mindforge-cc 11.2.0 → 11.2.1

package/bin/engine/orbital-guardian.js

@@ -35,26 +35,43 @@ class OrbitalGuardian {
       throw new Error(`[ORBITAL-GUARDIAN] DID ${did} has insufficient Trust Tier for Orbital Attestation.`);
     }
 
-    // 1. Sign the attestation payload using the Hardware Enclave provider
-    const attestationPayload = await ztaiManager.signData(did, JSON.stringify({
+    // 1. Build the EXACT canonical message and sign it with the agent's key.
+    //    UC-22: this canonical string is persisted verbatim alongside the DID so
+    //    verify() can re-verify the signature later. We must store the precise
+    //    bytes that were signed — recomputing them (e.g. with a fresh timestamp)
+    //    would never verify — so capture the message once, here, and reuse it.
+    const signedMessage = JSON.stringify({
       requestId,
       payload,
       timestamp: new Date().toISOString()
-    }));
+    });
+    const signature = await ztaiManager.signData(did, signedMessage);
 
     const attestation = {
       id: `att_${crypto.randomBytes(4).toString('hex')}`,
       request_id: requestId,
       status: 'APPROVED',
-      attestation_payload: attestationPayload,
+      did,
+      signed_message: signedMessage,
+      attestation_payload: signature,
       timestamp: new Date().toISOString()
     };
 
-    // 2. Persist to SQLite (Source of truth for v8 Governance Dashboard)
+    // 2. Persist to SQLite (Source of truth for v8 Governance Dashboard).
+    //    did + signed_message + signature together let verify() re-check the
+    //    cryptographic signature; status='APPROVED' alone is NOT trusted.
     vectorHub.run(
-      `INSERT INTO attestations (id, request_id, status, attestation_payload, timestamp)
-       VALUES (?, ?, ?, ?, ?)`,
-      [attestation.id, attestation.request_id, attestation.status, attestation.attestation_payload, attestation.timestamp]
+      `INSERT INTO attestations (id, request_id, status, did, signed_message, attestation_payload, timestamp)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      [
+        attestation.id,
+        attestation.request_id,
+        attestation.status,
+        attestation.did,
+        attestation.signed_message,
+        attestation.attestation_payload,
+        attestation.timestamp
+      ]
     );
 
     console.log(`[ORBITAL-GUARDIAN] Attestation SUCCESS: ${attestation.id}`);
@@ -63,9 +80,16 @@ class OrbitalGuardian {
 
   /**
    * Verifies if a request has a valid hardware bypass.
+   *
+   * UC-22 (audit finding #2): an APPROVED row is NOT trusted on its own. The
+   * stored signature is re-verified against the signer's registered public key
+   * over the EXACT canonical message that attest() signed. Anyone who forges an
+   * APPROVED row but cannot produce a valid signature is rejected. The check is
+   * fail-closed: a missing field, an unregistered/revoked DID, or any thrown
+   * error all resolve to { verified:false }.
    */
   async verify(requestId) {
-    if (!requestId) return { verified: false };
+    if (!requestId) return { verified: false, reason: 'missing requestId' };
     await this.ensureInit();
 
     const results = vectorHub.query(
@@ -74,7 +98,29 @@ class OrbitalGuardian {
     );
 
     const record = results[0];
-    if (!record) return { verified: false };
+    if (!record) return { verified: false, reason: 'no APPROVED attestation found' };
+
+    // Re-verify the cryptographic signature. Without a DID, the canonical signed
+    // message, AND a signature we cannot prove the row was produced by attest().
+    if (!record.did || !record.signed_message || !record.attestation_payload) {
+      return { verified: false, reason: 'attestation missing signature material' };
+    }
+
+    let signatureValid = false;
+    try {
+      signatureValid = ztaiManager.verifySignature(
+        record.did,
+        record.signed_message,
+        record.attestation_payload
+      );
+    } catch (err) {
+      // Unregistered/revoked DID or malformed signature → fail closed.
+      return { verified: false, reason: `signature verification error: ${err.message}` };
+    }
+
+    if (!signatureValid) {
+      return { verified: false, reason: 'signature verification failed' };
+    }
 
     return {
       verified: true,

package/bin/engine/reason-source-aligner.js

@@ -45,7 +45,17 @@ class ReasonSourceAligner {
    * @returns {Object} - Alignment results.
    */
   checkAlignment(thought) {
-    if (!this.initialized) return { score: 1.0, reason: 'uninitialized' }; // Fail-safe stable
+    // Fail-safe stable: when no requirements are loaded we CANNOT assess
+    // alignment, so we honestly decline rather than assert perfect alignment.
+    // Returning the SAME shape as the normal branch means the sole caller
+    // (auto-runner.checkMissionFidelity) reads a real boolean instead of
+    // `undefined`, so the mission-fidelity gate is no longer silently disabled.
+    // is_aligned:false is the safe direction — the caller only injects a
+    // correction when is_aligned is truthy, so an honest "can't assess" simply
+    // does nothing (no false correction, no silent shape mismatch).
+    if (!this.initialized) {
+      return { is_aligned: false, best_match_id: null, confidence: 0, status: 'uninitialized' };
+    }
 
     const alignmentScores = this.registry.map(req => {
       const score = this._calculateSimilarity(thought, req.summary + ' ' + req.description);
@@ -58,6 +68,7 @@ class ReasonSourceAligner {
       is_aligned: bestMatch ? bestMatch.score > 0.25 : false, // Sparse mapping allowed
       best_match_id: bestMatch ? bestMatch.id : null,
       confidence: bestMatch ? parseFloat(bestMatch.score.toFixed(4)) : 0,
+      status: 'assessed',
     };
   }
 
@@ -82,19 +93,21 @@ class ReasonSourceAligner {
   }
 
   /**
-   * Similarity Heuristic (Keyword-based overlap)
+   * Keyword-based overlap heuristic (Jaccard similarity).
+   * NOTE: This is a token-overlap heuristic, NOT semantic embeddings.
+   * Returns |A ∩ B| / |A ∪ B| in [0, 1].
    */
   _calculateSimilarity(a, b) {
     const getTokens = (str) => new Set(str.toLowerCase().replace(/[^\w\s]/g, '').split(/\s+/).filter(t => t.length > 3));
     const tokensA = getTokens(a);
     const tokensB = getTokens(b);
-    
+
     if (tokensA.size === 0 || tokensB.size === 0) return 0;
-    
+
     const intersection = new Set([...tokensA].filter(x => tokensB.has(x)));
     const union = new Set([...tokensA, ...tokensB]);
-    
-    return intersection.size / tokensA.size; // Weighted by thought coverage
+
+    return intersection.size / union.size; // Jaccard: overlap over combined vocabulary
   }
 
   /**

package/bin/engine/remediation-engine.js

@@ -1,5 +1,5 @@
 /**
- * MindForge v11.1.0 — Neural Drift Remediation (NDR)
+ * MindForge v11.2.0 — Neural Drift Remediation (NDR)
  * Component: Remediation Engine (Pillar X)
  *
  * Triggers corrective actions when logic drift or reasoning

package/bin/engine/self-corrective-synthesizer.js

@@ -1,5 +1,5 @@
 /**
- * MindForge v11.1.0 — Self-Corrective Synthesis (SCS)
+ * MindForge v11.2.0 — Self-Corrective Synthesis (SCS)
  * Component: Self-Corrective Synthesizer (Pillar XII)
  *
  * Analyzes mission drift and logic stagnation to synthesize

package/bin/engine/sre-manager.js

@@ -47,12 +47,22 @@ class SREManager {
   }
 
   /**
-   * Sanitizes a thought chain and generates a ZK-Proof Compliance Certificate.
-   * Ensures that sensitive IP or "zero-visibility" thoughts are isolated while proving audit-eligibility.
+   * Sanitizes a thought chain and generates an HMAC integrity certificate.
+   *
+   * IMPORTANT — HONEST LABELING: This is NOT a zero-knowledge proof. The
+   * artifact is an HMAC-SHA256 tag computed with a process-local shared secret
+   * (EPHEMERAL_ENCLAVE_KEY). It provides tamper-evidence/integrity over the
+   * proof payload, but:
+   *   - any party holding the key can forge it (symmetric MAC, not asymmetric),
+   *   - the payload carries the plaintext sha256(thoughtChain) digest, so it is
+   *     not "zero-visibility".
+   * The enclave is simulated (no hardware TEE). Consumers must treat the
+   * returned object as an integrity tag, not a cryptographic ZK proof.
+   *
    * @param {string} thoughtChain - The raw agentic thought chain.
    * @param {string} enclaveId - The active enclave ID.
    * @param {Object} policyResult - Whether the content passed internal policy checks.
-   * @returns {Object} - ZK-Proof compliance certificate.
+   * @returns {Object} - HMAC integrity certificate (simulated enclave).
    */
   sanitizeThoughtChain(thoughtChain, enclaveId, policyResult = { passed: true }) {
     if (!this.activeEnclaves.has(enclaveId)) {
@@ -64,7 +74,7 @@ class SREManager {
     const prevHash = enclaveData.cumulativeHash;
     const digest = crypto.createHash('sha256').update(thoughtChain).digest('hex');
     
-    // Generate a simulated ZK-Proof Compliance Certificate
+    // Generate a simulated-enclave HMAC integrity certificate (NOT a ZK proof)
     const proofPayload = {
       enclaveId: enclaveId,
       digest: digest,
@@ -85,19 +95,36 @@ class SREManager {
 
     const certificate = {
       status: 'SRE-ISOLATED',
+      // Honest labeling: this is a symmetric HMAC integrity tag, not a ZK proof.
+      type: 'hmac-integrity-certificate',
+      method: 'hmac-sha256-integrity',
+      simulated: true,
+      zeroKnowledge: false,
+      disclosure: 'HMAC integrity tag (simulated enclave; NOT a zero-knowledge proof). '
+        + 'Forgeable by any holder of the shared enclave key; payload carries the plaintext sha256(thought) digest.',
       proof: proofPayload,
       signature: signature,
       proofHash: proofHash,
       verificationDid: SYSTEM_DID,
-      message: `[SRE-ZK-PROOF] Confidential reasoning (sha256:${digest.substring(0, 8)}...) verified by Enclave Auditor.`
+      message: `[SRE-HMAC] HMAC integrity tag for confidential reasoning (sha256:${digest.substring(0, 8)}...) `
+        + 'in simulated enclave — NOT a zero-knowledge proof.'
     };
 
     return certificate;
   }
 
   /**
-   * Verifies an SRE Compliance Certificate without seeing the original content.
+   * Verifies an SRE integrity certificate's HMAC tag and policy flag.
+   *
+   * NOTE — HONEST LABELING: this recomputes the HMAC-SHA256 tag using the
+   * shared enclave key and compares it. It is symmetric MAC verification, NOT
+   * zero-knowledge verification. The method name is retained for API
+   * compatibility with existing callers; see verifyIntegrityCertificate alias.
    */
+  verifyIntegrityCertificate(certificate) {
+    return this.verifyZKProof(certificate);
+  }
+
   verifyZKProof(certificate) {
     if (certificate.status !== 'SRE-ISOLATED') return false;
 

package/bin/governance/policy-engine.js

@@ -92,10 +92,14 @@ class PolicyEngine {
             return verdict;
           }
 
-          // [ENTERPRISE] Tier 3 Reasoning/PQ Proof Bypass
+          // [ENTERPRISE] Tier 3 Sovereign Proof Bypass (fail-closed).
+          // A blast-radius override demands a CRYPTOGRAPHIC proof. Only a
+          // pq_proof verified via verifyZKProof may authorize the bypass.
+          // intent.reasoning_proof is free-form text validated nowhere, so it
+          // MUST NOT, on its own, grant an override (UC-22 authz bypass fix).
           if (intent.tier >= 3 && (intent.reasoning_proof || intent.pq_proof)) {
              const quantumCrypto = require('./quantum-crypto');
-             let isProofValid = true;
+             let isProofValid = false; // fail-closed: deny unless a real proof verifies
 
              if (intent.pq_proof) {
                const zkResult = quantumCrypto.verifyZKProof(intent.pq_proof, intent.id);
@@ -106,12 +110,21 @@ class PolicyEngine {
              }
 
              if (isProofValid) {
-                console.log(`[APO-BYPASS] [${requestId}] Tier 3 'Sovereign Proof' verified (${intent.pq_proof ? 'ZK-PQ' : 'Standard'}). Overriding Blast Radius limit.`);
+                console.log(`[APO-BYPASS] [${requestId}] Tier 3 'Sovereign Proof' verified (ZK-PQ). Overriding Blast Radius limit.`);
                 // Continue to permit check
-             } else {
+             } else if (intent.pq_proof) {
                 verdict = { verdict: 'DENY', reason: 'ZK proof verification failed. Configure a verifier module or provide a valid proof.', requestId };
                 this.logAudit(intent, impactScore, verdict);
                 return verdict;
+             } else {
+                // Only a reasoning_proof was supplied — not a cryptographic proof.
+                verdict = {
+                  verdict: 'DENY',
+                  reason: 'reasoning_proof is not a cryptographic proof; provide a valid pq_proof / Sovereign Proof for blast-radius override.',
+                  requestId
+                };
+                this.logAudit(intent, impactScore, verdict);
+                return verdict;
              }
           } else {
             verdict = { 

package/bin/governance/ztai-archiver.js

@@ -20,19 +20,35 @@ class ZTAIArchiver {
    * @param {string} archiverDid - The DID of the archiver (e.g., Release Manager)
    * @returns {Promise<Object>} - The signed manifest
    */
-  async generateManifest(entries, archiverDid) {
-    if (!entries || entries.length === 0) return null;
-
-    // 1. Calculate the Merkle-like root hash of the block
-    const blockHashes = entries.map(e => 
+  /**
+   * Computes the cumulative-hash-chain "Merkle root" for a block of entries.
+   *
+   * This is the SINGLE source of truth for the root algorithm. Both
+   * generateManifest() (write path) and verifyIntegrity() (read/verify path)
+   * MUST call this so the two can never drift — a drift would re-introduce the
+   * false-assurance defect (audit finding #15 / UC-22).
+   *
+   * @param {Array<Object>} entries - Ordered block of audit entries.
+   * @returns {string} - The cumulative SHA-256 hash chain (hex).
+   */
+  _computeMerkleRoot(entries) {
+    const blockHashes = entries.map(e =>
       crypto.createHash('sha256').update(JSON.stringify(e)).digest('hex')
     );
-    
-    // Simple cumulative hash chain as a Merkle Root equivalent
+
+    // Simple cumulative hash chain as a Merkle Root equivalent.
     let cumulativeHash = '';
     for (const h of blockHashes) {
       cumulativeHash = crypto.createHash('sha256').update(cumulativeHash + h).digest('hex');
     }
+    return cumulativeHash;
+  }
+
+  async generateManifest(entries, archiverDid) {
+    if (!entries || entries.length === 0) return null;
+
+    // 1. Calculate the Merkle-like root hash of the block.
+    const cumulativeHash = this._computeMerkleRoot(entries);
 
     const manifestMetadata = {
       blockStart: entries[0].timestamp,
@@ -94,8 +110,57 @@ class ZTAIArchiver {
       throw new Error(`CRITICAL: Manifest signature invalid for ${manifestPath}`);
     }
 
-    // 2. Recalculate and Verify Merkle Root (Simulated)
-    // In a real environment, this would compare against the actual AUDIT.jsonl data slices.
+    // 2. Recalculate and Verify Merkle Root against the LIVE AUDIT.jsonl.
+    //
+    // A valid signature only proves the manifest itself is authentic; it says
+    // NOTHING about whether the underlying audit log still matches. We must
+    // recompute the root from disk and compare — anything less is false
+    // assurance (audit finding #15 / UC-22). Fail-closed on every error path:
+    // a missing/unreadable log MUST NOT pass.
+    let auditData;
+    try {
+      auditData = await fs.readFile(this.auditPath, 'utf8');
+    } catch (err) {
+      throw new Error(`CRITICAL: Audit log unreadable at ${this.auditPath} — cannot verify integrity (${err.message})`);
+    }
+
+    let allEntries;
+    try {
+      allEntries = auditData
+        .split('\n')
+        .filter(l => l.trim() !== '')
+        .map(l => JSON.parse(l));
+    } catch (err) {
+      throw new Error(`CRITICAL: Audit log corrupted / unparseable for ${manifestPath} (${err.message})`);
+    }
+
+    // Select the block this manifest covers: entries whose timestamp falls
+    // within [blockStart, blockEnd] inclusive.
+    const start = Date.parse(manifest.blockStart);
+    const end = Date.parse(manifest.blockEnd);
+    const blockEntries = allEntries.filter(e => {
+      const ts = Date.parse(e.timestamp);
+      return ts >= start && ts <= end;
+    });
+
+    // Sanity-check the selected count against the manifest. A mismatch means
+    // entries were added or deleted within the covered window.
+    if (blockEntries.length !== manifest.entryCount) {
+      throw new Error(
+        'CRITICAL: Audit log tampering detected — block entry count mismatch ' +
+        `(manifest=${manifest.entryCount}, found=${blockEntries.length}) for ${manifestPath}`
+      );
+    }
+
+    // Recompute the root with the SAME algorithm used at archive time.
+    const recomputedRoot = this._computeMerkleRoot(blockEntries);
+    if (recomputedRoot !== manifest.merkleRoot) {
+      throw new Error(
+        `CRITICAL: Audit log tampering detected — Merkle root mismatch for ${manifestPath} ` +
+        `(expected=${manifest.merkleRoot}, recomputed=${recomputedRoot}).`
+      );
+    }
+
     console.log(`[ZTAI-ARCHIVER] Integrity Verified for block ending ${manifest.blockEnd}`);
     return true;
   }

package/bin/governance/ztai-manager.js

@@ -65,7 +65,7 @@ class SecureEnclaveProvider extends KeyProvider {
   }
 
   async generate(did) {
-    console.log(`[ZTAI-HSM] Provisioning protected identity enclave for ${did}...`);
+    console.log(`[ZTAI-HSM-SIM] Provisioning simulated (in-process) identity enclave for ${did}...`);
     const { publicKey, privateKey } = await generateKeyPair('ed25519');
     const pubPEM = publicKey.export({ type: 'spki', format: 'pem' });
     
@@ -82,7 +82,7 @@ class SecureEnclaveProvider extends KeyProvider {
     const record = this.enclaveStore.get(did);
     if (!record) throw new Error(`Enclave record not found for ${did}`);
     
-    console.log(`[ZTAI-HSM] Delegating signature to hardware enclave [DID: ${did}]`);
+    console.log(`[ZTAI-HSM-SIM] Signing via simulated in-process enclave (NOT a hardware HSM/TPM) [DID: ${did}]`);
     
     // Simulate enclave "wrapping" or "sealing" logic
     const signature = crypto.sign(null, Buffer.from(data), record.privateKey);
@@ -93,7 +93,7 @@ class SecureEnclaveProvider extends KeyProvider {
   }
 
   async rotate(did) {
-    console.log(`[ZTAI-HSM] Rotating enclave keys for ${did}...`);
+    console.log(`[ZTAI-HSM-SIM] Rotating simulated enclave keys for ${did}...`);
     return this.generate(did);
   }
 

package/bin/installer-core.js

@@ -95,6 +95,25 @@ const RUNTIMES = {
   },
 };
 
+/**
+ * Reads the target project's experimental.pqc_demo flag — the SINGLE gate that
+ * the engine (bin/governance/quantum-crypto.js) uses to enable the simulated
+ * PQAS minter. Defaults to false (engine default) when the config is absent or
+ * unreadable, so the installer never over-claims that PQAS is enabled.
+ * @param {string} cwd - Target project root being installed into.
+ * @returns {boolean} - true only when experimental.pqc_demo === true.
+ */
+function isPqcDemoEnabled(cwd) {
+  try {
+    const cfgPath = path.join(cwd, '.mindforge', 'config.json');
+    if (!fs.existsSync(cfgPath)) return false;
+    const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf8'));
+    return cfg && cfg.experimental && cfg.experimental.pqc_demo === true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Generates runtime-specific entry file content.
  * e.g. replacing "Claude" with "Gemini" in GEMINI.md
@@ -650,9 +669,19 @@ async function install(runtime, scope, options = {}) {
       }
     });
 
-    // ✨ SOVEREIGN INITIALIZATION: Mark project as PQAS & Proactive enabled
+    // ✨ SOVEREIGN INITIALIZATION: report actual security posture honestly.
+    // The PQAS minter is gated SOLELY behind experimental.pqc_demo (see
+    // bin/governance/quantum-crypto.js: getProvider/_assertPqcDemoEnabled). When
+    // that flag is off (the default) PQAS is inert/simulated — claiming it is
+    // "enabled" would contradict the engine and mislead operators (UC-22).
     Theme.printStatus(c.magenta('Sovereign Intelligence v8.2.0 activated'), 'done');
-    Theme.printStatus(c.dim('  - Post-Quantum Agentic Security (PQAS) enabled'), 'info');
+    if (isPqcDemoEnabled(process.cwd())) {
+      Theme.printStatus(c.dim('  - Post-Quantum Agentic Security (PQAS): SIMULATED demo ENABLED '
+        + '(experimental.pqc_demo=true — simulated lattice crypto, NOT production trust)'), 'info');
+    } else {
+      Theme.printStatus(c.dim('  - Post-Quantum Agentic Security (PQAS): available in simulated/experimental '
+        + 'mode (inactive by default — set experimental.pqc_demo=true to enable the simulated demo)'), 'info');
+    }
     Theme.printStatus(c.dim('  - Proactive Semantic Intent Harvesting active'), 'info');
 
     // bin/ utilities (remaining non-engine scripts)

package/bin/memory/eis-client.js

@@ -100,10 +100,48 @@ class EISClient {
     return [];
   }
 
-  // TODO: implement when remote nodes are available
+  /**
+   * Verifies the provenance of a remote knowledge entry by cryptographically
+   * checking its signature against the signer DID's registered public key.
+   *
+   * HONEST / FAIL-CLOSED CONTRACT (UC-22, finding #22): this method NEVER
+   * returns true for a signature it has not actually verified. It returns true
+   * ONLY when ZTAI.verifySignature confirms the signature against a public key
+   * that is resolvable in the local trust registry. Every other case fails
+   * closed → false:
+   *   - no/empty signature,
+   *   - no signer DID on the entry,
+   *   - the DID is not resolvable here (e.g. a genuinely remote peer whose key
+   *     is not in the local registry — there is no remote DID-resolution infra
+   *     yet, see resolveRemoteNode),
+   *   - tampered payload or signature (crypto.verify returns false / throws).
+   *
+   * @param {{did?: string, signedData?: string}} entry - Provenance-bearing entry.
+   *   `did` is the signer's DID; `signedData` is the exact canonical bytes that
+   *   were signed (defaults to a deterministic JSON of the entry if absent).
+   * @param {string} signature - Base64 signature to verify.
+   * @returns {boolean} true only if cryptographically verified; false otherwise.
+   */
   verifyRemoteProvenance(entry, signature) {
-    if (!signature) return false;
-    return true;
+    if (!signature || typeof signature !== 'string') return false;
+    if (!entry || typeof entry !== 'object') return false;
+
+    const did = entry.did;
+    if (!did || typeof did !== 'string') return false;
+
+    // Canonical signed bytes: prefer an explicit signedData field, else a
+    // deterministic JSON of the entry (excluding the signature envelope).
+    const signedData = typeof entry.signedData === 'string'
+      ? entry.signedData
+      : JSON.stringify(entry);
+
+    try {
+      // ZTAI.verifySignature throws for an unresolvable (unregistered) DID —
+      // treat that as fail-closed rather than asserting verified provenance.
+      return ZTAI.verifySignature(did, signedData, signature) === true;
+    } catch {
+      return false;
+    }
   }
 
   // TODO: implement when remote nodes are available
@@ -113,7 +151,10 @@ class EISClient {
 
   /**
    * [HARDEN] Generates a cryptographically signed auth header using the agent's DID.
-   * This ensures verifiable provenance of knowledge within the mesh.
+   * This attaches OUTBOUND provenance to locally-originated requests (it signs
+   * what this node sends). It does NOT verify the provenance of inbound remote
+   * entries — that is verifyRemoteProvenance's job, which fails closed unless a
+   * signature is cryptographically verified against a resolvable public key.
    */
   async getAuthHeader(action, resource) {
     const manager = new ZTAI();

package/bin/memory/vector-hub.js

@@ -56,6 +56,26 @@ class VectorHub {
     }
   }
 
+  /**
+   * Idempotently add a column to an existing table (lightweight migration).
+   * SQLite has no "ADD COLUMN IF NOT EXISTS", so we run the ALTER and swallow
+   * only the "duplicate column name" error — which simply means the column is
+   * already present (the table was created with it, or a prior run added it).
+   * Any other error is re-thrown so genuine schema problems surface loudly.
+   * @param {string} table
+   * @param {string} column
+   * @param {string} typeDecl - e.g. 'TEXT', 'INTEGER DEFAULT 0'
+   */
+  _addColumnIfMissing(table, column, typeDecl) {
+    try {
+      this._db.run(`ALTER TABLE ${table} ADD COLUMN ${column} ${typeDecl}`);
+    } catch (err) {
+      if (!/duplicate column name/i.test(err && err.message)) {
+        throw err;
+      }
+    }
+  }
+
   /**
    * Initialize the WASM SQLite database and create tables + indexes.
    */
@@ -124,11 +144,23 @@ class VectorHub {
         id TEXT PRIMARY KEY,
         request_id TEXT NOT NULL,
         status TEXT NOT NULL,
+        did TEXT,
+        signed_message TEXT,
         attestation_payload TEXT,
         timestamp TEXT NOT NULL
       )
     `);
 
+    // UC-22 (audit finding #2): orbital attestations must carry the signer DID
+    // and the EXACT canonical message that was signed so verify() can re-check
+    // the cryptographic signature instead of trusting status='APPROVED' alone.
+    // CREATE TABLE IF NOT EXISTS won't add columns to a database created before
+    // this fix, so back-fill them with guarded ALTER TABLE statements. SQLite
+    // throws "duplicate column name" when the column already exists — that case
+    // is the success path (already migrated), so it is swallowed.
+    this._addColumnIfMissing('attestations', 'did', 'TEXT');
+    this._addColumnIfMissing('attestations', 'signed_message', 'TEXT');
+
     this._db.run(`
       CREATE TABLE IF NOT EXISTS mesh_config (
         key TEXT PRIMARY KEY,

package/bin/review/finding-synthesizer.js

@@ -6,6 +6,10 @@
 
 const SEVERITY_ORDER = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
 
+// A severity spread of this many levels (or more) within a single location-group
+// is treated as a contradiction (e.g. CRITICAL=3 vs LOW=0 → gap 3).
+const CONTRADICTION_GAP_THRESHOLD = 2;
+
 function synthesizeFindings(reviews) {
   const allFindings = [];
   const modelSpecific = {};
@@ -18,8 +22,9 @@ function synthesizeFindings(reviews) {
     }
   }
 
-  // Detect consensus
+  // Detect consensus and contradictions from the same location-groups.
   const consensus = [];
+  const contradictions = [];
   const processed = new Set();
 
   for (let i = 0; i < allFindings.length; i++) {
@@ -31,7 +36,7 @@ function synthesizeFindings(reviews) {
     for (let j = i + 1; j < allFindings.length; j++) {
       if (processed.has(j)) continue;
       const f2 = allFindings[j];
-      
+
       if (isSameFinding(f1, f2)) {
         group.push(f2);
         processed.add(j);
@@ -45,13 +50,12 @@ function synthesizeFindings(reviews) {
         severity: getHighestSeverity(group.map(f => f.severity)),
         models: group.map(f => f.model),
       });
+
+      const contradiction = detectContradiction(f1.location, group);
+      if (contradiction) contradictions.push(contradiction);
     }
   }
 
-  // Detect contradictions (large severity gap on same finding)
-  const contradictions = [];
-  // (In a real implementation, we'd more deeply analyze conflicting logic)
-
   return {
     consensus,
     model_specific: modelSpecific,
@@ -92,6 +96,31 @@ function normalizeLocation(loc) {
   });
 }
 
+function severityRank(severity) {
+  const idx = SEVERITY_ORDER.indexOf(severity);
+  return idx < 0 ? 0 : idx;
+}
+
+// A location-group is contradictory when its reviews disagree on severity by
+// CONTRADICTION_GAP_THRESHOLD levels or more (e.g. CRITICAL vs LOW). Reuses the
+// already-computed location-group rather than re-deriving it.
+function detectContradiction(location, group) {
+  const ranks = group.map(f => severityRank(f.severity));
+  const maxRank = Math.max(...ranks);
+  const minRank = Math.min(...ranks);
+
+  if (maxRank - minRank < CONTRADICTION_GAP_THRESHOLD) return null;
+
+  return {
+    location,
+    severities: group.map(f => f.severity),
+    models: group.map(f => f.model),
+    description: `Severity disagreement at ${location}: ` +
+      `${SEVERITY_ORDER[minRank]} vs ${SEVERITY_ORDER[maxRank]} ` +
+      `(${maxRank - minRank}-level gap across ${group.length} reviews)`,
+  };
+}
+
 function getHighestSeverity(severities) {
   let highest = 0;
   for (const s of severities) {