@xaccefy/pi-casefile 0.10.1 → 0.11.0

package/src/ledger.ts

@@ -23,7 +23,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import type { MainAgentVerdict, PanelVote, PoCEvidence } from "./evidence.ts";
+import type { MainAgentVerdict, PoCEvidence } from "./evidence.ts";
 import { scanArtifactForSecrets } from "./evidence.ts";
 import type { HarnessVerifyResult } from "./harness-verify.ts";
 import {
@@ -343,7 +343,7 @@ export type RetryPolicy = {
 
 /** One harness-observed PoC run with its validated, nonce-bound evidence. */
 export type PocEvidenceRun = {
-  mode: "poc" | "control";
+  mode: "poc";
   target: string;
   /** The run's PI_POC_NONCE — evidence.nonce must equal it (binds evidence to the run). */
   nonce: string;
@@ -362,80 +362,23 @@ export type PocEvidenceRun = {
   evidencePath?: string;
 };
 
-/** Harness-observed out-of-band interactions (Tier 1, docs/poc-trust-model.md). */
-export type OobVerification = {
-  attempted: boolean;
-  targetHits: number;
-  controlHits: number;
-  /** True only when the PoC runner cannot directly reach the listener. */
-  sourceSeparated?: boolean;
-  note: string;
-};
-
 export type PendingConfirmation = {
   caseId: string;
   ranAt: string;
   pocPath: string;
   /** SHA-256 of the PoC script AT RUN TIME — re-hashed at confirm to catch edits. */
   pocSha256: string;
-  /**
-   * Differential shape. Absent/"inter_host" (default) = same request to target
-   * vs a distinct patched control host, proven by a separate control run +
-   * `replayDifferential`. "intra_target" = attack vs a legitimate same-host
-   * `baseline` request inside each run's evidence, proven by `replayIntraTarget`
-   * — no control run or control target (access-control / business-logic classes).
-   */
-  mode?: "inter_host" | "intra_target";
-  /** inter_host only. */
-  controlPath?: string;
-  /** inter_host only. */
-  controlTarget?: string;
   targetRuns: [PocEvidenceRun, PocEvidenceRun];
-  /** inter_host only — the same PoC run against the control target. */
-  controlRun?: PocEvidenceRun;
-  /** Harness's own replay of evidence.verify (public targets). Absent = legacy bundle. */
+  /** Harness's own attack-vs-baseline replay of the evidence contract. */
   harnessVerified?: HarnessVerifyResult;
-  /** OOB-only bundles: per-run oracle tokens so phase-2 can re-poll freshly.
-   * Stored raw deliberately: the oracle is operator-owned and bearer-gated,
-   * so a ledger reader without oracle write access cannot fabricate hits. */
-  oobTokens?: { targetToken: string; controlToken: string };
-  /** Harness-owned OOB listener log for the run (opt-in blind classes). */
-  callbackVerified?: OobVerification;
-  /**
-   * Optional pre-gate panel votes (advisory). CONFIRMED additionally requires
-   * a 2/3 exploit quorum or an explicit override note on the verdict; votes
-   * never commit anything — the main agent still owns the verdict.
-   */
-  panelVotes?: PanelVote[];
-};
-
-/**
- * Fresh machine transcript produced inside the main agent's ConfirmFinding call.
- *
- * BOUNDARY NOTE: the ledger enforces the STRUCTURAL floor on this object —
- * valid timestamp newer than phase 1 and ≤5 minutes old, target/control
- * binding, conclusive `target_only` differential, canary transcript when
- * requested (see assertMainAgentVerification). What it cannot enforce at this
- * API boundary is WHO executed the replay: in production the only caller is
- * the PromoteFinding/ConfirmFinding tool layer in index.ts, which runs the
- * replay itself before calling applyConfirmationResult. A second integration
- * calling applyConfirmationResult directly owns the provenance of the
- * transcript it passes. Cross-process identity limits are documented in
- * docs/confirmation-design.md §7 (honest limits).
- */
-export type MainAgentVerification = {
-  at: string;
-  result: HarnessVerifyResult;
 };
 
 /** Persisted main-agent verdict; `confirmer` naming is retained for DB compatibility. */
 export type MainAgentVerdictRecord = MainAgentVerdict & {
   at: string;
   reviewer: "main_agent";
-  /** Harness-owned phase-2 replay bound to this verdict. */
-  phase2Verification?: MainAgentVerification;
-  /** What the machine actually established; semantic vulnerability judgment remains main-agent-owned. */
-  proofStrength?: "predicate_differential" | "canary_differential";
+  /** What the machine established (predicate differential); the semantic judgment remains main-agent-owned. */
+  proofStrength?: "predicate_differential";
 };
 
 /** @deprecated Compatibility alias for the legacy database/API field name. */
@@ -2464,11 +2407,8 @@ const MAX_TOTAL_ARTIFACT_CHARS = 400_000;
 
 /**
  * Recursively redact sensitive values in a serialized object:
- * - local filesystem paths (path/pocPath/controlPath/evidencePath) → basename
+ * - local filesystem paths (path/pocPath/evidencePath) → basename
  *   (the context bundle must never leak the researcher's local paths);
- * - OOB oracle tokens (targetToken/controlToken) → sha256 prefix — the raw
- *   tokens are bearer credentials against the oracle and stay DB-only for the
- *   phase-2 re-poll; every rendered view must show a fingerprint instead.
  */
 function redactPaths(value: unknown, seen = new Set<object>()): unknown {
   if (Array.isArray(value)) return value.map((v) => redactPaths(v, seen));
@@ -2477,13 +2417,22 @@ function redactPaths(value: unknown, seen = new Set<object>()): unknown {
   seen.add(value);
   const out: Record<string, unknown> = {};
   for (const [k, v] of Object.entries(value)) {
-    if (typeof v === "string" && (k === "targetToken" || k === "controlToken")) {
-      out[k] = `sha256:${createHash("sha256").update(v).digest("hex").slice(0, 12)}`;
-    } else if (
+    if (
       typeof v === "string" &&
       (k === "path" || k === "pocPath" || k === "controlPath" || k === "evidencePath")
     ) {
+      // Local paths → basename: rendered views must never leak the
+      // researcher's local tree. controlPath matters for legacy inter-host
+      // bundles; harmless for new ones.
       out[k] = basename(v) || v;
+    } else if (
+      (k === "targetToken" || k === "controlToken") &&
+      typeof v === "string" &&
+      v.length > 0
+    ) {
+      // Legacy OOB oracle tokens are bearer credentials — fingerprint, never
+      // render raw. Pre-0.11 ledgers can still carry them in pending bundles.
+      out[k] = `sha256:${createHash("sha256").update(v).digest("hex").slice(0, 12)} (redacted)`;
     } else {
       out[k] = redactPaths(v, seen);
     }
@@ -2696,8 +2645,12 @@ export function writeCaseContext(id: string): CaseContextResult {
       : undefined,
     current.controlVerified
       ? mdSection(
-          "Control-Target Check (anti-cheat)",
-          `### Control Run Verification\n- **Timestamp:** ${current.controlVerified.ranAt}\n- **Script:** \`${basename(current.controlVerified.path)}\`\n- **Sandbox:** ${current.controlVerified.sandbox ? "yes" : "no"}\n- **Exit Code:** ${current.controlVerified.exitCode}\n- **Control target:** ${current.controlVerified.target ?? "not recorded"}\n- **Differential (machine-checked):** control evidence differs from the target runs' evidence — the claimed impact is target-dependent (assertEvidenceDifferential, re-checked at confirm).\n- **Note:** zero exit is necessary run integrity, never vulnerability proof; output markers are diagnostic only. The machine floor is the harness differential plus main-agent review.\n\n#### Output\n\`\`\`\n${current.controlVerified.output ?? ""}\n\`\`\``,
+          "Same-Host Baseline Check (anti-cheat)",
+          `### Baseline Replay Verification\n- **Timestamp:** ${current.controlVerified.ranAt}\n- **Script:** \`${basename(current.controlVerified.path)}\`\n- **Sandbox:** ${current.controlVerified.sandbox ? "yes" : "no"}\n- **Exit Code:** ${current.controlVerified.exitCode}\n- **Recorded target:** ${current.controlVerified.target ?? "not recorded"}\n${
+            current.controlVerified.mode === "control"
+              ? "- **Inter-host control run (pre-0.11 pipeline):** recorded as-is; the inter-host model was retired in 0.11. See Complete Case Record for the raw fields.\n"
+              : "- **Determinism (machine-checked):** both target runs produced identical evidence (assertEvidenceDifferential, re-checked at confirm).\n- **Differential (machine-checked):** the harness replayed the evidence's attack request and its legitimate same-host baseline request — the attack predicate matched on attack only (attack/baseline replay, recorded at promote and re-validated at confirm).\n"
+          }- **Note:** zero exit is necessary run integrity, never vulnerability proof; output markers are diagnostic only. The machine floor is the harness differential plus main-agent review.\n\n#### Output\n\`\`\`\n${current.controlVerified.output ?? ""}\n\`\`\``,
         )
       : undefined,
     mdSection("Disconfirmation Attempt", current.disconfirmation),

package/src/poc-runner.ts

@@ -78,7 +78,7 @@ export type PocRunOptions = {
   local?: boolean;
   /**
    * Extra environment variables merged into the run. The harness sets
-   * `PI_POC_MODE` ("poc" | "control" | "disconfirmation") and `PI_POC_TARGET`
+   * `PI_POC_MODE` ("poc") and `PI_POC_TARGET`
    * (the case target) so PoCs can be written once and parameterized per run.
    */
   env?: Record<string, string>;
@@ -694,7 +694,7 @@ function runLocal(pocPath: string, language: PocLanguage, env?: Record<string, s
       // Host runs get a MINIMAL env: OS locale/temp vars so interpreters
       // resolve and run, plus the harness env contract — never the operator's
       // ambient process env. Proxy URLs can embed credentials and PI_*
-      // carries operator secrets (e.g. PI_OOB_ORACLE_TOKEN bearer), and the
+      // carries operator secrets (e.g. oracle bearer tokens), and the
       // PoC script is untrusted agent-authored code. An operator who needs a
       // specific non-secret value for a local run injects it explicitly via
       // the run env. The sandboxed path was already minimal (explicit -e
@@ -763,7 +763,7 @@ export function runPoc(pocPath: string, options?: PocRunOptions): PocRun {
 
   // Operator/test-harness escape: PI_POC_FORCE_LOCAL=1 together with the
   // operator opt-in PI_POC_ALLOW_LOCAL=1 runs EVERY PoC on the host, skipping
-  // Docker entirely — including default (network:"none") and OOB runs, not just
+  // Docker entirely — including default (network:"none") runs, not just
   // local:true ones. Both flags are operator env (never agent-supplied), so this
   // cannot be triggered by a finding. Without them, execution falls through to
   // the isolated sandbox as before.

package/src/oob-oracle.ts

@@ -1,279 +0,0 @@
-/**
- * Operator-owned OOB oracle client — Tier 1 of docs/poc-trust-model.md.
- *
- * Blind/OOB classes (SSRF, blind XSS, XXE, DNS exfil) cannot be confirmed by
- * response differentials: the effect lands on a callback channel. The trust
- * model requires the judge to own the evidence channel and the secret:
- *
- * - The HARNESS generates a per-run random token and provisions a callback
- *   domain embedding it via the operator-run oracle service. The value does
- *   not exist when the PoC script is written, so it cannot be pre-printed.
- * - The PoC causes the TARGET to interact with that domain; the oracle's own
- *   interaction log — read back by the harness, never by the PoC — is the
- *   evidence.
- * - Differential shape: the target run gets one token, the control run a
- *   DIFFERENT token. Proof requires target-token interactions AND zero
- *   control-token interactions.
- *
- * Source separation (the PoC must not be able to fake the interaction):
- * - Hard guarantee (three-box model): only when the operator attests the
- *   network topology separates PoC egress from oracle reachability via
- *   PI_OOB_SOURCE_SEPARATED=1. Without it, verification stays diagnostic
- *   and the ledger gate refuses promotion.
- * - Self-interaction filtering: interactions originating from PI_OOB_SELF_IPS
- *   (the sandbox/host egress addresses) are rejected as self-caused and never
- *   counted as target hits.
- *
- * Everything fails closed: no oracle configured -> OOB promotion impossible.
- */
-
-import { randomBytes } from "node:crypto";
-
-export type OobInteraction = {
-  protocol?: string;
-  src_ip?: string;
-  ts?: string;
-  raw?: string;
-};
-
-export type OobOracleConfig = {
-  baseUrl: string;
-  bearer?: string;
-  sourceSeparated: boolean;
-  selfIps: string[];
-};
-
-/** Read the operator's oracle configuration; error text explains what's missing. */
-export function readOobOracleConfig(env: NodeJS.ProcessEnv = process.env): {
-  config?: OobOracleConfig;
-  error?: string;
-} {
-  const raw = (env.PI_OOB_ORACLE_URL ?? "").trim();
-  if (!raw) {
-    return {
-      error:
-        "no OOB oracle configured. Set PI_OOB_ORACLE_URL to an operator-run oracle service " +
-        "(POST /provision {token} -> {domain}; GET /interactions?token= -> {interactions}). " +
-        "Declare PI_OOB_SOURCE_SEPARATED=1 only when the network topology truly prevents the " +
-        "PoC sandbox from reaching the oracle directly.",
-    };
-  }
-  let baseUrl: URL;
-  try {
-    baseUrl = new URL(raw);
-  } catch {
-    return { error: `PI_OOB_ORACLE_URL is not a valid URL: ${raw}` };
-  }
-  if (baseUrl.protocol !== "http:" && baseUrl.protocol !== "https:") {
-    return { error: `PI_OOB_ORACLE_URL must be http(s), got ${baseUrl.protocol}` };
-  }
-  const selfIps = (env.PI_OOB_SELF_IPS ?? "")
-    .split(",")
-    .map((v) => v.trim())
-    .filter(Boolean);
-  return {
-    config: {
-      baseUrl: raw.replace(/\/+$/, ""),
-      bearer: env.PI_OOB_ORACLE_TOKEN?.trim() || undefined,
-      sourceSeparated: env.PI_OOB_SOURCE_SEPARATED === "1",
-      selfIps,
-    },
-  };
-}
-
-type FetchLike = (url: string, init?: RequestInit) => Promise<Response>;
-
-let oracleFetchForTest: FetchLike | undefined;
-
-/** Test seam; production uses global fetch. */
-export function setOobOracleFetchForTest(impl: FetchLike | undefined): void {
-  oracleFetchForTest = impl;
-}
-
-function makeToken(): string {
-  return randomBytes(16).toString("hex");
-}
-
-async function oracleFetch(
-  config: OobOracleConfig,
-  path: string,
-  init?: RequestInit,
-): Promise<Response> {
-  const headers: Record<string, string> = {
-    accept: "application/json",
-    ...((init?.headers as Record<string, string>) ?? {}),
-  };
-  if (config.bearer) headers.authorization = `Bearer ${config.bearer}`;
-  const fetchImpl = oracleFetchForTest ?? fetch;
-  // Bounded: an unresponsive oracle must fail the run, not hang the tool.
-  return fetchImpl(`${config.baseUrl}${path}`, {
-    ...init,
-    headers,
-    signal: AbortSignal.timeout(30_000),
-  });
-}
-
-export type ProvisionedCallback = {
-  /** Harness-generated secret embedded in the provisioned domain. */
-  token: string;
-  /** Domain the payload must make the target interact with. */
-  domain: string;
-};
-
-/**
- * Provision one callback identity. The token is generated HERE (harness owns
- * the secret); the oracle returns a domain that embeds it.
- */
-export async function provisionCallback(config: OobOracleConfig): Promise<ProvisionedCallback> {
-  const token = makeToken();
-  let res: Response;
-  try {
-    res = await oracleFetch(config, "/provision", {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ token }),
-    });
-  } catch (e) {
-    throw new Error(`OOB oracle unreachable (${config.baseUrl}): ${(e as Error).message}`);
-  }
-  if (!res.ok) {
-    throw new Error(`OOB oracle /provision failed: HTTP ${res.status}`);
-  }
-  let body: { domain?: unknown };
-  try {
-    body = (await res.json()) as { domain?: unknown };
-  } catch {
-    throw new Error("OOB oracle /provision returned a non-JSON body");
-  }
-  if (typeof body.domain !== "string" || !body.domain.includes(token)) {
-    throw new Error(
-      "OOB oracle /provision returned a domain that does not embed the harness token — refusing an oracle that invents its own secrets",
-    );
-  }
-  return { token, domain: body.domain };
-}
-
-export type OobPollResult = {
-  interactions: OobInteraction[];
-  /** Interactions NOT counted (self-IP matches) — recorded honestly. */
-  selfInteractions: OobInteraction[];
-};
-
-/** Fetch (not wait-and-retry — callers own the polling loop) current interactions for a token. */
-export async function fetchInteractions(
-  config: OobOracleConfig,
-  token: string,
-): Promise<OobPollResult> {
-  let res: Response;
-  try {
-    res = await oracleFetch(config, `/interactions?token=${encodeURIComponent(token)}`);
-  } catch (e) {
-    throw new Error(`OOB oracle unreachable (${config.baseUrl}): ${(e as Error).message}`);
-  }
-  if (!res.ok) {
-    throw new Error(`OOB oracle /interactions failed: HTTP ${res.status}`);
-  }
-  let body: { interactions?: unknown };
-  try {
-    body = (await res.json()) as { interactions?: unknown };
-  } catch {
-    throw new Error("OOB oracle /interactions returned a non-JSON body");
-  }
-  if (!Array.isArray(body.interactions)) {
-    throw new Error("OOB oracle /interactions response missing interactions array");
-  }
-  const all = body.interactions.filter(
-    (i): i is OobInteraction => typeof i === "object" && i !== null,
-  );
-  const self = config.selfIps;
-  // Fail closed on provenance: an interaction WITHOUT a source IP cannot be
-  // attributed to the target (a PoC could fabricate one on any channel it
-  // reaches), so it is never counted as a hit — surfaced separately instead.
-  const interactions = all.filter(
-    (i) => typeof i.src_ip === "string" && i.src_ip.length > 0 && !self.includes(i.src_ip),
-  );
-  const selfInteractions = all.filter(
-    (i) => !i.src_ip || (typeof i.src_ip === "string" && self.includes(i.src_ip)),
-  );
-  return { interactions, selfInteractions };
-}
-
-/**
- * Poll for interactions on both run tokens. Once ANY token observes an
- * interaction, polling continues for a full settle window so a DELAYED
- * control-token hit (the false-positive shape: target fires at t=1s, a
- * cheating/self-caused control hit lands at t=3s after an early exit)
- * cannot be missed. Evaluation happens after settle or at deadline.
- */
-export async function verifyOobDifferential(
-  opts: {
-    targetToken: string;
-    controlToken: string;
-    pollMs?: number;
-    intervalMs?: number;
-    /** Keep polling this long after the first observed interaction. */
-    settleMs?: number;
-  },
-  env: NodeJS.ProcessEnv = process.env,
-): Promise<{ verification: import("./ledger.ts").OobVerification }> {
-  const { config, error } = readOobOracleConfig(env);
-  if (!config) throw new Error(error ?? "OOB oracle not configured");
-  // Env overrides are operator tuning: clamp to sane minimums so a typo like
-  // PI_OOB_POLL_MS=-5 cannot produce an inverted deadline or a zero window.
-  const pollMs = opts.pollMs ?? Math.max(Number(env.PI_OOB_POLL_MS) || 30_000, 1_000);
-  const intervalMs = opts.intervalMs ?? Math.max(Number(env.PI_OOB_INTERVAL_MS) || 2_000, 100);
-  const settleMs =
-    opts.settleMs ?? Math.max(Number(env.PI_OOB_SETTLE_MS) || Math.max(intervalMs, 5_000), 250);
-  const deadline = Date.now() + pollMs;
-
-  let target: OobPollResult = { interactions: [], selfInteractions: [] };
-  let control: OobPollResult = { interactions: [], selfInteractions: [] };
-  let firstHitAt: number | undefined;
-  for (;;) {
-    target = await fetchInteractions(config, opts.targetToken);
-    control = await fetchInteractions(config, opts.controlToken);
-    if (target.interactions.length > 0 || control.interactions.length > 0) {
-      firstHitAt ??= Date.now();
-      // Settled: kept watching past the first hit long enough to catch
-      // trailing control hits.
-      if (Date.now() - firstHitAt >= settleMs) break;
-    }
-    const now = Date.now();
-    if (now >= deadline) break;
-    await new Promise((r) => setTimeout(r, Math.min(intervalMs, deadline - now)));
-  }
-
-  const notes: string[] = [];
-  if (target.selfInteractions.length + control.selfInteractions.length > 0) {
-    notes.push(
-      `${target.selfInteractions.length} target-run / ${control.selfInteractions.length} ` +
-        "control-run unattributed-or-self-source interaction(s) rejected (missing src_ip or PI_OOB_SELF_IPS)",
-    );
-  }
-  notes.push(
-    config.sourceSeparated
-      ? "operator attests source separation (PI_OOB_SOURCE_SEPARATED=1)"
-      : "source separation NOT attested — diagnostic only",
-  );
-  // Tokens are stored raw in the ledger (see PendingConfirmation.oobTokens);
-  // an oracle reachable without a bearer token makes those tokens pollable by
-  // anyone with ledger read access. Surface it where the operator's attention
-  // already is — the verification note.
-  if (!config.bearer) {
-    notes.push(
-      "oracle has no PI_OOB_ORACLE_TOKEN — stored run tokens are pollable by anyone with oracle network access; set a bearer token or restrict the oracle endpoint",
-    );
-  }
-
-  return {
-    verification: {
-      attempted: true,
-      targetHits: target.interactions.length,
-      controlHits: control.interactions.length,
-      sourceSeparated: config.sourceSeparated,
-      note:
-        `target-token ${target.interactions.length} interaction(s), control-token ${control.interactions.length}` +
-        (notes.length ? `; ${notes.join("; ")}` : ""),
-    },
-  };
-}