handoffprobe 0.1.0

package/dist/attacks/p1/authorization.js

@@ -0,0 +1,239 @@
+import { P0_AUTHORIZED_DOWNSTREAM, P0_AUTHORIZED_RESOURCE, P0_AUTHORIZED_TENANT, P0_CALLER, P0_CAPABILITY_UPDATE, P0_PRINCIPAL, createP0ReferenceContext, createP0UpdateInvoiceScenario, } from '../../p0-fixture/index.js';
+const FULL_DELEGATION_CHAIN = [P0_PRINCIPAL, P0_CALLER, P0_AUTHORIZED_DOWNSTREAM];
+function projectSources(section) {
+    return [
+        {
+            kind: 'project',
+            title: 'P1 Security Test Specification',
+            locator: `docs/P1_TEST_SPECIFICATION.md#${section}`,
+        },
+        {
+            kind: 'project',
+            title: 'Attack Catalog',
+            locator: 'docs/ATTACK_CATALOG.md#v01-p1--add-after-p0-engine-is-credible',
+        },
+    ];
+}
+function createDefinition(input) {
+    return {
+        id: input.id,
+        name: input.name,
+        category: 'authorization',
+        defaultSeverity: 'high',
+        priority: 'P1',
+        preconditions: input.preconditions,
+        mutationSteps: input.mutationSteps,
+        expectedInvariant: input.invariant,
+        evidenceRequirements: input.evidence,
+        applicability: {
+            a2a: ['1.0'],
+            mcp: ['2026-07-28'],
+        },
+        propertyClass: 'composition_responsibility',
+        sourceReferences: projectSources(input.section),
+        sideEffectClass: 'synthetic',
+        destructive: false,
+    };
+}
+function createUpdateContext() {
+    const context = createP0ReferenceContext();
+    if (context.upstreamAuthority === undefined || context.effectiveAuthority === undefined) {
+        throw new Error('P1 authorization attacks require authority bindings.');
+    }
+    context.capabilities = [P0_CAPABILITY_UPDATE];
+    context.upstreamAuthority.capabilities = [P0_CAPABILITY_UPDATE];
+    context.effectiveAuthority.capabilities = [P0_CAPABILITY_UPDATE];
+    return context;
+}
+function relevantEvidenceSequences(result) {
+    const relevant = new Set([
+        'p1.authorization',
+        'p1.authorization.blocked',
+        'p1.authorization.bypassed',
+        'handoff.translate',
+        'p0.authorization',
+        'mcp.tool.call',
+        'mcp.tool.result',
+    ]);
+    return result.evidence
+        .filter((event) => relevant.has(event.event))
+        .map((event) => event.sequence);
+}
+function evaluateInvalidAuthority(result, messages) {
+    const output = result.output;
+    const evidenceSequences = relevantEvidenceSequences(result);
+    /*
+     * The attack only proves something when
+     * the P1 mutation actually made the
+     * delegation invalid.
+     */
+    if (output.decision.allowed) {
+        return {
+            status: 'inconclusive',
+            observedBehavior: 'The intended P1 mutation did not create an invalid delegation state.',
+            evidenceSequences,
+        };
+    }
+    if (!output.executed && output.sideEffectCounterAfter === output.sideEffectCounterBefore) {
+        return {
+            status: 'pass',
+            observedBehavior: messages.pass,
+            evidenceSequences,
+        };
+    }
+    if (output.executed && output.sideEffectCounterAfter > output.sideEffectCounterBefore) {
+        return {
+            status: 'fail',
+            observedBehavior: messages.fail,
+            evidenceSequences,
+        };
+    }
+    return {
+        status: 'inconclusive',
+        observedBehavior: 'Delegation evidence and synthetic side-effect evidence could not establish a deterministic PASS or FAIL.',
+        evidenceSequences,
+    };
+}
+const AUTH_004_DEFINITION = createDefinition({
+    id: 'HP-AUTH-004',
+    name: 'Expired delegation reuse',
+    preconditions: [
+        'A delegation is valid before its deterministic expiry point.',
+        'The delegation authorizes invoice.update for invoice:INV-1001.',
+        'The protected action crosses the A2A to MCP handoff.',
+    ],
+    mutationSteps: [
+        'Advance deterministic logical time to the delegation expiry boundary.',
+        'Reuse the expired translated delegation.',
+        'Attempt the protected update_invoice action.',
+    ],
+    invariant: 'Authority that expired before downstream authorization must not authorize the protected action.',
+    evidence: [
+        'delegation ID',
+        'issued point',
+        'expiry point',
+        'authorization point',
+        'delegation validity state',
+        'authorization result',
+        'selected MCP tool',
+        'side-effect counter before and after',
+    ],
+    section: 'hp-auth-004--expired-delegation-reuse',
+});
+const AUTH_005_DEFINITION = createDefinition({
+    id: 'HP-AUTH-005',
+    name: 'Delegation-chain truncation',
+    preconditions: [
+        'Authorization requires the full user:alice to agent:sales to agent:billing delegation chain.',
+        'The protected action crosses the A2A to MCP handoff.',
+    ],
+    mutationSteps: [
+        'Remove agent:sales from the translated delegation chain.',
+        'Preserve the final principal, delegate, tenant, resource and capability.',
+        'Attempt the protected update_invoice action using the shortened chain.',
+    ],
+    invariant: 'Removing a security-relevant intermediate delegation hop must not preserve equivalent downstream authority.',
+    evidence: [
+        'original required delegation chain',
+        'translated delegation chain',
+        'missing delegation hop',
+        'authorization result',
+        'selected MCP tool',
+        'side-effect counter before and after',
+    ],
+    section: 'hp-auth-005--delegation-chain-truncation',
+});
+const AUTH_004_CASE = {
+    definition: AUTH_004_DEFINITION,
+    evaluate(result) {
+        return evaluateInvalidAuthority(result, {
+            pass: 'The expired delegation was rejected before protected MCP execution and no synthetic side effect occurred.',
+            fail: 'The expired delegation crossed the handoff and executed a protected synthetic invoice mutation.',
+        });
+    },
+};
+const AUTH_005_CASE = {
+    definition: AUTH_005_DEFINITION,
+    evaluate(result) {
+        return evaluateInvalidAuthority(result, {
+            pass: 'The truncated delegation chain was rejected before protected MCP execution and no synthetic side effect occurred.',
+            fail: 'The truncated delegation chain was treated as equivalent and executed a protected synthetic invoice mutation.',
+        });
+    },
+};
+export const HP_AUTH_004 = {
+    attack: AUTH_004_CASE,
+    scenario: {
+        id: 'expired-delegation-reuse',
+        delegation: {
+            id: 'delegation:DEL-1001',
+            principal: P0_PRINCIPAL,
+            delegate: P0_AUTHORIZED_DOWNSTREAM,
+            tenant: P0_AUTHORIZED_TENANT,
+            resources: [P0_AUTHORIZED_RESOURCE],
+            capabilities: [P0_CAPABILITY_UPDATE],
+            chain: [...FULL_DELEGATION_CHAIN],
+            taskId: 'task:P1-TASK-A',
+            runId: 'run:P1-RUN-A',
+            issuedAt: 10,
+            expiresAt: 20,
+            singleUse: false,
+        },
+        request: {
+            principal: P0_PRINCIPAL,
+            delegate: P0_AUTHORIZED_DOWNSTREAM,
+            tenant: P0_AUTHORIZED_TENANT,
+            resource: P0_AUTHORIZED_RESOURCE,
+            capability: P0_CAPABILITY_UPDATE,
+            taskId: 'task:P1-TASK-A',
+            runId: 'run:P1-RUN-A',
+            requiredChain: FULL_DELEGATION_CHAIN,
+        },
+        /*
+         * Exactly the expiry boundary.
+         * No sleeping or wall clock.
+         */
+        logicalTime: 20,
+        p0Scenario: createP0UpdateInvoiceScenario(24004),
+    },
+    createContext: createUpdateContext,
+};
+export const HP_AUTH_005 = {
+    attack: AUTH_005_CASE,
+    scenario: {
+        id: 'delegation-chain-truncation',
+        delegation: {
+            id: 'delegation:DEL-1002',
+            principal: P0_PRINCIPAL,
+            delegate: P0_AUTHORIZED_DOWNSTREAM,
+            tenant: P0_AUTHORIZED_TENANT,
+            resources: [P0_AUTHORIZED_RESOURCE],
+            capabilities: [P0_CAPABILITY_UPDATE],
+            /*
+             * Mutation:
+             * agent:sales was removed.
+             */
+            chain: [P0_PRINCIPAL, P0_AUTHORIZED_DOWNSTREAM],
+            taskId: 'task:P1-TASK-A',
+            runId: 'run:P1-RUN-A',
+            issuedAt: 10,
+            expiresAt: 30,
+            singleUse: false,
+        },
+        request: {
+            principal: P0_PRINCIPAL,
+            delegate: P0_AUTHORIZED_DOWNSTREAM,
+            tenant: P0_AUTHORIZED_TENANT,
+            resource: P0_AUTHORIZED_RESOURCE,
+            capability: P0_CAPABILITY_UPDATE,
+            taskId: 'task:P1-TASK-A',
+            runId: 'run:P1-RUN-A',
+            requiredChain: FULL_DELEGATION_CHAIN,
+        },
+        logicalTime: 15,
+        p0Scenario: createP0UpdateInvoiceScenario(24005),
+    },
+    createContext: createUpdateContext,
+};
+export const P1_AUTHORIZATION_ATTACKS = [HP_AUTH_004, HP_AUTH_005];
+//# sourceMappingURL=authorization.js.map

package/dist/attacks/p1/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../../../src/attacks/p1/authorization.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,oBAAoB,EACpB,YAAY,EACZ,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAMnC,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,wBAAwB,CAAU,CAAC;AAE3F,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO;QACL;YACE,IAAI,EAAE,SAAkB;YAExB,KAAK,EAAE,gCAAgC;YAEvC,OAAO,EAAE,iCAAiC,OAAO,EAAE;SACpD;QAED;YACE,IAAI,EAAE,SAAkB;YAExB,KAAK,EAAE,gBAAgB;YAEvB,OAAO,EAAE,gEAAgE;SAC1E;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAczB;IACC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QAEZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAEhB,QAAQ,EAAE,eAAe;QAEzB,eAAe,EAAE,MAAM;QAEvB,QAAQ,EAAE,IAAI;QAEd,aAAa,EAAE,KAAK,CAAC,aAAa;QAElC,aAAa,EAAE,KAAK,CAAC,aAAa;QAElC,iBAAiB,EAAE,KAAK,CAAC,SAAS;QAElC,oBAAoB,EAAE,KAAK,CAAC,QAAQ;QAEpC,aAAa,EAAE;YACb,GAAG,EAAE,CAAC,KAAK,CAAC;YAEZ,GAAG,EAAE,CAAC,YAAY,CAAC;SACpB;QAED,aAAa,EAAE,4BAA4B;QAE3C,gBAAgB,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAE/C,eAAe,EAAE,WAAW;QAE5B,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,OAAO,GAAG,wBAAwB,EAAE,CAAC;IAE3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAE9C,OAAO,CAAC,iBAAiB,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEhE,OAAO,CAAC,kBAAkB,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEjE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAA6B;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,kBAAkB;QAElB,0BAA0B;QAE1B,2BAA2B;QAE3B,mBAAmB;QAEnB,kBAAkB;QAElB,eAAe;QAEf,iBAAiB;KAClB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,QAAQ;SACnB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAA6B,EAC7B,QAIC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAqC,CAAC;IAE5D,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAE5D;;;;OAIG;IACH,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO;YACL,MAAM,EAAE,cAAc;YAEtB,gBAAgB,EAAE,sEAAsE;YAExF,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,sBAAsB,KAAK,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACzF,OAAO;YACL,MAAM,EAAE,MAAM;YAEd,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAE/B,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,sBAAsB,GAAG,MAAM,CAAC,uBAAuB,EAAE,CAAC;QACtF,OAAO;YACL,MAAM,EAAE,MAAM;YAEd,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAE/B,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,cAAc;QAEtB,gBAAgB,EACd,0GAA0G;QAE5G,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;IAC3C,EAAE,EAAE,aAAa;IAEjB,IAAI,EAAE,0BAA0B;IAEhC,aAAa,EAAE;QACb,8DAA8D;QAE9D,gEAAgE;QAEhE,sDAAsD;KACvD;IAED,aAAa,EAAE;QACb,uEAAuE;QAEvE,0CAA0C;QAE1C,8CAA8C;KAC/C;IAED,SAAS,EACP,iGAAiG;IAEnG,QAAQ,EAAE;QACR,eAAe;QAEf,cAAc;QAEd,cAAc;QAEd,qBAAqB;QAErB,2BAA2B;QAE3B,sBAAsB;QAEtB,mBAAmB;QAEnB,sCAAsC;KACvC;IAED,OAAO,EAAE,uCAAuC;CACjD,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;IAC3C,EAAE,EAAE,aAAa;IAEjB,IAAI,EAAE,6BAA6B;IAEnC,aAAa,EAAE;QACb,8FAA8F;QAE9F,sDAAsD;KACvD;IAED,aAAa,EAAE;QACb,0DAA0D;QAE1D,0EAA0E;QAE1E,wEAAwE;KACzE;IAED,SAAS,EACP,6GAA6G;IAE/G,QAAQ,EAAE;QACR,oCAAoC;QAEpC,6BAA6B;QAE7B,wBAAwB;QAExB,sBAAsB;QAEtB,mBAAmB;QAEnB,sCAAsC;KACvC;IAED,OAAO,EAAE,0CAA0C;CACpD,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG;IACpB,UAAU,EAAE,mBAAmB;IAE/B,QAAQ,CAAC,MAA6B;QACpC,OAAO,wBAAwB,CAAC,MAAM,EAAE;YACtC,IAAI,EAAE,2GAA2G;YAEjH,IAAI,EAAE,iGAAiG;SACxG,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,UAAU,EAAE,mBAAmB;IAE/B,QAAQ,CAAC,MAA6B;QACpC,OAAO,wBAAwB,CAAC,MAAM,EAAE;YACtC,IAAI,EAAE,mHAAmH;YAEzH,IAAI,EAAE,+GAA+G;SACtH,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,MAAM,EAAE,aAAa;IAErB,QAAQ,EAAE;QACR,EAAE,EAAE,0BAA0B;QAE9B,UAAU,EAAE;YACV,EAAE,EAAE,qBAAqB;YAEzB,SAAS,EAAE,YAAY;YAEvB,QAAQ,EAAE,wBAAwB;YAElC,MAAM,EAAE,oBAAoB;YAE5B,SAAS,EAAE,CAAC,sBAAsB,CAAC;YAEnC,YAAY,EAAE,CAAC,oBAAoB,CAAC;YAEpC,KAAK,EAAE,CAAC,GAAG,qBAAqB,CAAC;YAEjC,MAAM,EAAE,gBAAgB;YAExB,KAAK,EAAE,cAAc;YAErB,QAAQ,EAAE,EAAE;YAEZ,SAAS,EAAE,EAAE;YAEb,SAAS,EAAE,KAAK;SACjB;QAED,OAAO,EAAE;YACP,SAAS,EAAE,YAAY;YAEvB,QAAQ,EAAE,wBAAwB;YAElC,MAAM,EAAE,oBAAoB;YAE5B,QAAQ,EAAE,sBAAsB;YAEhC,UAAU,EAAE,oBAAoB;YAEhC,MAAM,EAAE,gBAAgB;YAExB,KAAK,EAAE,cAAc;YAErB,aAAa,EAAE,qBAAqB;SACrC;QAED;;;WAGG;QACH,WAAW,EAAE,EAAE;QAEf,UAAU,EAAE,6BAA6B,CAAC,KAAK,CAAC;KACjD;IAED,aAAa,EAAE,mBAAmB;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAiB;IACvC,MAAM,EAAE,aAAa;IAErB,QAAQ,EAAE;QACR,EAAE,EAAE,6BAA6B;QAEjC,UAAU,EAAE;YACV,EAAE,EAAE,qBAAqB;YAEzB,SAAS,EAAE,YAAY;YAEvB,QAAQ,EAAE,wBAAwB;YAElC,MAAM,EAAE,oBAAoB;YAE5B,SAAS,EAAE,CAAC,sBAAsB,CAAC;YAEnC,YAAY,EAAE,CAAC,oBAAoB,CAAC;YAEpC;;;eAGG;YACH,KAAK,EAAE,CAAC,YAAY,EAAE,wBAAwB,CAAC;YAE/C,MAAM,EAAE,gBAAgB;YAExB,KAAK,EAAE,cAAc;YAErB,QAAQ,EAAE,EAAE;YAEZ,SAAS,EAAE,EAAE;YAEb,SAAS,EAAE,KAAK;SACjB;QAED,OAAO,EAAE;YACP,SAAS,EAAE,YAAY;YAEvB,QAAQ,EAAE,wBAAwB;YAElC,MAAM,EAAE,oBAAoB;YAE5B,QAAQ,EAAE,sBAAsB;YAEhC,UAAU,EAAE,oBAAoB;YAEhC,MAAM,EAAE,gBAAgB;YAExB,KAAK,EAAE,cAAc;YAErB,aAAa,EAAE,qBAAqB;SACrC;QAED,WAAW,EAAE,EAAE;QAEf,UAAU,EAAE,6BAA6B,CAAC,KAAK,CAAC;KACjD;IAED,aAAa,EAAE,mBAAmB;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,wBAAwB,GAA4B,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC"}

package/dist/attacks/p1/index.d.ts

@@ -0,0 +1,7 @@
+export * from './approval.js';
+export * from './audit.js';
+export * from './authorization.js';
+export * from './race.js';
+export * from './replay.js';
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/attacks/p1/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/attacks/p1/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/attacks/p1/index.js

@@ -0,0 +1,7 @@
+export * from './approval.js';
+export * from './audit.js';
+export * from './authorization.js';
+export * from './race.js';
+export * from './replay.js';
+export * from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/attacks/p1/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/attacks/p1/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/attacks/p1/race.d.ts

@@ -0,0 +1,5 @@
+import type { P1RaceAttackPlan } from './types.js';
+export declare const HP_RACE_001: P1RaceAttackPlan;
+export declare const HP_RACE_002: P1RaceAttackPlan;
+export declare const P1_RACE_ATTACKS: readonly P1RaceAttackPlan[];
+//# sourceMappingURL=race.d.ts.map

package/dist/attacks/p1/race.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"race.d.ts","sourceRoot":"","sources":["../../../src/attacks/p1/race.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAuQnD,eAAO,MAAM,WAAW,EAAE,gBAqBzB,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,gBAsBzB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,SAAS,gBAAgB,EAA+B,CAAC"}

package/dist/attacks/p1/race.js

@@ -0,0 +1,255 @@
+import { P0_AUTHORIZED_DOWNSTREAM, P0_AUTHORIZED_RESOURCE, P0_AUTHORIZED_TENANT, P0_CALLER, P0_CAPABILITY_UPDATE, P0_PRINCIPAL, createP0ReferenceContext, createP0UpdateInvoiceScenario, } from '../../p0-fixture/index.js';
+const FULL_CHAIN = [P0_PRINCIPAL, P0_CALLER, P0_AUTHORIZED_DOWNSTREAM];
+function projectSources(section) {
+    return [
+        {
+            kind: 'project',
+            title: 'P1 Security Test Specification',
+            locator: `docs/P1_TEST_SPECIFICATION.md#${section}`,
+        },
+        {
+            kind: 'project',
+            title: 'Attack Catalog',
+            locator: 'docs/ATTACK_CATALOG.md#v01-p1--add-after-p0-engine-is-credible',
+        },
+    ];
+}
+function createDefinition(input) {
+    return {
+        id: input.id,
+        name: input.name,
+        category: 'race',
+        defaultSeverity: 'high',
+        priority: 'P1',
+        preconditions: input.preconditions,
+        mutationSteps: input.mutationSteps,
+        expectedInvariant: input.invariant,
+        evidenceRequirements: input.evidence,
+        applicability: {
+            a2a: ['1.0'],
+            mcp: ['2026-07-28'],
+        },
+        propertyClass: 'composition_responsibility',
+        sourceReferences: projectSources(input.section),
+        sideEffectClass: 'synthetic',
+        destructive: false,
+    };
+}
+function createUpdateContext() {
+    const context = createP0ReferenceContext();
+    if (context.upstreamAuthority === undefined || context.effectiveAuthority === undefined) {
+        throw new Error('P1 race attacks require authority bindings.');
+    }
+    context.capabilities = [P0_CAPABILITY_UPDATE];
+    context.upstreamAuthority.capabilities = [P0_CAPABILITY_UPDATE];
+    context.effectiveAuthority.capabilities = [P0_CAPABILITY_UPDATE];
+    return context;
+}
+function createDelegation(input) {
+    return {
+        id: input.id,
+        principal: P0_PRINCIPAL,
+        delegate: P0_AUTHORIZED_DOWNSTREAM,
+        tenant: P0_AUTHORIZED_TENANT,
+        resources: [P0_AUTHORIZED_RESOURCE],
+        capabilities: [P0_CAPABILITY_UPDATE],
+        chain: [...FULL_CHAIN],
+        taskId: 'task:P1-RACE-A',
+        runId: 'run:P1-RACE-A',
+        issuedAt: 10,
+        expiresAt: 40,
+        singleUse: input.singleUse,
+    };
+}
+function createRequest() {
+    return {
+        principal: P0_PRINCIPAL,
+        delegate: P0_AUTHORIZED_DOWNSTREAM,
+        tenant: P0_AUTHORIZED_TENANT,
+        resource: P0_AUTHORIZED_RESOURCE,
+        capability: P0_CAPABILITY_UPDATE,
+        taskId: 'task:P1-RACE-A',
+        runId: 'run:P1-RACE-A',
+        requiredChain: FULL_CHAIN,
+    };
+}
+function relevantEvidenceSequences(result) {
+    const relevant = new Set([
+        'p1.race.arrive',
+        'p1.race.release',
+        'p1.race.authorization',
+        'p1.race.blocked',
+        'p1.race.side_effect',
+        'p1.partial.capture',
+        'p1.partial.invalidate',
+        'p1.partial.resume',
+        'p1.partial.blocked',
+        'p1.partial.side_effect',
+        'handoff.translate',
+        'mcp.tool.call',
+        'mcp.tool.result',
+    ]);
+    return result.evidence
+        .filter((event) => relevant.has(event.event))
+        .map((event) => event.sequence);
+}
+function evaluateRace001(result) {
+    const output = result.output;
+    const evidenceSequences = relevantEvidenceSequences(result);
+    if (output.barrierArrivals !== 2) {
+        return {
+            status: 'inconclusive',
+            observedBehavior: 'Both deterministic race attempts did not reach the synchronization barrier.',
+            evidenceSequences,
+        };
+    }
+    const delta = output.sideEffectCounterAfter - output.sideEffectCounterBefore;
+    if (output.executedAttempts.length === 1 && delta === 1) {
+        return {
+            status: 'pass',
+            observedBehavior: 'Exactly one concurrent attempt consumed the one-time authority and only one synthetic protected side effect occurred.',
+            evidenceSequences,
+        };
+    }
+    if (output.executedAttempts.length === 2 && delta === 2) {
+        return {
+            status: 'fail',
+            observedBehavior: 'Both concurrent attempts reused the same one-time authority and produced two protected synthetic side effects.',
+            evidenceSequences,
+        };
+    }
+    return {
+        status: 'inconclusive',
+        observedBehavior: 'Race evidence did not establish a deterministic single or double protected execution.',
+        evidenceSequences,
+    };
+}
+function evaluateRace002(result) {
+    const output = result.output;
+    const evidenceSequences = relevantEvidenceSequences(result);
+    if (!output.initialDecision.allowed ||
+        output.currentDecision.allowed ||
+        !output.currentDecision.reasons.includes('delegation_invalidated')) {
+        return {
+            status: 'inconclusive',
+            observedBehavior: 'The fixture did not establish a valid captured state followed by deterministic invalidation.',
+            evidenceSequences,
+        };
+    }
+    const delta = output.sideEffectCounterAfter - output.sideEffectCounterBefore;
+    if (output.executedAttempts.length === 0 && delta === 0) {
+        return {
+            status: 'pass',
+            observedBehavior: 'The resumed operation revalidated current security state and rejected the stale captured authority.',
+            evidenceSequences,
+        };
+    }
+    if (output.executedAttempts.length === 1 && output.capturedStateUsed && delta === 1) {
+        return {
+            status: 'fail',
+            observedBehavior: 'The interrupted operation resumed using stale captured authority after that authority had been invalidated.',
+            evidenceSequences,
+        };
+    }
+    return {
+        status: 'inconclusive',
+        observedBehavior: 'Partial-failure evidence could not establish a deterministic stale-state PASS or FAIL.',
+        evidenceSequences,
+    };
+}
+const RACE_001_DEFINITION = createDefinition({
+    id: 'HP-RACE-001',
+    name: 'Parallel one-time authority consumption',
+    preconditions: [
+        'One valid delegation is explicitly single-use.',
+        'Two execution attempts target the same protected logical action.',
+    ],
+    mutationSteps: [
+        'Start both attempts before either consumes the authority.',
+        'Hold both at a deterministic synchronization barrier.',
+        'Release them in fixed order against the same single-use delegation.',
+    ],
+    invariant: 'One-time authority must authorize at most one successful protected side effect.',
+    evidence: [
+        'delegation ID',
+        'single-use marker',
+        'both attempt IDs',
+        'barrier arrival and release events',
+        'consumption state',
+        'authorization result per attempt',
+        'synthetic side-effect counter',
+    ],
+    section: 'hp-race-001--parallel-one-time-authority-consumption',
+});
+const RACE_002_DEFINITION = createDefinition({
+    id: 'HP-RACE-002',
+    name: 'Partial-failure stale execution',
+    preconditions: [
+        'A protected operation begins with valid authority.',
+        'The translated security state can be captured before protected execution.',
+    ],
+    mutationSteps: [
+        'Pause after translation but before protected execution.',
+        'Invalidate the governing delegation during the interruption.',
+        'Resume using the previously captured state.',
+    ],
+    invariant: 'A resumed operation must revalidate security state that may have changed during an interruption.',
+    evidence: [
+        'logical action ID',
+        'interruption point',
+        'captured authorization state',
+        'invalidation event',
+        'resume attempt',
+        'current revalidation result',
+        'deterministic sequence ordering',
+        'synthetic side-effect counter',
+    ],
+    section: 'hp-race-002--partial-failure-stale-execution',
+});
+const RACE_001_CASE = {
+    definition: RACE_001_DEFINITION,
+    evaluate: evaluateRace001,
+};
+const RACE_002_CASE = {
+    definition: RACE_002_DEFINITION,
+    evaluate: evaluateRace002,
+};
+export const HP_RACE_001 = {
+    attack: RACE_001_CASE,
+    scenario: {
+        id: 'parallel-one-time-authority',
+        kind: 'parallel-one-time-authority',
+        actionId: 'action:ACT-RACE-1001',
+        firstAttemptId: 'attempt:ATT-1',
+        secondAttemptId: 'attempt:ATT-2',
+        delegation: createDelegation({
+            id: 'delegation:DEL-ONCE-1001',
+            singleUse: true,
+        }),
+        request: createRequest(),
+        logicalTime: 15,
+        p0Scenario: createP0UpdateInvoiceScenario(24701),
+    },
+    createContext: createUpdateContext,
+};
+export const HP_RACE_002 = {
+    attack: RACE_002_CASE,
+    scenario: {
+        id: 'partial-failure-stale-execution',
+        kind: 'partial-failure-stale-execution',
+        actionId: 'action:ACT-STALE-1001',
+        firstAttemptId: 'attempt:ATT-1',
+        secondAttemptId: 'attempt:ATT-2',
+        delegation: createDelegation({
+            id: 'delegation:DEL-STALE-1001',
+            singleUse: false,
+        }),
+        request: createRequest(),
+        logicalTime: 15,
+        invalidationTime: 16,
+        p0Scenario: createP0UpdateInvoiceScenario(24702),
+    },
+    createContext: createUpdateContext,
+};
+export const P1_RACE_ATTACKS = [HP_RACE_001, HP_RACE_002];
+//# sourceMappingURL=race.js.map

package/dist/attacks/p1/race.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"race.js","sourceRoot":"","sources":["../../../src/attacks/p1/race.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,oBAAoB,EACpB,YAAY,EACZ,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAMnC,MAAM,UAAU,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,wBAAwB,CAAU,CAAC;AAEhF,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO;QACL;YACE,IAAI,EAAE,SAAkB;YACxB,KAAK,EAAE,gCAAgC;YACvC,OAAO,EAAE,iCAAiC,OAAO,EAAE;SACpD;QACD;YACE,IAAI,EAAE,SAAkB;YACxB,KAAK,EAAE,gBAAgB;YACvB,OAAO,EAAE,gEAAgE;SAC1E;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAQzB;IACC,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,MAAM;QAChB,eAAe,EAAE,MAAM;QACvB,QAAQ,EAAE,IAAI;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,iBAAiB,EAAE,KAAK,CAAC,SAAS;QAClC,oBAAoB,EAAE,KAAK,CAAC,QAAQ;QACpC,aAAa,EAAE;YACb,GAAG,EAAE,CAAC,KAAK,CAAC;YACZ,GAAG,EAAE,CAAC,YAAY,CAAC;SACpB;QACD,aAAa,EAAE,4BAA4B;QAC3C,gBAAgB,EAAE,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC;QAC/C,eAAe,EAAE,WAAW;QAC5B,WAAW,EAAE,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,OAAO,GAAG,wBAAwB,EAAE,CAAC;IAE3C,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,OAAO,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC9C,OAAO,CAAC,iBAAiB,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAChE,OAAO,CAAC,kBAAkB,CAAC,YAAY,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEjE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyC;IACjE,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,wBAAwB;QAClC,MAAM,EAAE,oBAAoB;QAC5B,SAAS,EAAE,CAAC,sBAAsB,CAAC;QACnC,YAAY,EAAE,CAAC,oBAAoB,CAAC;QACpC,KAAK,EAAE,CAAC,GAAG,UAAU,CAAC;QACtB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,eAAe;QACtB,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,EAAE;QACb,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,OAAO;QACL,SAAS,EAAE,YAAY;QACvB,QAAQ,EAAE,wBAAwB;QAClC,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,UAAU,EAAE,oBAAoB;QAChC,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,eAAe;QACtB,aAAa,EAAE,UAAU;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,MAA6B;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,gBAAgB;QAChB,iBAAiB;QACjB,uBAAuB;QACvB,iBAAiB;QACjB,qBAAqB;QACrB,oBAAoB;QACpB,uBAAuB;QACvB,mBAAmB;QACnB,oBAAoB;QACpB,wBAAwB;QACxB,mBAAmB;QACnB,eAAe;QACf,iBAAiB;KAClB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,QAAQ;SACnB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,eAAe,CAAC,MAA6B;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAA4B,CAAC;IACnD,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAE5D,IAAI,MAAM,CAAC,eAAe,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,gBAAgB,EACd,6EAA6E;YAC/E,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,GAAG,MAAM,CAAC,uBAAuB,CAAC;IAE7E,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,gBAAgB,EACd,uHAAuH;YACzH,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,gBAAgB,EACd,gHAAgH;YAClH,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,cAAc;QACtB,gBAAgB,EACd,uFAAuF;QACzF,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAA6B;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,MAA4B,CAAC;IACnD,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAE5D,IACE,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO;QAC/B,MAAM,CAAC,eAAe,CAAC,OAAO;QAC9B,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAClE,CAAC;QACD,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,gBAAgB,EACd,8FAA8F;YAChG,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,sBAAsB,GAAG,MAAM,CAAC,uBAAuB,CAAC;IAE7E,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,MAAM;YACd,gBAAgB,EACd,qGAAqG;YACvG,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,iBAAiB,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO;YACL,MAAM,EAAE,MAAM;YACd,gBAAgB,EACd,6GAA6G;YAC/G,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,cAAc;QACtB,gBAAgB,EACd,wFAAwF;QAC1F,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;IAC3C,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,yCAAyC;IAC/C,aAAa,EAAE;QACb,gDAAgD;QAChD,kEAAkE;KACnE;IACD,aAAa,EAAE;QACb,2DAA2D;QAC3D,uDAAuD;QACvD,qEAAqE;KACtE;IACD,SAAS,EAAE,iFAAiF;IAC5F,QAAQ,EAAE;QACR,eAAe;QACf,mBAAmB;QACnB,kBAAkB;QAClB,oCAAoC;QACpC,mBAAmB;QACnB,kCAAkC;QAClC,+BAA+B;KAChC;IACD,OAAO,EAAE,sDAAsD;CAChE,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;IAC3C,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,iCAAiC;IACvC,aAAa,EAAE;QACb,oDAAoD;QACpD,2EAA2E;KAC5E;IACD,aAAa,EAAE;QACb,yDAAyD;QACzD,8DAA8D;QAC9D,6CAA6C;KAC9C;IACD,SAAS,EACP,kGAAkG;IACpG,QAAQ,EAAE;QACR,mBAAmB;QACnB,oBAAoB;QACpB,8BAA8B;QAC9B,oBAAoB;QACpB,gBAAgB;QAChB,6BAA6B;QAC7B,iCAAiC;QACjC,+BAA+B;KAChC;IACD,OAAO,EAAE,8CAA8C;CACxD,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG;IACpB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,eAAe;CAC1B,CAAC;AAEF,MAAM,aAAa,GAAG;IACpB,UAAU,EAAE,mBAAmB;IAC/B,QAAQ,EAAE,eAAe;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAqB;IAC3C,MAAM,EAAE,aAAa;IAErB,QAAQ,EAAE;QACR,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,sBAAsB;QAChC,cAAc,EAAE,eAAe;QAC/B,eAAe,EAAE,eAAe;QAEhC,UAAU,EAAE,gBAAgB,CAAC;YAC3B,EAAE,EAAE,0BAA0B;YAC9B,SAAS,EAAE,IAAI;SAChB,CAAC;QAEF,OAAO,EAAE,aAAa,EAAE;QACxB,WAAW,EAAE,EAAE;QACf,UAAU,EAAE,6BAA6B,CAAC,KAAK,CAAC;KACjD;IAED,aAAa,EAAE,mBAAmB;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAqB;IAC3C,MAAM,EAAE,aAAa;IAErB,QAAQ,EAAE;QACR,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE,iCAAiC;QACvC,QAAQ,EAAE,uBAAuB;QACjC,cAAc,EAAE,eAAe;QAC/B,eAAe,EAAE,eAAe;QAEhC,UAAU,EAAE,gBAAgB,CAAC;YAC3B,EAAE,EAAE,2BAA2B;YAC/B,SAAS,EAAE,KAAK;SACjB,CAAC;QAEF,OAAO,EAAE,aAAa,EAAE;QACxB,WAAW,EAAE,EAAE;QACf,gBAAgB,EAAE,EAAE;QACpB,UAAU,EAAE,6BAA6B,CAAC,KAAK,CAAC;KACjD;IAED,aAAa,EAAE,mBAAmB;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAgC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC"}

package/dist/attacks/p1/replay.d.ts

@@ -0,0 +1,6 @@
+import type { P1ReplayAttackPlan } from './types.js';
+export declare const HP_REPLAY_001: P1ReplayAttackPlan;
+export declare const HP_REPLAY_002: P1ReplayAttackPlan;
+export declare const HP_REPLAY_003: P1ReplayAttackPlan;
+export declare const P1_REPLAY_ATTACKS: readonly P1ReplayAttackPlan[];
+//# sourceMappingURL=replay.d.ts.map

package/dist/attacks/p1/replay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay.d.ts","sourceRoot":"","sources":["../../../src/attacks/p1/replay.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAoYrD,eAAO,MAAM,aAAa,EAAE,kBA8B3B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,kBA8B3B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,kBAgC3B,CAAC;AAEF,eAAO,MAAM,iBAAiB,EAAE,SAAS,kBAAkB,EAI1D,CAAC"}