blitzstrike 1.0.32 → 1.0.33

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.33] — 2026-09-13
+
+### Added
+
+- **Phase 1 — Core Integrity** (per the master upgrade spec):
+  - **Finding invariants** (`src/invariants.ts`) — hard, machine-checkable rules:
+    a finding cannot be CONFIRMED without evidence, cannot be CONFIRMED with a
+    failed negative control, cannot be CONFIRMED out of scope, cannot persist a
+    raw secret, and its evidence hash must stay stable. Enforced in
+    `confirmFinding` and re-checkable via `checkFindingInvariants`.
+  - **Evidence provenance** (`src/evidence.ts` §16) — every evidence record now
+    carries chain-of-custody metadata (`tool`, `version`, `target`, `scope`,
+    `parentEvidence`).
+  - **Audit log** (`src/audit.ts` §45) — structured append-only audit events
+    (`scope_checked`, `finding_created`, `finding_updated`, `validation_finished`,
+    `evidence_created`, …) at `~/.blitzstrike/audit.jsonl`, wired into scope
+    check, finding creation, evidence attachment, and validation.
+  - `confirmFinding` now **throws** if called with no evidence (hard invariant).
+
+### Changed
+
+- `scopeCheck` refactored to a single exit path that always records a
+  `scope_checked` audit event.
+- Shared `src/version.ts` — single source of truth for the package version
+  (removed the duplicate VERSION readers in `server.ts`).
+
 ## [1.0.26] — 2026-09-13
 
 The first hardening milestone: the whole roadmap is implemented, measured, and

package/dist/index.js

@@ -14820,10 +14820,10 @@ var require_src = __commonJS(function(exports, module) {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync3, readFileSync as readFileSync10, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync2 } from "node:fs";
-import { join as join8 } from "node:path";
-import { homedir as homedir3 } from "node:os";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, readFileSync as readFileSync12, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync2 } from "node:fs";
+import { join as join10 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { spawnSync as spawnSync2 } from "node:child_process";
 function dirExists(p) {
   try {
@@ -14838,7 +14838,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync5(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join8(d, e.name));
+          walk(join10(d, e.name));
         else
           n++;
       }
@@ -14851,9 +14851,9 @@ function countFiles(dir) {
 }
 function syncData() {
   if (!dirExists(DATA_ROOT2))
-    mkdirSync2(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join8(DATA_ROOT2, "payloads");
-  const templatesPath = join8(DATA_ROOT2, "templates");
+    mkdirSync3(DATA_ROOT2, { recursive: true });
+  const payloadsPath = join10(DATA_ROOT2, "payloads");
+  const templatesPath = join10(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -14863,8 +14863,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join8(ROOT5, "payloads");
-  const localTemplates = join8(ROOT5, "templates");
+  const localPayloads = join10(ROOT5, "payloads");
+  const localTemplates = join10(ROOT5, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -14877,7 +14877,7 @@ function syncData() {
   }
   const gitOk = spawnSync2("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join8(DATA_ROOT2, ".tmp-clone");
+    const tmp = join10(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync2(tmp, { recursive: true, force: true });
     const r = spawnSync2("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -14885,11 +14885,11 @@ function syncData() {
       const sparse = spawnSync2("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join8(tmp, "payloads"), payloadsPath);
+          copyDir(join10(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join8(tmp, "templates"), templatesPath);
+          copyDir(join10(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -14909,20 +14909,20 @@ function copyDir(src, dst) {
   }
 }
 function manualCopy(src, dst) {
-  mkdirSync2(dst, { recursive: true });
+  mkdirSync3(dst, { recursive: true });
   for (const e of readdirSync5(src, { withFileTypes: true })) {
-    const s = join8(src, e.name);
-    const d = join8(dst, e.name);
+    const s = join10(src, e.name);
+    const d = join10(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync3(d, readFileSync10(s));
+      writeFileSync3(d, readFileSync12(s));
   }
 }
 var ROOT5, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT5 = join8(fileURLToPath6(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join8(homedir3(), ".blitzstrike", "data");
+  ROOT5 = join10(fileURLToPath7(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join10(homedir4(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -29683,9 +29683,9 @@ async function nvdLookup(cveId) {
 
 // src/orchestrator.ts
 init_scanner();
-import { readFileSync as readFileSync4, existsSync as existsSync3, statSync as statSync2 } from "node:fs";
-import { join as join4 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { readFileSync as readFileSync6, existsSync as existsSync4, statSync as statSync2 } from "node:fs";
+import { join as join6 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/memory.ts
 import { readFileSync as readFileSync2, appendFileSync, mkdirSync, existsSync, writeFileSync } from "node:fs";
@@ -29917,6 +29917,47 @@ function manualForTool(toolName) {
   return null;
 }
 
+// src/audit.ts
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
+import { join as join5 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+
+// src/version.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { join as join4, dirname } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var VERSION = (() => {
+  try {
+    const root = join4(dirname(fileURLToPath2(import.meta.url)), "..");
+    return JSON.parse(readFileSync4(join4(root, "package.json"), "utf8")).version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+})();
+
+// src/audit.ts
+var HOME_DIR2 = process.env.BLITZSTRIKE_HOME ?? join5(homedir2(), ".blitzstrike");
+var AUDIT_PATH = join5(HOME_DIR2, "audit.jsonl");
+function recordAudit(event, opts = {}) {
+  const record = {
+    timestamp: new Date().toISOString(),
+    event,
+    actor: opts.actor ?? "system",
+    tool: opts.tool,
+    tool_version: VERSION,
+    target: opts.target,
+    result: opts.result,
+    correlationId: opts.correlationId
+  };
+  try {
+    if (!existsSync3(HOME_DIR2))
+      mkdirSync2(HOME_DIR2, { recursive: true });
+    appendFileSync2(AUDIT_PATH, JSON.stringify(record) + `
+`);
+  } catch {}
+  return record;
+}
+
 // src/evidence.ts
 import { createHash as createHash2 } from "node:crypto";
 var REDACTION_PATTERNS = [
@@ -29943,6 +29984,13 @@ function redactSecrets(text) {
   }
   return out;
 }
+function hasSecrets(text) {
+  for (const [re] of REDACTION_PATTERNS) {
+    if (re.test(text))
+      return true;
+  }
+  return false;
+}
 function redactObject(value) {
   if (typeof value === "string")
     return redactSecrets(value);
@@ -29977,9 +30025,61 @@ function makeEvidence(input) {
     source: input.source ? redactObject(input.source) : undefined,
     sink: input.sink ? redactObject(input.sink) : undefined,
     artifacts,
-    recorded: new Date().toISOString()
+    recorded: new Date().toISOString(),
+    provenance: {
+      tool: input.provenance?.tool ?? "blitzstrike",
+      version: input.provenance?.version ?? VERSION,
+      ...input.provenance?.target ? { target: input.provenance.target } : {},
+      ...input.provenance?.scope ? { scope: input.provenance.scope } : {},
+      ...input.provenance?.parentEvidence ? { parentEvidence: input.provenance.parentEvidence } : {}
+    }
   };
 }
+function verifyArtifact(artifact) {
+  return sha256(artifact.content) === artifact.sha256;
+}
+function verifyEvidence(evidence) {
+  const failed = [];
+  for (const a of evidence.artifacts) {
+    if (!verifyArtifact(a))
+      failed.push(a.name);
+  }
+  return { ok: failed.length === 0, failed };
+}
+
+// src/invariants.ts
+function checkFindingInvariants(finding) {
+  const violations = [];
+  if (finding.status === "confirmed" && finding.evidence.length === 0) {
+    violations.push({ invariant: "confirmed-requires-evidence", detail: `finding ${finding.id} is confirmed with no evidence` });
+  }
+  if (finding.status === "confirmed" && finding.validation.negative_control === false) {
+    violations.push({ invariant: "confirmed-requires-clean-negative-control", detail: `finding ${finding.id} confirmed with a failed negative control` });
+  }
+  if (finding.status === "confirmed" && finding.validation.scope_allowed === false) {
+    violations.push({ invariant: "confirmed-requires-scope-allowed", detail: `finding ${finding.id} confirmed out of scope` });
+  }
+  for (const e of finding.evidence) {
+    for (const a of e.artifacts) {
+      if (hasSecrets(a.content)) {
+        violations.push({ invariant: "no-secret-in-evidence", detail: `evidence ${e.evidence_id} artifact ${a.name} contains a raw secret` });
+      }
+    }
+  }
+  for (const e of finding.evidence) {
+    const v = verifyEvidence(e);
+    if (!v.ok) {
+      violations.push({ invariant: "evidence-hash-stable", detail: `evidence ${e.evidence_id} artifacts ${v.failed.join(",")} failed integrity check` });
+    }
+  }
+  return violations;
+}
+function assertFindingInvariants(finding) {
+  const violations = checkFindingInvariants(finding);
+  if (violations.length > 0) {
+    throw new Error(`invariant violation: ${violations.map((v) => v.invariant).join(", ")}`);
+  }
+}
 
 // src/finding.ts
 var LIFECYCLE_TRANSITIONS = {
@@ -30041,7 +30141,7 @@ function makeFinding(input) {
   const status = input.status ?? "detected";
   const factors = confidenceFactorsFor(input);
   const confidence = computeConfidence(factors);
-  return {
+  const finding = {
     id: nextFindingId(),
     status,
     title: input.title,
@@ -30064,6 +30164,8 @@ function makeFinding(input) {
     remediation: {},
     timestamps: { created: now, updated: now }
   };
+  recordAudit("finding_created", { tool: "eagle-eye", target: input.target.host ?? input.target.endpoint, result: status, correlationId: finding.id });
+  return finding;
 }
 function confidenceFactorsFor(_input) {
   return {
@@ -30083,6 +30185,7 @@ function transition(finding, to) {
   return updated;
 }
 function attachEvidence(finding, evidence) {
+  recordAudit("evidence_created", { tool: "blitzstrike", target: finding.target.host ?? finding.target.endpoint, result: evidence.evidence_id, correlationId: finding.id });
   return {
     ...finding,
     evidence: [...finding.evidence, evidence],
@@ -30090,8 +30193,12 @@ function attachEvidence(finding, evidence) {
   };
 }
 function confirmFinding(finding, opts) {
+  if (opts.evidence.length === 0) {
+    throw new Error("invariant: cannot confirm a finding without evidence");
+  }
   const evidence = opts.evidence.map((e) => makeEvidence(e));
   const negativeControl = opts.negative_control ?? true;
+  const scopeAllowed = opts.scope_allowed ?? true;
   const confidence = computeConfidence({
     static_analysis: true,
     data_flow: true,
@@ -30102,7 +30209,7 @@ function confirmFinding(finding, opts) {
   });
   const level = confidenceLevel(confidence);
   const status = negativeControl ? "confirmed" : "hypothesis";
-  return {
+  const confirmed = {
     ...finding,
     status,
     confidence,
@@ -30111,11 +30218,15 @@ function confirmFinding(finding, opts) {
       performed: true,
       status: negativeControl ? "confirmed" : "unconfirmed",
       baseline: opts.baseline ?? true,
-      negative_control: negativeControl
+      negative_control: negativeControl,
+      scope_allowed: scopeAllowed
     },
     evidence: [...finding.evidence, ...evidence],
     timestamps: { ...finding.timestamps, updated: new Date().toISOString() }
   };
+  assertFindingInvariants(confirmed);
+  recordAudit("validation_finished", { tool: "strike", target: finding.target.host ?? finding.target.endpoint, result: status, correlationId: finding.id });
+  return confirmed;
 }
 function rejectFinding(finding, status, reason, evidence) {
   const ev = evidence?.map((e) => makeEvidence(e)) ?? [];
@@ -30135,9 +30246,9 @@ function loadChains() {
   if (_chainsCache)
     return _chainsCache;
   try {
-    const dir = join4(fileURLToPath2(new URL(".", import.meta.url)), "..");
-    const path = join4(dir, "chains.json");
-    const raw = JSON.parse(readFileSync4(path, "utf8"));
+    const dir = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
+    const path = join6(dir, "chains.json");
+    const raw = JSON.parse(readFileSync6(path, "utf8"));
     _chainsCache = raw.chains ?? [];
     return _chainsCache;
   } catch {
@@ -30146,40 +30257,50 @@ function loadChains() {
   }
 }
 function scopeCheck(target, scope = "", mode = "bug-bounty") {
+  let result;
   if (mode === "ctf" || mode === "reverse-engineering" || mode === "offensive") {
-    return { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };
-  }
-  if (!scope.trim()) {
-    return { target, allowed: false, enforcement: "strict", reason: "no scope provided; refusing active testing" };
-  }
-  const inScope = [];
-  const outScope = [];
-  for (const raw of scope.split(/[,\n]/)) {
-    const line = raw.trim();
-    if (!line)
-      continue;
-    if (line.startsWith("-"))
-      outScope.push(line.slice(1).trim());
-    else
-      inScope.push(line);
-  }
-  let host = target;
-  host = host.replace(/^https?:\/\//, "");
-  host = host.split("/")[0].split(":")[0];
-  for (const exc of outScope) {
-    if (exc && (host.includes(exc) || host.endsWith("." + exc.replace(/^\./, "")))) {
-      return { target, allowed: false, enforcement: "strict", reason: `target '${host}' is explicitly out of scope (${exc})` };
+    result = { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };
+  } else if (!scope.trim()) {
+    result = { target, allowed: false, enforcement: "strict", reason: "no scope provided; refusing active testing" };
+  } else {
+    const inScope = [];
+    const outScope = [];
+    for (const raw of scope.split(/[,\n]/)) {
+      const line = raw.trim();
+      if (!line)
+        continue;
+      if (line.startsWith("-"))
+        outScope.push(line.slice(1).trim());
+      else
+        inScope.push(line);
+    }
+    let host = target;
+    host = host.replace(/^https?:\/\//, "");
+    host = host.split("/")[0].split(":")[0];
+    let decided = false;
+    result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' not in scope` };
+    for (const exc of outScope) {
+      if (exc && (host.includes(exc) || host.endsWith("." + exc.replace(/^\./, "")))) {
+        result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' is explicitly out of scope (${exc})` };
+        decided = true;
+        break;
+      }
     }
-  }
-  for (const allowed of inScope) {
-    const a = allowed.replace(/\*/g, "");
-    if (!a)
-      continue;
-    if (host.includes(a) || host.endsWith("." + a.replace(/^\./, ""))) {
-      return { target, allowed: true, enforcement: "strict", reason: `matched in-scope pattern '${allowed}'` };
+    if (!decided) {
+      for (const allowed of inScope) {
+        const a = allowed.replace(/\*/g, "");
+        if (!a)
+          continue;
+        if (host.includes(a) || host.endsWith("." + a.replace(/^\./, ""))) {
+          result = { target, allowed: true, enforcement: "strict", reason: `matched in-scope pattern '${allowed}'` };
+          decided = true;
+          break;
+        }
+      }
     }
   }
-  return { target, allowed: false, enforcement: "strict", reason: `target '${host}' not in scope` };
+  recordAudit("scope_checked", { tool: "scope", target, result: result.allowed ? "allowed" : "denied" });
+  return result;
 }
 function classifySink(sink) {
   if (/(move_uploaded_file|file_put_contents|fwrite)/.test(sink))
@@ -30243,7 +30364,7 @@ function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000,
   };
   const isPath = (() => {
     try {
-      return existsSync3(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
+      return existsSync4(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
     } catch {
       return false;
     }
@@ -30360,18 +30481,18 @@ function listChains() {
 }
 
 // src/catalog.ts
-import { readFileSync as readFileSync5, readdirSync as readdirSync2 } from "node:fs";
-import { join as join5 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { readFileSync as readFileSync7, readdirSync as readdirSync2 } from "node:fs";
+import { join as join7 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { spawnSync } from "node:child_process";
-var ROOT2 = join5(fileURLToPath3(new URL(".", import.meta.url)), "..");
+var ROOT2 = join7(fileURLToPath4(new URL(".", import.meta.url)), "..");
 var _toolsCache = null;
 var _skillsCache = null;
 function loadTools() {
   if (_toolsCache)
     return _toolsCache;
   try {
-    const raw = JSON.parse(readFileSync5(join5(ROOT2, "tools-catalog.json"), "utf8"));
+    const raw = JSON.parse(readFileSync7(join7(ROOT2, "tools-catalog.json"), "utf8"));
     _toolsCache = raw.tools ?? [];
   } catch {
     _toolsCache = [];
@@ -30381,14 +30502,14 @@ function loadTools() {
 function loadSkills() {
   if (_skillsCache)
     return _skillsCache;
-  const dir = join5(ROOT2, "skills");
+  const dir = join7(ROOT2, "skills");
   const out = [];
   try {
     for (const f of readdirSync2(dir)) {
       if (!f.endsWith(".md"))
         continue;
-      const p = join5(dir, f);
-      const text = readFileSync5(p, "utf8");
+      const p = join7(dir, f);
+      const text = readFileSync7(p, "utf8");
       const descMatch = text.match(/^description:\s*(.+)$/m);
       out.push({
         name: f.replace(/\.md$/, ""),
@@ -30461,7 +30582,7 @@ function readSkill(name) {
   if (!s)
     return { found: false, query: name };
   try {
-    const text = readFileSync5(join5(ROOT2, "skills", s.file), "utf8");
+    const text = readFileSync7(join7(ROOT2, "skills", s.file), "utf8");
     return { found: true, name: s.name, content: text.slice(0, 12000) };
   } catch {
     return { found: false, query: name, error: "unreadable" };
@@ -30494,19 +30615,19 @@ function ensureTool(name) {
 }
 
 // src/intel.ts
-import { readFileSync as readFileSync6, existsSync as existsSync4 } from "node:fs";
-import { join as join6 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { readFileSync as readFileSync8, existsSync as existsSync5 } from "node:fs";
+import { join as join8 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { readdirSync as readdirSync3 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-var ROOT3 = join6(fileURLToPath4(new URL(".", import.meta.url)), "..");
-var INTEL = join6(ROOT3, "intelligence");
+import { homedir as homedir3 } from "node:os";
+var ROOT3 = join8(fileURLToPath5(new URL(".", import.meta.url)), "..");
+var INTEL = join8(ROOT3, "intelligence");
 function loadJson(name) {
-  const p = join6(INTEL, `${name}.json`);
-  if (!existsSync4(p))
+  const p = join8(INTEL, `${name}.json`);
+  if (!existsSync5(p))
     return null;
   try {
-    return JSON.parse(readFileSync6(p, "utf8"));
+    return JSON.parse(readFileSync8(p, "utf8"));
   } catch {
     return null;
   }
@@ -30638,18 +30759,18 @@ function attackVectors(category) {
   }
   return { found: true, id: found.id, title: found.title, count: found.vectors.length, vectors: found.vectors };
 }
-var PACKAGE_PAYLOADS = join6(ROOT3, "payloads");
-var PACKAGE_TEMPLATES = join6(ROOT3, "templates");
-var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join6(homedir2(), ".blitzstrike", "data");
+var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
+var PACKAGE_TEMPLATES = join8(ROOT3, "templates");
+var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir3(), ".blitzstrike", "data");
 function payloadsDir() {
-  if (existsSync4(PACKAGE_PAYLOADS))
+  if (existsSync5(PACKAGE_PAYLOADS))
     return PACKAGE_PAYLOADS;
-  return join6(DATA_ROOT, "payloads");
+  return join8(DATA_ROOT, "payloads");
 }
 function templatesDir() {
-  if (existsSync4(PACKAGE_TEMPLATES))
+  if (existsSync5(PACKAGE_TEMPLATES))
     return PACKAGE_TEMPLATES;
-  return join6(DATA_ROOT, "templates");
+  return join8(DATA_ROOT, "templates");
 }
 var PAYLOADS = payloadsDir();
 var TEMPLATES = templatesDir();
@@ -30685,7 +30806,7 @@ function payloadLookup(topic) {
   const normalized = ALIASES[key] ?? key;
   const exact = cats.find((c) => c.toLowerCase() === normalized);
   if (exact) {
-    return { found: true, category: exact, files: listFiles(join6(PAYLOADS, exact)) };
+    return { found: true, category: exact, files: listFiles(join8(PAYLOADS, exact)) };
   }
   const keyTokens = normalized.split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
   const matches = cats.filter((c) => {
@@ -30695,7 +30816,7 @@ function payloadLookup(topic) {
     return keyTokens.some((tok) => new RegExp(`(^|[^a-z0-9])${tok}`).test(cl));
   });
   if (matches.length > 0) {
-    return { found: true, category: matches[0], files: listFiles(join6(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
+    return { found: true, category: matches[0], files: listFiles(join8(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
   }
   return { found: false, topic, suggestions: cats.slice(0, 20) };
 }
@@ -30704,19 +30825,19 @@ function readPayload(category, file) {
   const exact = cats.find((c) => c.toLowerCase() === category.toLowerCase());
   if (!exact)
     return { found: false, category, suggestions: cats.slice(0, 20) };
-  const dir = join6(PAYLOADS, exact);
+  const dir = join8(PAYLOADS, exact);
   const files = listFiles(dir);
   if (!file) {
     const readme = files.find((f) => f.toLowerCase() === "readme.md");
     if (readme) {
-      return { found: true, category: exact, file: readme, content: readFileSync6(join6(dir, readme), "utf8").slice(0, 20000) };
+      return { found: true, category: exact, file: readme, content: readFileSync8(join8(dir, readme), "utf8").slice(0, 20000) };
     }
     return { found: true, category: exact, files };
   }
   const f = files.find((x) => x.toLowerCase() === file.toLowerCase());
   if (!f)
     return { found: false, category: exact, file, suggestions: files };
-  return { found: true, category: exact, file: f, content: readFileSync6(join6(dir, f), "utf8").slice(0, 20000) };
+  return { found: true, category: exact, file: f, content: readFileSync8(join8(dir, f), "utf8").slice(0, 20000) };
 }
 function listFiles(dir) {
   try {
@@ -30731,7 +30852,7 @@ function countTemplates() {
     const walk = (dir) => {
       for (const e of readdirSync3(dir, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join6(dir, e.name));
+          walk(join8(dir, e.name));
         else if (e.name.endsWith(".yaml"))
           n++;
       }
@@ -30756,14 +30877,14 @@ function templateLookup(topic, limit = 10) {
     }
     for (const e of entries) {
       if (e.isDirectory())
-        walk(join6(dir, e.name), depth + 1);
+        walk(join8(dir, e.name), depth + 1);
       else if (e.name.endsWith(".yaml")) {
         const name = e.name.toLowerCase();
         if (name.includes(key)) {
-          const full = join6(dir, e.name);
+          const full = join8(dir, e.name);
           let id = "";
           try {
-            const content = readFileSync6(full, "utf8");
+            const content = readFileSync8(full, "utf8");
             const m = content.match(/^\s*id:\s*(.+)$/m);
             if (m)
               id = m[1].trim();
@@ -30923,7 +31044,7 @@ async function activeScan(target, scope = "", mode = "bug-bounty", allowed = und
 
 // src/dataflow.ts
 init_scanner();
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 var SOURCES = {
   $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
   $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
@@ -31005,7 +31126,7 @@ function traceDataFlow(path) {
     return result;
   let text;
   try {
-    text = readFileSync7(path, "utf8");
+    text = readFileSync9(path, "utf8");
   } catch {
     return result;
   }
@@ -31084,7 +31205,7 @@ function groupVariants(results) {
 // src/taint.ts
 init_scanner();
 var import_php_parser = __toESM(require_src(), 1);
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 var parser = new import_php_parser.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -31382,7 +31503,7 @@ function analyzeTaint(path) {
   const result = { file: path, findings: [], suppressed: 0 };
   let code;
   try {
-    code = readFileSync8(path, "utf8");
+    code = readFileSync10(path, "utf8");
   } catch {
     return result;
   }
@@ -50656,16 +50777,16 @@ function reportJson(findings, opts = {}) {
 }
 
 // src/benchmark.ts
-import { readFileSync as readFileSync9, readdirSync as readdirSync4, writeFileSync as writeFileSync2, rmSync } from "node:fs";
-import { join as join7 } from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { readFileSync as readFileSync11, readdirSync as readdirSync4, writeFileSync as writeFileSync2, rmSync } from "node:fs";
+import { join as join9 } from "node:path";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { tmpdir } from "node:os";
-var ROOT4 = join7(fileURLToPath5(new URL(".", import.meta.url)), "..");
-var CORPUS = join7(ROOT4, "bench", "corpus");
+var ROOT4 = join9(fileURLToPath6(new URL(".", import.meta.url)), "..");
+var CORPUS = join9(ROOT4, "bench", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
-    text = readFileSync9(path, "utf8");
+    text = readFileSync11(path, "utf8");
   } catch {
     return null;
   }
@@ -50715,7 +50836,7 @@ function loadCorpus() {
     for (const f of readdirSync4(CORPUS)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join7(CORPUS, f));
+      const e = parseCorpusFile(join9(CORPUS, f));
       if (e)
         entries.push(e);
     }
@@ -50727,7 +50848,7 @@ function loadCorpus() {
 function detect(entry) {
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join7(tmpdir(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    const tmp = join9(tmpdir(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync2(tmp, entry.code);
     const r = analyzeTaint(tmp);
     rmSync(tmp, { force: true });
@@ -50875,17 +50996,6 @@ function coverageMatrix() {
 
 // src/server.ts
 init_update();
-import { readFileSync as readFileSync11 } from "node:fs";
-import { join as join9, dirname } from "node:path";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
-var VERSION = (() => {
-  try {
-    const root = join9(dirname(fileURLToPath7(import.meta.url)), "..");
-    return JSON.parse(readFileSync11(join9(root, "package.json"), "utf8")).version ?? "unknown";
-  } catch {
-    return "unknown";
-  }
-})();
 function createServer() {
   const server = new McpServer({
     name: "blitzstrike",
@@ -51677,12 +51787,12 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync12, existsSync as existsSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join10, dirname as dirname2 } from "node:path";
-import { homedir as homedir4 } from "node:os";
+import { readFileSync as readFileSync13, existsSync as existsSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join11, dirname as dirname2 } from "node:path";
+import { homedir as homedir5 } from "node:os";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
-var ROOT6 = join10(fileURLToPath8(new URL(".", import.meta.url)), "..");
+var ROOT6 = join11(fileURLToPath8(new URL(".", import.meta.url)), "..");
 function which(cmd) {
   return spawnSync3(`command -v ${cmd}`, { shell: true }).status === 0;
 }
@@ -51717,7 +51827,7 @@ function runDoctor() {
     detail: fofa ? "set" : "FOFA_EMAIL/FOFA_KEY not set",
     fix: fofa ? undefined : "export FOFA_EMAIL=... && export FOFA_KEY=... (enables fofa_search)"
   });
-  const dataOk = existsSync5(join10(ROOT6, "chains.json")) && existsSync5(join10(ROOT6, "tools-catalog.json"));
+  const dataOk = existsSync6(join11(ROOT6, "chains.json")) && existsSync6(join11(ROOT6, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -51745,21 +51855,21 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join10(ROOT6, "src", "index.ts");
-  if (which("bun") && existsSync5(src))
+  const src = join11(ROOT6, "src", "index.ts");
+  if (which("bun") && existsSync6(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join10(ROOT6, "dist", "index.js");
-  if (existsSync5(dist))
+  const dist = join11(ROOT6, "dist", "index.js");
+  if (existsSync6(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync12(p, "utf8"));
+    return JSON.parse(readFileSync13(p, "utf8"));
   } catch {
     return null;
   }
@@ -51767,8 +51877,8 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync5(dir))
-      mkdirSync3(dir, { recursive: true });
+    if (!existsSync6(dir))
+      mkdirSync4(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
       ...existing.mcpServers ?? {},
@@ -51780,8 +51890,8 @@ function jsonMcpServersWrite(p) {
 function opencodeWrite(p) {
   return (_command, _args) => {
     const dir = dirname2(p);
-    if (!existsSync5(dir))
-      mkdirSync3(dir, { recursive: true });
+    if (!existsSync6(dir))
+      mkdirSync4(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
       ...existing.mcp ?? {},
@@ -51792,26 +51902,26 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join10(ROOT6, "opencode-agents");
-  const dstDir = join10(homedir4(), ".config", "opencode", "agents");
-  if (!existsSync5(srcDir))
+  const srcDir = join11(ROOT6, "opencode-agents");
+  const dstDir = join11(homedir5(), ".config", "opencode", "agents");
+  if (!existsSync6(srcDir))
     return;
-  if (!existsSync5(dstDir))
-    mkdirSync3(dstDir, { recursive: true });
+  if (!existsSync6(dstDir))
+    mkdirSync4(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join10(srcDir, f);
-    const dst = join10(dstDir, f);
-    if (existsSync5(src)) {
-      writeFileSync4(dst, readFileSync12(src, "utf8"));
+    const src = join11(srcDir, f);
+    const dst = join11(dstDir, f);
+    if (existsSync6(src)) {
+      writeFileSync4(dst, readFileSync13(src, "utf8"));
     }
   }
 }
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync5(dir))
-      mkdirSync3(dir, { recursive: true });
-    let existing = existsSync5(p) ? readFileSync12(p, "utf8") : "";
+    if (!existsSync6(dir))
+      mkdirSync4(dir, { recursive: true });
+    let existing = existsSync6(p) ? readFileSync13(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -51828,9 +51938,9 @@ args = ${JSON.stringify(args)}
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync5(dir))
-      mkdirSync3(dir, { recursive: true });
-    let existing = existsSync5(p) ? readFileSync12(p, "utf8") : "";
+    if (!existsSync6(dir))
+      mkdirSync4(dir, { recursive: true });
+    let existing = existsSync6(p) ? readFileSync13(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -51855,76 +51965,76 @@ mcp_servers:
   };
 }
 function detectAgents() {
-  const home = homedir4();
+  const home = homedir5();
   const agents = [];
-  const claudeJson = join10(home, ".claude.json");
+  const claudeJson = join11(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync5(claudeJson) || which("claude"),
+    installed: () => existsSync6(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join10(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join11(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync5(claudeDesktop),
+    installed: () => existsSync6(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join10(home, ".cursor", "mcp.json");
+  const cursor = join11(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync5(join10(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync6(join11(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join10(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join11(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync5(join10(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync6(join11(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join10(home, ".codex", "config.toml");
+  const codex = join11(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync5(join10(home, ".codex")) || which("codex"),
+    installed: () => existsSync6(join11(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join10(home, ".hermes", "config.yaml");
+  const hermes = join11(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync5(join10(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync6(join11(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join10(home, ".gemini", "settings.json");
+  const gemini = join11(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync5(join10(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync6(join11(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join10(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join11(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync5(join10(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync6(join11(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join10(home, ".copilot", "mcp.json");
+  const copilot = join11(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync5(join10(home, ".copilot")),
+    installed: () => existsSync6(join11(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join10(home, ".cline", "mcp_settings.json");
+  const cline = join11(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync5(join10(home, ".cline")),
+    installed: () => existsSync6(join11(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -51968,15 +52078,15 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync13, existsSync as existsSync6 } from "node:fs";
-import { join as join11 } from "node:path";
+import { readFileSync as readFileSync14, existsSync as existsSync7 } from "node:fs";
+import { join as join12 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
-var ROOT7 = join11(fileURLToPath9(new URL(".", import.meta.url)), "..");
+var ROOT7 = join12(fileURLToPath9(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join11(ROOT7, "package.json");
-    if (existsSync6(p))
-      return JSON.parse(readFileSync13(p, "utf8")).version ?? "1.0.0";
+    const p = join12(ROOT7, "package.json");
+    if (existsSync7(p))
+      return JSON.parse(readFileSync14(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/docs/findings.md

@@ -76,12 +76,33 @@ validation + evidence.
 
 `src/evidence.ts`:
 
-- **Schema** — `evidence_id`, `type`, `description`, `source`, `sink`, `artifacts[]`, `recorded`.
+- **Schema** — `evidence_id`, `type`, `description`, `source`, `sink`, `artifacts[]`, `recorded`, `provenance`.
+- **Provenance (§16)** — every record carries chain-of-custody metadata: `tool`,
+  `version`, `target`, `scope`, `parentEvidence`.
 - **Integrity** — every artifact carries a SHA-256 (`sha256()`), verified by `verifyEvidence()`.
 - **Secret redaction** — `redactSecrets()` strips passwords, API keys, tokens,
   cookies, `Authorization` headers, private keys before persistence/report/log/context.
 - **Append-only** — confirmed evidence is never silently rewritten.
 
+## Finding invariants (§53)
+
+`src/invariants.ts` enforces hard, machine-checkable rules:
+
+| Invariant | Enforcement |
+| :--- | :--- |
+| CONFIRMED requires evidence | `confirmFinding` throws without evidence |
+| CONFIRMED requires clean negative control | `checkFindingInvariants` |
+| CONFIRMED requires in-scope target | `checkFindingInvariants` |
+| No raw secret in persisted evidence | `checkFindingInvariants` |
+| Evidence hash must stay stable | `checkFindingInvariants` |
+
+## Audit log (§45)
+
+`src/audit.ts` emits structured append-only audit events to
+`~/.blitzstrike/audit.jsonl`: `scope_checked`, `finding_created`,
+`finding_updated`, `validation_finished`, `evidence_created`, … each carrying
+timestamp, actor, tool, target, result, and correlationId.
+
 ## MCP tools
 
 | Tool | Purpose |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.32",
+  "version": "1.0.33",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {