mindforge-cc 11.2.0 → 11.3.0

package/bin/browser/regression-writer.js

@@ -10,12 +10,54 @@ function write(bug, phaseNum) {
   const dir = path.join(process.cwd(), 'tests', 'regression');
   fs.mkdirSync(dir, { recursive: true });
   const name = `phase${phaseNum}-${bug.surface.replace(/\//g, '-').slice(1) || 'home'}.test.ts`;
+
+  // Embed the bug's surface and failure signal as safely-escaped JS string
+  // literals. JSON.stringify escapes quotes, backticks and ${...} so a
+  // freeform bug.error cannot break out of the generated source.
+  const surfaceLit = JSON.stringify(bug.surface);
+  const errorLit   = JSON.stringify(bug.error);
+
+  // The generated test reproduces the original failure conditions and asserts
+  // the page no longer exhibits THIS bug's signal — it is NOT a body-visibility
+  // tautology that passes for any page.
   const content = `
 import { test, expect } from '@playwright/test';
 
-test('Regression: ${bug.surface} [${bug.error}]', async ({ page }) => {
-  await page.goto('${bug.surface}');
-  // TODO: Add more specific assertions based on the bug
+// Regression guard for the bug originally observed on ${bug.surface}:
+//   ${String(bug.error).replace(/[\r\n]+/g, ' ')}
+// This test fails again if that failure signal re-appears (console error,
+// page text, or a >=400 HTTP status on the affected surface).
+const SURFACE = ${surfaceLit};
+const BUG_SIGNAL = ${errorLit};
+
+test('Regression: ' + SURFACE + ' [' + BUG_SIGNAL + ']', async ({ page }) => {
+  const consoleErrors: string[] = [];
+  page.on('console', (msg) => {
+    if (msg.type() === 'error') consoleErrors.push(msg.text());
+  });
+  page.on('pageerror', (err) => consoleErrors.push(String(err)));
+
+  const response = await page.goto(SURFACE);
+
+  // 1. The affected surface must load without the original HTTP failure.
+  if (response) {
+    expect(response.status(), 'surface re-returned a failing HTTP status').toBeLessThan(400);
+  }
+
+  // 2. The specific failure signal must not re-appear in the console.
+  expect(
+    consoleErrors.some((line) => line.includes(BUG_SIGNAL)),
+    'console re-emitted the original error: ' + BUG_SIGNAL
+  ).toBeFalsy();
+
+  // 3. ...nor be surfaced in the rendered page text.
+  const bodyText = await page.textContent('body');
+  expect(
+    (bodyText || '').includes(BUG_SIGNAL),
+    'page re-rendered the original error: ' + BUG_SIGNAL
+  ).toBeFalsy();
+
+  // 4. Smoke check: the page actually rendered something.
   expect(await page.isVisible('body')).toBeTruthy();
 });
 `;

package/bin/browser/session-manager.js

@@ -7,7 +7,6 @@
 
 const fs   = require('fs');
 const path = require('path');
-const os   = require('os');
 
 const SESSIONS_DIR = path.join(process.cwd(), '.mindforge', 'browser', 'sessions');
 const ensureDir = () => fs.mkdirSync(SESSIONS_DIR, { recursive: true });
@@ -71,23 +70,28 @@ async function loadSession(name, context) {
   return { cookiesLoaded };
 }
 
+/**
+ * Import cookies/sessions directly from a native browser profile.
+ *
+ * NOT IMPLEMENTED: native browser cookie DB import was removed together with
+ * the `better-sqlite3` dependency (the project now uses sql.js / WASM). Browser
+ * cookie stores are SQLite databases, and decoding them required that native
+ * backend. Rather than silently returning an empty array — which would lie about
+ * capability and let callers mistake "no cookies imported" for success — this
+ * method throws so the missing capability is explicit.
+ *
+ * To populate a session, capture cookies live via a browser context and use
+ * `saveSession` / `loadSession` instead.
+ *
+ * @param {string} source - Browser identifier (chrome, arc, brave, edge).
+ * @throws {Error} Always — native browser cookie import is not implemented.
+ */
 function importFromBrowser(source) {
-  const home = os.homedir();
-  const paths = {
-    chrome: `${home}/Library/Application Support/Google/Chrome/Default/Cookies`,
-    arc: `${home}/Library/Application Support/Arc/User Data/Default/Cookies`,
-    brave: `${home}/Library/Application Support/BraveSoftware/Brave-Browser/Default/Cookies`,
-    edge: `${home}/Library/Application Support/Microsoft Edge/Default/Cookies`,
-  };
-
-  const p = paths[source.toLowerCase()];
-  if (!p || !fs.existsSync(p)) {
-    throw new Error(`Cookie file for ${source} not found at ${p}`);
-  }
-
-  // Real SQLite parsing would happen here via better-sqlite3 if installed.
-  // This is a placeholder for the logic specified in the roadmap.
-  return [];
+  throw new Error(
+    `importFromBrowser not implemented for "${source}": the native browser ` +
+    'cookie-DB backend (better-sqlite3) was removed project-wide. ' +
+    'Capture cookies live via a browser context and use saveSession/loadSession instead.'
+  );
 }
 
 module.exports = { saveSession, loadSession, importFromBrowser };

package/bin/engine/logic-drift-detector.js

@@ -1,9 +1,15 @@
 /**
- * MindForge v6.1.0-alpha — Neural Drift Remediation (NDR)
- * Component: Logic Drift Detector (Pillar X)
- * 
- * Analyzes reasoning traces for "Semantic Decay" (repeated failure patterns, 
- * hallucination-like markers, or mission drift).
+ * MindForge v6.1.0-alpha — Logic Drift Detector (Pillar X)
+ *
+ * HEURISTIC drift detector. Despite the "Pillar X" product naming, this
+ * component does NOT use a neural network, embeddings, or any learned model.
+ * It scores reasoning traces using pure keyword/ratio heuristics:
+ *   - unique-word-to-total ratio (proxy for "rambling")
+ *   - max word-repetition count (proxy for circular reasoning)
+ *   - presence of a small hardcoded list of contradiction phrases
+ *
+ * Flags "Semantic Decay" (repeated failure patterns, contradiction markers,
+ * or mission drift) heuristically. No model inference is performed.
  */
 'use strict';
 
@@ -48,7 +54,9 @@ class LogicDriftDetector {
   }
 
   /**
-   * Internal Heuristic: Detects low semantic density (rambling).
+   * Internal Heuristic: approximates "rambling" via a unique-keyword-to-word
+   * ratio. NOTE: this is NOT a semantic/embedding measure — "density" here is
+   * a plain lexical ratio, not model-derived semantic similarity.
    */
   _calculateSemanticDensity(thought) {
     const words = thought.split(/\s+/).length;

package/bin/engine/logic-validator.js

@@ -1,67 +1,197 @@
 /**
  * MindForge v7 — Neural Drift Remediation (NDR)
  * Component: Logic Validator
- * 
+ *
  * Performs high-level semantic validation on agent reasoning traces.
- * Supports Local Model (Ollama) integration and Self-Reflective Heuristics.
+ *
+ * Strategy: real-when-available, else honest heuristic.
+ *   - By DEFAULT this validator uses a local Self-Reflective Heuristic
+ *     (`_reflectiveHeuristic`). This is the standard path and runs everywhere,
+ *     with no external dependency.
+ *   - OPTIONALLY, if a local Ollama model is actually reachable at the
+ *     configured endpoint, validation is upgraded to a real model call
+ *     (`_modelValidation`). Reachability is determined by a real, fail-fast
+ *     network probe — never a hardcoded flag. When Ollama is absent (the
+ *     normal case) the probe fails fast and we fall back to the heuristic.
+ *
+ * The return shape is stable: { is_valid, confidence, critique, method }.
+ * Consumers (nexus-tracer) read `is_valid` and `critique`.
  */
 'use strict';
 
 const configManager = require('../governance/config-manager');
 
+// Fail-fast budget for the reachability probe and the model call. Ollama is
+// usually absent, so this must time out quickly to avoid hanging CI/production.
+const PROBE_TIMEOUT_MS = 400;
+const MODEL_TIMEOUT_MS = 4000;
+
 class LogicValidator {
   constructor() {
     this.endpoint = configManager.get('governance.local_model_endpoint', 'localhost:11434');
-    this.isModelAvailable = false; // Simulated check result
+    this.model = configManager.get('governance.local_model_name', 'llama3');
+    // Reflects reality: set by probeModel(), not hardcoded. Unknown until probed.
+    this.isModelAvailable = false;
+    this._probed = false;
+  }
+
+  /**
+   * Normalises the configured endpoint into a base URL (adds scheme if absent).
+   * @returns {string}
+   */
+  _baseUrl() {
+    const ep = String(this.endpoint || 'localhost:11434').trim();
+    return /^https?:\/\//i.test(ep) ? ep.replace(/\/+$/, '') : `http://${ep.replace(/\/+$/, '')}`;
+  }
+
+  /**
+   * Resets cached probe state (used by tests to re-probe after changing endpoint).
+   */
+  resetProbe() {
+    this._probed = false;
+    this.isModelAvailable = false;
+  }
+
+  /**
+   * Real, fail-fast reachability check for a local Ollama instance.
+   * Performs a short GET to the Ollama tags endpoint. On ANY error or timeout
+   * (the normal case when Ollama is absent) it resolves `false` — never throws,
+   * never hangs. Sets `this.isModelAvailable` from the actual result.
+   * @returns {Promise<boolean>}
+   */
+  async probeModel() {
+    let reachable = false;
+    try {
+      const res = await fetch(`${this._baseUrl()}/api/tags`, {
+        method: 'GET',
+        signal: AbortSignal.timeout(PROBE_TIMEOUT_MS)
+      });
+      reachable = res.ok;
+    } catch {
+      // ECONNREFUSED / timeout / DNS / abort — Ollama not reachable. Stay quiet.
+      reachable = false;
+    }
+    this.isModelAvailable = reachable;
+    this._probed = true;
+    return reachable;
   }
 
   /**
    * Validates a reasoning trace using the best available method.
+   * Probes for a local model on first call (lazy); falls back to the heuristic
+   * when unreachable.
    * @param {string} thought - The agent's thought string
    * @param {Object} context - Optional metadata (span attributes, etc.)
    */
   async validate(thought, context = {}) {
-    console.log(`[LogicValidator] Validating trace segment (Length: ${thought.length})`);
+    const spanTag = context && context.span_id ? ` span=${context.span_id}` : '';
+    console.log(`[LogicValidator] Validating trace segment (Length: ${thought.length})${spanTag}`);
+
+    if (!this._probed) {
+      await this.probeModel();
+    }
 
-    // In a real v7 deployment, we would perform an asynchronous fetch to Ollama/Llama-CPP
-    // For this simulation, we simulate a "Reflective Heuristic" analysis.
-    
     if (this.isModelAvailable) {
-      return this._modelValidation(thought, context);
-    } else {
-      return this._reflectiveHeuristic(thought, context);
+      try {
+        return await this._modelValidation(thought);
+      } catch {
+        // Model became unreachable mid-flight — degrade honestly to heuristic.
+        this.isModelAvailable = false;
+        return this._reflectiveHeuristic(thought);
+      }
     }
+    return this._reflectiveHeuristic(thought);
   }
 
   /**
-   * Simulated Local Model Validation logic.
+   * Real Local Model Validation via Ollama's /api/generate.
+   * Asks the model whether the thought is logical and grounded, then derives a
+   * real is_valid/confidence from the response — no fabricated fixed values.
    */
-  async _modelValidation(thought, context) {
-    // Mocking an LLM callback: "Is this thought logical and grounded?"
-    const result = {
-      is_valid: true,
-      confidence: 0.98,
-      critique: 'Logic is consistent with project goals.',
-      method: 'Ollama/Llama-3-8B'
+  async _modelValidation(thought) {
+    const prompt =
+      'You are a reasoning-trace auditor. Decide whether the following agent ' +
+      'thought is logical and grounded (consistent, on-task, no self-contradiction).\n' +
+      'Reply with ONLY a JSON object: {"valid": <true|false>, "confidence": <0..1>, ' +
+      '"critique": "<short reason>"}.\n\n' +
+      `Thought: """${thought}"""`;
+
+    const res = await fetch(`${this._baseUrl()}/api/generate`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ model: this.model, prompt, stream: false }),
+      signal: AbortSignal.timeout(MODEL_TIMEOUT_MS)
+    });
+
+    if (!res.ok) {
+      throw new Error(`Ollama responded ${res.status}`);
+    }
+
+    const payload = await res.json();
+    const parsed = this._parseModelResponse(payload && payload.response);
+
+    return {
+      is_valid: parsed.valid,
+      confidence: parsed.confidence,
+      critique: parsed.critique,
+      method: `ollama:${this.model}`
+    };
+  }
+
+  /**
+   * Robustly parses the model's textual response into a verdict. Falls back to
+   * conservative defaults derived from the raw text when JSON is unavailable —
+   * never invents a fixed high-confidence pass.
+   * @param {string} raw
+   */
+  _parseModelResponse(raw) {
+    const text = String(raw || '');
+    const match = text.match(/\{[\s\S]*\}/);
+    if (match) {
+      try {
+        const obj = JSON.parse(match[0]);
+        const valid = obj.valid === true || obj.valid === 'true';
+        let confidence = Number(obj.confidence);
+        if (!Number.isFinite(confidence)) confidence = valid ? 0.6 : 0.4;
+        confidence = Math.min(1, Math.max(0, confidence));
+        const critique = typeof obj.critique === 'string' && obj.critique.trim()
+          ? obj.critique.trim()
+          : (valid ? 'Model judged the thought logical and grounded.'
+                   : 'Model flagged the thought as illogical or ungrounded.');
+        return { valid, confidence, critique };
+      } catch {
+        // fall through to text heuristic below
+      }
+    }
+
+    // No parseable JSON: derive a conservative verdict from the raw text.
+    const lowered = text.toLowerCase();
+    const valid = !/(invalid|illogical|not\s+grounded|inconsistent|"valid"\s*:\s*false)/.test(lowered)
+      && /(valid|logical|grounded|consistent)/.test(lowered);
+    return {
+      valid,
+      confidence: valid ? 0.55 : 0.45,
+      critique: 'Model response was unstructured; verdict derived from text.'
     };
-    return result;
   }
 
   /**
-   * Advanced "Reflective Heuristic" which is more intensive than the DriftDetector.
+   * Local Self-Reflective Heuristic — the default validation path. More
+   * intensive than the DriftDetector; uses self-doubt and goal-misalignment
+   * markers. Honestly labelled as a heuristic (no model is involved here).
    */
-  async _reflectiveHeuristic(thought, context) {
-    const t = thought.toLowerCase();
-    
+  async _reflectiveHeuristic(thought) {
+    const t = String(thought || '').toLowerCase();
+
     // Check for "Self-Doubt" markers that might indicate drift
     const doubtMarkers = ['i am not sure', 'maybe i should wait', 'actually, i forgot', 'i will instead try to just'];
     const doubtCount = doubtMarkers.filter(m => t.includes(m)).length;
 
-    // Check for "Goal Misalignment" (Simulated)
+    // Check for "Goal Misalignment"
     const goalMismatch = t.includes('ignoring current goal') || t.includes('outside scope');
 
     const score = 1.0 - (doubtCount * 0.2) - (goalMismatch ? 0.5 : 0);
-    
+
     return {
       is_valid: score > 0.6,
       confidence: parseFloat(score.toFixed(2)),

package/bin/engine/orbital-guardian.js

@@ -35,26 +35,43 @@ class OrbitalGuardian {
       throw new Error(`[ORBITAL-GUARDIAN] DID ${did} has insufficient Trust Tier for Orbital Attestation.`);
     }
 
-    // 1. Sign the attestation payload using the Hardware Enclave provider
-    const attestationPayload = await ztaiManager.signData(did, JSON.stringify({
+    // 1. Build the EXACT canonical message and sign it with the agent's key.
+    //    UC-22: this canonical string is persisted verbatim alongside the DID so
+    //    verify() can re-verify the signature later. We must store the precise
+    //    bytes that were signed — recomputing them (e.g. with a fresh timestamp)
+    //    would never verify — so capture the message once, here, and reuse it.
+    const signedMessage = JSON.stringify({
       requestId,
       payload,
       timestamp: new Date().toISOString()
-    }));
+    });
+    const signature = await ztaiManager.signData(did, signedMessage);
 
     const attestation = {
       id: `att_${crypto.randomBytes(4).toString('hex')}`,
       request_id: requestId,
       status: 'APPROVED',
-      attestation_payload: attestationPayload,
+      did,
+      signed_message: signedMessage,
+      attestation_payload: signature,
       timestamp: new Date().toISOString()
     };
 
-    // 2. Persist to SQLite (Source of truth for v8 Governance Dashboard)
+    // 2. Persist to SQLite (Source of truth for v8 Governance Dashboard).
+    //    did + signed_message + signature together let verify() re-check the
+    //    cryptographic signature; status='APPROVED' alone is NOT trusted.
     vectorHub.run(
-      `INSERT INTO attestations (id, request_id, status, attestation_payload, timestamp)
-       VALUES (?, ?, ?, ?, ?)`,
-      [attestation.id, attestation.request_id, attestation.status, attestation.attestation_payload, attestation.timestamp]
+      `INSERT INTO attestations (id, request_id, status, did, signed_message, attestation_payload, timestamp)
+       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      [
+        attestation.id,
+        attestation.request_id,
+        attestation.status,
+        attestation.did,
+        attestation.signed_message,
+        attestation.attestation_payload,
+        attestation.timestamp
+      ]
     );
 
     console.log(`[ORBITAL-GUARDIAN] Attestation SUCCESS: ${attestation.id}`);
@@ -63,9 +80,16 @@ class OrbitalGuardian {
 
   /**
    * Verifies if a request has a valid hardware bypass.
+   *
+   * UC-22 (audit finding #2): an APPROVED row is NOT trusted on its own. The
+   * stored signature is re-verified against the signer's registered public key
+   * over the EXACT canonical message that attest() signed. Anyone who forges an
+   * APPROVED row but cannot produce a valid signature is rejected. The check is
+   * fail-closed: a missing field, an unregistered/revoked DID, or any thrown
+   * error all resolve to { verified:false }.
    */
   async verify(requestId) {
-    if (!requestId) return { verified: false };
+    if (!requestId) return { verified: false, reason: 'missing requestId' };
     await this.ensureInit();
 
     const results = vectorHub.query(
@@ -74,7 +98,29 @@ class OrbitalGuardian {
     );
 
     const record = results[0];
-    if (!record) return { verified: false };
+    if (!record) return { verified: false, reason: 'no APPROVED attestation found' };
+
+    // Re-verify the cryptographic signature. Without a DID, the canonical signed
+    // message, AND a signature we cannot prove the row was produced by attest().
+    if (!record.did || !record.signed_message || !record.attestation_payload) {
+      return { verified: false, reason: 'attestation missing signature material' };
+    }
+
+    let signatureValid = false;
+    try {
+      signatureValid = ztaiManager.verifySignature(
+        record.did,
+        record.signed_message,
+        record.attestation_payload
+      );
+    } catch (err) {
+      // Unregistered/revoked DID or malformed signature → fail closed.
+      return { verified: false, reason: `signature verification error: ${err.message}` };
+    }
+
+    if (!signatureValid) {
+      return { verified: false, reason: 'signature verification failed' };
+    }
 
     return {
       verified: true,

package/bin/engine/reason-source-aligner.js

@@ -45,7 +45,17 @@ class ReasonSourceAligner {
    * @returns {Object} - Alignment results.
    */
   checkAlignment(thought) {
-    if (!this.initialized) return { score: 1.0, reason: 'uninitialized' }; // Fail-safe stable
+    // Fail-safe stable: when no requirements are loaded we CANNOT assess
+    // alignment, so we honestly decline rather than assert perfect alignment.
+    // Returning the SAME shape as the normal branch means the sole caller
+    // (auto-runner.checkMissionFidelity) reads a real boolean instead of
+    // `undefined`, so the mission-fidelity gate is no longer silently disabled.
+    // is_aligned:false is the safe direction — the caller only injects a
+    // correction when is_aligned is truthy, so an honest "can't assess" simply
+    // does nothing (no false correction, no silent shape mismatch).
+    if (!this.initialized) {
+      return { is_aligned: false, best_match_id: null, confidence: 0, status: 'uninitialized' };
+    }
 
     const alignmentScores = this.registry.map(req => {
       const score = this._calculateSimilarity(thought, req.summary + ' ' + req.description);
@@ -58,6 +68,7 @@ class ReasonSourceAligner {
       is_aligned: bestMatch ? bestMatch.score > 0.25 : false, // Sparse mapping allowed
       best_match_id: bestMatch ? bestMatch.id : null,
       confidence: bestMatch ? parseFloat(bestMatch.score.toFixed(4)) : 0,
+      status: 'assessed',
     };
   }
 
@@ -82,19 +93,21 @@ class ReasonSourceAligner {
   }
 
   /**
-   * Similarity Heuristic (Keyword-based overlap)
+   * Keyword-based overlap heuristic (Jaccard similarity).
+   * NOTE: This is a token-overlap heuristic, NOT semantic embeddings.
+   * Returns |A ∩ B| / |A ∪ B| in [0, 1].
    */
   _calculateSimilarity(a, b) {
     const getTokens = (str) => new Set(str.toLowerCase().replace(/[^\w\s]/g, '').split(/\s+/).filter(t => t.length > 3));
     const tokensA = getTokens(a);
     const tokensB = getTokens(b);
-    
+
     if (tokensA.size === 0 || tokensB.size === 0) return 0;
-    
+
     const intersection = new Set([...tokensA].filter(x => tokensB.has(x)));
     const union = new Set([...tokensA, ...tokensB]);
-    
-    return intersection.size / tokensA.size; // Weighted by thought coverage
+
+    return intersection.size / union.size; // Jaccard: overlap over combined vocabulary
   }
 
   /**

package/bin/engine/remediation-engine.js

@@ -1,5 +1,5 @@
 /**
- * MindForge v11.1.0 — Neural Drift Remediation (NDR)
+ * MindForge v11.2.0 — Neural Drift Remediation (NDR)
  * Component: Remediation Engine (Pillar X)
  *
  * Triggers corrective actions when logic drift or reasoning

package/bin/engine/self-corrective-synthesizer.js

@@ -1,5 +1,5 @@
 /**
- * MindForge v11.1.0 — Self-Corrective Synthesis (SCS)
+ * MindForge v11.2.0 — Self-Corrective Synthesis (SCS)
  * Component: Self-Corrective Synthesizer (Pillar XII)
  *
  * Analyzes mission drift and logic stagnation to synthesize

package/bin/engine/sre-manager.js

@@ -47,12 +47,22 @@ class SREManager {
   }
 
   /**
-   * Sanitizes a thought chain and generates a ZK-Proof Compliance Certificate.
-   * Ensures that sensitive IP or "zero-visibility" thoughts are isolated while proving audit-eligibility.
+   * Sanitizes a thought chain and generates an HMAC integrity certificate.
+   *
+   * IMPORTANT — HONEST LABELING: This is NOT a zero-knowledge proof. The
+   * artifact is an HMAC-SHA256 tag computed with a process-local shared secret
+   * (EPHEMERAL_ENCLAVE_KEY). It provides tamper-evidence/integrity over the
+   * proof payload, but:
+   *   - any party holding the key can forge it (symmetric MAC, not asymmetric),
+   *   - the payload carries the plaintext sha256(thoughtChain) digest, so it is
+   *     not "zero-visibility".
+   * The enclave is simulated (no hardware TEE). Consumers must treat the
+   * returned object as an integrity tag, not a cryptographic ZK proof.
+   *
    * @param {string} thoughtChain - The raw agentic thought chain.
    * @param {string} enclaveId - The active enclave ID.
    * @param {Object} policyResult - Whether the content passed internal policy checks.
-   * @returns {Object} - ZK-Proof compliance certificate.
+   * @returns {Object} - HMAC integrity certificate (simulated enclave).
    */
   sanitizeThoughtChain(thoughtChain, enclaveId, policyResult = { passed: true }) {
     if (!this.activeEnclaves.has(enclaveId)) {
@@ -64,7 +74,7 @@ class SREManager {
     const prevHash = enclaveData.cumulativeHash;
     const digest = crypto.createHash('sha256').update(thoughtChain).digest('hex');
     
-    // Generate a simulated ZK-Proof Compliance Certificate
+    // Generate a simulated-enclave HMAC integrity certificate (NOT a ZK proof)
     const proofPayload = {
       enclaveId: enclaveId,
       digest: digest,
@@ -85,19 +95,36 @@ class SREManager {
 
     const certificate = {
       status: 'SRE-ISOLATED',
+      // Honest labeling: this is a symmetric HMAC integrity tag, not a ZK proof.
+      type: 'hmac-integrity-certificate',
+      method: 'hmac-sha256-integrity',
+      simulated: true,
+      zeroKnowledge: false,
+      disclosure: 'HMAC integrity tag (simulated enclave; NOT a zero-knowledge proof). '
+        + 'Forgeable by any holder of the shared enclave key; payload carries the plaintext sha256(thought) digest.',
       proof: proofPayload,
       signature: signature,
       proofHash: proofHash,
       verificationDid: SYSTEM_DID,
-      message: `[SRE-ZK-PROOF] Confidential reasoning (sha256:${digest.substring(0, 8)}...) verified by Enclave Auditor.`
+      message: `[SRE-HMAC] HMAC integrity tag for confidential reasoning (sha256:${digest.substring(0, 8)}...) `
+        + 'in simulated enclave — NOT a zero-knowledge proof.'
     };
 
     return certificate;
   }
 
   /**
-   * Verifies an SRE Compliance Certificate without seeing the original content.
+   * Verifies an SRE integrity certificate's HMAC tag and policy flag.
+   *
+   * NOTE — HONEST LABELING: this recomputes the HMAC-SHA256 tag using the
+   * shared enclave key and compares it. It is symmetric MAC verification, NOT
+   * zero-knowledge verification. The method name is retained for API
+   * compatibility with existing callers; see verifyIntegrityCertificate alias.
    */
+  verifyIntegrityCertificate(certificate) {
+    return this.verifyZKProof(certificate);
+  }
+
   verifyZKProof(certificate) {
     if (certificate.status !== 'SRE-ISOLATED') return false;
 

package/bin/governance/policy-engine.js

@@ -92,10 +92,14 @@ class PolicyEngine {
             return verdict;
           }
 
-          // [ENTERPRISE] Tier 3 Reasoning/PQ Proof Bypass
+          // [ENTERPRISE] Tier 3 Sovereign Proof Bypass (fail-closed).
+          // A blast-radius override demands a CRYPTOGRAPHIC proof. Only a
+          // pq_proof verified via verifyZKProof may authorize the bypass.
+          // intent.reasoning_proof is free-form text validated nowhere, so it
+          // MUST NOT, on its own, grant an override (UC-22 authz bypass fix).
           if (intent.tier >= 3 && (intent.reasoning_proof || intent.pq_proof)) {
              const quantumCrypto = require('./quantum-crypto');
-             let isProofValid = true;
+             let isProofValid = false; // fail-closed: deny unless a real proof verifies
 
              if (intent.pq_proof) {
                const zkResult = quantumCrypto.verifyZKProof(intent.pq_proof, intent.id);
@@ -106,12 +110,21 @@ class PolicyEngine {
              }
 
              if (isProofValid) {
-                console.log(`[APO-BYPASS] [${requestId}] Tier 3 'Sovereign Proof' verified (${intent.pq_proof ? 'ZK-PQ' : 'Standard'}). Overriding Blast Radius limit.`);
+                console.log(`[APO-BYPASS] [${requestId}] Tier 3 'Sovereign Proof' verified (ZK-PQ). Overriding Blast Radius limit.`);
                 // Continue to permit check
-             } else {
+             } else if (intent.pq_proof) {
                 verdict = { verdict: 'DENY', reason: 'ZK proof verification failed. Configure a verifier module or provide a valid proof.', requestId };
                 this.logAudit(intent, impactScore, verdict);
                 return verdict;
+             } else {
+                // Only a reasoning_proof was supplied — not a cryptographic proof.
+                verdict = {
+                  verdict: 'DENY',
+                  reason: 'reasoning_proof is not a cryptographic proof; provide a valid pq_proof / Sovereign Proof for blast-radius override.',
+                  requestId
+                };
+                this.logAudit(intent, impactScore, verdict);
+                return verdict;
              }
           } else {
             verdict = {