@xaccefy/pi-casefile 0.10.0 → 0.11.0

package/src/evidence.ts

@@ -2,9 +2,9 @@
  * Evidence contract for PoC confirmation.
  *
  * A PoC must write `evidence.json` into $PI_POC_EVIDENCE_DIR: a nonce-bound,
- * schema-validated record of what it claims and the request spec the harness
- * executes against both target and control. The harness validates the file,
- * binds it to the run via $PI_POC_NONCE, and acquires the responses itself.
+ * schema-validated record of what it claims, the attack request spec, and a
+ * legitimate same-host baseline request. The harness validates the file,
+ * binds it to the run via $PI_POC_NONCE, and acquires both responses itself.
  * The main/coordinator agent remains the semantic reviewer after the machine differential.
  *
  * Exit zero is required run integrity, but never vulnerability proof.
@@ -21,43 +21,26 @@ export type VerifyExpect = {
   body_regex?: string[];
 };
 
-/** Replaced only inside the harness replay, after the PoC process has exited. */
-export const POC_CANARY_PLACEHOLDER = "{{PI_POC_CANARY}}";
-
-export type VerifyCanary = {
-  /** Reflection is machine-checked: target must return the fresh token and control must not. */
-  mode: "reflection";
-  /** Fixed literal; callers cannot choose or predict the harness-generated token. */
-  placeholder: typeof POC_CANARY_PLACEHOLDER;
-};
-
 export type PoCEvidence = {
   /** Must equal the run's PI_POC_NONCE (harness-verified). */
   nonce: string;
   /** What the exploit asserts, e.g. "read /etc/passwd of target". */
   claim: string;
-  /** Request spec the harness executes in phase 1 and again from the main-agent phase-2 call. */
+  /** Attack request spec the harness executes to acquire machine evidence. */
   verify: {
     method: string;
     url: string;
     headers?: Record<string, string>;
     body?: string;
     expect: VerifyExpect;
-    /** Optional stronger causality dimension, independent of the authored predicate. */
-    canary?: VerifyCanary;
-    /**
-     * Differential shape. "inter_host" (default) = same request to target vs a
-     * distinct patched control host (body-carried proof). "intra_target" = attack
-     * request vs a legitimate same-host `baseline` request (access-control /
-     * business-logic classes, where the discriminating variable is identity or a
-     * parameter, not the host) — requires `baseline`.
-     */
-    mode?: "inter_host" | "intra_target";
   };
   /** What the script itself saw — corroboration only, never proof. */
   observations: string[];
-  /** Optional baseline request for the main agent's differential review. */
-  baseline?: {
+  /**
+   * Legitimate same-host request whose response must NOT satisfy the attack
+   * predicate — the differential control (identity or parameter varies, not host).
+   */
+  baseline: {
     method: string;
     url: string;
     headers?: Record<string, string>;
@@ -184,10 +167,6 @@ function hasDiscriminatingBodyExpectation(expect: Record<string, unknown>): bool
   );
 }
 
-function countOccurrences(value: string, needle: string): number {
-  return value.split(needle).length - 1;
-}
-
 /**
  * Parse + validate a PoC's evidence.json. Returns the validated object or a
  * field-level error. Deliberately strict: an invalid evidence file means the
@@ -230,48 +209,18 @@ export function parsePoCEvidence(
       error: `evidence.json verify.body must be a string no longer than ${MAX_REQUEST_BODY_CHARS} characters`,
     };
   }
-  if (verify.canary !== undefined) {
-    if (
-      !isRecord(verify.canary) ||
-      verify.canary.mode !== "reflection" ||
-      verify.canary.placeholder !== POC_CANARY_PLACEHOLDER
-    ) {
-      return {
-        ok: false,
-        error: `evidence.json verify.canary must be {"mode":"reflection","placeholder":"${POC_CANARY_PLACEHOLDER}"}`,
-      };
-    }
-    const canaryLocations = [
-      verify.url,
-      typeof verify.body === "string" ? verify.body : "",
-      ...(isRecord(verify.headers)
-        ? Object.values(verify.headers).filter(
-            (value): value is string => typeof value === "string",
-          )
-        : []),
-    ];
-    const count = canaryLocations.reduce(
-      (total, value) => total + countOccurrences(value, POC_CANARY_PLACEHOLDER),
-      0,
-    );
-    if (count !== 1) {
-      return {
-        ok: false,
-        error: `evidence.json verify.canary requires exactly one ${POC_CANARY_PLACEHOLDER} placeholder across url, body, or header values (got ${count})`,
-      };
-    }
-  }
-  if (verify.mode !== undefined && verify.mode !== "inter_host" && verify.mode !== "intra_target") {
+  if (verify.mode !== undefined) {
     return {
       ok: false,
-      error: 'evidence.json verify.mode must be "inter_host" or "intra_target"',
+      error:
+        "evidence.json verify.mode is removed — the attack-vs-baseline differential is the only confirmation model. Drop verify.mode and declare evidence.baseline.",
     };
   }
-  if (verify.mode === "intra_target" && !isRecord(raw.baseline)) {
+  if (verify.canary !== undefined) {
     return {
       ok: false,
       error:
-        "evidence.json verify.mode intra_target requires baseline — a legitimate same-host request whose response must NOT satisfy the attack predicate",
+        "evidence.json verify.canary is removed — the reflection canary tier was retired. Remove verify.canary and any {{PI_POC_CANARY}} placeholder.",
     };
   }
   const expect = verify.expect;
@@ -332,41 +281,45 @@ export function parsePoCEvidence(
   ) {
     return { ok: false, error: "evidence.json observations exceed the bounded string-array limit" };
   }
-  if (raw.baseline !== undefined) {
-    const b = raw.baseline;
-    if (!isRecord(b)) return { ok: false, error: "evidence.json baseline must be an object" };
-    if (
-      !nonEmptyString(b.method) ||
-      !HTTP_METHODS.includes(b.method.toUpperCase()) ||
-      !httpUrl(b.url)
-    ) {
-      return {
-        ok: false,
-        error: "evidence.json baseline needs an http(s) url and a valid HTTP method",
-      };
-    }
-    if (b.headers !== undefined && !headerRecord(b.headers)) {
-      return {
-        ok: false,
-        error:
-          "evidence.json baseline.headers must be bounded valid end-to-end HTTP headers; authority, framing, proxy, and hop-by-hop headers are forbidden",
-      };
-    }
-    if (
-      b.body !== undefined &&
-      (typeof b.body !== "string" || b.body.length > MAX_REQUEST_BODY_CHARS)
-    ) {
-      return {
-        ok: false,
-        error: `evidence.json baseline.body must be no longer than ${MAX_REQUEST_BODY_CHARS} characters`,
-      };
-    }
-    if (
-      b.body_contains !== undefined &&
-      !boundedStringArray(b.body_contains, MAX_EXPECT_VALUES, MAX_EXPECT_CHARS)
-    ) {
-      return { ok: false, error: "evidence.json baseline.body_contains exceeds limits" };
-    }
+  const b = raw.baseline;
+  if (!isRecord(b)) {
+    return {
+      ok: false,
+      error:
+        "evidence.json requires baseline — a legitimate same-host request whose response must NOT satisfy the attack predicate",
+    };
+  }
+  if (
+    !nonEmptyString(b.method) ||
+    !HTTP_METHODS.includes(b.method.toUpperCase()) ||
+    !httpUrl(b.url)
+  ) {
+    return {
+      ok: false,
+      error: "evidence.json baseline needs an http(s) url and a valid HTTP method",
+    };
+  }
+  if (b.headers !== undefined && !headerRecord(b.headers)) {
+    return {
+      ok: false,
+      error:
+        "evidence.json baseline.headers must be bounded valid end-to-end HTTP headers; authority, framing, proxy, and hop-by-hop headers are forbidden",
+    };
+  }
+  if (
+    b.body !== undefined &&
+    (typeof b.body !== "string" || b.body.length > MAX_REQUEST_BODY_CHARS)
+  ) {
+    return {
+      ok: false,
+      error: `evidence.json baseline.body must be no longer than ${MAX_REQUEST_BODY_CHARS} characters`,
+    };
+  }
+  if (
+    b.body_contains !== undefined &&
+    !boundedStringArray(b.body_contains, MAX_EXPECT_VALUES, MAX_EXPECT_CHARS)
+  ) {
+    return { ok: false, error: "evidence.json baseline.body_contains exceeds limits" };
   }
   return { ok: true, evidence: raw as unknown as PoCEvidence };
 }
@@ -385,6 +338,48 @@ export function normalizeEvidence(e: PoCEvidence): string {
   return JSON.stringify({ claim: e.claim, verify: e.verify, baseline: e.baseline });
 }
 
+// ── Artifact secret scanning (defense in depth) ──────────────────────
+//
+// Evidence artifacts are raw target responses and logs — they routinely
+// contain live credentials. The gate never blocks storage (an engaged
+// finding must keep its proof), it FLAGS the item so every later view can
+// redact or warn. Best-effort pattern matching only: labels are recorded,
+// matched VALUES are never persisted by the scanner itself.
+
+/** Label → pattern. Linear regexes only (artifacts reach 10 MiB). */
+const SECRET_PATTERNS: ReadonlyArray<{ label: string; pattern: RegExp }> = [
+  { label: "aws-access-key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
+  { label: "google-api-key", pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { label: "github-token", pattern: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g },
+  { label: "slack-token", pattern: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g },
+  {
+    label: "private-key-block",
+    pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
+  },
+  { label: "bearer-token", pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/gi },
+  { label: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+  {
+    label: "credential-assignment",
+    pattern:
+      /\b(?:api[_-]?key|apikey|secret|token|passwd|password)\b["']?\s*[:=]\s*["'][^"'\s]{12,}["']/gi,
+  },
+];
+
+/**
+ * Scan artifact bytes for embedded secret material. Returns the LABELS of the
+ * patterns that matched (deduplicated, order of first match) — never the
+ * matched values themselves.
+ */
+export function scanArtifactForSecrets(bytes: Buffer): string[] {
+  const text = bytes.toString("utf8");
+  const labels: string[] = [];
+  for (const { label, pattern } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    if (pattern.test(text)) labels.push(label);
+  }
+  return labels;
+}
+
 // ── Main-agent confirmation verdict ─────────────────────────────────
 
 // INCONCLUSIVE is the fail-safe verdict: the reviewer could neither reproduce
@@ -402,25 +397,20 @@ export const CONFIRM_DIFFERENTIAL_VALUES = [
 export type ConfirmDifferential = (typeof CONFIRM_DIFFERENTIAL_VALUES)[number];
 
 export const SEVERITY_MATCH_VALUES = ["under", "over", "ok"] as const;
-export const CANARY_ASSESSMENT_VALUES = ["verified", "not_applicable"] as const;
 
 export type MainAgentVerdict = {
   verdict: ConfirmVerdict;
   reasoning: string;
   /** Files/evidence the main agent actually reviewed. */
   evidence_reviewed: string[];
-  /** What the main agent observed during its review and fresh harness replay. */
+  /** What the main agent observed during review of the runs and transcripts. */
   re_execution_note?: string;
-  /** Target vs control evidence comparison. CONFIRMED requires target_only. */
+  /** Attack vs baseline evidence comparison. CONFIRMED requires target_only. */
   differential: ConfirmDifferential;
   /** Claimed severity vs what the evidence shows. */
   severity_match?: (typeof SEVERITY_MATCH_VALUES)[number];
   /** The main agent's own failed attempt to disprove — becomes the case's disconfirmation. */
   disconfirmation_attempt?: string;
-  /** Whether the machine replay carried a harness-generated causal canary. */
-  canary_assessment?: (typeof CANARY_ASSESSMENT_VALUES)[number];
-  /** Why no meaningful canary oracle exists for this exploit class. */
-  canary_reason?: string;
   /** Which model judged (recorded for the accuracy ledger). */
   model?: string;
 };
@@ -428,8 +418,8 @@ export type MainAgentVerdict = {
 /**
  * Validate the main-agent verdict. CONFIRMED additionally requires a target-only
  * differential, a concrete review note, and a disconfirmation attempt. The
- * ledger separately requires a fresh harness-owned phase-2 replay; there is no
- * caller-supplied `re_executed` checkbox.
+ * verdict is judged against the still-valid phase-1 evidence bundle; there is
+ * no caller-supplied `re_executed` checkbox.
  */
 export function validateMainAgentVerdict(
   raw: unknown,
@@ -460,18 +450,6 @@ export function validateMainAgentVerdict(
       error: `verdict differential must be one of ${CONFIRM_DIFFERENTIAL_VALUES.join(" | ")}`,
     };
   }
-  if (
-    raw.canary_assessment !== undefined &&
-    !CANARY_ASSESSMENT_VALUES.includes(raw.canary_assessment as never)
-  ) {
-    return {
-      ok: false,
-      error: `verdict canary_assessment must be one of ${CANARY_ASSESSMENT_VALUES.join(" | ")}`,
-    };
-  }
-  if (raw.canary_reason !== undefined && !nonEmptyString(raw.canary_reason)) {
-    return { ok: false, error: "verdict canary_reason must be a non-empty string" };
-  }
   if (
     raw.severity_match !== undefined &&
     !SEVERITY_MATCH_VALUES.includes(raw.severity_match as never)
@@ -486,14 +464,14 @@ export function validateMainAgentVerdict(
       return {
         ok: false,
         error:
-          'CONFIRMED requires differential "target_only" — the control run must not demonstrate the claimed impact',
+          'CONFIRMED requires differential "target_only" — the same-host baseline must not demonstrate the claimed impact',
       };
     }
     if (!nonEmptyString(raw.re_execution_note)) {
       return {
         ok: false,
         error:
-          "CONFIRMED requires re_execution_note — record what the main agent observed during review and the fresh harness replay",
+          "CONFIRMED requires re_execution_note — record what the main agent observed during review of the runs and transcripts",
       };
     }
     if (!nonEmptyString(raw.disconfirmation_attempt)) {
@@ -503,18 +481,6 @@ export function validateMainAgentVerdict(
           "CONFIRMED requires disconfirmation_attempt — the main agent's own failed attempt to disprove",
       };
     }
-    if (!CANARY_ASSESSMENT_VALUES.includes(raw.canary_assessment as never)) {
-      return {
-        ok: false,
-        error: `CONFIRMED requires canary_assessment (${CANARY_ASSESSMENT_VALUES.join(" | ")})`,
-      };
-    }
-    if (raw.canary_assessment === "not_applicable" && !nonEmptyString(raw.canary_reason)) {
-      return {
-        ok: false,
-        error: "CONFIRMED with canary_assessment not_applicable requires canary_reason",
-      };
-    }
   }
   return { ok: true, verdict: raw as unknown as MainAgentVerdict };
 }