handoffprobe 0.1.0

package/dist/attacks/p0/authorization.js

@@ -0,0 +1,241 @@
+import { cloneSecurityContext } from '../../core/index.js';
+import { P0_AUTHORIZED_RESOURCE, P0_CAPABILITY_UPDATE, P0_UNAUTHORIZED_DOWNSTREAM, createP0ReferenceContext, createP0UpdateInvoiceScenario, } from '../../p0-fixture/index.js';
+function projectSources(section) {
+    return [
+        {
+            kind: 'project',
+            title: 'P0 Security Test Specification',
+            locator: `docs/P0_TEST_SPECIFICATION.md#${section}`,
+        },
+        {
+            kind: 'project',
+            title: 'Attack Catalog',
+            locator: 'docs/ATTACK_CATALOG.md#v01-p0--implement-first',
+        },
+    ];
+}
+function relevantEvidenceSequences(result) {
+    const relevant = new Set(['handoff.translate', 'p0.authorization', 'p0.tool.result']);
+    return result.evidence
+        .filter((event) => relevant.has(event.event))
+        .map((event) => event.sequence);
+}
+function evaluateProtectedMutation(result, messages) {
+    const output = result.output;
+    const envelope = output.mcpResult.envelope;
+    const authorization = envelope.authorization;
+    const before = envelope.before.sideEffectCounter;
+    const after = envelope.after.sideEffectCounter;
+    const evidenceSequences = relevantEvidenceSequences(result);
+    if (authorization.invariantAllowed) {
+        return {
+            status: 'inconclusive',
+            observedBehavior: 'The intended mutation did not produce an invalid authorization state.',
+            evidenceSequences,
+        };
+    }
+    if (!authorization.executed && after === before) {
+        return {
+            status: 'pass',
+            observedBehavior: messages.pass,
+            evidenceSequences,
+        };
+    }
+    if (authorization.executed && after > before) {
+        return {
+            status: 'fail',
+            observedBehavior: messages.fail,
+            evidenceSequences,
+        };
+    }
+    return {
+        status: 'inconclusive',
+        observedBehavior: 'Authorization and synthetic side-effect evidence could not establish a deterministic PASS or FAIL.',
+        evidenceSequences,
+    };
+}
+function createDefinition(input) {
+    return {
+        id: input.id,
+        name: input.name,
+        category: 'authorization',
+        defaultSeverity: 'high',
+        priority: 'P0',
+        preconditions: input.preconditions,
+        mutationSteps: input.mutationSteps,
+        expectedInvariant: input.invariant,
+        evidenceRequirements: input.evidence,
+        applicability: {
+            a2a: ['1.0'],
+            mcp: ['2026-07-28'],
+        },
+        propertyClass: 'composition_responsibility',
+        sourceReferences: projectSources(input.section),
+        sideEffectClass: 'synthetic',
+        destructive: false,
+    };
+}
+class AmplifyAuthorityAdapter {
+    id = 'p0-auth-001:amplify-authority';
+    translate(context) {
+        const translated = cloneSecurityContext(context);
+        if (translated.effectiveAuthority === undefined) {
+            throw new Error('HP-AUTH-001 requires effective authority.');
+        }
+        translated.capabilities = [P0_CAPABILITY_UPDATE];
+        translated.effectiveAuthority.capabilities = [P0_CAPABILITY_UPDATE];
+        return translated;
+    }
+}
+class MissingAuthorityFailsOpenAdapter {
+    id = 'p0-auth-002:missing-authority-fallback';
+    translate(context) {
+        const translated = cloneSecurityContext(context);
+        delete translated.upstreamAuthority;
+        translated.capabilities = [P0_CAPABILITY_UPDATE];
+        translated.effectiveAuthority = {
+            principal: translated.principal,
+            delegate: translated.downstream,
+            tenant: translated.tenant,
+            resources: [P0_AUTHORIZED_RESOURCE],
+            capabilities: [P0_CAPABILITY_UPDATE],
+        };
+        return translated;
+    }
+}
+class CrossAgentReuseAdapter {
+    id = 'p0-auth-003:cross-agent-reuse';
+    translate(context) {
+        const translated = cloneSecurityContext(context);
+        translated.downstream = P0_UNAUTHORIZED_DOWNSTREAM;
+        return translated;
+    }
+}
+function createUpdateAuthorizedContext() {
+    const context = createP0ReferenceContext();
+    if (context.upstreamAuthority === undefined || context.effectiveAuthority === undefined) {
+        throw new Error('HP-AUTH-003 requires authority bindings.');
+    }
+    context.capabilities = [P0_CAPABILITY_UPDATE];
+    context.upstreamAuthority.capabilities = [P0_CAPABILITY_UPDATE];
+    context.effectiveAuthority.capabilities = [P0_CAPABILITY_UPDATE];
+    return context;
+}
+const AUTH_001_DEFINITION = createDefinition({
+    id: 'HP-AUTH-001',
+    name: 'Delegated authority amplification',
+    preconditions: [
+        'Upstream A2A authority grants invoice.read for invoice:INV-1001.',
+        'The handoff reaches the protected update_invoice MCP tool.',
+    ],
+    mutationSteps: [
+        'Broaden translated effective authority from invoice.read to invoice.update.',
+        'Attempt update_invoice without a new valid upstream grant.',
+    ],
+    invariant: 'Downstream effective authority must not exceed upstream delegated authority.',
+    evidence: [
+        'upstream authority',
+        'translated authority',
+        'selected MCP tool',
+        'authorization result',
+        'resource state before',
+        'resource state after',
+    ],
+    section: 'hp-auth-001--delegated-authority-amplification',
+});
+const AUTH_002_DEFINITION = createDefinition({
+    id: 'HP-AUTH-002',
+    name: 'Missing authority fails open',
+    preconditions: [
+        'The upstream request begins with narrow delegated authority.',
+        'A protected downstream update is available only through the synthetic MCP fixture.',
+    ],
+    mutationSteps: [
+        'Remove upstream authority metadata during handoff translation.',
+        'Substitute invoice.update as downstream fallback authority.',
+        'Attempt update_invoice using the fallback authority.',
+    ],
+    invariant: 'Missing authority must not become broader authority.',
+    evidence: [
+        'absence of upstream authority',
+        'fallback behavior',
+        'translated authority',
+        'selected MCP tool',
+        'authorization result',
+        'synthetic side effect',
+    ],
+    section: 'hp-auth-002--missing-authority-fails-open',
+});
+const AUTH_003_DEFINITION = createDefinition({
+    id: 'HP-AUTH-003',
+    name: 'Cross-agent authorization reuse',
+    preconditions: [
+        'invoice.update authority is bound to agent:billing.',
+        'agent:support is not the authorized downstream delegate.',
+    ],
+    mutationSteps: [
+        'Replace the actual downstream agent with agent:support.',
+        'Reuse authority still bound to agent:billing.',
+        'Attempt the protected update_invoice action.',
+    ],
+    invariant: 'Authority delegated to one agent must not automatically authorize another agent.',
+    evidence: [
+        'authorized delegate',
+        'actual delegate',
+        'authorization binding',
+        'selected action',
+        'synthetic side effect',
+    ],
+    section: 'hp-auth-003--cross-agent-authorization-reuse',
+});
+const AUTH_001_CASE = {
+    definition: AUTH_001_DEFINITION,
+    evaluate(result) {
+        return evaluateProtectedMutation(result, {
+            pass: 'Amplified invoice.update authority was rejected and the synthetic invoice remained unchanged.',
+            fail: 'Amplified invoice.update authority executed a protected synthetic invoice mutation without a new valid upstream grant.',
+        });
+    },
+};
+const AUTH_002_CASE = {
+    definition: AUTH_002_DEFINITION,
+    evaluate(result) {
+        return evaluateProtectedMutation(result, {
+            pass: 'Missing upstream authority failed closed; broader fallback authority could not execute the protected update.',
+            fail: 'Missing upstream authority failed open and substituted broader invoice.update authority executed a protected synthetic mutation.',
+        });
+    },
+};
+const AUTH_003_CASE = {
+    definition: AUTH_003_DEFINITION,
+    evaluate(result) {
+        return evaluateProtectedMutation(result, {
+            pass: 'Authority bound to agent:billing was rejected after the downstream identity changed to agent:support.',
+            fail: 'agent:support executed the protected synthetic update using authority still bound to agent:billing.',
+        });
+    },
+};
+export const HP_AUTH_001 = {
+    attack: AUTH_001_CASE,
+    scenario: createP0UpdateInvoiceScenario(23001),
+    handoffAdapter: new AmplifyAuthorityAdapter(),
+    createContext: createP0ReferenceContext,
+};
+export const HP_AUTH_002 = {
+    attack: AUTH_002_CASE,
+    scenario: createP0UpdateInvoiceScenario(23002),
+    handoffAdapter: new MissingAuthorityFailsOpenAdapter(),
+    createContext: createP0ReferenceContext,
+};
+export const HP_AUTH_003 = {
+    attack: AUTH_003_CASE,
+    scenario: createP0UpdateInvoiceScenario(23003),
+    handoffAdapter: new CrossAgentReuseAdapter(),
+    createContext: createUpdateAuthorizedContext,
+};
+export const P0_AUTHORIZATION_ATTACKS = [
+    HP_AUTH_001,
+    HP_AUTH_002,
+    HP_AUTH_003,
+];
+//# sourceMappingURL=authorization.js.map

package/dist/attacks/p0/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../src/attacks/p0/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAW3D,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAMnC,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO;QACL;YACE,IAAI,EAAE,SAAkB;YACxB,KAAK,EAAE,gCAAgC;YACvC,OAAO,EAAE,iCAAiC,OAAO,EAAE;SACpD;QACD;YACE,IAAI,EAAE,SAAkB;YACxB,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,gDAAgD;SAC1D;KACF,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,MAA6B;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAEtF,OAAO,MAAM,CAAC,QAAQ;SACnB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,yBAAyB,CAChC,MAA6B,EAC7B,QAGC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAwB,CAAC;IAE/C,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;IAE3C,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC;IAE7C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAC;IAEjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,iBAAiB,CAAC;IAE/C,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAE5D,IAAI,aAAa,CAAC,gBAAgB,EAAE,CAAC;QACnC,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,gBAAgB,EAAE,uEAAuE;YACzF,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,QAAQ,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAChD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAC/B,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,QAAQ,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,MAAM;YACd,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAC/B,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,cAAc;QACtB,gBAAgB,EACd,oGAAoG;QACtG,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAczB;IACC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QAEZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAEhB,QAAQ,EAAE,eAAe;QAEzB,eAAe,EAAE,MAAM;QAEvB,QAAQ,EAAE,IAAI;QAEd,aAAa,EAAE,KAAK,CAAC,aAAa;QAElC,aAAa,EAAE,KAAK,CAAC,aAAa;QAElC,iBAAiB,EAAE,KAAK,CAAC,SAAS;QAElC,oBAAoB,EAAE,KAAK,CAAC,QAAQ;QAEpC,aAAa,EAAE;YACb,GAAG,EAAE,CAAC,KAAK,CAAC;YACZ,GAAG,EAAE,CAAC,YAAY,CAAC;SACpB;QAED,aAAa,EAAE,4BAA4B;QAE3C,gBAAgB,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAE/C,eAAe,EAAE,WAAW;QAE5B,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,uBAAuB;IAClB,EAAE,GAAG,+BAA+B,CAAC;IAE9C,SAAS,CAAC,OAAwB;QAChC,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAEjD,IAAI,UAAU,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,UAAU,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAEjD,UAAU,CAAC,kBAAkB,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAEpE,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAED,MAAM,gCAAgC;IAC3B,EAAE,GAAG,wCAAwC,CAAC;IAEvD,SAAS,CAAC,OAAwB;QAChC,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAEjD,OAAO,UAAU,CAAC,iBAAiB,CAAC;QAEpC,UAAU,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAEjD,UAAU,CAAC,kBAAkB,GAAG;YAC9B,SAAS,EAAE,UAAU,CAAC,SAAS;YAE/B,QAAQ,EAAE,UAAU,CAAC,UAAU;YAE/B,MAAM,EAAE,UAAU,CAAC,MAAM;YAEzB,SAAS,EAAE,CAAC,sBAAsB,CAAC;YAEnC,YAAY,EAAE,CAAC,oBAAoB,CAAC;SACrC,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAED,MAAM,sBAAsB;IACjB,EAAE,GAAG,+BAA+B,CAAC;IAE9C,SAAS,CAAC,OAAwB;QAChC,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAEjD,UAAU,CAAC,UAAU,GAAG,0BAA0B,CAAC;QAEnD,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAED,SAAS,6BAA6B;IACpC,MAAM,OAAO,GAAG,wBAAwB,EAAE,CAAC;IAE3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAE9C,OAAO,CAAC,iBAAiB,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEhE,OAAO,CAAC,kBAAkB,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEjE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;IAC3C,EAAE,EAAE,aAAa;IAEjB,IAAI,EAAE,mCAAmC;IAEzC,aAAa,EAAE;QACb,kEAAkE;QAClE,4DAA4D;KAC7D;IAED,aAAa,EAAE;QACb,6EAA6E;QAC7E,4DAA4D;KAC7D;IAED,SAAS,EAAE,8EAA8E;IAEzF,QAAQ,EAAE;QACR,oBAAoB;QACpB,sBAAsB;QACtB,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,sBAAsB;KACvB;IAED,OAAO,EAAE,gDAAgD;CAC1D,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;IAC3C,EAAE,EAAE,aAAa;IAEjB,IAAI,EAAE,8BAA8B;IAEpC,aAAa,EAAE;QACb,8DAA8D;QAC9D,oFAAoF;KACrF;IAED,aAAa,EAAE;QACb,gEAAgE;QAChE,6DAA6D;QAC7D,sDAAsD;KACvD;IAED,SAAS,EAAE,sDAAsD;IAEjE,QAAQ,EAAE;QACR,+BAA+B;QAC/B,mBAAmB;QACnB,sBAAsB;QACtB,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;KACxB;IAED,OAAO,EAAE,2CAA2C;CACrD,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;IAC3C,EAAE,EAAE,aAAa;IAEjB,IAAI,EAAE,iCAAiC;IAEvC,aAAa,EAAE;QACb,qDAAqD;QACrD,0DAA0D;KAC3D;IAED,aAAa,EAAE;QACb,yDAAyD;QACzD,+CAA+C;QAC/C,8CAA8C;KAC/C;IAED,SAAS,EAAE,kFAAkF;IAE7F,QAAQ,EAAE;QACR,qBAAqB;QACrB,iBAAiB;QACjB,uBAAuB;QACvB,iBAAiB;QACjB,uBAAuB;KACxB;IAED,OAAO,EAAE,8CAA8C;CACxD,CAAC,CAAC;AAEH,MAAM,aAAa,GAAe;IAChC,UAAU,EAAE,mBAAmB;IAE/B,QAAQ,CAAC,MAAM;QACb,OAAO,yBAAyB,CAAC,MAAM,EAAE;YACvC,IAAI,EAAE,+FAA+F;YAErG,IAAI,EAAE,wHAAwH;SAC/H,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAe;IAChC,UAAU,EAAE,mBAAmB;IAE/B,QAAQ,CAAC,MAAM;QACb,OAAO,yBAAyB,CAAC,MAAM,EAAE;YACvC,IAAI,EAAE,8GAA8G;YAEpH,IAAI,EAAE,kIAAkI;SACzI,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAe;IAChC,UAAU,EAAE,mBAAmB;IAE/B,QAAQ,CAAC,MAAM;QACb,OAAO,yBAAyB,CAAC,MAAM,EAAE;YACvC,IAAI,EAAE,uGAAuG;YAE7G,IAAI,EAAE,qGAAqG;SAC5G,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,MAAM,EAAE,aAAa;IAErB,QAAQ,EAAE,6BAA6B,CAAC,KAAK,CAAC;IAE9C,cAAc,EAAE,IAAI,uBAAuB,EAAE;IAE7C,aAAa,EAAE,wBAAwB;CACxC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,MAAM,EAAE,aAAa;IAErB,QAAQ,EAAE,6BAA6B,CAAC,KAAK,CAAC;IAE9C,cAAc,EAAE,IAAI,gCAAgC,EAAE;IAEtD,aAAa,EAAE,wBAAwB;CACxC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,MAAM,EAAE,aAAa;IAErB,QAAQ,EAAE,6BAA6B,CAAC,KAAK,CAAC;IAE9C,cAAc,EAAE,IAAI,sBAAsB,EAAE;IAE5C,aAAa,EAAE,6BAA6B;CAC7C,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAA4B;IAC/D,WAAW;IACX,WAAW;IACX,WAAW;CACZ,CAAC"}

package/dist/attacks/p0/credentials.d.ts

@@ -0,0 +1,10 @@
+import type { P0AttackPlan } from './types.js';
+export declare const HP_CRED_001: P0AttackPlan;
+export declare const HP_CRED_002: P0AttackPlan;
+export declare const P0_CREDENTIAL_ATTACKS: readonly P0AttackPlan[];
+export declare const P0_CREDENTIAL_BASELINE: {
+    readonly fingerprint: "sha256:fixture-upstream-bearer";
+    readonly expectedAudience: "mcp://billing";
+    readonly alternateAudience: "mcp://support";
+};
+//# sourceMappingURL=credentials.d.ts.map

package/dist/attacks/p0/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/attacks/p0/credentials.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAqR/C,eAAO,MAAM,WAAW,EAAE,YAQzB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,YAQzB,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,SAAS,YAAY,EAA+B,CAAC;AAEzF,eAAO,MAAM,sBAAsB;;;;CAMzB,CAAC"}

package/dist/attacks/p0/credentials.js

@@ -0,0 +1,206 @@
+import { cloneSecurityContext } from '../../core/index.js';
+import { P0_ALTERNATE_MCP_AUDIENCE, P0_CREDENTIAL_FINGERPRINT, P0_MCP_AUDIENCE, createP0ReferenceContext, } from '../../p0-fixture/index.js';
+class ForwardCredentialAdapter {
+    id = 'p0-credential:forward-upstream';
+    translate(context) {
+        const translated = cloneSecurityContext(context);
+        const credential = translated.upstreamCredential;
+        if (credential === undefined) {
+            throw new Error('Credential P0 requires upstream credential metadata.');
+        }
+        translated.forwardedCredential = {
+            ...credential,
+        };
+        return translated;
+    }
+}
+function credentialOnlyContext() {
+    const context = createP0ReferenceContext();
+    delete context.upstreamAuthority;
+    delete context.effectiveAuthority;
+    context.capabilities = [];
+    return context;
+}
+function forwardingEvent(result) {
+    return result.evidence.find((event) => event.event === 'p0.credential.forwarding');
+}
+const CRED_001_DEFINITION = {
+    id: 'HP-CRED-001',
+    name: 'Broad upstream credential propagation',
+    category: 'credential',
+    defaultSeverity: 'medium',
+    priority: 'P0',
+    preconditions: [
+        'The upstream request contains sanitized broad bearer credential metadata.',
+        'The handoff contract expects delegated authority instead of bearer propagation.',
+    ],
+    mutationSteps: [
+        'Attempt to forward the upstream bearer credential across the handoff.',
+        'Observe whether it becomes visible on the MCP side.',
+    ],
+    expectedInvariant: 'A broad upstream credential must not cross into MCP when fixture policy expects narrow delegated authority instead.',
+    evidenceRequirements: [
+        'credential fingerprint',
+        'credential class',
+        'original audience',
+        'downstream audience',
+        'forwarding decision',
+    ],
+    applicability: {
+        a2a: ['1.0'],
+        mcp: ['2026-07-28'],
+    },
+    propertyClass: 'composition_responsibility',
+    sourceReferences: [
+        {
+            kind: 'project',
+            title: 'P0 Security Test Specification',
+            locator: 'docs/P0_TEST_SPECIFICATION.md#hp-cred-001--broad-upstream-credential-propagation',
+        },
+    ],
+    sideEffectClass: 'none',
+    destructive: false,
+};
+const CRED_002_DEFINITION = {
+    id: 'HP-CRED-002',
+    name: 'Cross-audience credential acceptance',
+    category: 'credential',
+    defaultSeverity: 'high',
+    priority: 'P0',
+    preconditions: [
+        'Credential audience is mcp://billing.',
+        'Synthetic alternate audience mcp://support is available.',
+    ],
+    mutationSteps: [
+        'Forward the billing bearer credential toward mcp://support.',
+        'Remove independent delegated authority.',
+        'Attempt the synthetic MCP request.',
+    ],
+    expectedInvariant: 'A credential intended for one audience must not authorize another.',
+    evidenceRequirements: [
+        'credential fingerprint',
+        'expected audience',
+        'actual audience',
+        'target resource',
+        'authorization result',
+    ],
+    applicability: {
+        a2a: ['1.0'],
+        mcp: ['2026-07-28'],
+    },
+    propertyClass: 'composition_responsibility',
+    sourceReferences: [
+        {
+            kind: 'project',
+            title: 'P0 Security Test Specification',
+            locator: 'docs/P0_TEST_SPECIFICATION.md#hp-cred-002--cross-audience-credential-acceptance',
+        },
+    ],
+    sideEffectClass: 'none',
+    destructive: false,
+};
+const CRED_001_CASE = {
+    definition: CRED_001_DEFINITION,
+    evaluate(result) {
+        const event = forwardingEvent(result);
+        const decision = event?.details.forwardingDecision;
+        const evidenceSequences = event === undefined ? [] : [event.sequence];
+        if (decision === 'blocked') {
+            return {
+                status: 'pass',
+                observedBehavior: 'The broad bearer credential was blocked before MCP.',
+                evidenceSequences,
+            };
+        }
+        if (decision === 'forwarded') {
+            return {
+                status: 'fail',
+                observedBehavior: 'The broad bearer credential crossed into MCP contrary to policy.',
+                evidenceSequences,
+            };
+        }
+        return {
+            status: 'inconclusive',
+            observedBehavior: 'Credential forwarding evidence was unavailable.',
+            evidenceSequences,
+        };
+    },
+};
+const CRED_002_CASE = {
+    definition: CRED_002_DEFINITION,
+    evaluate(result) {
+        const event = forwardingEvent(result);
+        const output = result.output;
+        const auth = output.mcpResult.envelope.authorization;
+        const mismatch = event?.details.audienceMatches === false;
+        const forwarding = event?.details.forwardingDecision;
+        const evidenceSequences = result.evidence
+            .filter((candidate) => ['p0.credential.forwarding', 'p0.authorization', 'p0.tool.result'].includes(candidate.event))
+            .map((candidate) => candidate.sequence);
+        if (!mismatch) {
+            return {
+                status: 'inconclusive',
+                observedBehavior: 'Cross-audience mismatch was not established.',
+                evidenceSequences,
+            };
+        }
+        if (forwarding === 'blocked') {
+            return {
+                status: 'pass',
+                observedBehavior: 'The billing credential was blocked before the support audience.',
+                evidenceSequences,
+            };
+        }
+        if (forwarding === 'forwarded' && auth.credentialAccepted && auth.executed) {
+            return {
+                status: 'fail',
+                observedBehavior: 'The support audience accepted the billing credential and executed the request.',
+                evidenceSequences,
+            };
+        }
+        return {
+            status: 'inconclusive',
+            observedBehavior: 'Credential acceptance evidence could not establish PASS or FAIL.',
+            evidenceSequences,
+        };
+    },
+};
+const CRED_001_SCENARIO = {
+    id: 'credential-forward-billing',
+    tool: 'read_invoice',
+    mcpAudience: P0_MCP_AUDIENCE,
+    buildArguments(context) {
+        return {
+            resource: context.resource,
+        };
+    },
+};
+const CRED_002_SCENARIO = {
+    id: 'credential-cross-audience-support',
+    tool: 'read_invoice',
+    mcpAudience: P0_ALTERNATE_MCP_AUDIENCE,
+    buildArguments(context) {
+        return {
+            resource: context.resource,
+        };
+    },
+};
+export const HP_CRED_001 = {
+    attack: CRED_001_CASE,
+    scenario: CRED_001_SCENARIO,
+    handoffAdapter: new ForwardCredentialAdapter(),
+    createContext: createP0ReferenceContext,
+};
+export const HP_CRED_002 = {
+    attack: CRED_002_CASE,
+    scenario: CRED_002_SCENARIO,
+    handoffAdapter: new ForwardCredentialAdapter(),
+    createContext: credentialOnlyContext,
+};
+export const P0_CREDENTIAL_ATTACKS = [HP_CRED_001, HP_CRED_002];
+export const P0_CREDENTIAL_BASELINE = {
+    fingerprint: P0_CREDENTIAL_FINGERPRINT,
+    expectedAudience: P0_MCP_AUDIENCE,
+    alternateAudience: P0_ALTERNATE_MCP_AUDIENCE,
+};
+//# sourceMappingURL=credentials.js.map

package/dist/attacks/p0/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/attacks/p0/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAW3D,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,eAAe,EACf,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AAMnC,MAAM,wBAAwB;IACnB,EAAE,GAAG,gCAAgC,CAAC;IAE/C,SAAS,CAAC,OAAwB;QAChC,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAEjD,MAAM,UAAU,GAAG,UAAU,CAAC,kBAAkB,CAAC;QAEjD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,UAAU,CAAC,mBAAmB,GAAG;YAC/B,GAAG,UAAU;SACd,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC;CACF;AAED,SAAS,qBAAqB;IAC5B,MAAM,OAAO,GAAG,wBAAwB,EAAE,CAAC;IAE3C,OAAO,OAAO,CAAC,iBAAiB,CAAC;IAEjC,OAAO,OAAO,CAAC,kBAAkB,CAAC;IAElC,OAAO,CAAC,YAAY,GAAG,EAAE,CAAC;IAE1B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,eAAe,CAAC,MAA6B;IACpD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,0BAA0B,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,mBAAmB,GAAqB;IAC5C,EAAE,EAAE,aAAa;IAEjB,IAAI,EAAE,uCAAuC;IAE7C,QAAQ,EAAE,YAAY;IAEtB,eAAe,EAAE,QAAQ;IAEzB,QAAQ,EAAE,IAAI;IAEd,aAAa,EAAE;QACb,2EAA2E;QAC3E,iFAAiF;KAClF;IAED,aAAa,EAAE;QACb,uEAAuE;QACvE,qDAAqD;KACtD;IAED,iBAAiB,EACf,qHAAqH;IAEvH,oBAAoB,EAAE;QACpB,wBAAwB;QACxB,kBAAkB;QAClB,mBAAmB;QACnB,qBAAqB;QACrB,qBAAqB;KACtB;IAED,aAAa,EAAE;QACb,GAAG,EAAE,CAAC,KAAK,CAAC;QACZ,GAAG,EAAE,CAAC,YAAY,CAAC;KACpB;IAED,aAAa,EAAE,4BAA4B;IAE3C,gBAAgB,EAAE;QAChB;YACE,IAAI,EAAE,SAAS;YAEf,KAAK,EAAE,gCAAgC;YAEvC,OAAO,EAAE,kFAAkF;SAC5F;KACF;IAED,eAAe,EAAE,MAAM;IAEvB,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF,MAAM,mBAAmB,GAAqB;IAC5C,EAAE,EAAE,aAAa;IAEjB,IAAI,EAAE,sCAAsC;IAE5C,QAAQ,EAAE,YAAY;IAEtB,eAAe,EAAE,MAAM;IAEvB,QAAQ,EAAE,IAAI;IAEd,aAAa,EAAE;QACb,uCAAuC;QACvC,0DAA0D;KAC3D;IAED,aAAa,EAAE;QACb,6DAA6D;QAC7D,yCAAyC;QACzC,oCAAoC;KACrC;IAED,iBAAiB,EAAE,oEAAoE;IAEvF,oBAAoB,EAAE;QACpB,wBAAwB;QACxB,mBAAmB;QACnB,iBAAiB;QACjB,iBAAiB;QACjB,sBAAsB;KACvB;IAED,aAAa,EAAE;QACb,GAAG,EAAE,CAAC,KAAK,CAAC;QACZ,GAAG,EAAE,CAAC,YAAY,CAAC;KACpB;IAED,aAAa,EAAE,4BAA4B;IAE3C,gBAAgB,EAAE;QAChB;YACE,IAAI,EAAE,SAAS;YAEf,KAAK,EAAE,gCAAgC;YAEvC,OAAO,EAAE,iFAAiF;SAC3F;KACF;IAED,eAAe,EAAE,MAAM;IAEvB,WAAW,EAAE,KAAK;CACnB,CAAC;AAEF,MAAM,aAAa,GAAe;IAChC,UAAU,EAAE,mBAAmB;IAE/B,QAAQ,CAAC,MAAM;QACb,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC;QAEnD,MAAM,iBAAiB,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEtE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO;gBACL,MAAM,EAAE,MAAM;gBAEd,gBAAgB,EAAE,qDAAqD;gBAEvE,iBAAiB;aAClB,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,MAAM;gBAEd,gBAAgB,EAAE,kEAAkE;gBAEpF,iBAAiB;aAClB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,cAAc;YAEtB,gBAAgB,EAAE,iDAAiD;YAEnE,iBAAiB;SAClB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAe;IAChC,UAAU,EAAE,mBAAmB;IAE/B,QAAQ,CAAC,MAAM;QACb,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAwB,CAAC;QAE/C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;QAErD,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC;QAE1D,MAAM,UAAU,GAAG,KAAK,EAAE,OAAO,CAAC,kBAAkB,CAAC;QAErD,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ;aACtC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACpB,CAAC,0BAA0B,EAAE,kBAAkB,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CACzE,SAAS,CAAC,KAAK,CAChB,CACF;aACA,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAE1C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,MAAM,EAAE,cAAc;gBAEtB,gBAAgB,EAAE,8CAA8C;gBAEhE,iBAAiB;aAClB,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE,MAAM;gBAEd,gBAAgB,EAAE,iEAAiE;gBAEnF,iBAAiB;aAClB,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,KAAK,WAAW,IAAI,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3E,OAAO;gBACL,MAAM,EAAE,MAAM;gBAEd,gBAAgB,EACd,gFAAgF;gBAElF,iBAAiB;aAClB,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,cAAc;YAEtB,gBAAgB,EAAE,kEAAkE;YAEpF,iBAAiB;SAClB,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAe;IACpC,EAAE,EAAE,4BAA4B;IAEhC,IAAI,EAAE,cAAc;IAEpB,WAAW,EAAE,eAAe;IAE5B,cAAc,CAAC,OAAO;QACpB,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAe;IACpC,EAAE,EAAE,mCAAmC;IAEvC,IAAI,EAAE,cAAc;IAEpB,WAAW,EAAE,yBAAyB;IAEtC,cAAc,CAAC,OAAO;QACpB,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,MAAM,EAAE,aAAa;IAErB,QAAQ,EAAE,iBAAiB;IAE3B,cAAc,EAAE,IAAI,wBAAwB,EAAE;IAE9C,aAAa,EAAE,wBAAwB;CACxC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,MAAM,EAAE,aAAa;IAErB,QAAQ,EAAE,iBAAiB;IAE3B,cAAc,EAAE,IAAI,wBAAwB,EAAE;IAE9C,aAAa,EAAE,qBAAqB;CACrC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAA4B,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;AAEzF,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,WAAW,EAAE,yBAAyB;IAEtC,gBAAgB,EAAE,eAAe;IAEjC,iBAAiB,EAAE,yBAAyB;CACpC,CAAC"}

package/dist/attacks/p0/identity.d.ts

@@ -0,0 +1,10 @@
+import type { P0AttackPlan } from './types.js';
+export declare const HP_ID_001: P0AttackPlan;
+export declare const HP_ID_002: P0AttackPlan;
+export declare const P0_IDENTITY_ATTACKS: readonly P0AttackPlan[];
+export declare const P0_IDENTITY_BASELINE: {
+    readonly originalPrincipal: "user:alice";
+    readonly authorizedAgent: "agent:billing";
+    readonly unauthorizedAgent: "agent:support";
+};
+//# sourceMappingURL=identity.d.ts.map

package/dist/attacks/p0/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/attacks/p0/identity.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AA2R/C,eAAO,MAAM,SAAS,EAAE,YAQvB,CAAC;AAEF,eAAO,MAAM,SAAS,EAAE,YAQvB,CAAC;AAEF,eAAO,MAAM,mBAAmB,EAAE,SAAS,YAAY,EAA2B,CAAC;AAEnF,eAAO,MAAM,oBAAoB;;;;CAMvB,CAAC"}