nsauditor-ai 0.2.56 → 0.2.57

package/utils/sarif.mjs

@@ -2,6 +2,7 @@
 // Generate SARIF 2.1.0 output from nsauditor scan results.
 
 import { createRequire } from 'node:module';
+import { flagFindings, conclusionFindings, OPEN_SERVICE_SEVERITY } from './service_flags.mjs';
 const require = createRequire(import.meta.url);
 const { version: TOOL_VERSION } = require('../package.json');
 
@@ -35,13 +36,12 @@ function ruleIdFromService(svc) {
 }
 
 /**
- * Infer severity from a service's status and other indicators.
- * @param {object} svc
+ * The "service detected" result's grade: OPEN_SERVICE_SEVERITY from the shared table (1.3.0 (s2)) — an open port is
+ * inventory, never a warning of its own. A service that is not open is never graded above it.
  * @returns {string}
  */
-function inferServiceSeverity(svc) {
-  if (svc.status === 'open') return 'Medium';
-  return 'Info';
+function inferServiceSeverity() {
+  return OPEN_SERVICE_SEVERITY;
 }
 
 /**
@@ -62,101 +62,31 @@ function buildServiceMessage(svc, host) {
 }
 
 /**
- * Build SARIF result entries for security findings on a service.
- * @param {object} svc
+ * SARIF rule + result entries for graded findings. Every grade comes from the shared service-flag table
+ * (utils/service_flags.mjs, 1.3.0 (s1)); the rule ids of the four flags SARIF graded before 1.3.0 are unchanged, since a
+ * code-scanning alert is keyed on its rule id.
+ * @param {object[]} findings - from the table, each with key/severity/title/ruleId/evidence
  * @param {string} host
+ * @param {string} where - the location text in the message (host:port/protocol, or the host for an evidence payload)
  * @returns {{ results: object[], rules: object[] }}
  */
-function securityFindingsFromService(svc, host) {
+function sarifEntries(findings, host, where) {
   const results = [];
   const rules = [];
-
-  const makeResult = (ruleId, level, message) => ({
-    ruleId,
-    level,
-    message: { text: message },
-    locations: [{
-      physicalLocation: {
-        artifactLocation: { uri: host }
-      }
-    }]
-  });
-
-  // anonymousLogin: true
-  if (svc.anonymousLogin === true) {
-    const ruleId = 'ftp-anonymous-login';
+  for (const f of findings) {
     rules.push({
-      id: ruleId,
-      shortDescription: { text: 'FTP anonymous login enabled' },
-      helpUri: `${TOOL_URI}`,
-      properties: { severity: 'Critical' }
+      id: f.ruleId,
+      shortDescription: { text: f.key === 'cves' ? `Known vulnerability: ${f.ruleId}` : f.title },
+      helpUri: f.key === 'cves' ? `https://nvd.nist.gov/vuln/detail/${f.ruleId}` : TOOL_URI,
+      properties: { severity: f.severity }
     });
-    results.push(makeResult(ruleId, 'error',
-      `FTP anonymous login is enabled on ${host}:${svc.port}. This allows unauthenticated access to the FTP server.`));
-  }
-
-  // axfrAllowed: true
-  if (svc.axfrAllowed === true) {
-    const ruleId = 'dns-zone-transfer';
-    rules.push({
-      id: ruleId,
-      shortDescription: { text: 'DNS zone transfer (AXFR) allowed' },
-      helpUri: `${TOOL_URI}`,
-      properties: { severity: 'Critical' }
+    results.push({
+      ruleId: f.ruleId,
+      level: severityToLevel(f.severity),
+      message: { text: `${f.title} on ${where}.${f.evidence ? ` ${f.evidence}` : ''}` },
+      locations: [{ physicalLocation: { artifactLocation: { uri: host } } }]
     });
-    results.push(makeResult(ruleId, 'error',
-      `DNS zone transfer (AXFR) is allowed on ${host}:${svc.port}. This can expose the entire DNS zone to attackers.`));
-  }
-
-  // weakAlgorithms: [...]
-  if (Array.isArray(svc.weakAlgorithms) && svc.weakAlgorithms.length > 0) {
-    for (const algo of svc.weakAlgorithms) {
-      const algoName = typeof algo === 'string' ? algo : (algo?.algorithm || algo?.name || String(algo));
-      const ruleId = `weak-algorithm-${algoName.replace(/[^a-zA-Z0-9._-]/g, '-')}`;
-      rules.push({
-        id: ruleId,
-        shortDescription: { text: `Weak algorithm: ${algoName}` },
-        helpUri: `${TOOL_URI}`,
-        properties: { severity: 'Medium' }
-      });
-      results.push(makeResult(ruleId, 'warning',
-        `Weak algorithm "${algoName}" is supported on ${host}:${svc.port}/${svc.protocol || 'tcp'}.`));
-    }
   }
-
-  // dangerousMethods: [...]
-  if (Array.isArray(svc.dangerousMethods) && svc.dangerousMethods.length > 0) {
-    for (const method of svc.dangerousMethods) {
-      const ruleId = `http-dangerous-method-${String(method).toLowerCase()}`;
-      rules.push({
-        id: ruleId,
-        shortDescription: { text: `Dangerous HTTP method: ${method}` },
-        helpUri: `${TOOL_URI}`,
-        properties: { severity: 'Medium' }
-      });
-      results.push(makeResult(ruleId, 'warning',
-        `Dangerous HTTP method "${method}" is allowed on ${host}:${svc.port}.`));
-    }
-  }
-
-  // CVE data (if service has cves or cve array)
-  const cves = svc.cves || svc.cve || [];
-  if (Array.isArray(cves)) {
-    for (const cve of cves) {
-      const cveId = typeof cve === 'string' ? cve : (cve?.id || cve?.cveId || String(cve));
-      const cveSeverity = cve?.severity || 'High';
-      const ruleId = cveId;
-      rules.push({
-        id: ruleId,
-        shortDescription: { text: `Known vulnerability: ${cveId}` },
-        helpUri: `https://nvd.nist.gov/vuln/detail/${cveId}`,
-        properties: { severity: cveSeverity }
-      });
-      results.push(makeResult(ruleId, severityToLevel(cveSeverity),
-        `${cveId} affects ${svc.program || svc.service}${svc.version && svc.version !== 'Unknown' ? ' ' + svc.version : ''} on ${host}:${svc.port}.`));
-    }
-  }
-
   return { results, rules };
 }
 
@@ -175,7 +105,7 @@ export function buildSarifLog(scanData) {
   for (const svc of services) {
     // Base service result
     const ruleId = ruleIdFromService(svc);
-    const severity = inferServiceSeverity(svc);
+    const severity = inferServiceSeverity();
     const level = severityToLevel(severity);
     const message = buildServiceMessage(svc, host);
 
@@ -200,13 +130,23 @@ export function buildSarifLog(scanData) {
     });
 
     // Security findings
-    const { results: secResults, rules: secRules } = securityFindingsFromService(svc, host);
+    const where = `${host}:${svc.port}/${svc.protocol || 'tcp'}`;
+    const { results: secResults, rules: secRules } = sarifEntries(flagFindings(svc, { target: where }), host, where);
     for (const sr of secResults) sarifResults.push(sr);
     for (const rule of secRules) {
       if (!rulesMap.has(rule.id)) rulesMap.set(rule.id, rule);
     }
   }
 
+  // An adapter payload that landed in EVIDENCE (no port — a domain's DNS posture when no 53/udp service was found) is
+  // graded too, located at the host: its grade must not depend on whether an unrelated port answered.
+  const onEvidence = conclusionFindings({ evidence: conclusion?.result?.evidence ?? [] }, host);
+  const { results: evResults, rules: evRules } = sarifEntries(onEvidence, host, String(host));
+  for (const sr of evResults) sarifResults.push(sr);
+  for (const rule of evRules) {
+    if (!rulesMap.has(rule.id)) rulesMap.set(rule.id, rule);
+  }
+
   return {
     $schema: SARIF_SCHEMA,
     version: SARIF_VERSION,

package/utils/scan_delta.mjs

@@ -18,10 +18,11 @@
 // A finding may be called RESOLVED only when its host, plugin, scope and framework enumeration
 // were in scope in BOTH runs. Otherwise it goes to NOT-COMPARABLE **with its reason** — never
 // into `resolved`, and never silently dropped.
-// ⚠️ 1.2.0 limit, boarded for 1.2.1: "plugin" is a PLUGIN row's own producer. An analysis agent's or the
-// CVE mapper's row is derived from other plugins' output, and whether those were requested in both runs
-// is NOT checked — narrow `--plugins` in one run and such a row goes into `resolved` (or `new`).
-// AGENT_SCOPE_FROM_TIER discloses it; tests/build6_delta_scope_honesty.test.mjs pins it until the check exists.
+// "plugin" is a PLUGIN row's own producer. An analysis agent's or the CVE mapper's row is derived from other
+// plugins' output: from Enterprise 1.3.0 a scan that left one of those plugins out RECORDS it (an input-gap record),
+// and the producer-gap leg refuses the row. A run made before EE 1.3.0 could not record that, so against one such a
+// row still goes into `resolved` (or `new`) — the legacy limit. AGENT_SCOPE_FROM_TIER and the row's Basis cell
+// disclose it; tests/build6_delta_scope_honesty.test.mjs pins both pairs.
 // Integrity is a fact about BYTES ON DISK, so the caller measures it with `utils/run_chain.mjs`
 // and passes the verdict in. Keeping it out of this module means the comparability rules can be
 // driven without a filesystem, and the chain can be driven without the delta.
@@ -109,6 +110,23 @@ export const isUdpTransport = (label) => typeof label === 'string' && TRANSPORT_
 // The queue producer whose rows are CVE matches over a service's IDENTITY (program + version). Community cannot import
 // Enterprise, so the name is declared here and Enterprise's test holds it equal to its `INTELLIGENCE_ENGINE_SOURCE`.
 export const CVE_MAPPER_PRODUCER = 'intelligence_engine';
+// THE PRODUCERS THAT ATTRIBUTE ON A SERVICE'S IDENTITY (1.3.0, lane 6 — F2 (b)). Each writes a row only for a service
+// whose program AND version it can read — the CVE mapper matches CVEs on them, Enterprise's service agent judges
+// end-of-life on them — so a service the run could not identify gives it nothing to attribute, and its silence there
+// is not a measurement. Read at exactly two sites: `tcpServiceMeasurement`'s producer branch, and the delta's reach gate
+// that calls it for a TCP port the other run saw open. The mapper's other sites (its lookup gaps and notes,
+// `vulnerability-data-changed`, the "newly attributed" basis note) are CVE semantics and do NOT read this set.
+// Each member names its own row in the refusal sentence; the set is this table's keys, so no member lacks one.
+const IDENTIFYING_ROW = Object.freeze({
+  [CVE_MAPPER_PRODUCER]: Object.freeze({ row: 'a CVE row', denied: 'the CVE mapper nothing to match' }),
+  service_agent: Object.freeze({ row: 'an end-of-life row', denied: 'the service agent nothing to judge' }),
+});
+export const IDENTIFYING_PRODUCERS = Object.freeze(Object.keys(IDENTIFYING_ROW));
+// THE RELEASE THAT ADDED THE NOT-REQUESTED CAUSE (1.3.0, lane 6 — F2). From EE 1.3.0 an analysis agent whose input plugin
+// was LEFT OUT of the scan records an input-gap record, so its rows there are refused; a run before it could not record
+// that (its input-gap record, since EE 1.1.0 build 5, covered a plugin that was requested and did not complete). The
+// client's Basis cell keys its legacy sentence on this, through `cmpVersion`, against the run that LACKS the row.
+export const NOT_REQUESTED_RECORD_SINCE_EE = '1.3.0';
 const identified = (program) => typeof program === 'string' && program.trim() !== '' && program.trim().toLowerCase() !== 'unknown';
 
 /**
@@ -155,6 +173,39 @@ export function udpPortMeasurement(port, producer, services, runName = 'the othe
   const who = identified(s.program) ? ` · ${s.program}${s.version ? ` ${s.version}` : ''}` : '';
   return { measured: true, basis: `${port}/udp answered in ${runName} (${s.service ?? s.protocol} open${who})` };
 }
+/**
+ * WAS THIS TCP SERVICE MEASURED IN A RUN, FOR THIS PRODUCER? (1.3.0, lane 6 — the TCP-unidentified sibling of F2.) The ONE
+ * decision the delta and Enterprise's MTTR call for a TCP port the run's port scanner saw OPEN; `services` is that run's
+ * service set, every transport (the loader's `servicesOf`), or null when it recorded none.
+ *
+ * - an analysis agent outside `IDENTIFYING_PRODUCERS` → MEASURED: it reads the fields its probes filled, so an open
+ *   port is enough (as for UDP).
+ * - an IDENTIFYING producer (the CVE mapper, the service agent) → MEASURED only when an open TCP-transport record on the
+ *   port carries an IDENTITY — a program AND a version (`identityOf`). Each writes nothing for a service it cannot
+ *   identify, so a port that answered without one gives it nothing to attribute. MEASURED through the real concluder:
+ *   with the SSH probe (002) left out, 22/tcp concludes `Unknown` / `Unknown`, and every CVE row on it read RESOLVED —
+ *   and every end-of-life row the service agent had written there.
+ * - no service set at all → `measured: null` (NO ORACLE) — never false: a TCP row with no oracle stays outside, as the TCP
+ *   port rule does without 003. A UDP record never stands in for TCP.
+ * `runName` has NO default: every caller names the run absolutely (the delta its frame's name, MTTR "this scan"), and a
+ * relative default is what tests/delta_run_names_absolute.test.mjs allows exactly once, for udpPortMeasurement.
+ *
+ * @returns {{measured: true, basis: string} | {measured: false, kind: 'unidentified', why: string} | {measured: null, kind: 'no-oracle', why: string}}
+ */
+export function tcpServiceMeasurement(port, producer, services, runName) {
+  if (!Array.isArray(services)) {
+    return { measured: null, kind: 'no-oracle', why: `${runName} recorded no service set, so nothing says what answered there` };
+  }
+  if (!IDENTIFYING_PRODUCERS.includes(producer)) return { measured: true, basis: `${port}/tcp open in ${runName}` };
+  const open = services.filter((s) => Number(s?.port) === Number(port) && transportOf(s?.protocol) === 'tcp' && s?.status === 'open');
+  const id = open.map((s) => ({ s, id: identityOf(s.program, s.version) })).find((x) => x.id);
+  if (id) return { measured: true, basis: `${port}/tcp answered in ${runName} (${id.s.service ?? id.s.protocol} open · ${id.id.program} ${id.id.version})` };
+  const s = open[0];
+  const shown = (v) => (identified(v) ? v : 'absent');
+  return { measured: false, kind: 'unidentified', why: s
+    ? `in ${runName} the TCP service on that port answered but was not identified (program ${shown(s.program)}, version ${shown(s.version)})`
+    : `in ${runName} the port was open but no TCP service record on it carries a program and a version` };
+}
 // ⚠️ A CVE ROW THAT VANISHED WHILE THE SAME PROGRAM AND VERSION STILL ANSWER WAS NOT FIXED (1.2.0 build 2 — the audit
 // seat's ruling on the build-1 smoke). The CVE mapper attributes a CVE on (program, version) alone, so a row present in
 // one run only while the IDENTIFIED program AND version at that host:port:transport are the same in both runs cannot
@@ -189,6 +240,38 @@ export function serviceIdentityAt(services, port, protocol) {
 /** The same identified program AND version — both present. Program is compared case-insensitively, version exactly. */
 export const sameServiceIdentity = (a, b) => a != null && b != null
   && a.program.toLowerCase() === b.program.toLowerCase() && a.version === b.version;
+// A message with every ABSOLUTE local path reduced to what a reader needs (1.3.0, B6-4a): its tail after the LAST
+// `node_modules` (the package-relative module, e.g. `@nsasoft/nsauditor-ai-ee/utils/x.mjs`), else its basename when that is
+// a FILE name at depth >= 3 after the root, else `<local path>` (a home directory's basename is the user's name). A load
+// error names absolute paths, and a client artifact must never carry the operator's directory layout — the rule
+// `vulnerabilityDataSource` below states for its own detail. POSIX and Windows paths and a `file://` URL; a path in
+// quotes may hold spaces, and so may an unquoted one that ends in a module file (Node's "imported from <path>"). A path
+// whose closing quote was cut off is still reduced: an opening quote is a lead for the unquoted rules too.
+// ⚠️ LIMIT, pinned: an UNQUOTED path holding a space and NO module extension reduces only up to its first space
+// (`C:\Program Files\x\state` → `<local path> Files\x\state`) — nothing marks where such a path ends. Node quotes those paths,
+// so its own messages are covered; a message composed by hand might not be. A UNC path (`\\server\share`) matches no
+// rule and passes through. And the reduction runs BEFORE the caller's length cap, never after: a cap landing inside
+// `/Users/<name>/` would leave fragments of the user's name.
+const QUOTED_PATH = /(['"`])((?:file:\/\/)?(?:\/|[A-Za-z]:\\)[^'"`\n]*)\1/g;
+const UNQUOTED_MODULE_PATH = /(^|[\s(='"`])((?:file:\/\/)?(?:\/|[A-Za-z]:\\)[^'"\n]*?\.(?:mjs|cjs|js|json|node)(?::\d+)*)(?=$|[\s'"),;])/g;
+const UNQUOTED_PATH = /(^|[\s(='"`])((?:file:\/\/)?(?:\/|[A-Za-z]:\\)[^\s'"()]+)/g;
+const LOCAL_PATH = '<local path>';
+function shortPath(p) {
+  const s = p.replace(/^file:\/\//, '');
+  const i = Math.max(s.lastIndexOf('node_modules/'), s.lastIndexOf('node_modules\\'));
+  if (i >= 0) return s.slice(i + 'node_modules/'.length);
+  // A FILE name below the first component survives; anything else is the layout itself. A home directory's basename IS
+  // the user's name, and a dotted user name (`/Users/j.doe`) carries an "extension" — hence BOTH conditions.
+  const parts = s.replace(/^[A-Za-z]:\\/, '').split(/[\\/]/).filter(Boolean);
+  const base = parts.at(-1) ?? '';
+  return parts.length >= 3 && /\.[A-Za-z0-9]+(?::\d+)*$/.test(base) ? base : LOCAL_PATH;
+}
+export function withoutLocalPaths(text) {
+  return String(text)
+    .replace(QUOTED_PATH, (_, q, p) => `${q}${shortPath(p)}${q}`)
+    .replace(UNQUOTED_MODULE_PATH, (_, lead, p) => `${lead}${shortPath(p)}`)
+    .replace(UNQUOTED_PATH, (_, lead, p) => `${lead}${shortPath(p)}`);
+}
 /**
  * WHERE A RUN'S VULNERABILITY DATA CAME FROM, in words, from its run record's `nvdCache` — never a local path, which
  * would carry the operator's directory layout into a client artifact. `state` is the offline store's (`absent` means
@@ -317,6 +400,12 @@ export const IDENTITY_BASIS_CHANGED_AT = Object.freeze({
   // rows one count-free title with the count in details. Both put new values into `keyOf` — `port`, `title` — which
   // CHANGES WHAT THOSE FINDINGS ARE, so the straddle is declared like 1040's region stamp.
   1023: '1.1.0',
+  // ⚠️ 1160 JOINS AT 1.3.0 — THE 1110 KIND, A TEXT CORRECTION (B4-8a). Its dimension-4 row (endpoint type substrate) said
+  // "Privacy + CC6.6 substrate evidence: PrivateLink connectivity attestation", and no rule in any pack matches that title;
+  // the claim was WITHDRAWN at 1.3.0. The issue IS the title, so every dim-4 row straddling the upgrade would otherwise read
+  // as one finding resolved and a new one appearing. Enterprise's instrument cannot measure this mover — its corpus account
+  // has no VPC endpoints — so it is premised there on REACH (the 1023 precedent), and the premise goes false the day it can.
+  1160: '1.3.0',
   // ⚠️ AN ANALYSIS AGENT, NOT A PLUGIN, AND THE FIRST NON-NUMERIC KEY THIS TABLE HAS HELD. A
   // finding from Enterprise's finding QUEUE emits no resource, no region, no identity qualifier
   // and no content digest, so `keyOf` reduces to `host · producer · port · TITLE` — the title IS
@@ -330,6 +419,18 @@ export const IDENTITY_BASIS_CHANGED_AT = Object.freeze({
   // actually emits, because a key outside the vocabulary can never match a finding — and a
   // declaration that matches nothing is SILENT while the real producer stays undeclared.
   intelligence_engine: '1.1.0',
+  // ⚠️ exposure_agent JOINS AT 1.3.0 — THE SAME KIND: ITS TITLE IS WHAT IT NAMES (lane 6, F2's exposure sibling). Its rows
+  // were titled `Management port 22 (ssh) open` / `Database port 3306 (mysql) open`, embedding the service the probe
+  // identified — so with the SSH probe left out the same open port titled `Management port 22 (unknown) open`, and a LABEL
+  // move read as one row RESOLVED and one NEW. From 1.3.0 the title is port-keyed (`Management port 22 open`) and the
+  // service rides `target.service` and the description, so every exposure row straddling the upgrade is declared once.
+  exposure_agent: '1.3.0',
+  // ⚠️ service_agent JOINS AT 1.3.0 — THE SAME KIND, IN THE SAME RELEASE (lane 6). Its rows were titled `End-of-life OpenSSH
+  // 6.6p1 on port 22`, embedding the version it judged — so an identified move that stayed end-of-life (6.6p1 → 6.7p1) read
+  // one row RESOLVED and one NEW, and MTTR closed the first while the host was still end-of-life. From 1.3.0 the title is
+  // `End-of-life OpenSSH on port 22` and the version rides `target.version` and the description. Declared beside
+  // exposure_agent's so a customer takes both agent straddles in one upgrade, said once.
+  service_agent: '1.3.0',
 });
 
 // ⚠️ NO SECOND COMPARATOR. This file already has `cmpVersion` (below, used by the
@@ -830,11 +931,10 @@ export const SCOPE_NOT_EVALUATED =
 // away from — a digest over volatile prose reintroduces the volatility through the digest.
 export const AGENT_SCOPE_FROM_TIER =
   'Agent-produced findings: their scope is derived from the run TIER, plus the records a run writes when '
-  + 'Enterprise failed on a host, an agent did not run, or a requested plugin it reads did not complete — the '
-  + 'agent set is a function of the licensed capabilities, and a tier difference refuses the comparison outright '
-  + 'rather than narrowing it. What is NOT compared is whether the plugins an analysis agent or the CVE mapper '
-  + 'reads were REQUESTED in both runs: when the two runs requested different --plugins, such a row can read '
-  + 'resolved or new with nothing changed. Keep --plugins identical between compared runs. '
+  + 'Enterprise failed on a host, an agent did not run, or a plugin it reads was left out of the scan or did not '
+  + 'complete — the agent set is a function of the licensed capabilities, and a tier difference refuses the comparison '
+  + 'outright rather than narrowing it. A run made before EE 1.3.0 could not record a plugin left out of it, so in a '
+  + 'comparison with one, an agent row that run lacks is not refused; the row\'s Basis cell says so. '
   + 'Their IDENTITY is also narrower than a plugin finding\'s: an agent finding is keyed on host, '
   + 'producer, port and title, and on nothing else — it carries no object (resource), no region, '
   + 'no rule qualifier and NO CONTENT DIGEST. So two agent findings that differ only in text the '
@@ -881,11 +981,12 @@ function incomparabilityReason(f, mine, theirs, names) {
   // mode this engine was built to avoid on the other axis. Its scope is the run TIER, and the two
   // whole-comparison refusals above (`ee-presence-differs`, `tier-differs`) guarantee that by the
   // time control reaches here both sides carry Enterprise and the SAME tier, so the agent SET is
-  // identical on both. ⚠️ THAT DOES NOT MAKE AN AGENT ROW COMPARABLE (1.2.0 limit, boarded for
-  // 1.2.1): the agent — and the CVE mapper — derives its rows from other plugins' output, and those
-  // can differ at the same tier when `--plugins` was narrowed in one run. Nothing here checks them,
-  // so such a row reads resolved or new; AGENT_SCOPE_FROM_TIER says so. That per-finding INPUT check
-  // CAN fail through the shipped path — it is owed, not dead code.
+  // identical on both. ⚠️ THAT DOES NOT MAKE AN AGENT ROW COMPARABLE BY ITSELF: the agent — and the
+  // CVE mapper — derives its rows from other plugins' output, and those can differ at the same tier
+  // when `--plugins` was narrowed in one run. From Enterprise 1.3.0 the narrowed run RECORDS it (an
+  // input-gap record naming the plugin not requested) and the producer-gap leg below refuses the row;
+  // a run made before EE 1.3.0 records nothing, so against one such a row reads resolved or new —
+  // AGENT_SCOPE_FROM_TIER and the row's Basis cell say so.
   if (f.producerKind !== 'agent' && !theirs.plugins.has(f.plugin)) {
     // ⚠️ THE NOUN HERE IS A LITERAL `plugin` AND THAT IS CORRECT — but only because of the
     // `producerKind !== 'agent'` guard on this very line, which makes the branch unreachable for
@@ -909,7 +1010,7 @@ function incomparabilityReason(f, mine, theirs, names) {
       const what = stage.loadError ? 'failed to load' : 'failed during enrichment';
       return { reason: 'evidence-gap',
         detail: `Enterprise ${what} on ${f.host} in ${which} — none of its analysis agents or its CVE mapper ran there, so `
-          + `this ${producerNoun(f)}'s rows were not looked for (${String(stage.loadError ?? stage.enrichmentError).slice(0, 200)})` };
+          + `this ${producerNoun(f)}'s rows were not looked for (${withoutLocalPaths(stage.loadError ?? stage.enrichmentError).slice(0, 200)})` };
     }
   }
   // ⚠️ THE PRODUCER CHANGED WHAT IT NAMES BETWEEN THESE TWO RELEASES, so its two keys for one
@@ -992,6 +1093,17 @@ function incomparabilityReason(f, mine, theirs, names) {
         + `${TRANSPORT_OF_LABEL[String(f.protocol ?? '').toLowerCase()] ?? f.protocol} (${f.gapClass}), present in only one of the `
         + 'two runs — a coverage gap that opened or cleared, not an exposure that appeared or was fixed.' };
   }
+  // ⚠️ A COVERAGE NOTE THAT ENDED IS NOT A REMEDIATION (1.3.0, the audit seat's ruling P — the precedent just above). A
+  // note is the mapper's own record of what it could not show on a service (a truncation; a CVE NVD lists for the product
+  // only at version NA). Its ending fixed nothing, whether or not the service changed: an upgrade ends a note without
+  // remediating anything, and the CVE rows carry the upgrade's signal — so this is answered BEFORE the identity rule. The
+  // VANISHED direction only: a note that appears is a disclosure to be seen, and stays NEW.
+  if (isEngineNoteRow(f) && names.mine === RUN_NAMES.baseline) {
+    return { reason: 'evidence-gap',
+      detail: `this is a coverage note of the CVE mapper (${f.gapClass}) on ${f.port}/`
+        + `${TRANSPORT_OF_LABEL[String(f.protocol ?? '').toLowerCase()] ?? f.protocol}, present in ${names.mine} only — it recorded `
+        + 'what the mapper could not show there, so its ending is not a remediation: nothing was fixed.' };
+  }
   if (f.plugin === CVE_MAPPER_PRODUCER && Number(f.port) > 0) {
     const lookupGap = theirs.engineLookupGaps?.get(engineLookupGapKey(f.host, f.port, f.protocol));
     if (lookupGap) {
@@ -1024,6 +1136,22 @@ function incomparabilityReason(f, mine, theirs, names) {
           + 'reads TCP ports the port scanner saw open; a UDP-transport finding is judged by its own rule, and a '
           + 'host-wide finding by neither.)' };
     }
+    // ⚠️ THE PORT ANSWERED BUT ITS SERVICE WAS NOT IDENTIFIED (1.3.0, lane 6 — F2's TCP-unidentified sibling). A row of an
+    // IDENTIFYING producer (`IDENTIFYING_PRODUCERS`: the CVE mapper, the service agent) on a TCP port the OTHER run's port
+    // scanner saw OPEN, where `tcpServiceMeasurement` finds no open record there carrying a program AND a version: the
+    // producer had nothing to attribute, so the row's absence (or appearance) is not a measurement. Both directions. After the lookup-gap leg (a `no_version_detected` record is the mapper SAYING so, and
+    // answers first) and the port leg above; before the vulnerability-data rule, which needs an identity on both sides.
+    // No service set in the other run → silent, as this TCP rule is without 003 (a stated limit).
+    if (IDENTIFYING_PRODUCERS.includes(f.plugin) && !f.gapClass && other?.open?.has(port)) {
+      const m = tcpServiceMeasurement(port, f.plugin, other.services ?? null, names.theirs);
+      if (m.measured === false) {
+        const w = IDENTIFYING_ROW[f.plugin];
+        return { reason: PORT_NOT_MEASURED_REASON,
+          detail: `${port}/tcp on ${f.host} carries ${w.row} in only one of the two runs, and ${m.why}. An unidentified `
+            + `service gives ${w.denied}, so the absence of ${w.row} there is not a measurement. It is `
+            + 'NOT reported as fixed or as new — rescan once the service\'s program and version can be read.' };
+      }
+    }
   }
   // ⚠️ A UDP-TRANSPORT ROW PRESENT IN ONE RUN ONLY (1.1.1). No UDP producer in this release records a port as
   // CLOSED, so the other run's silence on this port is not a measurement: never RESOLVED, never NEW. Its precondition
@@ -1052,7 +1180,8 @@ function incomparabilityReason(f, mine, theirs, names) {
   // ⚠️ THE SAME PROGRAM AND VERSION ANSWERED IN BOTH RUNS, AND ONE OF THEM HOLDS A CVE ROW THE OTHER DOES NOT (1.2.0
   // build 2). DISAPPEARED only: a newly attributed CVE is new knowledge about an exposure that is real now, so it stays
   // NEW and carries a basis note instead (`withNewBasis`). After the port and UDP legs, so a port that was not measured
-  // keeps its own reason; the mapper's CVE rows only — its gap and note rows carry a `gapClass` and are not attributions.
+  // keeps its own reason; the mapper's CVE rows only — its gap and note rows carry a `gapClass`, are not attributions, and
+  // are answered earlier (`isEngineLookupGap`, `isEngineNoteRow`).
   if (f.plugin === CVE_MAPPER_PRODUCER && !f.gapClass && port > 0 && names.mine === RUN_NAMES.baseline) {
     const was = serviceIdentityAt(mine.portState?.get(hostKey(f.host))?.services, port, f.protocol);
     const now = serviceIdentityAt(theirs.portState?.get(hostKey(f.host))?.services, port, f.protocol);
@@ -1103,11 +1232,16 @@ export const ENGINE_GAP_CLASS_KIND = Object.freeze({
   cpe_map_miss: 'lookup-failed',
   no_version_detected: 'lookup-failed',
   truncated_low_severity_cves: 'note',      // a COVERAGE NOTE: the lookup worked and some LOW rows were folded
+  // 1.3.0 (B6-4b): the lookup worked; NVD lists ONE CVE for the product only at version NA, which no banner can decide. A
+  // note, never `lookup-failed` — that kind refuses every CVE row on the port, and this one is on every scan of the product.
+  cve_listed_without_version: 'note',
   input_gap: 'input-gap',                   // the engine's input gap — an evidence gap, handled by the recorded-gap leg
 });
 /** A CVE-mapper lookup-gap row, port-scoped. Written as plain `f.` reads so the boundary contract sees them. */
 export const isEngineLookupGap = (f) => f != null && f.plugin === CVE_MAPPER_PRODUCER
   && ENGINE_GAP_CLASS_KIND[f.gapClass] === 'lookup-failed' && Number(f.port) > 0;
+/** A CVE-mapper coverage NOTE (1.3.0, ruling P): its class is classified 'note'. Its ending is never a remediation. */
+export const isEngineNoteRow = (f) => f != null && f.plugin === CVE_MAPPER_PRODUCER && ENGINE_GAP_CLASS_KIND[f.gapClass] === 'note';
 /** The key a lookup gap and the CVE rows it covers share: host (as `hostKey`), port, and the TRANSPORT of the label. */
 export const engineLookupGapKey = (host, port, protocol) =>
   `${hostKey(host)}|${Number(port)}|${TRANSPORT_OF_LABEL[String(protocol ?? '').toLowerCase()] ?? `label:${String(protocol ?? '').toLowerCase()}`}`;
@@ -1128,6 +1262,24 @@ function withUdpBasis(f, theirs, theirName) {
   const m = udpPortMeasurement(port, f.plugin, theirs.portState?.get(hostKey(f.host))?.udpServices ?? null, theirName);
   return m.measured ? { ...f, basisNote: m.basis } : f;
 }
+/** The closed-port oracle's basis for a TCP row: the other run's port scanner measured the port CLOSED. */
+export const tcpPortClosedBasis = (port, runName) => `${port}/tcp closed in ${runName}`;
+// A TCP row of an IDENTIFYING producer that RESOLVED or APPEARED (1.3.0, lane 6 — deltaBasis) shows the measurement that
+// made it comparable: the TCP decision's OWN basis where the other run saw the port open and identified the service, or
+// the closed-port basis — never a sentence of its own, so the cell cannot say "identified" about a port nobody identified.
+// An analysis agent outside the set needs no more than an open port, and its cell claims no more.
+function withTcpBasis(f, theirs, theirName) {
+  const port = Number(f.port);
+  if (!(port > 0) || f.gapClass || !IDENTIFYING_PRODUCERS.includes(f.plugin)) return f;
+  const ps = theirs.portState?.get(hostKey(f.host));
+  if (ps?.closed?.has(port)) return { ...f, basisNote: tcpPortClosedBasis(port, theirName) };
+  if (ps?.open?.has(port)) {
+    const m = tcpServiceMeasurement(port, f.plugin, ps.services ?? null, theirName);
+    if (m.measured === true) return { ...f, basisNote: m.basis };
+  }
+  return f;
+}
+const withMeasuredBasis = (f, theirs, theirName) => (isUdpTransport(f.protocol) ? withUdpBasis(f, theirs, theirName) : withTcpBasis(f, theirs, theirName));
 
 // A CVE row that APPEARED on a service identified the same in both runs (1.2.0 build 2 — MANDATORY, the audit seat's
 // ruling): it stays NEW, and says the service did not change, because "new exposure on my estate" and "new knowledge
@@ -1142,7 +1294,7 @@ function withNewBasis(f, mine, theirs) {
         + `in ${RUN_NAMES.baseline}; the service is unchanged, the vulnerability data is not` };
     }
   }
-  return withUdpBasis(f, theirs, RUN_NAMES.baseline);
+  return withMeasuredBasis(f, theirs, RUN_NAMES.baseline);
 }
 
 // The oracle test, separated from the per-finding check so its ABSENCE has somewhere to be
@@ -1410,7 +1562,7 @@ export function buildScanDelta({ baseline, current }) {
     }
     const why = incomparabilityReason(f, bScope, cScope, FRAME_DISAPPEARED);
     if (why) notComparable.push({ ...f, direction: 'disappeared', ...why });
-    else resolved.push(withUdpBasis(f, cScope, RUN_NAMES.current));
+    else resolved.push(withMeasuredBasis(f, cScope, RUN_NAMES.current));
   }
   for (const [k, f] of cMap) {
     if (bMap.has(k)) continue;
@@ -1425,6 +1577,9 @@ export function buildScanDelta({ baseline, current }) {
     schema: SCAN_DELTA_SCHEMA, comparable: true, refusal: null,
     newFindings, resolved, unchanged, changed, notComparable,
     baselineIntegrity, currentIntegrity, limits,
+    // Each run's EE version, read off its own record (null when it records none) — append-only. Read by the executive
+    // report's Basis cell, which keys its legacy sentence on the run that LACKS an agent row.
+    baselineEeVersion: bEE, currentEeVersion: cEE,
     coverage: {
       hostsOnlyInBaseline: [...bScope.hosts].filter((h) => !cScope.hosts.has(h)).map((h) => shownHost(bScope, h)),
       hostsOnlyInCurrent: [...cScope.hosts].filter((h) => !bScope.hosts.has(h)).map((h) => shownHost(cScope, h)),

package/utils/scan_delta_view.mjs

@@ -4,9 +4,9 @@
 // silently diffing against it. If the selected run was narrow — a `--plugins` subset, one host,
 // an interrupted run — the delta is practically a wall of NOT-COMPARABLE, and an operator who
 // meets that twice stops reading the feature. So the baseline's id, timestamp and scope are
-// printed BEFORE any verdict. ⚠️ Not for an AGENT row (1.2.0 limit): an analysis agent's or the
-// CVE mapper's row whose input plugins a `--plugins` subset dropped reads resolved or new instead
-// of NOT-COMPARABLE — see AGENT_SCOPE_FROM_TIER.
+// printed BEFORE any verdict. An analysis agent's or the CVE mapper's row whose input plugin a
+// `--plugins` subset dropped is refused too, from Enterprise 1.3.0 (the narrowed run records it);
+// against a run made before EE 1.3.0 it reads resolved or new — see AGENT_SCOPE_FROM_TIER.
 //
 // ⚠️ AND REFUSING IS NOT STONEWALLING. When the selected baseline cannot support a verdict, this
 // says which earlier records exist and which of them are chain-verified — but it NEVER