progmune-runtime 2.1.5 → 3.2.0

package/dist/trust/engine.js

@@ -0,0 +1,1145 @@
+"use strict";
+/**
+ * Phase 1: Trust Engine Orchestrator
+ *
+ * Main entry point for the AI Trust Decision Engine.
+ * Composes existing modules (policy engine, protocol detector, SSG validator,
+ * ledger registry, failure corpus) into the 4-dimension Trust Decision model.
+ *
+ * Pipeline:
+ *   1. COLLECT  — gather raw data from existing modules
+ *   2. NORMALIZE — map all results to TrustViolation[] with 6-tuple evidence
+ *   3. SCORE    — apply weighted scoring formulas
+ *   4. DECIDE   — compute Overall, Decision, Confidence
+ *   5. ASSEMBLE — build final TrustDecision with audit trail
+ *
+ * Uses lazy require() pattern to avoid circular dependencies
+ * and enable best-effort graceful degradation.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateTrust = evaluateTrust;
+const crypto = __importStar(require("crypto"));
+const path = __importStar(require("path"));
+const types_1 = require("./types");
+const explainability_1 = require("./explainability");
+const score_calculator_1 = require("./score-calculator");
+const confidence_calculator_1 = require("./confidence-calculator");
+const violation_trace_1 = require("./violation-trace");
+const api_semantic_mapper_1 = require("./api-semantic-mapper");
+const protocol_domain_validator_1 = require("./protocol-domain-validator");
+const call_graph_propagator_1 = require("./call-graph-propagator");
+const ssg_bridge_1 = require("./ssg-bridge");
+// ── Main Entry Point ──
+async function evaluateTrust(ctx) {
+    const engineVersion = "trust-runtime-v1.0.0";
+    const timestamp = new Date().toISOString();
+    const checkId = `check_${crypto.randomBytes(4).toString("hex")}`;
+    // ═══════════════════════════════════════
+    //  PHASE 1: COLLECT
+    // ═══════════════════════════════════════
+    // ── Phase 5: Build call graph for cross-function propagation ──
+    const callGraph = (0, call_graph_propagator_1.buildCallGraphFromIR)(path.join(ctx.projectPath, "ir.json"));
+    const enterpriseViolations = collectEnterpriseViolations(ctx);
+    const { violations: protocolViolations, coverage: mappingCoverageData, ssgCoverage: ssgCov } = await collectProtocolViolations(ctx, callGraph);
+    const expressResult = collectExpressViolations(ctx);
+    const nestjsResult = collectNestJSViolations(ctx);
+    const trpcResult = collectTRPCViolations(ctx);
+    const coverageData = collectVerificationCoverage(ctx);
+    const governanceDefects = collectGovernanceDefects(ctx);
+    // ═══════════════════════════════════════
+    //  PHASE 2: NORMALIZE — All violations to TrustViolation[]
+    // ═══════════════════════════════════════
+    // Cross-framework correction: tRPC projects authenticate via
+    // protectedProcedure/adminProcedure, not Express middleware.
+    // Suppress EXPRESS_NO_AUTH_MIDDLEWARE when tRPC auth exists.
+    const expressViolations = trpcResult.coverage.hasTRPCAuth
+        ? expressResult.violations.filter(v => v.rule_id !== "EXPRESS_NO_AUTH_MIDDLEWARE")
+        : expressResult.violations;
+    const allViolations = [
+        ...enterpriseViolations,
+        ...protocolViolations,
+        ...expressViolations,
+        ...nestjsResult.violations,
+        ...trpcResult.violations,
+    ];
+    // ═══════════════════════════════════════
+    //  PHASE 3: SCORE
+    // ═══════════════════════════════════════
+    const policyResult = (0, score_calculator_1.scorePolicyCompliance)(allViolations);
+    const protocolResult = (0, score_calculator_1.scoreProtocolSafety)(allViolations);
+    const coverageResult = (0, score_calculator_1.scoreVerificationCoverage)(coverageData);
+    const governanceResult = (0, score_calculator_1.scoreGovernanceIntegrity)(governanceDefects);
+    const explainResult = (0, explainability_1.checkExplainability)(allViolations);
+    // ═══════════════════════════════════════
+    //  PHASE 4: DECIDE
+    // ═══════════════════════════════════════
+    const overallScore = (0, score_calculator_1.calculateOverallScore)([
+        { score: policyResult.score, weight: types_1.DEFAULT_DIMENSION_WEIGHTS.policyCompliance },
+        { score: protocolResult.score, weight: types_1.DEFAULT_DIMENSION_WEIGHTS.protocolSafety },
+        { score: coverageResult.score, weight: types_1.DEFAULT_DIMENSION_WEIGHTS.verificationCoverage },
+        { score: governanceResult.score, weight: types_1.DEFAULT_DIMENSION_WEIGHTS.governanceIntegrity },
+    ]);
+    // Apply critical lock
+    const effectiveScore = policyResult.hasCritical
+        ? Math.min(overallScore, types_1.DECISION_THRESHOLDS.criticalLock)
+        : overallScore;
+    const decision = (0, score_calculator_1.determineDecision)(effectiveScore, policyResult.hasCritical, explainResult.status);
+    // ── Phase 1: Coverage-based confidence (replaces qualitative labels) ──
+    const coverageConfidence = (0, confidence_calculator_1.computeCoverageConfidence)(ctx.projectPath);
+    const dimConfidences = [
+        policyResult.hasCritical ? "LOW" : coverageResult.confidence,
+        protocolResult.confidence,
+        coverageResult.confidence,
+        governanceResult.confidence,
+    ];
+    const confidence = (0, score_calculator_1.determineConfidence)(dimConfidences, explainResult.status);
+    // ═══════════════════════════════════════
+    //  PHASE 5: ASSEMBLE
+    // ═══════════════════════════════════════
+    // Build violation traces (Phase 3)
+    const traces = (0, violation_trace_1.buildViolationTraces)(allViolations);
+    const violationTraces = traces.map(t => ({
+        rule_id: t.violation.rule_id,
+        file: t.violation.file,
+        function: t.violation.function,
+        steps: t.steps.map(s => ({
+            step: s.step,
+            label: s.label,
+            action: s.action,
+            preState: s.preState,
+            explanation: s.explanation,
+        })),
+        fixPath: t.fixPath,
+        estimatedReadingTimeMinutes: t.estimatedReadingTimeMinutes,
+    }));
+    const summary = (0, score_calculator_1.countViolationsBySeverity)(allViolations);
+    const auditTrail = {
+        commit: ctx.commit,
+        policy: ctx.policyName || "default",
+        policyVersion: "v1.0.0",
+        engineVersion,
+        generatedAt: timestamp,
+        reproducible: true,
+        checkId,
+    };
+    const trustDecision = {
+        project: ctx.projectName,
+        commit: ctx.commit,
+        timestamp,
+        engineVersion,
+        overall: {
+            score: effectiveScore,
+            decision,
+            confidence,
+            coverageConfidence: {
+                score: coverageConfidence.score,
+                margin: coverageConfidence.margin,
+                level: coverageConfidence.level,
+                summary: coverageConfidence.summary,
+            },
+            mappingCoverage: mappingCoverageData.totalApis > 0
+                ? {
+                    rate: Math.round(((mappingCoverageData.lookupHits + mappingCoverageData.llmHits) /
+                        mappingCoverageData.totalApis) *
+                        100),
+                    lookupHits: mappingCoverageData.lookupHits,
+                    llmHits: mappingCoverageData.llmHits,
+                    totalApis: mappingCoverageData.totalApis,
+                    level: (mappingCoverageData.lookupHits + mappingCoverageData.llmHits) /
+                        mappingCoverageData.totalApis >
+                        0.7
+                        ? "GOOD"
+                        : (mappingCoverageData.lookupHits + mappingCoverageData.llmHits) /
+                            mappingCoverageData.totalApis >
+                            0.4
+                            ? "ADEQUATE"
+                            : "LOW",
+                    /** Phase 5: cross-function call graph propagation */
+                    propagatedDomains: mappingCoverageData.propagatedDomains,
+                    graphAvailable: mappingCoverageData.graphAvailable,
+                }
+                : undefined,
+            /** SSG State Machine coverage — how many calls were matched to protocol rules */
+            ssgCoverage: ssgCov,
+            /** Express framework adapter coverage — routes & middleware analyzed */
+            expressCoverage: expressResult.coverage.expressApps > 0
+                ? {
+                    appsDetected: expressResult.coverage.expressApps,
+                    totalRoutes: expressResult.coverage.totalRoutes,
+                    filesScanned: expressResult.coverage.filesScanned,
+                    issuesFound: expressResult.violations.length,
+                }
+                : undefined,
+            /** NestJS framework adapter coverage — decorator-based route analysis */
+            nestjsCoverage: nestjsResult.coverage.controllers > 0
+                ? {
+                    controllers: nestjsResult.coverage.controllers,
+                    totalRoutes: nestjsResult.coverage.routes,
+                    filesScanned: nestjsResult.coverage.filesScanned,
+                    issuesFound: nestjsResult.violations.length,
+                }
+                : undefined,
+        },
+        dimensions: {
+            policyCompliance: {
+                score: policyResult.score,
+                weight: types_1.DEFAULT_DIMENSION_WEIGHTS.policyCompliance,
+                confidence: policyResult.hasCritical ? "LOW" : "HIGH",
+                violations: allViolations.filter((v) => v.severity !== "low" || v.policy_ref !== "protocol"),
+            },
+            protocolSafety: protocolResult,
+            verificationCoverage: coverageResult,
+            governanceIntegrity: governanceResult,
+            explainability: explainResult,
+            evolutionStability: {
+                score: null,
+                weight: types_1.DEFAULT_DIMENSION_WEIGHTS.evolutionStability,
+                status: "UNAVAILABLE",
+                reason: "Insufficient history — requires ≥ 3 iterations of AI-generated changes",
+            },
+        },
+        violations: allViolations,
+        violationTraces,
+        summary,
+        auditTrail,
+    };
+    return trustDecision;
+}
+// ═══════════════════════════════════════════════
+//  COLLECTORS — Each gathers data from existing modules
+// ═══════════════════════════════════════════════
+/**
+ * Collect enterprise policy violations from the existing policy engine
+ * and map them to TrustViolation[] with 6-tuple evidence.
+ */
+function collectEnterpriseViolations(ctx) {
+    const violations = [];
+    // ── A. Enterprise Policy Rules ──
+    try {
+        const { loadEnterprisePolicyConfig, evaluatePolicy } = require("../policy");
+        const { certify } = require("../certify");
+        const { buildAccountabilityChain } = require("../ledger");
+        const enterprisePolicy = loadEnterprisePolicyConfig(ctx.projectPath, ctx.policyName);
+        // Scan project files for certifiable files (best-effort)
+        const projectDir = ctx.projectPath;
+        let certFile = null;
+        try {
+            const fs = require("fs");
+            const srcDir = path.join(projectDir, "src");
+            if (fs.existsSync(srcDir)) {
+                const extensions = languageToExtensions(ctx.language);
+                const files = walkDir(srcDir, extensions, 50);
+                certFile = files.length > 0 ? files[0] : null;
+            }
+        }
+        catch { /* best-effort */ }
+        if (certFile) {
+            try {
+                const cert = certify(certFile);
+                let acct;
+                try {
+                    acct = buildAccountabilityChain(cert.sessionId);
+                }
+                catch { /* no accountability */ }
+                const policyCtx = {
+                    certificate: {
+                        validated: cert.validated,
+                        confidence: cert.confidence,
+                        provenanceIntact: cert.provenanceIntact,
+                        fingerprint: cert.fingerprint,
+                        violations: cert.violations,
+                        plsbCoverage: cert.plsbCoverage,
+                        plsbRecall: cert.plsbRecall,
+                        degraded: cert.degraded,
+                        sessionId: cert.sessionId,
+                        file: cert.file,
+                    },
+                    accountability: acct ? {
+                        humanEvents: acct.humanEvents,
+                        aiEvents: acct.aiEvents,
+                        automatedEvents: acct.automatedEvents,
+                        custodyGap: acct.custodyGap,
+                    } : undefined,
+                };
+                const result = evaluatePolicy(policyCtx);
+                // Map PolicyResult violations → TrustViolation[]
+                for (const rv of result.violations) {
+                    const trustViolation = mapPolicyViolation(rv, certFile, enterprisePolicy);
+                    violations.push(trustViolation);
+                }
+            }
+            catch { /* best-effort */ }
+        }
+        // ── B. Enterprise Rules (custom rules from .progmune-policy.json) ──
+        if (enterprisePolicy.isEnterprise && enterprisePolicy.rules.length > 0) {
+            for (const rule of enterprisePolicy.rules) {
+                const matched = checkEnterpriseRule(rule, ctx.projectPath, ctx.language);
+                if (matched) {
+                    violations.push({
+                        severity: rule.severity,
+                        rule_id: rule.id,
+                        file: matched.file || "unknown",
+                        function: matched.function || "unknown",
+                        message: rule.description,
+                        evidence: matched.evidence || rule.description,
+                        why: `Violates enterprise policy: ${rule.name}`,
+                        fix: `Review and align with enterprise rule ${rule.id}`,
+                        policy_ref: rule.policy_ref,
+                    });
+                }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return violations;
+}
+/**
+ * Map a legacy PolicyResult RuleViolation to a TrustViolation with 6-tuple evidence.
+ */
+function mapPolicyViolation(rv, filePath, _enterprisePolicy) {
+    const severity = rv.rule.severity === "block" ? "critical" : rv.rule.severity === "warn" ? "high" : "medium";
+    return {
+        severity,
+        rule_id: rv.rule.type,
+        file: filePath,
+        function: extractFunctionName(rv.detail || rv.actual),
+        message: rv.rule.description || `${rv.actual} (expected: ${rv.expected})`,
+        evidence: rv.detail || `${rv.actual} → ${rv.expected}`,
+        why: rv.detail || `Violation of rule type: ${rv.rule.type}`,
+        fix: `Address ${rv.rule.type} violation: ${rv.expected}`,
+        policy_ref: "default",
+    };
+}
+// ═══════════════════════════════════════════════
+//  Express Framework Adapter Collector
+// ═══════════════════════════════════════════════
+/**
+ * Collect Express-specific security violations from the framework detector.
+ * Maps ExpressSecurityIssue[] → TrustViolation[].
+ */
+function collectExpressViolations(ctx) {
+    const violations = [];
+    let expressApps = 0;
+    let totalRoutes = 0;
+    let filesScanned = 0;
+    try {
+        const { analyzeExpressFile } = require("../frameworks/express-detector");
+        const fs = require("fs");
+        // Scan common source directories for Express files
+        const candidateDirs = ["src", "server", "app", "api", "routes"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            // First pass: identify all Express apps and find the main one
+            const expressAnalyses = [];
+            for (const file of files) {
+                // Skip test files
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                filesScanned++;
+                try {
+                    const analysis = analyzeExpressFile(file);
+                    if (analysis && analysis.hasExpress) {
+                        expressAnalyses.push({ file, analysis });
+                    }
+                }
+                catch { /* skip unreadable files */ }
+            }
+            // Second pass: report issues from the main app file only
+            // (the file with the most routes is the entry point).
+            // Cross-file analysis: merge global findings (helmet/cors/auth)
+            // from all files to avoid false positives from sub-modules.
+            expressApps = expressAnalyses.length;
+            let mainAppRoutes = 0;
+            // Collect cross-file evidence
+            const allGlobalMiddleware = new Set();
+            const allRouteMiddleware = new Set();
+            for (const { analysis } of expressAnalyses) {
+                totalRoutes += analysis.routes.length;
+                if (analysis.routes.length > mainAppRoutes)
+                    mainAppRoutes = analysis.routes.length;
+                for (const mw of analysis.globalMiddleware) {
+                    allGlobalMiddleware.add(mw.type);
+                }
+                for (const route of analysis.routes) {
+                    for (const mw of route.middlewares) {
+                        // Classify each route middleware
+                        try {
+                            const { classifyMiddleware } = require("../frameworks/express-detector");
+                            allRouteMiddleware.add(classifyMiddleware("", mw));
+                        }
+                        catch { /* skip */ }
+                    }
+                }
+            }
+            // Report from main app + cross-file evidence
+            for (const { file, analysis } of expressAnalyses) {
+                if (analysis.routes.length < mainAppRoutes)
+                    continue; // skip sub-modules
+                for (const issue of analysis.issues) {
+                    // Cross-file correction: if the missing thing exists elsewhere, suppress the issue
+                    if (issue.rule === "EXPRESS_NO_AUTH_MIDDLEWARE" &&
+                        (allGlobalMiddleware.has("auth") || allRouteMiddleware.has("auth"))) {
+                        continue; // auth exists in project — this file just doesn't define it directly
+                    }
+                    if (issue.rule === "EXPRESS_NO_HELMET" && allGlobalMiddleware.has("security_header")) {
+                        continue;
+                    }
+                    if (issue.rule === "EXPRESS_NO_CORS_CONFIG" && allGlobalMiddleware.has("cors")) {
+                        continue;
+                    }
+                    if (issue.rule === "EXPRESS_NO_RATE_LIMIT" && allGlobalMiddleware.has("rate_limit")) {
+                        continue;
+                    }
+                    if (issue.rule === "EXPRESS_NO_INPUT_VALIDATION" &&
+                        (allGlobalMiddleware.has("validation") || allRouteMiddleware.has("validation"))) {
+                        continue;
+                    }
+                    if (issue.rule === "EXPRESS_SESSION_INSECURE" && allGlobalMiddleware.has("session")) {
+                        continue;
+                    }
+                    const severity = issue.severity === "critical" ? "critical" :
+                        issue.severity === "high" ? "high" :
+                            issue.severity === "medium" ? "medium" : "low";
+                    violations.push({
+                        severity,
+                        rule_id: issue.rule,
+                        file: path.relative(ctx.projectPath, file),
+                        function: issue.route || "express-app",
+                        message: issue.message,
+                        evidence: `Express route: ${issue.route || "global"} | Line: ${issue.line}`,
+                        why: `Express security check failed: ${issue.rule}`,
+                        fix: issue.fix,
+                        policy_ref: "framework.express",
+                    });
+                }
+            }
+        }
+    }
+    catch { /* best-effort — framework detector optional */ }
+    return { violations, coverage: { expressApps, totalRoutes, filesScanned } };
+}
+// ═══════════════════════════════════════════════
+//  tRPC Framework Adapter Collector
+// ═══════════════════════════════════════════════
+/**
+ * Collect tRPC-specific API contract violations from procedure definitions.
+ * Maps TRPCSecurityIssue[] → TrustViolation[].
+ */
+function collectTRPCViolations(ctx) {
+    const violations = [];
+    let trpcFiles = 0;
+    let procedures = 0;
+    let filesScanned = 0;
+    let hasTRPCAuth = false;
+    try {
+        const { analyzeTRPCFile } = require("../frameworks/trpc-detector");
+        const fs = require("fs");
+        // Scan common source directories for tRPC files
+        const candidateDirs = ["src", "server", "app", "api", "routes", "trpc"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                // Skip test files
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                filesScanned++;
+                let analysis;
+                try {
+                    analysis = analyzeTRPCFile(file);
+                }
+                catch {
+                    continue;
+                }
+                if (!analysis.hasTRPC)
+                    continue;
+                trpcFiles++;
+                procedures += analysis.procedures.length;
+                if (analysis.procedures.some((p) => p.procedureType === "protected" || p.procedureType === "admin")) {
+                    hasTRPCAuth = true;
+                }
+                for (const issue of analysis.issues) {
+                    const severity = issue.severity === "critical" ? "critical" :
+                        issue.severity === "high" ? "high" :
+                            issue.severity === "medium" ? "medium" : "low";
+                    violations.push({
+                        severity,
+                        rule_id: issue.rule,
+                        file: path.relative(ctx.projectPath, file),
+                        function: issue.procedure,
+                        message: issue.message,
+                        evidence: `tRPC procedure: ${issue.procedure} | Line: ${issue.line}`,
+                        why: `tRPC API contract check failed: ${issue.rule}`,
+                        fix: issue.fix,
+                        policy_ref: "framework.trpc.api-contract",
+                    });
+                }
+            }
+        }
+    }
+    catch { /* best-effort — tRPC detector optional */ }
+    return { violations, coverage: { trpcFiles, procedures, filesScanned, hasTRPCAuth } };
+}
+// ═══════════════════════════════════════════════
+//  NestJS Framework Adapter Collector
+// ═══════════════════════════════════════════════
+/**
+ * Collect NestJS-specific security violations from decorator analysis.
+ * Maps NestJSSecurityIssue[] → TrustViolation[].
+ */
+function collectNestJSViolations(ctx) {
+    const violations = [];
+    let controllers = 0;
+    let routes = 0;
+    let filesScanned = 0;
+    try {
+        const { analyzeNestJSFile } = require("../frameworks/nestjs-detector");
+        const fs = require("fs");
+        const candidateDirs = ["src", "server", "app", "api", "modules"];
+        const extensions = languageToExtensions(ctx.language);
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(ctx.projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            let files;
+            try {
+                files = walkDir(dirPath, extensions, 100);
+            }
+            catch {
+                continue;
+            }
+            for (const file of files) {
+                if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(file))
+                    continue;
+                filesScanned++;
+                try {
+                    const analysis = analyzeNestJSFile(file);
+                    if (!analysis || analysis.controllers.length === 0)
+                        continue;
+                    controllers += analysis.controllers.length;
+                    routes += analysis.routes.length;
+                    for (const issue of analysis.issues) {
+                        const severity = issue.severity === "critical" ? "critical" :
+                            issue.severity === "high" ? "high" :
+                                issue.severity === "medium" ? "medium" : "low";
+                        violations.push({
+                            severity,
+                            rule_id: issue.type,
+                            file: path.relative(ctx.projectPath, file),
+                            function: `${issue.controller}.${issue.route}`,
+                            message: issue.message,
+                            evidence: `NestJS route: ${issue.route} | Controller: ${issue.controller}`,
+                            why: `NestJS decorator analysis: ${issue.type}`,
+                            fix: issue.fix,
+                            policy_ref: "framework.nestjs",
+                        });
+                    }
+                }
+                catch { /* skip unreadable files */ }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return { violations, coverage: { controllers, routes, filesScanned } };
+}
+/**
+ * Check if an enterprise rule matches a file in the project.
+ * Uses rule conditions (file_pattern, function_name, import, api_call, regex).
+ */
+function checkEnterpriseRule(rule, projectPath, language) {
+    if (!rule.conditions || rule.conditions.length === 0) {
+        return null; // Enterprise rules with no conditions can't be auto-matched
+    }
+    try {
+        const fs = require("fs");
+        const srcDir = path.join(projectPath, "src");
+        if (!fs.existsSync(srcDir))
+            return null;
+        const extensions = languageToExtensions(language);
+        const files = walkDir(srcDir, extensions, 100);
+        for (const file of files) {
+            for (const cond of rule.conditions) {
+                const matched = checkCondition(cond, file, projectPath);
+                if (matched)
+                    return matched;
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return null;
+}
+/**
+ * Check a single RuleCondition against a file.
+ */
+function checkCondition(cond, filePath, _projectPath) {
+    try {
+        const fs = require("fs");
+        const content = fs.readFileSync(filePath, "utf-8");
+        const lines = content.split("\n");
+        if (cond.type === "file_pattern") {
+            const pattern = new RegExp(cond.pattern, "i");
+            if (pattern.test(filePath)) {
+                return {
+                    file: filePath,
+                    function: "unknown",
+                    evidence: `File matches pattern: ${cond.pattern}`,
+                };
+            }
+        }
+        if (cond.type === "regex") {
+            const regex = new RegExp(cond.pattern, "gm");
+            const match = regex.exec(content);
+            if (match) {
+                const lineNum = content.substring(0, match.index).split("\n").length;
+                const lineContent = lines[lineNum - 1]?.trim() || match[0];
+                return {
+                    file: filePath,
+                    function: extractFunctionAtLine(lines, lineNum),
+                    evidence: `${filePath}:${lineNum} — ${lineContent}`,
+                };
+            }
+        }
+        if (cond.type === "function_name") {
+            const escaped = cond.pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const regex = new RegExp(`(function\\s+${escaped}|${escaped}\\s*[=:]\\s*(?:async\\s*)?\\(|${escaped}\\s*\\([^)]*\\)\\s*{)`, "gm");
+            const match = regex.exec(content);
+            if (match) {
+                const lineNum = content.substring(0, match.index).split("\n").length;
+                return {
+                    file: filePath,
+                    function: cond.pattern,
+                    evidence: `${filePath}:${lineNum} — ${lines[lineNum - 1]?.trim() || match[0]}`,
+                };
+            }
+        }
+        if (cond.type === "import") {
+            if (content.includes(cond.pattern)) {
+                const lineNum = content.split("\n").findIndex((l) => l.includes(cond.pattern)) + 1;
+                return {
+                    file: filePath,
+                    function: "unknown",
+                    evidence: `${filePath}:${lineNum} — imports "${cond.pattern}"`,
+                };
+            }
+        }
+        if (cond.type === "api_call") {
+            const escaped = cond.pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const regex = new RegExp(escaped, "gm");
+            const match = regex.exec(content);
+            if (match) {
+                const lineNum = content.substring(0, match.index).split("\n").length;
+                return {
+                    file: filePath,
+                    function: extractFunctionAtLine(lines, lineNum),
+                    evidence: `${filePath}:${lineNum} — ${lines[lineNum - 1]?.trim() || match[0]}`,
+                };
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return null;
+}
+async function collectProtocolViolations(ctx, callGraph) {
+    const violations = [];
+    let totalApis = 0;
+    let lookupHits = 0;
+    let llmHits = 0;
+    let propagatedCount = 0;
+    // SSG State Machine variables (declared outside try for scope)
+    let protocolRulesData = null;
+    const ssgResults = [];
+    let ssgTotalCalls = 0;
+    let ssgMatchedCalls = 0;
+    let ssgViolationCount = 0;
+    try {
+        // ── Phase 1-5 Semantic Pipeline ──
+        const callSequences = extractCallSequencesFromProject(ctx.projectPath, ctx.language);
+        const flaggedCount = { value: 0 };
+        const cleanCount = { value: 0 };
+        // ── SSG State Machine: load protocol rules once ──
+        protocolRulesData = (0, ssg_bridge_1.loadProtocolRules)(ctx.projectPath);
+        for (const seq of callSequences) {
+            try {
+                const semantic = await (0, api_semantic_mapper_1.mapSequenceToSemanticWithLLM)(seq.calls);
+                // ── Phase 5: Cross-function propagation ──
+                let enrichedDomains = [];
+                if (callGraph.totalFunctions > 0) {
+                    // IR available: use call graph propagation
+                    const enriched = (0, call_graph_propagator_1.enrichSequence)(semantic.steps, callGraph);
+                    enrichedDomains = enriched.propagatedDomains;
+                    if (enrichedDomains.length > 0)
+                        propagatedCount++;
+                }
+                else if (seq.function && seq.function !== "unknown") {
+                    // C project without IR: use heuristic inference
+                    enrichedDomains = (0, call_graph_propagator_1.inferDomainsFromFunctionName)(seq.function);
+                    for (const call of seq.calls) {
+                        enrichedDomains.push(...(0, call_graph_propagator_1.inferDomainsFromFunctionName)(call));
+                    }
+                }
+                // Merge propagated domains into the semantic sequence
+                // so specific violation checks can use cross-function context
+                if (enrichedDomains.length > 0) {
+                    for (const d of enrichedDomains) {
+                        if (!semantic.domains.includes(d)) {
+                            semantic.domains.push(d);
+                        }
+                    }
+                }
+                // Track coverage stats (exclude JS/Python builtins)
+                const noiseBuiltins = new Set([
+                    "console", "log", "error", "warn", "debug", "info",
+                    "JSON", "Math", "Object", "Array", "String", "Number", "Boolean",
+                    "Promise", "require", "module", "process", "Buffer",
+                    "describe", "it", "test", "expect", "assert", "beforeEach",
+                    "toString", "valueOf", "hasOwnProperty",
+                    "print", "len", "range", "enumerate",
+                ]);
+                for (const step of semantic.steps) {
+                    if (!noiseBuiltins.has(step.api)) {
+                        totalApis++;
+                        if (step.source === "llm")
+                            llmHits++;
+                        else if (step.domain !== "util")
+                            lookupHits++;
+                    }
+                }
+                const validation = (0, protocol_domain_validator_1.validateSemanticSequence)(semantic);
+                if (!validation.valid && validation.reason) {
+                    // Cross-domain violation — report as potential issue
+                    flaggedCount.value++;
+                    violations.push({
+                        severity: "medium",
+                        rule_id: "PROTOCOL_CROSS_DOMAIN",
+                        file: seq.file,
+                        function: seq.function || "unknown",
+                        message: `Cross-domain protocol concern: ${validation.reason}`,
+                        evidence: seq.calls.join(" → "),
+                        why: `Semantic domains [${validation.groups.join(", ")}] flagged as potentially incompatible`,
+                        fix: `Review call sequence for proper protocol transitions between ${validation.groups.join(" and ")}`,
+                        policy_ref: "protocol-safety.semantic",
+                    });
+                }
+                else if (validation.valid && validation.primaryGroup) {
+                    cleanCount.value++;
+                    // ── Phase 2: Run specific violation checks even on CLEAN sequences ──
+                    // A sequence may be a valid protocol operation but still violate
+                    // specific security requirements (e.g., TLS without cert verify)
+                    try {
+                        const specificViolations = (0, protocol_domain_validator_1.checkSpecificViolations)(semantic, seq.file ? path.join(ctx.projectPath, seq.file) : undefined);
+                        for (const sv of specificViolations) {
+                            violations.push({
+                                severity: "medium", // Phase 2: per-function window has inherent limitations
+                                rule_id: sv.ruleId,
+                                file: seq.file,
+                                function: seq.function || "unknown",
+                                message: sv.description,
+                                evidence: sv.evidence,
+                                why: `Protocol security requirement violated: ${sv.description}`,
+                                fix: `Ensure the required security check is performed: ${sv.description}`,
+                                policy_ref: "protocol-safety.specific",
+                            });
+                        }
+                    }
+                    catch { /* best-effort */ }
+                }
+                // ── SSG State Machine Validation ──
+                // Validate the call sequence against protocol state machine rules.
+                // Runs after semantic mapping so we can use domain classification
+                // to bridge real API names to abstract protocol function names.
+                if (protocolRulesData) {
+                    try {
+                        const ssgResult = (0, ssg_bridge_1.validateSequenceWithSSG)(semantic.steps, protocolRulesData.rules, protocolRulesData.namespaceInitialStates, seq.file, protocolRulesData.aliasIndex, protocolRulesData.wildcardAliases);
+                        ssgResults.push(ssgResult);
+                        ssgTotalCalls += ssgResult.stats.totalCalls;
+                        ssgMatchedCalls += ssgResult.stats.matchedCalls;
+                        ssgViolationCount += ssgResult.violations.length;
+                        // Convert SSG violations to TrustViolations and add to pipeline
+                        if (ssgResult.violations.length > 0) {
+                            const trustViolations = (0, ssg_bridge_1.ssgViolationsToTrustViolations)(ssgResult, seq.file, seq.function || "unknown");
+                            for (const tv of trustViolations) {
+                                violations.push(tv);
+                            }
+                        }
+                    }
+                    catch { /* SSG validation best-effort */ }
+                }
+            }
+            catch { /* best-effort per sequence */ }
+        }
+        // If no sequences found or all clean, fall back to risk-model for TP detection
+        if (violations.length === 0) {
+            try {
+                const { assessRisk } = require("../risk-model");
+                const risk = assessRisk(["init", "connect", "authenticate", "read", "write", "close"]);
+                for (const pattern of risk.patterns || []) {
+                    const severity = mapRiskSeverity(pattern.severity);
+                    violations.push({
+                        severity,
+                        rule_id: pattern.id || `RISK_${pattern.patternName?.toUpperCase().replace(/\s+/g, "_") || "UNKNOWN"}`,
+                        file: "unknown",
+                        function: pattern.patternName || "unknown",
+                        message: pattern.detail || pattern.description || "Protocol risk detected",
+                        evidence: pattern.evidenceSequences?.join("; ") || pattern.detail || "",
+                        why: pattern.recommendation || `Detected risk pattern: ${pattern.patternName}`,
+                        fix: pattern.recommendation || "Review and address the detected risk pattern",
+                        policy_ref: "protocol-safety.default",
+                    });
+                }
+            }
+            catch { /* best-effort fallback */ }
+        }
+    }
+    catch { /* best-effort */ }
+    return {
+        violations,
+        coverage: {
+            totalApis,
+            lookupHits,
+            llmHits,
+            propagatedDomains: propagatedCount,
+            graphAvailable: callGraph.totalFunctions > 0,
+        },
+        ssgCoverage: protocolRulesData ? {
+            sequencesValidated: ssgResults.length,
+            totalCalls: ssgTotalCalls,
+            matchedCalls: ssgMatchedCalls,
+            ssgViolations: ssgViolationCount,
+            summary: (0, ssg_bridge_1.summarizeSSGCoverage)(ssgResults),
+            aliasWarnings: protocolRulesData.aliasWarnings?.length
+                ? protocolRulesData.aliasWarnings : undefined,
+        } : undefined,
+    };
+}
+function extractCallSequencesFromProject(projectPath, language) {
+    const sequences = [];
+    try {
+        const fs = require("fs");
+        // Scan multiple common source directories (not just "src/")
+        const candidateDirs = ["src", "server", "app", "lib", "api", "pages", "components", "routes"];
+        const extensions = languageToExtensions(language);
+        const allFiles = [];
+        for (const dir of candidateDirs) {
+            const dirPath = path.join(projectPath, dir);
+            if (!fs.existsSync(dirPath))
+                continue;
+            try {
+                const files = walkDir(dirPath, extensions, 200);
+                allFiles.push(...files);
+            }
+            catch { /* skip inaccessible dirs */ }
+        }
+        // Also scan TypeScript/JS files in root (e.g., next.config.ts, vite.config.ts)
+        try {
+            const rootEntries = fs.readdirSync(projectPath);
+            for (const entry of rootEntries) {
+                const full = path.join(projectPath, entry);
+                if (!fs.statSync(full).isFile())
+                    continue;
+                if (extensions.some((ext) => entry.endsWith(ext))) {
+                    allFiles.push(full);
+                }
+            }
+        }
+        catch { /* best-effort */ }
+        // Limit total files to prevent timeout
+        const files = allFiles.slice(0, 300);
+        for (const file of files) {
+            // Skip test files — test assertions and setup code produce noise
+            // in protocol validation. Real violations come from production code paths.
+            const relFile = path.relative(projectPath, file);
+            if (/\.(test|spec)\.(ts|tsx|js|jsx)$/.test(relFile))
+                continue;
+            if (relFile.includes("/test/") || relFile.includes("/__tests__/"))
+                continue;
+            try {
+                const content = fs.readFileSync(file, "utf-8");
+                const calls = extractCallsFromSource(content);
+                if (calls.length >= 4) {
+                    sequences.push({
+                        calls,
+                        file: path.relative(projectPath, file),
+                        function: extractTopFunction(content),
+                    });
+                }
+            }
+            catch { /* skip unreadable files */ }
+        }
+    }
+    catch { /* best-effort */ }
+    return sequences;
+}
+/**
+ * Extract function call names from source code using simple regex.
+ * Filters out keywords, operators, and common noise.
+ */
+function extractCallsFromSource(source) {
+    const calls = [];
+    const callRegex = /\b([a-zA-Z_]\w*(?:\.[a-zA-Z_]\w*)*)\s*\(/g;
+    const keywords = new Set([
+        "if", "for", "while", "switch", "return", "sizeof", "typeof",
+        "defined", "endif", "ifdef", "ifndef", "else", "elif",
+        "case", "default", "break", "continue", "goto",
+        "void", "int", "char", "long", "short", "float", "double",
+        "struct", "enum", "union", "typedef", "static", "const", "volatile",
+        "new", "delete", "class", "public", "private", "protected",
+        "try", "catch", "throw", "finally", "async", "await",
+    ]);
+    let match;
+    callRegex.lastIndex = 0;
+    while ((match = callRegex.exec(source)) !== null) {
+        const name = match[1];
+        if (!keywords.has(name) && !name.startsWith("_")) {
+            calls.push(name);
+        }
+    }
+    return calls;
+}
+/**
+ * Extract the top-level function name from source code.
+ */
+function extractTopFunction(source) {
+    const m = source.match(/(?:function\s+|def\s+|func\s+)(\w+)/);
+    if (m)
+        return m[1];
+    const m2 = source.match(/(?:int\s+|void\s+|static\s+\w+\s+)(\w+)\s*\(/);
+    if (m2)
+        return m2[1];
+    return "unknown";
+}
+// ── Verification Coverage Collector ──
+function collectVerificationCoverage(ctx) {
+    const coverage = {};
+    // SSG Rules
+    try {
+        const { buildCoverageReport } = require("../ssg-validator");
+        const report = buildCoverageReport?.();
+        if (report?.coverage !== undefined && !Number.isNaN(report.coverage)) {
+            coverage.ssgRules = Math.round(report.coverage * 30); // max 30
+        }
+        else {
+            coverage.ssgRules = 15; // conservative default
+        }
+    }
+    catch {
+        coverage.ssgRules = 10;
+    }
+    // Ledger Invariant
+    try {
+        const { getAllSessions } = require("../failure-corpus");
+        const sessions = getAllSessions?.() || [];
+        const consistentCount = sessions.filter((s) => {
+            try {
+                const { checkLedgerConsistency } = require("../ssg-validator");
+                const { getNsInit } = require("../protocol-registry");
+                const trans = (s.attempts || []).flatMap((a) => a.transitions || []);
+                if (trans.length === 0)
+                    return false;
+                const result = checkLedgerConsistency(trans, getNsInit());
+                return result.consistent;
+            }
+            catch {
+                return false;
+            }
+        }).length;
+        coverage.ledgerInvariant = sessions.length > 0
+            ? Math.round((consistentCount / sessions.length) * 20)
+            : 20; // assume passed if no sessions
+    }
+    catch {
+        coverage.ledgerInvariant = 20;
+    }
+    // Coverage
+    try {
+        const { getAntibodyStats } = require("../failure-corpus");
+        const stats = getAntibodyStats?.();
+        if (stats?.totalHits !== undefined) {
+            // Map antibody hits to coverage score (max 15)
+            coverage.coverage = Math.min(15, Math.round((stats.totalHits || 0) / 10));
+        }
+        else {
+            coverage.coverage = 8;
+        }
+    }
+    catch {
+        coverage.coverage = 5;
+    }
+    // TypeScript Type Check — always assume project handles this
+    coverage.typescriptTypeCheck = ctx.language === "typescript" || !ctx.language ? 25 : 0;
+    // Failure Genome
+    try {
+        const { getAntibodyStats } = require("../failure-corpus");
+        const stats = getAntibodyStats?.();
+        if (stats?.byLevel) {
+            const totalSignatures = Object.values(stats.byLevel).reduce((a, b) => a + (b || 0), 0);
+            coverage.failureGenome = Math.min(10, Math.round(totalSignatures / 5));
+        }
+        else {
+            coverage.failureGenome = 5;
+        }
+    }
+    catch {
+        coverage.failureGenome = 5;
+    }
+    return coverage;
+}
+// ── Governance Defect Collector ──
+function collectGovernanceDefects(_ctx) {
+    const defects = [];
+    try {
+        const { verifyAllFingerprints } = require("../ledger-registry");
+        const summary = verifyAllFingerprints?.();
+        if (summary) {
+            if ((summary.tampered || 0) > 0) {
+                for (let i = 0; i < summary.tampered; i++) {
+                    defects.push({ type: "hashMismatch" });
+                }
+            }
+            if ((summary.notFound || 0) > 0) {
+                defects.push({ type: "auditIncomplete" });
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    // Check ledger registry existence
+    try {
+        const fs = require("fs");
+        const ledgerPath = path.join(_ctx.projectPath, ".progmune_corpus", "ledger");
+        if (fs.existsSync(ledgerPath)) {
+            const files = fs.readdirSync(ledgerPath);
+            if (files.length === 0) {
+                defects.push({ type: "ledgerMissing" });
+            }
+        }
+        else {
+            defects.push({ type: "ledgerMissing" });
+        }
+    }
+    catch {
+        defects.push({ type: "auditIncomplete" });
+    }
+    return defects;
+}
+// ═══════════════════════════════════════════════
+//  UTILITY FUNCTIONS
+// ═══════════════════════════════════════════════
+function mapRiskSeverity(severity) {
+    switch ((severity || "").toLowerCase()) {
+        case "critical": return "critical";
+        case "high": return "high";
+        case "medium": return "medium";
+        default: return "low";
+    }
+}
+function extractFunctionName(text) {
+    if (!text)
+        return "unknown";
+    // Try to find function name patterns
+    const m = text.match(/(?:in|at|function|method)\s+[`']?(\w+)[`']?/i);
+    if (m)
+        return m[1];
+    const m2 = text.match(/(\w+)\s*\(/);
+    if (m2)
+        return m2[1];
+    return "unknown";
+}
+function extractFunctionAtLine(lines, lineNum) {
+    // Search backward for a function definition
+    for (let i = lineNum - 1; i >= Math.max(0, lineNum - 30); i--) {
+        const line = lines[i]?.trim() || "";
+        const m = line.match(/(?:function\s+(\w+)|(\w+)\s*[=:]\s*(?:async\s*)?\(|(\w+)\s*\([^)]*\)\s*\{)/);
+        if (m)
+            return m[1] || m[2] || m[3] || "unknown";
+    }
+    return "unknown";
+}
+/**
+ * Recursively walk a directory, collecting file paths matching extensions.
+ */
+function languageToExtensions(language) {
+    switch (language) {
+        case "python": return [".py"];
+        case "c": return [".c", ".h"];
+        case "go": return [".go"];
+        case "java": return [".java"];
+        case "typescript":
+        case "javascript":
+        default:
+            return [".ts", ".tsx", ".js"];
+    }
+}
+function walkDir(dir, extensions, maxFiles) {
+    const results = [];
+    try {
+        const fs = require("fs");
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (results.length >= maxFiles)
+                break;
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules") {
+                results.push(...walkDir(fullPath, extensions, maxFiles - results.length));
+            }
+            else if (entry.isFile()) {
+                const ext = path.extname(entry.name);
+                if (extensions.includes(ext)) {
+                    results.push(fullPath);
+                }
+            }
+        }
+    }
+    catch { /* best-effort */ }
+    return results;
+}