@zivis/mcp 0.1.0-alpha.21 → 0.1.0-alpha.22

package/dist/pattern-packs/zivis-public-0.1.0/capsules/prompting/self-consistency-no-isolation.yaml

@@ -0,0 +1,240 @@
+# Capsule: Self-consistency without context isolation
+# Spec: docs/specs/PATTERN-MATCHING-LIBRARY-V1.md
+# Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md
+# Schema: schemas/pattern-detection-card.schema.json
+
+id: prompting.self-consistency-no-isolation
+slug: self-consistency-no-isolation
+version: 0.1.0
+category: prompting
+title: Self-Consistency Without Context Isolation
+headline: Vote Without Independence
+description: >
+  Detects code that aggregates multiple LLM samples (vote, consensus, ranking)
+  while every sample shares the same untrusted context. Majority voting only
+  filters random noise — when context is shared, correlated errors override
+  correctness and the vote count is mis-read as calibrated confidence.
+
+detection_tier: public
+scoring_tier: proprietary
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+relevance_filter:
+  any_of:
+    - dependency: openai
+      direct_only: true
+    - dependency: "@anthropic-ai/sdk"
+      direct_only: true
+    - dependency: anthropic
+      direct_only: true
+    - dependency: "ai"
+      direct_only: true
+    - dependency: langchain
+      direct_only: true
+    - dependency: llama-index
+      direct_only: true
+
+strategies:
+  - code: AST
+    language: python
+    expression: |
+      rule:
+        kind: for_statement
+        has:
+          kind: call
+          any:
+            - pattern: $CLIENT.chat.completions.create($$$)
+            - pattern: $CLIENT.messages.create($$$)
+            - pattern: openai.ChatCompletion.create($$$)
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.30
+
+  - code: AST
+    language: typescript
+    expression: |
+      rule:
+        any:
+          - pattern: |
+              for ($_; $_; $_) {
+                $$$
+                generateText($$$)
+                $$$
+              }
+          - pattern: |
+              [...].map($_ => generateText($$$))
+          - pattern: |
+              Promise.all([... .map($_ => $CLIENT.chat.completions.create($$$))])
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.30
+
+  - code: GRAPH
+    expression: |
+      same_messages_argument_passed_to_n_completion_calls(n >= 2)
+      AND aggregator_observed(any_of: Counter, max(set(.), key=.count), majority_vote, np.argmax, statistics.mode)
+    evidence_fields: [graph_path, file_spans, node_ids]
+    confidence_weight: 0.30
+
+  - code: META
+    expression: |
+      NOT exists_any_of(
+        per_sample_retrieval_diversification,
+        per_sample_temperature_variation,
+        per_sample_seed_variation,
+        external_validator_on_facts,
+        human_approval_gate
+      )
+    evidence_fields: [missing_controls]
+    confidence_weight: 0.25
+
+  - code: INFER
+    expression: prompt_id:prompting.self-consistency-no-isolation.identify
+    evidence_fields: [llm_rationale]
+    confidence_weight: 0.15
+    trusted: false
+
+required_evidence_count: 3
+
+control_negations:
+  - "presence_of(per_sample_retrieval_diversification)"
+  - "presence_of(external_validator_on_facts)"
+  - "presence_of(human_approval_gate)"
+
+threats:
+  - title: Vote count mistaken for calibrated confidence
+    stride: [tampering, repudiation]
+    description: >
+      The application treats agreement across samples as independent confirmation,
+      when in fact every sample saw the same poisoned retrieval context or the
+      same prompt-injection payload. Downstream actions (auto-approve, send,
+      execute) fire under false high-confidence signal.
+    remediation: >
+      Diversify per-sample retrieval queries, temperatures, or seeds.
+      Add an external fact-validator. For high-impact outputs, require a human
+      approval gate. Never expose vote count as a confidence number to users
+      without disclosing the independence assumption.
+  - title: Correlated injection amplification
+    stride: [tampering]
+    description: >
+      A single prompt-injection payload in shared retrieved context biases all N
+      samples identically; majority vote then ratifies the attack rather than
+      filtering it.
+    remediation: >
+      Per-sample context isolation. Run independent retrieval (different queries
+      or different stores) per sample so an injection only contaminates a subset.
+
+fixtures:
+  positive:
+    - "fixtures/positive/self-consistency-no-isolation/openai_loop_vote_python"
+    - "fixtures/positive/self-consistency-no-isolation/anthropic_promise_all_typescript"
+  negative:
+    - "fixtures/negative/self-consistency-no-isolation/per_sample_diverse_retrieval"
+    - "fixtures/negative/self-consistency-no-isolation/single_completion_no_aggregation"
+
+lifecycle: draft
+owner: platform-threat-modeling
+tags:
+  - prompting
+  - self-consistency
+  - context-isolation
+  - prompt-injection-amplification
+
+sensitivity_level: customer_safe
+allowed_execution_modes:
+  - local_only
+  - local_model
+  - hybrid_cloud_eval
+
+safe_summary: >
+  Multiple LLM completions are aggregated by voting or consensus, but every
+  sample sees the same retrieved context or the same user message. Independence
+  is assumed and not enforced. A single prompt-injection or a single
+  hallucinated retrieval contaminates the vote uniformly; majority count is
+  mistaken for calibrated confidence and downstream actions fire under
+  false certainty.
+
+detect_when: >
+  Two or more LLM completions for the same user task are merged by voting,
+  consensus, or similarity scoring without independent context isolation —
+  no per-sample retrieval diversification, no external validator, no human gate.
+
+risk_hints:
+  - Shared retrieval/injection in the user message affects every sample the same way
+  - Majority vote amplifies systematic bias rather than filtering noise
+  - Vote count surfaced as a confidence number is a UX lie when context is shared
+  - Async Promise.all with the same messages array is the most common JS shape
+
+architectural_signals:
+  - Same `messages` argument passed to N completion calls inside a loop or Promise.all
+  - majority_vote, Counter, np.argmax, statistics.mode applied to the result array
+  - Single retrieval call upstream feeding all samples
+
+model_task_prompt_ref: prompts/prompting/self-consistency-no-isolation/identify.md
+
+expected_output_schema:
+  type: object
+  required: [independence_assessment, confidence_claim_risk, evidence_spans]
+  properties:
+    independence_assessment:
+      type: string
+      enum: [shared_context, isolated_context, unclear]
+    confidence_claim_risk:
+      type: string
+      enum: [high, medium, low]
+      description: How dangerous is the confidence claim users see, given the (lack of) independence
+    rationale:
+      type: string
+    recommended_controls:
+      type: array
+      items:
+        type: string
+        enum: [per_sample_retrieval_diversification, external_validator, human_approval, temperature_variation, seed_variation]
+    evidence_spans:
+      type: array
+      items:
+        type: object
+        required: [file]
+        properties:
+          file: { type: string }
+          start_line: { type: integer }
+          end_line: { type: integer }
+          note: { type: string }
+
+minimum_context_required:
+  lines: 80
+  symbols:
+    - chat.completions.create
+    - messages.create
+    - generateText
+    - Counter
+    - majority
+    - np.argmax
+
+related_patterns:
+  - prompting.chain-of-thought-leakage
+  - retrieval.shared-context-poisoning
+
+repair_contract:
+  allowed:
+    - Diversify retrieval queries per sample
+    - Vary temperature or seed across samples
+    - Add an external fact validator on aggregated output
+    - Add a human approval gate before high-impact actions
+  forbidden:
+    - Silently treating vote count as calibrated confidence
+    - Removing the aggregation entirely for performance reasons (does not address the architectural issue)
+    - Adding more samples without addressing context independence
+
+validation_contract:
+  requires_tests_pass: false
+  requires_static_rules:
+    - aggregator_remains_present_after_patch
+    - independence_mechanism_introduced
+
+unsafe_to_expose_fields:
+  - internal_rubric
+  - golden_transcripts
+  - exploit_templates

package/dist/pattern-packs/zivis-public-0.1.0/capsules/security/late-org-filter.yaml

@@ -0,0 +1,270 @@
+# Capsule: Late org-filter — cross-tenant leak via presentation-time scoping
+# Spec: docs/specs/PATTERN-MATCHING-LIBRARY-V1.md
+# Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md
+# Schema: schemas/pattern-detection-card.schema.json
+
+id: security.late-org-filter
+slug: late-org-filter
+version: 0.1.0
+category: security
+title: Late Org Filter
+headline: Tenant Scoping Applied After the Query, Not Inside It
+description: >
+  Detects multi-tenant code paths where org/tenant filtering happens at the
+  presentation layer (response loop, stream emit, response shaping) instead
+  of inside the data query. Any race, error path, or partial response that
+  reaches the wire before the filter fires leaks rows across tenants.
+
+detection_tier: public
+scoring_tier: proprietary
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+  - go
+
+relevance_filter:
+  any_of:
+    - dependency: express
+      direct_only: true
+    - dependency: fastify
+      direct_only: true
+    - dependency: hono
+      direct_only: true
+    - dependency: "@nestjs/core"
+      direct_only: true
+    - dependency: fastapi
+      direct_only: true
+    - dependency: flask
+      direct_only: true
+    - dependency: "django"
+      direct_only: true
+    - dependency: "github.com/gin-gonic/gin"
+      direct_only: true
+    - dependency: "github.com/labstack/echo/v4"
+      direct_only: true
+  none_of:
+    # If the project clearly isn't multi-tenant, skip — no benefit, lots of noise.
+    - evidence: "single_tenant_only_marker"
+
+strategies:
+  - code: AST
+    language: typescript
+    expression: |
+      rule:
+        any:
+          # Filter applied to a query result then sent — classic shape.
+          - pattern: |
+              const $ROWS = await $QUERY($$$);
+              $ROWS.filter($_ => $_.orgId === $REQ.orgId).$$$;
+          - pattern: |
+              const $ROWS = await $QUERY($$$);
+              for (const $R of $ROWS) {
+                if ($R.orgId === $REQ.orgId) { $$$ }
+              }
+          # SSE / stream where filter applied per emit, not at subscription.
+          - pattern: |
+              $STREAM.on("$_", $EVENT => {
+                if ($EVENT.orgId === $REQ.orgId) { $$$ }
+              });
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.35
+
+  - code: AST
+    language: python
+    expression: |
+      rule:
+        any:
+          - pattern: |
+              rows = $QUERY($$$)
+              filtered = [r for r in rows if r.org_id == $REQ.org_id]
+          - pattern: |
+              for row in $QUERY($$$):
+                if row.org_id == request.org_id:
+                  yield row
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.35
+
+  - code: GRAPH
+    expression: |
+      query_call_returns_rows
+      AND filter_predicate_references(req_org_id OR session_org_id)
+      AND filter_executes_AFTER(query_call) IN response_handler_or_stream_emit
+      AND query_call.where_clause DOES_NOT include org_id
+    evidence_fields: [graph_path, file_spans, node_ids]
+    confidence_weight: 0.30
+
+  - code: META
+    expression: |
+      NOT exists_any_of(
+        row_level_security_policy,
+        query_helper_with_implicit_org_scope,
+        prisma_extension_or_middleware_attaching_org_filter,
+        sqlalchemy_loader_option_with_org_scope
+      )
+    evidence_fields: [missing_controls]
+    confidence_weight: 0.20
+
+  - code: INFER
+    expression: prompt_id:security.late-org-filter.identify
+    evidence_fields: [llm_rationale]
+    confidence_weight: 0.15
+    trusted: false
+
+required_evidence_count: 3
+
+control_negations:
+  - "presence_of(row_level_security_policy)"
+  - "presence_of(query_helper_with_implicit_org_scope)"
+  - "presence_of(prisma_extension_or_middleware_attaching_org_filter)"
+
+threats:
+  - title: Cross-tenant data leak via SSE / stream pre-filter window
+    stride: [information_disclosure, elevation_of_privilege]
+    description: >
+      In a streaming or async-iterator response, the underlying query returns
+      rows from all tenants and the per-emit filter rejects mismatches. A
+      brief window where rows are buffered, logged, traced, or partially
+      rendered before the filter executes can leak data across tenants. This
+      is the SSE / queue/stream variant of the pattern.
+    remediation: >
+      Push the org/tenant predicate into the data layer — RLS, query helpers,
+      ORM middleware. Make every query mandatorily org-scoped at the boundary;
+      treat presentation-layer filters as defense in depth, never the primary
+      barrier.
+  - title: Cross-tenant leak via error path or partial response
+    stride: [information_disclosure]
+    description: >
+      An exception inside the post-query filter loop returns the unfiltered
+      buffer or a serialization mid-state. Other tenants' rows reach the
+      wire because the only org check sits past the failure point.
+    remediation: >
+      Same control — RLS or query-time scoping. Plus: serialize the response
+      body only after filtering completes; on filter error, return a
+      structured error with no payload.
+  - title: Logged or traced rows expose other tenants
+    stride: [information_disclosure, repudiation]
+    description: >
+      Observability hooks (request logger, tracer, metrics) often capture the
+      raw query result before the presentation-layer filter runs. Other
+      tenants' identifiers, names, or PII land in logs the requesting tenant
+      should never have seen.
+    remediation: >
+      Either log only post-filter results, or — better — make the query
+      itself org-scoped so the unfiltered result never exists.
+
+fixtures:
+  positive:
+    - "fixtures/positive/late-org-filter/express_sse_post_filter_typescript"
+    - "fixtures/positive/late-org-filter/fastapi_iterator_post_filter_python"
+  negative:
+    - "fixtures/negative/late-org-filter/prisma_middleware_org_scope"
+    - "fixtures/negative/late-org-filter/postgres_rls_enabled"
+
+lifecycle: draft
+owner: platform-threat-modeling
+tags:
+  - multi-tenant
+  - cross-tenant-leak
+  - data-scoping
+  - sse
+  - stream
+
+sensitivity_level: customer_safe
+allowed_execution_modes:
+  - local_only
+  - local_model
+  - hybrid_cloud_eval
+
+safe_summary: >
+  Tenant filtering applied after the query — at the response loop, the SSE
+  emit, or the stream iterator — instead of inside the query. Any error,
+  race, observability hook, or partial response that fires before the filter
+  reaches the wire leaks rows across tenants. The fix is to push org/tenant
+  scoping down to the data layer (RLS, query helpers, ORM middleware) so the
+  unfiltered set never exists in the first place.
+
+detect_when: >
+  A handler, stream, or async iterator runs a data query, then filters the
+  result by `request.orgId` (or a session org) before responding — and the
+  query itself doesn't include the org predicate. Multi-tenant routes only.
+
+risk_hints:
+  - The bug class behind a meaningful share of cross-tenant SaaS incidents
+  - SSE / queue / WebSocket variants are the hardest to spot because the filter looks "inside" the loop
+  - Logs and traces often capture the unfiltered set even when the response itself is clean
+  - Tests often pass because they only run with a single tenant in the test database
+
+architectural_signals:
+  - Query call followed by an explicit filter referencing a request/session org id
+  - SSE or async iterator that yields events conditional on a tenant match
+  - No row-level security policy, no implicit-org-scope helper, no ORM middleware
+
+model_task_prompt_ref: prompts/security/late-org-filter/identify.md
+
+expected_output_schema:
+  type: object
+  required: [verdict, scope_location, evidence_spans]
+  properties:
+    verdict:
+      type: string
+      enum: [late_filter_present, scoped_at_query, partial_scope, unclear]
+    scope_location:
+      type: string
+      enum: [data_layer, query_layer, presentation_layer, multiple, none]
+    rationale:
+      type: string
+    blast_radius:
+      type: string
+      enum: [single_endpoint, route_family, service_wide, unclear]
+    recommended_controls:
+      type: array
+      items:
+        type: string
+        enum: [row_level_security, query_helper, orm_middleware, repository_pattern_with_org_scope, none]
+    evidence_spans:
+      type: array
+      items:
+        type: object
+        required: [file]
+        properties:
+          file: { type: string }
+          start_line: { type: integer }
+          end_line: { type: integer }
+          note: { type: string }
+
+minimum_context_required:
+  lines: 100
+  symbols:
+    - orgId
+    - org_id
+    - tenant_id
+    - filter
+    - SSE
+    - stream
+
+related_patterns:
+  - security.idor-via-direct-id
+  - security.broken-object-level-authz
+
+repair_contract:
+  allowed:
+    - Push org/tenant scoping into the query (where clause, RLS, ORM middleware)
+    - Introduce a repository wrapper that mandates org_id on every method
+    - Add a Postgres row-level security policy
+    - Keep the presentation-layer filter as defense in depth IN ADDITION TO the data-layer scope
+  forbidden:
+    - Removing the presentation-layer filter without first introducing a data-layer scope (regresses safety)
+    - Treating the patch as complete after only fixing the immediate route — the bug class is structural
+
+validation_contract:
+  requires_tests_pass: false
+  requires_static_rules:
+    - data_layer_org_scope_present_after_patch
+    - no_unscoped_query_remains_in_route_handler
+
+unsafe_to_expose_fields:
+  - internal_rubric
+  - golden_transcripts
+  - exploit_templates

package/dist/pattern-packs/zivis-public-0.1.0/manifest.json

@@ -0,0 +1,68 @@
+{
+  "schema_version": "1.0.0",
+  "pack_id": "zivis-public",
+  "pack_name": "ZIVIS Public Pattern Pack",
+  "version": "0.1.0",
+  "built_at": "2026-05-06T21:01:49.106Z",
+  "tier": "customer_safe",
+  "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
+  "capsules": [
+    {
+      "id": "agents.privilege-separation",
+      "version": "0.1.0",
+      "path": "capsules/agents/privilege-separation.yaml",
+      "sha256": "31b5984b167ab97ef5c8902327bc80363d1ed3c43d08c82d979b0e34f2b88fde",
+      "category": "agents",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "prompting.self-consistency-no-isolation",
+      "version": "0.1.0",
+      "path": "capsules/prompting/self-consistency-no-isolation.yaml",
+      "sha256": "1663fef4b9d544e7ef067501becde5d499eb64e439cf88255b4fae2cdc4d53ea",
+      "category": "prompting",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python"
+      ]
+    },
+    {
+      "id": "security.late-org-filter",
+      "version": "0.1.0",
+      "path": "capsules/security/late-org-filter.yaml",
+      "sha256": "34ef82b1da0f690af66579a09355674dd132755fbfc0411ea7c7ef5bbb1b3270",
+      "category": "security",
+      "lifecycle": "draft",
+      "applicable_languages": [
+        "typescript",
+        "javascript",
+        "python",
+        "go"
+      ]
+    }
+  ],
+  "prompts": [
+    {
+      "path": "prompts/agents/privilege-separation/identify.md",
+      "sha256": "eda7d288f9d1c6f7dfc18d2856300df76e8c4fdb5f18f3490f39ddf7117853e4",
+      "capsule_id": "agents.privilege-separation"
+    },
+    {
+      "path": "prompts/prompting/self-consistency-no-isolation/identify.md",
+      "sha256": "e05ffb777550a2a79b3c5b8e75d3e3c7fb2da2cd43ab0fcf202a9eda0f29c10f",
+      "capsule_id": "prompting.self-consistency-no-isolation"
+    },
+    {
+      "path": "prompts/security/late-org-filter/identify.md",
+      "sha256": "8e602179572ace5d457f8582b67e9d6ab29c675e82964481848c95e5ccb83e1e",
+      "capsule_id": "security.late-org-filter"
+    }
+  ]
+}

package/dist/pattern-packs/zivis-public-0.1.0/prompts/agents/privilege-separation/identify.md

@@ -0,0 +1,54 @@
+# Inference prompt: agents.privilege-separation — identify
+
+You are assisting with secure agentic-AI architecture review. The user is
+working on a codebase that has been flagged by deterministic detectors as
+*possibly* lacking privilege separation between agents. Your job is to
+look at the attached code context and produce a structured verdict.
+
+## Pattern definition
+
+**Privilege separation** means each agent in a multi-agent system is bound
+only to the minimum tools required for its role. The anti-pattern is a
+single shared tool registry that every agent inherits.
+
+## What you are evaluating
+
+1. Does the code construct two or more agents (or two or more entry points
+   that invoke the same agent factory) with a **shared** tool array?
+2. Is there a per-agent capability filter, authorization layer, or
+   capability-token check between an agent and its tool dispatch? If so,
+   the pattern does *not* fire even when tools appear shared.
+3. If LangGraph is used: are tools bound per node (good), or is one tool
+   list passed to a top-level `create_react_agent` covering every node
+   (anti-pattern)?
+
+## What does NOT count as privilege separation
+
+- Comments mentioning least privilege without code enforcing it.
+- A shared tool list with one agent renamed at runtime.
+- Defensive prompt instructions ("don't use the database tool unless…")
+  — prompts are not authorization.
+
+## Output
+
+Return JSON only, matching the capsule's `expected_output_schema`:
+
+```json
+{
+  "verdict": "absent | present | unclear",
+  "confidence": 0.0,
+  "rationale": "one paragraph",
+  "evidence_spans": [
+    { "file": "src/agent.ts", "start_line": 10, "end_line": 40, "note": "..." }
+  ]
+}
+```
+
+- `verdict: absent` — the anti-pattern fires (shared registry, no scoping).
+- `verdict: present` — privilege separation is correctly implemented.
+- `verdict: unclear` — the available context is ambiguous; do not guess.
+
+Cite line numbers from the snippet only. Do not invent files. Do not
+fabricate evidence. If a concept (e.g. "authorization layer") is mentioned
+but you cannot identify the line that implements it, mark `unclear` and
+explain.

package/dist/pattern-packs/zivis-public-0.1.0/prompts/prompting/self-consistency-no-isolation/identify.md

@@ -0,0 +1,60 @@
+# Inference prompt: prompting.self-consistency-no-isolation — identify
+
+You are reviewing code that has been flagged as *possibly* aggregating multiple
+LLM samples without context isolation. Your job is to determine whether each
+sample actually sees independent context, or whether they all share the same
+input — making the aggregation a confidence-amplifier rather than a
+confidence-filter.
+
+## What you are evaluating
+
+1. How many LLM completion calls happen for one user request? Identify the
+   loop, `Promise.all`, list comprehension, or fan-out construct.
+2. Does each sample receive the **same** `messages` / prompt argument verbatim,
+   or is there per-sample variation (different retrieval query, different
+   temperature, different seed, different context window)?
+3. How is the result aggregated? Voting, ranking, similarity-based merging,
+   first-passing-validator, or simple averaging?
+4. Is there an external check on the aggregated output — e.g. a fact validator,
+   tool-output validation, human approval gate?
+5. Does the user-facing surface advertise the vote count as a "confidence"
+   number? That's the strongest tell that independence is being assumed.
+
+## What does NOT count as context isolation
+
+- Different agent *names* with the same prompt and same retrieval.
+- Comments saying "ensemble" without per-sample variation in the call.
+- Setting `n=N` on a single OpenAI completion call (the model produces N
+  samples but they share the entire prompt and context — same problem).
+- Different temperatures on every sample WITH the same retrieval — partial
+  mitigation but not full isolation; mark `unclear` and explain.
+
+## Output
+
+Return JSON only, matching the capsule's `expected_output_schema`:
+
+```json
+{
+  "independence_assessment": "shared_context | isolated_context | unclear",
+  "confidence_claim_risk": "high | medium | low",
+  "rationale": "one paragraph",
+  "recommended_controls": [
+    "per_sample_retrieval_diversification",
+    "external_validator",
+    "human_approval"
+  ],
+  "evidence_spans": [
+    { "file": "src/agent.ts", "start_line": 10, "end_line": 40, "note": "..." }
+  ]
+}
+```
+
+- `shared_context` — every sample sees identical input. The vote is
+  amplifying rather than filtering. `confidence_claim_risk` should be `high`
+  if any user-facing label calls the vote count a confidence.
+- `isolated_context` — per-sample retrieval, temperature, or seed variation
+  IS present. The aggregation is doing real work.
+- `unclear` — context plumbing is too complex to determine from the snippet,
+  or the code uses a custom aggregator. Don't guess; ask in the rationale.
+
+Cite line numbers from the snippet only. Do not fabricate evidence.