@zivis/mcp 0.1.0-alpha.23 → 0.1.0-alpha.24

package/dist/lib/inspect-cache.d.ts

@@ -0,0 +1,32 @@
+/**
+ * inspect-cache — shared helpers for locating local `zivis inspect` artifacts.
+ *
+ * The repo-id derivation must match the algorithm `zivis inspect` uses when it
+ * writes runs (git remote URL hash, falling back to root-path hash). Both
+ * `zivis_get_started` and `zivis_threat_guide` read this cache to avoid
+ * nagging the user to re-inspect when a fresh run already exists on disk.
+ */
+export interface LocatedArtifact {
+    path: string;
+    mtimeMs: number;
+}
+export declare function userCacheRoot(): string;
+export declare function deriveRepoId(cwd: string): Promise<string>;
+/**
+ * Locate the most recent inspect artifact for THIS repo.
+ *
+ * Returns undefined if no runs exist for this repo, even when other repos
+ * have artifacts. Returns both the path and mtime so callers can apply
+ * freshness logic without re-stat'ing.
+ */
+export declare function locateLatestArtifact(cwd: string): Promise<LocatedArtifact | undefined>;
+/**
+ * Default freshness TTL for the inspect cache. After this, callers should
+ * treat the artifact as stale and recommend re-running inspect.
+ *
+ * 15 min matches the typical IDE-session length for "I just inspected; don't
+ * make me do it again." Override via ZIVIS_INSPECT_CACHE_TTL_MS.
+ */
+export declare const DEFAULT_INSPECT_CACHE_TTL_MS: number;
+export declare function inspectCacheTtlMs(): number;
+export declare function isFresh(mtimeMs: number, now?: number): boolean;

package/dist/lib/inspect-cache.js

@@ -0,0 +1,99 @@
+/**
+ * inspect-cache — shared helpers for locating local `zivis inspect` artifacts.
+ *
+ * The repo-id derivation must match the algorithm `zivis inspect` uses when it
+ * writes runs (git remote URL hash, falling back to root-path hash). Both
+ * `zivis_get_started` and `zivis_threat_guide` read this cache to avoid
+ * nagging the user to re-inspect when a fresh run already exists on disk.
+ */
+import * as fs from "node:fs/promises";
+import * as fssync from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import * as crypto from "node:crypto";
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+const execAsync = promisify(exec);
+export function userCacheRoot() {
+    const home = os.homedir();
+    if (process.platform === "darwin") {
+        return path.join(home, "Library", "Caches", "zivis");
+    }
+    if (process.platform === "win32") {
+        const localAppData = process.env.LOCALAPPDATA ?? path.join(home, "AppData", "Local");
+        return path.join(localAppData, "zivis", "Cache");
+    }
+    const xdg = process.env.XDG_CACHE_HOME;
+    return path.join(xdg ?? path.join(home, ".cache"), "zivis");
+}
+export async function deriveRepoId(cwd) {
+    const remote = await tryGit(cwd, "remote get-url origin");
+    if (remote) {
+        return "remote-" + sha256Short(remote);
+    }
+    return "path-" + sha256Short(cwd);
+}
+async function tryGit(cwd, args) {
+    try {
+        const { stdout } = await execAsync(`git ${args}`, { cwd });
+        const value = stdout.trim();
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function sha256Short(value) {
+    return crypto.createHash("sha256").update(value).digest("hex").slice(0, 16);
+}
+/**
+ * Locate the most recent inspect artifact for THIS repo.
+ *
+ * Returns undefined if no runs exist for this repo, even when other repos
+ * have artifacts. Returns both the path and mtime so callers can apply
+ * freshness logic without re-stat'ing.
+ */
+export async function locateLatestArtifact(cwd) {
+    const repoId = await deriveRepoId(cwd);
+    const runsDir = path.join(userCacheRoot(), "repos", repoId, "inspect", "runs");
+    if (!fssync.existsSync(runsDir))
+        return undefined;
+    const candidates = [];
+    for (const entry of await fs.readdir(runsDir)) {
+        if (!entry.endsWith(".json"))
+            continue;
+        const full = path.join(runsDir, entry);
+        try {
+            const stat = await fs.stat(full);
+            candidates.push({ path: full, mtimeMs: stat.mtimeMs });
+        }
+        catch {
+            // skip
+        }
+    }
+    if (candidates.length === 0)
+        return undefined;
+    candidates.sort((a, b) => b.mtimeMs - a.mtimeMs);
+    return candidates[0];
+}
+/**
+ * Default freshness TTL for the inspect cache. After this, callers should
+ * treat the artifact as stale and recommend re-running inspect.
+ *
+ * 15 min matches the typical IDE-session length for "I just inspected; don't
+ * make me do it again." Override via ZIVIS_INSPECT_CACHE_TTL_MS.
+ */
+export const DEFAULT_INSPECT_CACHE_TTL_MS = 15 * 60 * 1000;
+export function inspectCacheTtlMs() {
+    const raw = process.env.ZIVIS_INSPECT_CACHE_TTL_MS;
+    if (!raw)
+        return DEFAULT_INSPECT_CACHE_TTL_MS;
+    const parsed = Number.parseInt(raw, 10);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return DEFAULT_INSPECT_CACHE_TTL_MS;
+    return parsed;
+}
+export function isFresh(mtimeMs, now = Date.now()) {
+    return now - mtimeMs <= inspectCacheTtlMs();
+}
+//# sourceMappingURL=inspect-cache.js.map

package/dist/lib/inspect-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect-cache.js","sourceRoot":"","sources":["../../src/lib/inspect-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAOlC,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACrF,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW;IAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC1D,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,KAAK,IAAI,SAAS,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAW;IACpD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/E,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE3D,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,4BAA4B,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,4BAA4B,CAAC;IACjF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC/D,OAAO,GAAG,GAAG,OAAO,IAAI,iBAAiB,EAAE,CAAC;AAC9C,CAAC"}

package/dist/pattern-packs/zivis-public-0.1.0/manifest.json

@@ -3,7 +3,7 @@
   "pack_id": "zivis-public",
   "pack_name": "ZIVIS Public Pattern Pack",
   "version": "0.1.0",
-  "built_at": "2026-05-07T12:24:59.867Z",
+  "built_at": "2026-05-07T12:29:17.361Z",
   "tier": "customer_safe",
   "description": "ZIVIS-curated public pattern pack — capsules + inference prompts evaluated locally on the user's machine.",
   "capsules": [

package/dist/pattern-packs/zivis-public-0.2.0/capsules/agents/privilege-separation.yaml

@@ -0,0 +1,224 @@
+# Detection Card: Privilege Separation (absent)
+# Spec: docs/specs/PATTERN-MATCHING-LIBRARY-V1.md
+# Schema: schemas/pattern-detection-card.schema.json
+
+id: agents.privilege-separation
+slug: privilege-separation
+version: 0.1.0
+category: agents
+title: Privilege Separation
+headline: Per-Subtask Capability Scoping
+description: >
+  Detects agentic codebases where multiple agents share a single tool/capability
+  set without per-agent scoping. Absence of privilege separation means one
+  compromised agent inherits the full capability surface of the system.
+detection_tier: public
+scoring_tier: proprietary
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+# Don't run this pattern unless an agent framework is actually present.
+# Mirrors nuclei-style relevance gating to keep the noise floor low.
+relevance_filter:
+  any_of:
+    - dependency: "langgraph"
+      direct_only: true
+    - dependency: "langchain"
+      direct_only: true
+    - dependency: "@langchain/langgraph"
+      direct_only: true
+    - dependency: "crewai"
+      direct_only: true
+    - dependency: "llama-index"
+      direct_only: true
+    - dependency: "openai-agents"
+      direct_only: true
+    - dependency: "autogen-agentchat"
+      direct_only: true
+
+strategies:
+  # 1. AST: Find tool list assignments (Python — LangChain/LangGraph idiom).
+  - code: AST
+    language: python
+    expression: |
+      rule:
+        kind: assignment
+        pattern: $TOOLS = [$$$]
+        has:
+          stopBy: end
+          any:
+            - pattern: create_react_agent
+            - pattern: bind_tools
+            - pattern: AgentExecutor
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.25
+
+  # 2. AST: TypeScript/JavaScript equivalent.
+  - code: AST
+    language: typescript
+    expression: |
+      rule:
+        any:
+          - pattern: const $TOOLS = [$$$]
+          - pattern: bindTools($$$)
+          - pattern: createReactAgent($$$)
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.25
+
+  # 3. GRAPH: Two or more agent declarations share the same tool set.
+  # Predicate evaluated against extractor output (components/edges).
+  - code: GRAPH
+    expression: |
+      count(distinct agent_declaration) >= 2
+      AND any_pair(agents, lambda a, b: a.tool_set == b.tool_set)
+    evidence_fields: [graph_path, file_spans, node_ids]
+    confidence_weight: 0.35
+
+  # 4. META: Absence of per-agent capability scope OR explicit authz layer.
+  - code: META
+    expression:
+      none_of_controls:
+        - langgraph_state_machine_with_per_node_tools
+    evidence_fields: [missing_controls]
+    confidence_weight: 0.30
+
+  # 5. INFER: Last-resort semantic check; never alone proves a finding.
+  - code: INFER
+    expression: "prompt_id:agents.privilege-separation.identify"
+    evidence_fields: [llm_rationale]
+    confidence_weight: 0.15
+    trusted: false
+
+required_evidence_count: 3
+
+# Presence of any of these controls downgrades or eliminates the finding.
+control_negations:
+  - "presence_of(per_agent_tool_filter)"
+  - "presence_of(capability_token_check)"
+  - "presence_of(langgraph_state_machine_with_per_node_tools)"
+
+threats:
+  - title: Compromised planner inherits executor capabilities
+    stride: [tampering, elevation_of_privilege]
+    description: >
+      A prompt-injection compromise of any agent escalates to the full set of
+      tools available to all agents in the system, including high-impact tools
+      like code execution, email, or file write.
+    remediation: >
+      Bind only the minimum tools required to each agent. In LangGraph, define
+      tools per node rather than globally. Add a capability token or
+      authorization layer that validates tool dispatch against agent identity.
+  - title: Lateral compromise via shared tool registry
+    stride: [elevation_of_privilege, information_disclosure]
+    description: >
+      Any tool callable from one agent is callable from every agent. There is
+      no blast-radius reduction even if one agent is otherwise constrained.
+
+fixtures:
+  positive:
+    - "fixtures/positive/privilege-separation/langgraph_shared_tools_python"
+    - "fixtures/positive/privilege-separation/langchain_shared_tools_typescript"
+  negative:
+    - "fixtures/negative/privilege-separation/langgraph_per_node_tools"
+    - "fixtures/negative/privilege-separation/non_agentic_repo"
+
+lifecycle: draft
+owner: platform-threat-modeling
+tags:
+  - agentic-ai
+  - least-privilege
+  - blast-radius
+
+# Capsule fields — added in Phase 2A so the pack builder can ship this card
+# as a runnable customer-safe capsule (deterministic strategies + inference prompt).
+sensitivity_level: customer_safe
+allowed_execution_modes:
+  - local_only
+  - local_model
+  - hybrid_cloud_eval
+
+safe_summary: >
+  Multi-agent systems often share a single tool registry across agents. When that
+  happens, a prompt-injection compromise of any one agent inherits the full
+  capability surface of the system — including high-impact tools like code
+  execution, email, or filesystem write. Privilege separation means each agent
+  is bound only to the minimum tools required for its role.
+
+detect_when: >
+  Two or more agent declarations are wired to the same tool list, or a single
+  shared tool array is referenced by every agent factory call, with no per-agent
+  capability scoping or authorization layer between agent and tool dispatch.
+
+risk_hints:
+  - Any tool callable from one agent becomes callable from every agent
+  - Compromise of the weakest-prompted agent escalates to the most-privileged tool
+  - LangGraph's per-node tool binding is the idiomatic fix; AgentExecutor with a flat tool list is the anti-pattern
+
+architectural_signals:
+  - Shared TOOLS array reused across multiple agent constructors
+  - No capability_token / authorization_layer between planner and tool dispatch
+  - LangGraph used without per-node tool binding
+
+model_task_prompt_ref: prompts/agents/privilege-separation/identify.md
+
+expected_output_schema:
+  type: object
+  required: [verdict, rationale, evidence_spans]
+  properties:
+    verdict:
+      type: string
+      enum: [present, absent, unclear]
+      description: present = privilege separation IS implemented; absent = the anti-pattern fires; unclear = needs human review
+    confidence:
+      type: number
+      minimum: 0
+      maximum: 1
+    rationale:
+      type: string
+      description: One paragraph, cites specific code constructs.
+    evidence_spans:
+      type: array
+      items:
+        type: object
+        required: [file]
+        properties:
+          file: { type: string }
+          start_line: { type: integer }
+          end_line: { type: integer }
+          note: { type: string }
+
+minimum_context_required:
+  lines: 120
+  symbols:
+    - bind_tools
+    - bindTools
+    - create_react_agent
+    - createReactAgent
+    - AgentExecutor
+
+related_patterns:
+  - agents.goal-decomposition-attack-surface
+  - agents.tool-call-without-authorization
+
+repair_contract:
+  allowed:
+    - Bind a per-agent tool subset at construction time
+    - Introduce a capability-token or authorization layer between agent and tool dispatch
+    - Migrate to LangGraph state machines with per-node tools
+  forbidden:
+    - Removing tools entirely without functional replacement
+    - Centralizing tools further (the opposite direction)
+    - Disabling agent execution to "fix" the finding
+
+validation_contract:
+  requires_tests_pass: false
+  requires_static_rules:
+    - no_shared_tool_registry_after_patch
+
+unsafe_to_expose_fields:
+  - internal_rubric
+  - golden_transcripts
+  - exploit_templates

package/dist/pattern-packs/zivis-public-0.2.0/capsules/prompting/self-consistency-no-isolation.yaml

@@ -0,0 +1,237 @@
+# Capsule: Self-consistency without context isolation
+# Spec: docs/specs/PATTERN-MATCHING-LIBRARY-V1.md
+# Plan: docs/plans/LOCAL-REPO-GRAPH-IMPLEMENTATION.md
+# Schema: schemas/pattern-detection-card.schema.json
+
+id: prompting.self-consistency-no-isolation
+slug: self-consistency-no-isolation
+version: 0.1.0
+category: prompting
+title: Self-Consistency Without Context Isolation
+headline: Vote Without Independence
+description: >
+  Detects code that aggregates multiple LLM samples (vote, consensus, ranking)
+  while every sample shares the same untrusted context. Majority voting only
+  filters random noise — when context is shared, correlated errors override
+  correctness and the vote count is mis-read as calibrated confidence.
+
+detection_tier: public
+scoring_tier: proprietary
+
+applicable_languages:
+  - typescript
+  - javascript
+  - python
+
+relevance_filter:
+  any_of:
+    - dependency: openai
+      direct_only: true
+    - dependency: "@anthropic-ai/sdk"
+      direct_only: true
+    - dependency: anthropic
+      direct_only: true
+    - dependency: "ai"
+      direct_only: true
+    - dependency: langchain
+      direct_only: true
+    - dependency: llama-index
+      direct_only: true
+
+strategies:
+  - code: AST
+    language: python
+    expression: |
+      rule:
+        kind: for_statement
+        has:
+          kind: call
+          any:
+            - pattern: $CLIENT.chat.completions.create($$$)
+            - pattern: $CLIENT.messages.create($$$)
+            - pattern: openai.ChatCompletion.create($$$)
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.30
+
+  - code: AST
+    language: typescript
+    expression: |
+      rule:
+        any:
+          - pattern: $_.chat.completions.create($$$)
+          - pattern: generateText($$$)
+          - pattern: streamText($$$)
+        inside:
+          stopBy: end
+          any:
+            - pattern: Promise.all($$$)
+            - pattern: $X.map($$$)
+            - kind: for_statement
+            - kind: while_statement
+    evidence_fields: [file_path, line_span, symbol]
+    confidence_weight: 0.30
+
+  - code: GRAPH
+    expression: |
+      same_messages_argument_passed_to_n_completion_calls(n >= 2)
+      AND aggregator_observed(any_of: Counter, max(set(.), key=.count), majority_vote, np.argmax, statistics.mode)
+    evidence_fields: [graph_path, file_spans, node_ids]
+    confidence_weight: 0.30
+
+  - code: META
+    expression:
+      none_of_controls:
+        - per_sample_retrieval_diversification
+        - external_validator_on_facts
+        - human_approval_gate
+    evidence_fields: [missing_controls]
+    confidence_weight: 0.25
+
+  - code: INFER
+    expression: prompt_id:prompting.self-consistency-no-isolation.identify
+    evidence_fields: [llm_rationale]
+    confidence_weight: 0.15
+    trusted: false
+
+required_evidence_count: 2
+
+control_negations:
+  - "presence_of(per_sample_retrieval_diversification)"
+  - "presence_of(external_validator_on_facts)"
+  - "presence_of(human_approval_gate)"
+
+threats:
+  - title: Vote count mistaken for calibrated confidence
+    stride: [tampering, repudiation]
+    description: >
+      The application treats agreement across samples as independent confirmation,
+      when in fact every sample saw the same poisoned retrieval context or the
+      same prompt-injection payload. Downstream actions (auto-approve, send,
+      execute) fire under false high-confidence signal.
+    remediation: >
+      Diversify per-sample retrieval queries, temperatures, or seeds.
+      Add an external fact-validator. For high-impact outputs, require a human
+      approval gate. Never expose vote count as a confidence number to users
+      without disclosing the independence assumption.
+  - title: Correlated injection amplification
+    stride: [tampering]
+    description: >
+      A single prompt-injection payload in shared retrieved context biases all N
+      samples identically; majority vote then ratifies the attack rather than
+      filtering it.
+    remediation: >
+      Per-sample context isolation. Run independent retrieval (different queries
+      or different stores) per sample so an injection only contaminates a subset.
+
+fixtures:
+  positive:
+    - "fixtures/positive/self-consistency-no-isolation/openai_loop_vote_python"
+    - "fixtures/positive/self-consistency-no-isolation/anthropic_promise_all_typescript"
+  negative:
+    - "fixtures/negative/self-consistency-no-isolation/per_sample_diverse_retrieval"
+    - "fixtures/negative/self-consistency-no-isolation/single_completion_no_aggregation"
+
+lifecycle: draft
+owner: platform-threat-modeling
+tags:
+  - prompting
+  - self-consistency
+  - context-isolation
+  - prompt-injection-amplification
+
+sensitivity_level: customer_safe
+allowed_execution_modes:
+  - local_only
+  - local_model
+  - hybrid_cloud_eval
+
+safe_summary: >
+  Multiple LLM completions are aggregated by voting or consensus, but every
+  sample sees the same retrieved context or the same user message. Independence
+  is assumed and not enforced. A single prompt-injection or a single
+  hallucinated retrieval contaminates the vote uniformly; majority count is
+  mistaken for calibrated confidence and downstream actions fire under
+  false certainty.
+
+detect_when: >
+  Two or more LLM completions for the same user task are merged by voting,
+  consensus, or similarity scoring without independent context isolation —
+  no per-sample retrieval diversification, no external validator, no human gate.
+
+risk_hints:
+  - Shared retrieval/injection in the user message affects every sample the same way
+  - Majority vote amplifies systematic bias rather than filtering noise
+  - Vote count surfaced as a confidence number is a UX lie when context is shared
+  - Async Promise.all with the same messages array is the most common JS shape
+
+architectural_signals:
+  - Same `messages` argument passed to N completion calls inside a loop or Promise.all
+  - majority_vote, Counter, np.argmax, statistics.mode applied to the result array
+  - Single retrieval call upstream feeding all samples
+
+model_task_prompt_ref: prompts/prompting/self-consistency-no-isolation/identify.md
+
+expected_output_schema:
+  type: object
+  required: [independence_assessment, confidence_claim_risk, evidence_spans]
+  properties:
+    independence_assessment:
+      type: string
+      enum: [shared_context, isolated_context, unclear]
+    confidence_claim_risk:
+      type: string
+      enum: [high, medium, low]
+      description: How dangerous is the confidence claim users see, given the (lack of) independence
+    rationale:
+      type: string
+    recommended_controls:
+      type: array
+      items:
+        type: string
+        enum: [per_sample_retrieval_diversification, external_validator, human_approval, temperature_variation, seed_variation]
+    evidence_spans:
+      type: array
+      items:
+        type: object
+        required: [file]
+        properties:
+          file: { type: string }
+          start_line: { type: integer }
+          end_line: { type: integer }
+          note: { type: string }
+
+minimum_context_required:
+  lines: 80
+  symbols:
+    - chat.completions.create
+    - messages.create
+    - generateText
+    - Counter
+    - majority
+    - np.argmax
+
+related_patterns:
+  - prompting.chain-of-thought-leakage
+  - retrieval.shared-context-poisoning
+
+repair_contract:
+  allowed:
+    - Diversify retrieval queries per sample
+    - Vary temperature or seed across samples
+    - Add an external fact validator on aggregated output
+    - Add a human approval gate before high-impact actions
+  forbidden:
+    - Silently treating vote count as calibrated confidence
+    - Removing the aggregation entirely for performance reasons (does not address the architectural issue)
+    - Adding more samples without addressing context independence
+
+validation_contract:
+  requires_tests_pass: false
+  requires_static_rules:
+    - aggregator_remains_present_after_patch
+    - independence_mechanism_introduced
+
+unsafe_to_expose_fields:
+  - internal_rubric
+  - golden_transcripts
+  - exploit_templates