@xaccefy/pi-casefile 0.9.4 → 0.10.1

package/src/evidence.ts

@@ -385,9 +385,54 @@ export function normalizeEvidence(e: PoCEvidence): string {
   return JSON.stringify({ claim: e.claim, verify: e.verify, baseline: e.baseline });
 }
 
+// ── Artifact secret scanning (defense in depth) ──────────────────────
+//
+// Evidence artifacts are raw target responses and logs — they routinely
+// contain live credentials. The gate never blocks storage (an engaged
+// finding must keep its proof), it FLAGS the item so every later view can
+// redact or warn. Best-effort pattern matching only: labels are recorded,
+// matched VALUES are never persisted by the scanner itself.
+
+/** Label → pattern. Linear regexes only (artifacts reach 10 MiB). */
+const SECRET_PATTERNS: ReadonlyArray<{ label: string; pattern: RegExp }> = [
+  { label: "aws-access-key", pattern: /\bAKIA[0-9A-Z]{16}\b/g },
+  { label: "google-api-key", pattern: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { label: "github-token", pattern: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g },
+  { label: "slack-token", pattern: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g },
+  {
+    label: "private-key-block",
+    pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/g,
+  },
+  { label: "bearer-token", pattern: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/gi },
+  { label: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
+  {
+    label: "credential-assignment",
+    pattern:
+      /\b(?:api[_-]?key|apikey|secret|token|passwd|password)\b["']?\s*[:=]\s*["'][^"'\s]{12,}["']/gi,
+  },
+];
+
+/**
+ * Scan artifact bytes for embedded secret material. Returns the LABELS of the
+ * patterns that matched (deduplicated, order of first match) — never the
+ * matched values themselves.
+ */
+export function scanArtifactForSecrets(bytes: Buffer): string[] {
+  const text = bytes.toString("utf8");
+  const labels: string[] = [];
+  for (const { label, pattern } of SECRET_PATTERNS) {
+    pattern.lastIndex = 0;
+    if (pattern.test(text)) labels.push(label);
+  }
+  return labels;
+}
+
 // ── Main-agent confirmation verdict ─────────────────────────────────
 
-export const CONFIRM_VERDICT_VALUES = ["CONFIRMED", "NOT_CONFIRMED"] as const;
+// INCONCLUSIVE is the fail-safe verdict: the reviewer could neither reproduce
+// the finding nor positively disprove it. It preserves the case for manual
+// review instead of dropping it. NOT_CONFIRMED means positively disproved.
+export const CONFIRM_VERDICT_VALUES = ["CONFIRMED", "NOT_CONFIRMED", "INCONCLUSIVE"] as const;
 export type ConfirmVerdict = (typeof CONFIRM_VERDICT_VALUES)[number];
 
 export const CONFIRM_DIFFERENTIAL_VALUES = [
@@ -401,6 +446,82 @@ export type ConfirmDifferential = (typeof CONFIRM_DIFFERENTIAL_VALUES)[number];
 export const SEVERITY_MATCH_VALUES = ["under", "over", "ok"] as const;
 export const CANARY_ASSESSMENT_VALUES = ["verified", "not_applicable"] as const;
 
+// ── Quorum panel votes (advisory, CONFIRMED-blocking) ───────────────
+
+export const PANEL_VERDICT_VALUES = ["exploit", "not_exploit", "inconclusive"] as const;
+export type PanelVote = {
+  verdict: (typeof PANEL_VERDICT_VALUES)[number];
+  rationale: string;
+  model: string;
+  at?: string;
+};
+
+/** Bounded panel: enough voices for 2/3 quorum, small enough to stay cheap. */
+const MAX_PANEL_VOTES = 5;
+
+/**
+ * Validate panel votes recorded on a promotion bundle. Votes are advisory —
+ * they gate only the CONFIRMED commit (quorum or explicit override note) —
+ * but their SHAPE is machine-checked so a malformed panel cannot silently
+ * count as a quorum.
+ */
+export function validatePanelVotes(
+  raw: unknown,
+): { ok: true; votes: PanelVote[] } | { ok: false; error: string } {
+  if (!Array.isArray(raw)) return { ok: false, error: "panel_votes must be an array" };
+  if (raw.length === 0) return { ok: false, error: "panel_votes must not be empty when provided" };
+  if (raw.length > MAX_PANEL_VOTES) {
+    return { ok: false, error: `panel_votes exceeds ${MAX_PANEL_VOTES} entries` };
+  }
+  for (const [index, v] of raw.entries()) {
+    if (!isRecord(v)) return { ok: false, error: `panel_votes[${index}] must be an object` };
+    if (
+      !nonEmptyString(v.verdict) ||
+      !(PANEL_VERDICT_VALUES as readonly string[]).includes(v.verdict)
+    ) {
+      return {
+        ok: false,
+        error: `panel_votes[${index}].verdict must be one of ${PANEL_VERDICT_VALUES.join(" | ")}`,
+      };
+    }
+    if (!nonEmptyString(v.rationale)) {
+      return { ok: false, error: `panel_votes[${index}].rationale must be a non-empty string` };
+    }
+    if (!nonEmptyString(v.model)) {
+      return { ok: false, error: `panel_votes[${index}].model must be a non-empty string` };
+    }
+    if (v.at !== undefined) {
+      if (!nonEmptyString(v.at) || !Number.isFinite(Date.parse(v.at))) {
+        return { ok: false, error: `panel_votes[${index}].at must be a parseable timestamp` };
+      }
+    }
+  }
+  return { ok: true, votes: raw as unknown as PanelVote[] };
+}
+
+/**
+ * Quorum rule: a panel of at least 3 votes with at least 2 exploit verdicts
+ * and exploit strictly ahead of not_exploit. Anything else — no panel, a tied
+ * panel, or a dissenting majority — requires the main agent's explicit
+ * override note to CONFIRM.
+ */
+export function panelQuorumReached(votes: PanelVote[] | undefined): {
+  quorum: boolean;
+  exploit: number;
+  notExploit: number;
+  total: number;
+} {
+  const list = votes ?? [];
+  const exploit = list.filter((v) => v.verdict === "exploit").length;
+  const notExploit = list.filter((v) => v.verdict === "not_exploit").length;
+  return {
+    quorum: list.length >= 3 && exploit >= 2 && exploit > notExploit,
+    exploit,
+    notExploit,
+    total: list.length,
+  };
+}
+
 export type MainAgentVerdict = {
   verdict: ConfirmVerdict;
   reasoning: string;
@@ -418,6 +539,12 @@ export type MainAgentVerdict = {
   canary_assessment?: (typeof CANARY_ASSESSMENT_VALUES)[number];
   /** Why no meaningful canary oracle exists for this exploit class. */
   canary_reason?: string;
+  /**
+   * Why CONFIRMED proceeds without a 2/3 exploit panel quorum (no panel
+   * provisioned, panel unavailable, or documented disagreement). Required for
+   * CONFIRMED whenever quorum was not reached.
+   */
+  panel_override_note?: string;
   /** Which model judged (recorded for the accuracy ledger). */
   model?: string;
 };
@@ -469,6 +596,9 @@ export function validateMainAgentVerdict(
   if (raw.canary_reason !== undefined && !nonEmptyString(raw.canary_reason)) {
     return { ok: false, error: "verdict canary_reason must be a non-empty string" };
   }
+  if (raw.panel_override_note !== undefined && !nonEmptyString(raw.panel_override_note)) {
+    return { ok: false, error: "verdict panel_override_note must be a non-empty string" };
+  }
   if (
     raw.severity_match !== undefined &&
     !SEVERITY_MATCH_VALUES.includes(raw.severity_match as never)
@@ -518,6 +648,3 @@ export function validateMainAgentVerdict(
 
 /** @deprecated Compatibility alias for integrations built before phase 2 became main-agent-only. */
 export type ConfirmerVerdict = MainAgentVerdict;
-
-/** @deprecated Use validateMainAgentVerdict. */
-export const validateConfirmerVerdict = validateMainAgentVerdict;

package/src/harness-verify.ts

@@ -76,8 +76,16 @@ const REGEX_TIMEOUT_MS = 250;
 
 type ResolvedAddress = { address: string; family: 4 | 6 };
 
+/** Comparison-normalize a hostname: lowercase, strip IPv6 brackets and any trailing root dot. */
+function normHost(hostname: string): string {
+  return hostname
+    .toLowerCase()
+    .replace(/^\[|\]$/g, "")
+    .replace(/\.$/, "");
+}
+
 async function resolveHost(hostname: string): Promise<ResolvedAddress[]> {
-  const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  const host = normHost(hostname);
   const literalFamily = isIP(host);
   if (literalFamily) return [{ address: host, family: literalFamily as 4 | 6 }];
   const lookup = dnsLookup(host, { all: true, verbatim: true }) as Promise<ResolvedAddress[]>;
@@ -116,10 +124,7 @@ function sameTargetIdentity(left: string, right: string): boolean {
   const a = parseNetworkTarget(left);
   const b = parseNetworkTarget(right);
   if (!a || !b) return false;
-  if (
-    a.url.hostname.toLowerCase().replace(/\.$/, "") !==
-    b.url.hostname.toLowerCase().replace(/\.$/, "")
-  ) {
+  if (normHost(a.url.hostname) !== normHost(b.url.hostname)) {
     return false;
   }
   if ((a.url.port || b.url.port) && effectivePort(a.url) !== effectivePort(b.url)) return false;
@@ -161,8 +166,8 @@ export function verifyUrlBindingError(verifyUrl: string, target: string): string
     return `verify.url is not parseable: ${verifyUrl}`;
   }
   if (!declared) return `target is not an HTTP network target: ${target}`;
-  const declaredHost = declared.url.hostname.toLowerCase().replace(/\.$/, "");
-  const observedHost = observed.hostname.toLowerCase().replace(/\.$/, "");
+  const declaredHost = normHost(declared.url.hostname);
+  const observedHost = normHost(observed.hostname);
   if (declaredHost !== observedHost) {
     return `verify.url host ${observedHost} does not match run target ${declaredHost}`;
   }
@@ -383,7 +388,7 @@ async function replayRequest(
     };
   }
   const signal = AbortSignal.timeout(opts?.timeoutMs ?? TIMEOUT_MS);
-  const lockedHostname = url.hostname.toLowerCase().replace(/\.$/, "");
+  const lockedHostname = normHost(url.hostname);
   const fetchImpl = opts?.fetchImpl ?? harnessFetchForTest;
 
   for (let redirects = 0; redirects <= MAX_REDIRECTS; redirects++) {
@@ -415,13 +420,11 @@ async function replayRequest(
           note: `request errored (DNS): ${url.hostname} resolved to no addresses`,
         };
       }
-    } else if (isIP(url.hostname.replace(/^\[|\]$/g, ""))) {
-      addresses = [
-        {
-          address: url.hostname.replace(/^\[|\]$/g, ""),
-          family: isIP(url.hostname.replace(/^\[|\]$/g, "")) as 4 | 6,
-        },
-      ];
+    } else {
+      const host = normHost(url.hostname);
+      if (isIP(host)) {
+        addresses = [{ address: host, family: isIP(host) as 4 | 6 }];
+      }
     }
     if (!opts?.allowPrivate && addresses.some((address) => !isPublicIpAddress(address.address))) {
       return {
@@ -470,7 +473,7 @@ async function replayRequest(
             note: `redirected to disallowed protocol ${next.protocol}`,
           };
         }
-        if (next.hostname.toLowerCase().replace(/\.$/, "") !== lockedHostname) {
+        if (normHost(next.hostname) !== lockedHostname) {
           await res.body?.cancel().catch(() => undefined);
           await fetched.close().catch(() => undefined);
           closeFetched = undefined;
@@ -609,32 +612,6 @@ function canaryResult(
   };
 }
 
-/**
- * Re-send the evidence's verify request with the harness's own client and
- * judge the response against verify.expect. Never throws — the outcome is a
- * structured result the ledger gate interprets.
- */
-export async function replayVerify(
-  evidence: PoCEvidence,
-  opts?: ReplayOptions,
-): Promise<HarnessVerifyResult> {
-  const token = evidence.verify.canary
-    ? `poc_canary_${randomBytes(24).toString("hex")}`
-    : undefined;
-  const verify = injectCanary(evidence.verify, token);
-  const target = await replayRequest(verify, verify.expect, token, opts);
-  const canary = canaryResult(token, target);
-  return {
-    attempted: target.attempted,
-    pass: target.matched === true,
-    status: target.status,
-    target,
-    canary,
-    proofStrength: canary?.pass ? "canary_differential" : "predicate_differential",
-    note: `harness replay: ${target.note}${canary ? `; ${canary.note}` : ""}`,
-  };
-}
-
 /**
  * Combine the two observations into the differential verdict. Shared by the
  * inter-host (target vs control host) and intra-target (attack vs same-host