     }
 
@@ -665,6 +858,22 @@ export function applyConfirmationResult(
       summary: `PoC evidence accepted (2 target runs + ${isIntra ? "same-host baseline" : "control"}; ${recorded.proofStrength}) — main agent semantic confirmation${verdict.model ? ` (${verdict.model})` : ""}`,
       createdAt: targetRun.ranAt,
     };
+    // Defense in depth: the run's evidence.json may embed secrets in
+    // observations/claim text — flag it like any other artifact.
+    if (targetRun.evidencePath) {
+      try {
+        const secretFindings = scanArtifactForSecrets(
+          readWorkspaceArtifact(targetRun.evidencePath).bytes,
+        );
+        if (secretFindings.length > 0) {
+          reproductionItem.containsSecret = true;
+          reproductionItem.secretFindings = secretFindings;
+        }
+      } catch {
+        // validateRunEvidence already proved the artifact readable; a scan
+        // failure never blocks the confirmation itself.
+      }
+    }
 
     const newEvidence =
       (current.evidence ? `${current.evidence}\n\n` : "") +
@@ -723,6 +932,19 @@ export function applyConfirmationResult(
     validateCase(next);
     insertEvidenceItem(db, reproductionItem);
     upsertCase(db, next);
+    appendCaseEvent(db, {
+      caseId: id,
+      actor: "main_agent",
+      eventType: "case_confirmed",
+      payload: {
+        verdict: "CONFIRMED",
+        proof_strength: recorded.proofStrength ?? null,
+        model: verdict.model ?? null,
+        panel: panelQuorumReached(bundle.panelVotes),
+        override: verdict.panel_override_note ? true : false,
+        reproduction_evidence_id: reproductionItem.id,
+      },
+    });
     next.evidenceItems = [...(next.evidenceItems ?? []), reproductionItem];
     return { record: next, changed: true };
   });

package/src/evidence.ts

@@ -385,6 +385,48 @@ export function normalizeEvidence(e: PoCEvidence): string {
   return JSON.stringify({ claim: e.claim, verify: e.verify, baseline: e.baseline });
 }
 
+// ── Artifact secret scanning (defense in depth) ──────────────────────
+//
+// Evidence artifacts are raw target responses and logs — they routinely
+// contain live credentials. The gate never blocks storage (an engaged
+// finding must keep its proof), it FLAGS the item so every later view can
+// redact or warn. Best-effort pattern matching only: labels are recorded,
+// matched VALUES are never persisted by the scanner itself.
+
+/** Label → pattern. Linear regexes only (artifacts reach 10 MiB). */
+const SECRET_PATTERNS: ReadonlyArray<{ label: string; pattern: RegExp }> = [
+  { label: "aws-access-key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
+  { label: "google-api-key", pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { label: "github-token", pattern: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g },
+  { label: "slack-token", pattern: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g },
+  {
+    label: "private-key-block",
+    pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
+  },
+  { label: "bearer-token", pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/gi },
+  { label: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+  {
+    label: "credential-assignment",
+    pattern:
+      /\b(?:api[_-]?key|apikey|secret|token|passwd|password)\b["']?\s*[:=]\s*["'][^"'\s]{12,}["']/gi,
+  },
+];
+
+/**
+ * Scan artifact bytes for embedded secret material. Returns the LABELS of the
+ * patterns that matched (deduplicated, order of first match) — never the
+ * matched values themselves.
+ */
+export function scanArtifactForSecrets(bytes: Buffer): string[] {
+  const text = bytes.toString("utf8");
+  const labels: string[] = [];
+  for (const { label, pattern } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    if (pattern.test(text)) labels.push(label);
+  }
+  return labels;
+}
+
 // ── Main-agent confirmation verdict ─────────────────────────────────
 
 // INCONCLUSIVE is the fail-safe verdict: the reviewer could neither reproduce
@@ -404,6 +446,82 @@ export type ConfirmDifferential = (typeof CONFIRM_DIFFERENTIAL_VALUES)[number];
 export const SEVERITY_MATCH_VALUES = ["under", "over", "ok"] as const;
 export const CANARY_ASSESSMENT_VALUES = ["verified", "not_applicable"] as const;
 
+// ── Quorum panel votes (advisory, CONFIRMED-blocking) ───────────────
+
+export const PANEL_VERDICT_VALUES = ["exploit", "not_exploit", "inconclusive"] as const;
+export type PanelVote = {
+  verdict: (typeof PANEL_VERDICT_VALUES)[number];
+  rationale: string;
+  model: string;
+  at?: string;
+};
+
+/** Bounded panel: enough voices for 2/3 quorum, small enough to stay cheap. */
+const MAX_PANEL_VOTES = 5;
+
+/**
+ * Validate panel votes recorded on a promotion bundle. Votes are advisory —
+ * they gate only the CONFIRMED commit (quorum or explicit override note) —
+ * but their SHAPE is machine-checked so a malformed panel cannot silently
+ * count as a quorum.
+ */
+export function validatePanelVotes(
+  raw: unknown,
+): { ok: true; votes: PanelVote[] } | { ok: false; error: string } {
+  if (!Array.isArray(raw)) return { ok: false, error: "panel_votes must be an array" };
+  if (raw.length === 0) return { ok: false, error: "panel_votes must not be empty when provided" };
+  if (raw.length > MAX_PANEL_VOTES) {
+    return { ok: false, error: `panel_votes exceeds ${MAX_PANEL_VOTES} entries` };
+  }
+  for (const [index, v] of raw.entries()) {
+    if (!isRecord(v)) return { ok: false, error: `panel_votes[${index}] must be an object` };
+    if (
+      !nonEmptyString(v.verdict) ||
+      !(PANEL_VERDICT_VALUES as readonly string[]).includes(v.verdict)
+    ) {
+      return {
+        ok: false,
+        error: `panel_votes[${index}].verdict must be one of ${PANEL_VERDICT_VALUES.join(" | ")}`,
+      };
+    }
+    if (!nonEmptyString(v.rationale)) {
+      return { ok: false, error: `panel_votes[${index}].rationale must be a non-empty string` };
+    }
+    if (!nonEmptyString(v.model)) {
+      return { ok: false, error: `panel_votes[${index}].model must be a non-empty string` };
+    }
+    if (v.at !== undefined) {
+      if (!nonEmptyString(v.at) || !Number.isFinite(Date.parse(v.at))) {
+        return { ok: false, error: `panel_votes[${index}].at must be a parseable timestamp` };
+      }
+    }
+  }
+  return { ok: true, votes: raw as unknown as PanelVote[] };
+}
+
+/**
+ * Quorum rule: a panel of at least 3 votes with at least 2 exploit verdicts
+ * and exploit strictly ahead of not_exploit. Anything else — no panel, a tied
+ * panel, or a dissenting majority — requires the main agent's explicit
+ * override note to CONFIRM.
+ */
+export function panelQuorumReached(votes: PanelVote[] | undefined): {
+  quorum: boolean;
+  exploit: number;
+  notExploit: number;
+  total: number;
+} {
+  const list = votes ?? [];
+  const exploit = list.filter((v) => v.verdict === "exploit").length;
+  const notExploit = list.filter((v) => v.verdict === "not_exploit").length;
+  return {
+    quorum: list.length >= 3 && exploit >= 2 && exploit > notExploit,
+    exploit,
+    notExploit,
+    total: list.length,
+  };
+}
+
 export type MainAgentVerdict = {
   verdict: ConfirmVerdict;
   reasoning: string;
@@ -421,6 +539,12 @@ export type MainAgentVerdict = {
   canary_assessment?: (typeof CANARY_ASSESSMENT_VALUES)[number];
   /** Why no meaningful canary oracle exists for this exploit class. */
   canary_reason?: string;
+  /**
+   * Why CONFIRMED proceeds without a 2/3 exploit panel quorum (no panel
+   * provisioned, panel unavailable, or documented disagreement). Required for
+   * CONFIRMED whenever quorum was not reached.
+   */
+  panel_override_note?: string;
   /** Which model judged (recorded for the accuracy ledger). */
   model?: string;
 };
@@ -472,6 +596,9 @@ export function validateMainAgentVerdict(
   if (raw.canary_reason !== undefined && !nonEmptyString(raw.canary_reason)) {
     return { ok: false, error: "verdict canary_reason must be a non-empty string" };
   }
+  if (raw.panel_override_note !== undefined && !nonEmptyString(raw.panel_override_note)) {
+    return { ok: false, error: "verdict panel_override_note must be a non-empty string" };
+  }
   if (
     raw.severity_match !== undefined &&
     !SEVERITY_MATCH_VALUES.includes(raw.severity_match as never)

package/src/harness-verify.ts

@@ -76,8 +76,16 @@ const REGEX_TIMEOUT_MS = 250;
 
 type ResolvedAddress = { address: string; family: 4 | 6 };
 
+/** Comparison-normalize a hostname: lowercase, strip IPv6 brackets and any trailing root dot. */
+function normHost(hostname: string): string {
+  return hostname
+    .toLowerCase()
+    .replace(/^\[|\]$/g, "")
+    .replace(/\.$/, "");
+}
+
 async function resolveHost(hostname: string): Promise<ResolvedAddress[]> {
-  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const host = normHost(hostname);
   const literalFamily = isIP(host);
   if (literalFamily) return [{ address: host, family: literalFamily as 4 | 6 }];
   const lookup = dnsLookup(host, { all: true, verbatim: true }) as Promise<ResolvedAddress[]>;
@@ -116,10 +124,7 @@ function sameTargetIdentity(left: string, right: string): boolean {
   const a = parseNetworkTarget(left);
   const b = parseNetworkTarget(right);
   if (!a || !b) return false;
-  if (
-    a.url.hostname.toLowerCase().replace(/\.$/, "") !==
-    b.url.hostname.toLowerCase().replace(/\.$/, "")
-  ) {
+  if (normHost(a.url.hostname) !== normHost(b.url.hostname)) {
     return false;
   }
   if ((a.url.port || b.url.port) && effectivePort(a.url) !== effectivePort(b.url)) return false;
@@ -161,8 +166,8 @@ export function verifyUrlBindingError(verifyUrl: string, target: string): string
     return `verify.url is not parseable: ${verifyUrl}`;
   }
   if (!declared) return `target is not an HTTP network target: ${target}`;
-  const declaredHost = declared.url.hostname.toLowerCase().replace(/\.$/, "");
-  const observedHost = observed.hostname.toLowerCase().replace(/\.$/, "");
+  const declaredHost = normHost(declared.url.hostname);
+  const observedHost = normHost(observed.hostname);
   if (declaredHost !== observedHost) {
     return `verify.url host ${observedHost} does not match run target ${declaredHost}`;
   }
@@ -383,7 +388,7 @@ async function replayRequest(
     };
   }
   const signal = AbortSignal.timeout(opts?.timeoutMs ?? TIMEOUT_MS);
-  const lockedHostname = url.hostname.toLowerCase().replace(/\.$/, "");
+  const lockedHostname = normHost(url.hostname);
   const fetchImpl = opts?.fetchImpl ?? harnessFetchForTest;
 
   for (let redirects = 0; redirects <= MAX_REDIRECTS; redirects++) {
@@ -415,13 +420,11 @@ async function replayRequest(
           note: `request errored (DNS): ${url.hostname} resolved to no addresses`,
         };
       }
-    } else if (isIP(url.hostname.replace(/^\[|\]$/g, ""))) {
-      addresses = [
-        {
-          address: url.hostname.replace(/^\[|\]$/g, ""),
-          family: isIP(url.hostname.replace(/^\[|\]$/g, "")) as 4 | 6,
-        },
-      ];
+    } else {
+      const host = normHost(url.hostname);
+      if (isIP(host)) {
+        addresses = [{ address: host, family: isIP(host) as 4 | 6 }];
+      }
     }
     if (!opts?.allowPrivate && addresses.some((address) => !isPublicIpAddress(address.address))) {
       return {
@@ -470,7 +473,7 @@ async function replayRequest(
             note: `redirected to disallowed protocol ${next.protocol}`,
           };
         }
-        if (next.hostname.toLowerCase().replace(/\.$/, "") !== lockedHostname) {
+        if (normHost(next.hostname) !== lockedHostname) {
           await res.body?.cancel().catch(() => undefined);
           await fetched.close().catch(() => undefined);
           closeFetched = undefined;
@@ -609,32 +612,6 @@ function canaryResult(
   };
 }
 
-/**
- * Re-send the evidence's verify request with the harness's own client and
- * judge the response against verify.expect. Never throws — the outcome is a
- * structured result the ledger gate interprets.
- */
-export async function replayVerify(
-  evidence: PoCEvidence,
-  opts?: ReplayOptions,
-): Promise<HarnessVerifyResult> {
-  const token = evidence.verify.canary
-    ? `poc_canary_${randomBytes(24).toString("hex")}`
-    : undefined;
-  const verify = injectCanary(evidence.verify, token);
-  const target = await replayRequest(verify, verify.expect, token, opts);
-  const canary = canaryResult(token, target);
-  return {
-    attempted: target.attempted,
-    pass: target.matched === true,
-    status: target.status,
-    target,
-    canary,
-    proofStrength: canary?.pass ? "canary_differential" : "predicate_differential",
-    note: `harness replay: ${target.note}${canary ? `; ${canary.note}` : ""}`,
-  };
-}
-
 /**
  * Combine the two observations into the differential verdict. Shared by the
  * inter-host (target vs control host) and intra-target (attack vs same-host