progmune-runtime 2.1.5 → 3.2.0

package/dist/gold-tiers.js

@@ -0,0 +1,241 @@
+"use strict";
+/**
+ * P9.2e: Three-Tier Gold Data System with Annotation Benefit Scoring
+ *
+ * Tier 1 (Verified Gold):   Git Diff + human verified + before/after SM
+ * Tier 2 (Silver Gold):     Git Diff + auto-extracted + human spot-check
+ * Tier 3 (Raw CVE Pool):    NVD / GitHub Advisory / OSS-Fuzz, auto-scored
+ *
+ * Data flywheel: Raw → assessGoldQuality() → Silver → human verify → Gold
+ *
+ * Annotation Benefit Score:
+ *   benefit = quality × novelty × coverage_gain
+ *
+ * This prevents over-annotating already-well-covered categories
+ * (e.g., 30th auth_bypass) and prioritizes rare but valuable cases
+ * (e.g., first session_fixation, double_free).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeBenefit = computeBenefit;
+exports.buildTieredDataset = buildTieredDataset;
+exports.getAnnotationPriorities = getAnnotationPriorities;
+exports.printTieredReport = printTieredReport;
+const gold_quality_1 = require("./gold-quality");
+// ═══════════════════════════════════════════════════════════════
+// Category registry — all known lifecycle vulnerability types
+// ═══════════════════════════════════════════════════════════════
+const ALL_CATEGORIES = [
+    "resource_leak",
+    "auth_bypass",
+    "use_after_free",
+    "double_free",
+    "race_condition",
+    "data_corruption",
+    "transaction_violation",
+    "session_fixation",
+    "privilege_escalation",
+    "missing_validation",
+];
+// ═══════════════════════════════════════════════════════════════
+// Annotation Benefit Scoring
+// ═══════════════════════════════════════════════════════════════
+/**
+ * Compute the annotation benefit score for a candidate case.
+ *
+ * benefit = quality × novelty × coverage_gain
+ *
+ * quality:       how detectable is this case? (0-1, from assessGoldQuality)
+ * novelty:       how rare is this category in the existing gold set? (0-1)
+ * coverage_gain: would adding this case cover a new category? (1.0 if new, 0.5 if existing)
+ *
+ * High benefit = rare category + good structural signal.
+ * Low benefit = already-well-covered category or weak signal.
+ */
+function computeBenefit(quality, category, existingGoldByCategory) {
+    // Quality: direct from assessor
+    const q = Math.max(0, Math.min(1, quality));
+    // Novelty: inverse of how many gold cases we already have in this category
+    const existingCount = existingGoldByCategory[category] || 0;
+    const novelty = 1.0 / (1.0 + existingCount * 0.3);
+    // With 0 existing: novelty = 1.0
+    // With 10 existing: novelty = 0.25
+    // With 30 existing: novelty = 0.1
+    // Coverage gain: bonus for entirely new categories
+    const isNew = existingCount === 0;
+    const coverage = isNew ? 1.0 : 0.5;
+    const benefit = q * novelty * coverage;
+    return Math.round(benefit * 1000) / 1000;
+}
+// ═══════════════════════════════════════════════════════════════
+// Build the tiered dataset
+// ═══════════════════════════════════════════════════════════════
+function buildTieredDataset() {
+    const cases = [];
+    // ── Tier 1: Verified Gold (curated + diff-based) ──
+    const { REAL_WORLD_DEFECTS } = require("./realworld-benchmark");
+    for (const d of REAL_WORLD_DEFECTS) {
+        const q = (0, gold_quality_1.assessGoldQuality)(d.broken, d.expected);
+        cases.push({
+            id: d.id,
+            tier: "gold",
+            category: d.category,
+            broken: d.broken,
+            expected: d.expected,
+            quality: q.score,
+            verified: true,
+            source: "curated",
+            benefit: 0, // computed after category counts are known
+            notes: d.description,
+        });
+    }
+    // Diff-based gold from gold-seed.json
+    try {
+        const fs = require("fs");
+        const path = require("path");
+        const seedPath = path.resolve(__dirname, "..", "benchmarks", "gold-seed.json");
+        if (fs.existsSync(seedPath)) {
+            const seed = JSON.parse(fs.readFileSync(seedPath, "utf-8"));
+            for (const c of seed) {
+                const q = (0, gold_quality_1.assessGoldQuality)(c.before, c.after);
+                cases.push({
+                    id: `GOLD-${c.cve}`,
+                    tier: "gold",
+                    category: c.category,
+                    broken: c.before,
+                    expected: c.after,
+                    quality: q.score,
+                    verified: true,
+                    source: "git_diff",
+                    benefit: 0,
+                    notes: c.notes,
+                });
+            }
+        }
+    }
+    catch { }
+    // ── Tier 3: Raw CVE Pool (synthetic, awaiting assessment) ──
+    try {
+        const { createProtocolForTopology, ALL_TOPOLOGIES } = require("./topology-factory");
+        const categories = [
+            "resource_leak", "auth_bypass", "data_corruption",
+            "use_after_free", "race_condition",
+        ];
+        let sid = 500;
+        for (const topo of ALL_TOPOLOGIES) {
+            const rules = createProtocolForTopology(topo);
+            const entries = [...rules.entries()];
+            if (entries.length < 2)
+                continue;
+            for (let v = 0; v < 3; v++) {
+                const path = [];
+                const ss = new Set(["INIT", "IDLE"]);
+                const s = entries[Math.floor(Math.random() * entries.length)];
+                path.push(s[0]);
+                const r = s[1];
+                if (r.invalidate)
+                    r.invalidate.forEach((x) => ss.delete(x));
+                for (const x of r.post_states)
+                    ss.add(x);
+                for (let t = 0; t < 4; t++) {
+                    const cands = entries.filter(([, rr]) => rr.pre_states.every((x) => ss.has(x)));
+                    if (!cands.length)
+                        break;
+                    const [fn, nr] = cands[Math.floor(Math.random() * cands.length)];
+                    path.push(fn);
+                    if (nr.invalidate)
+                        nr.invalidate.forEach((x) => ss.delete(x));
+                    for (const x of nr.post_states)
+                        ss.add(x);
+                }
+                if (path.length < 3)
+                    continue;
+                const cat = categories[sid % categories.length];
+                const broken = path.slice(0, -1);
+                const expected = path;
+                const q = (0, gold_quality_1.assessGoldQuality)(broken, expected);
+                cases.push({
+                    id: `RAW-${sid++}`,
+                    tier: q.detectable ? "silver" : "raw",
+                    category: cat,
+                    broken,
+                    expected,
+                    quality: q.score,
+                    verified: false,
+                    source: "synthetic",
+                    benefit: 0,
+                });
+            }
+        }
+    }
+    catch { }
+    // ── Compute benefit scores using final category counts ──
+    const goldByCategory = {};
+    for (const c of cases) {
+        if (c.tier === "gold") {
+            goldByCategory[c.category] = (goldByCategory[c.category] || 0) + 1;
+        }
+    }
+    for (const c of cases) {
+        c.benefit = computeBenefit(c.quality, c.category, goldByCategory);
+    }
+    // ── Build metadata ──
+    const byTier = { gold: 0, silver: 0, raw: 0 };
+    const byCategory = {};
+    for (const c of cases) {
+        byTier[c.tier] = (byTier[c.tier] || 0) + 1;
+        byCategory[c.category] = (byCategory[c.category] || 0) + 1;
+    }
+    const coveredCategories = ALL_CATEGORIES.filter(cat => cases.some(c => c.tier === "gold" && c.category === cat));
+    const uncoveredCategories = ALL_CATEGORIES.filter(cat => !coveredCategories.includes(cat));
+    return {
+        cases,
+        metadata: {
+            total: cases.length,
+            byTier,
+            byCategory,
+            coveredCategories,
+            uncoveredCategories,
+        },
+    };
+}
+function getAnnotationPriorities(dataset) {
+    const priorities = [];
+    for (const cat of ALL_CATEGORIES) {
+        const goldCount = dataset.cases.filter(c => c.tier === "gold" && c.category === cat).length;
+        const pending = dataset.cases.filter(c => c.tier !== "gold" && c.category === cat);
+        const pendingCount = pending.length;
+        const avgBenefit = pending.length > 0
+            ? pending.reduce((s, c) => s + c.benefit, 0) / pending.length
+            : (goldCount === 0 ? 0.8 : 0); // uncovered categories get high priority
+        priorities.push({ category: cat, goldCount, pendingCount, avgBenefit, rank: 0 });
+    }
+    // Rank by avgBenefit descending
+    priorities.sort((a, b) => b.avgBenefit - a.avgBenefit);
+    priorities.forEach((p, i) => { p.rank = i + 1; });
+    return priorities;
+}
+// ═══════════════════════════════════════════════════════════════
+// Reporting
+// ═══════════════════════════════════════════════════════════════
+function printTieredReport(dataset) {
+    console.log("\n╔════════════════════════════════════════════════════╗");
+    console.log("║   P9.2e Three-Tier Gold Data System                ║");
+    console.log("╚════════════════════════════════════════════════════╝\n");
+    console.log(`  Total cases: ${dataset.metadata.total}`);
+    console.log(`  Tier 1 (Gold):   ${dataset.metadata.byTier.gold} (verified)`);
+    console.log(`  Tier 2 (Silver): ${dataset.metadata.byTier.silver} (auto, detectable)`);
+    console.log(`  Tier 3 (Raw):    ${dataset.metadata.byTier.raw} (auto, pending)`);
+    console.log();
+    console.log(`  Covered categories:   ${dataset.metadata.coveredCategories.join(", ") || "none"}`);
+    console.log(`  Uncovered categories: ${dataset.metadata.uncoveredCategories.join(", ") || "none"}`);
+    console.log();
+    const priorities = getAnnotationPriorities(dataset);
+    console.log(`  ── Annotation Priority ──`);
+    console.log(`  ${'Rank'.padEnd(6)} ${'Category'.padEnd(22)} ${'Gold'.padEnd(6)} ${'Pending'.padEnd(8)} ${'Avg Benefit'}`);
+    console.log(`  ${'─'.repeat(62)}`);
+    for (const p of priorities) {
+        const icon = p.goldCount === 0 ? "🆕" : p.goldCount < 3 ? "⚠️" : "✅";
+        console.log(`  ${String(p.rank).padEnd(6)} ${icon} ${p.category.padEnd(20)} ${String(p.goldCount).padEnd(6)} ${String(p.pendingCount).padEnd(8)} ${p.avgBenefit.toFixed(3)}`);
+    }
+    console.log();
+}

package/dist/governance-dashboard.js

@@ -0,0 +1,327 @@
+"use strict";
+/**
+ * Phase 12: Governance Dashboard
+ *
+ * CEO/CISO-ready web dashboard for AI Code Governance.
+ * Shows the 4 key metrics, risk level, and recent activity.
+ *
+ * Usage:
+ *   npx ts-node src/governance-dashboard.ts
+ *   PROGMUNE_DASH_PORT=3200 npx ts-node src/governance-dashboard.ts
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const http = __importStar(require("http"));
+const PORT = parseInt(process.env.PROGMUNE_DASH_PORT || "3200", 10);
+// ═══════════════════════════════════════════════════════════════
+// Data API
+// ═══════════════════════════════════════════════════════════════
+function getDashboardData() {
+    const { getAllSessions, getAntibodyStats } = require("./failure-corpus");
+    const { verifyAllFingerprints } = require("./ledger-registry");
+    const { buildPLSB, PROTOCOL_WEAKNESS_TAXONOMY } = require("./plsb-benchmark");
+    const sessions = getAllSessions();
+    const fpSummary = verifyAllFingerprints();
+    const abStats = getAntibodyStats();
+    const benchmark = buildPLSB();
+    const taxonomy = PROTOCOL_WEAKNESS_TAXONOMY;
+    const byPLS = benchmark.metadata?.byPLS || {};
+    // Per-session analysis
+    let validated = 0;
+    let failed = 0;
+    let tampered = 0;
+    let totalTransitions = 0;
+    for (const s of sessions) {
+        let trans = [];
+        for (const a of s.attempts || [])
+            trans = trans.concat(a.transitions || []);
+        totalTransitions += trans.length;
+        const hasViolations = (s.attempts || []).some((a) => (a.violations || []).length > 0);
+        if (hasViolations)
+            failed++;
+        else
+            validated++;
+    }
+    tampered = fpSummary.tampered || 0;
+    // Risk level
+    const total = sessions.length;
+    let riskLevel = "PASS";
+    let riskColor = "#22c55e";
+    if (tampered > 0) {
+        riskLevel = "FAIL";
+        riskColor = "#ef4444";
+    }
+    else if (total > 0 && validated / total < 0.85) {
+        riskLevel = "WARN";
+        riskColor = "#f59e0b";
+    }
+    else if (failed > total * 0.1) {
+        riskLevel = "WARN";
+        riskColor = "#f59e0b";
+    }
+    // PLSB
+    const covered = taxonomy.filter((t) => (byPLS[t.id] || 0) > 0).length;
+    // Recent sessions
+    const recent = sessions
+        .filter((s) => s.attempts?.length > 0)
+        .slice(-10)
+        .reverse()
+        .map((s) => {
+        let trans = 0;
+        let viols = 0;
+        for (const a of s.attempts || []) {
+            trans += (a.transitions || []).length;
+            viols += (a.violations || []).length;
+        }
+        return {
+            sessionId: s.sessionId?.slice(0, 24),
+            intent: (s.intent || "").slice(0, 50),
+            transitions: trans,
+            violations: viols,
+            outcome: viols === 0 ? "pass" : "violation",
+        };
+    });
+    return {
+        timestamp: new Date().toISOString(),
+        risk: { level: riskLevel, color: riskColor },
+        assets: {
+            total: total,
+            validated: validated,
+            failed: failed,
+            tampered: tampered,
+        },
+        transitions: totalTransitions,
+        fingerprints: {
+            total: fpSummary.total || 0,
+            verified: fpSummary.valid || 0,
+            tampered: fpSummary.tampered || 0,
+        },
+        antibodies: {
+            totalHits: abStats.totalHits || 0,
+            fastPath: abStats.fastPathHits || 0,
+            llmSaved: abStats.totalLLMCallsSaved || 0,
+            tokensSaved: abStats.totalTokensSaved || 0,
+        },
+        plsb: {
+            version: benchmark.version || "1.0",
+            entries: benchmark.metadata?.total || 0,
+            categoriesCovered: covered,
+            categoriesTotal: taxonomy.length,
+            recall: ((benchmark.metadata?.recall || 0) * 100).toFixed(0),
+        },
+        recent,
+    };
+}
+// ═══════════════════════════════════════════════════════════════
+// HTML Template
+// ═══════════════════════════════════════════════════════════════
+function renderHTML() {
+    return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta http-equiv="refresh" content="30">
+<title>Progmune Governance Dashboard</title>
+<style>
+*{margin:0;padding:0;box-sizing:border-box}
+body{
+  font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;
+  background:#0a0a0a;color:#d4d4d4;min-height:100vh
+}
+.header{
+  background:#111;border-bottom:1px solid #222;padding:16px 24px;
+  display:flex;justify-content:space-between;align-items:center
+}
+.header h1{font-size:18px;font-weight:600;color:#fff}
+.header .sub{font-size:12px;color:#666}
+.grid{display:grid;grid-template-columns:repeat(4,1fr);gap:16px;padding:24px;max-width:1200px;margin:0 auto}
+.metric{
+  background:#111;border:1px solid #222;border-radius:8px;padding:20px;
+  text-align:center
+}
+.metric .value{font-size:36px;font-weight:700;line-height:1.2}
+.metric .label{font-size:12px;color:#666;margin-top:4px;text-transform:uppercase;letter-spacing:0.5px}
+.risk-banner{
+  max-width:1200px;margin:0 auto;padding:0 24px 16px;
+  display:flex;justify-content:center
+}
+.risk-badge{
+  padding:12px 32px;border-radius:8px;font-size:16px;font-weight:700;
+  text-align:center;min-width:300px
+}
+.section{max-width:1200px;margin:0 auto;padding:0 24px 24px}
+.section h2{font-size:14px;color:#888;margin-bottom:12px;text-transform:uppercase;letter-spacing:0.5px}
+.cards{display:grid;grid-template-columns:repeat(3,1fr);gap:16px}
+.card{
+  background:#111;border:1px solid #222;border-radius:8px;padding:16px
+}
+.card .title{font-size:12px;color:#666;margin-bottom:8px;text-transform:uppercase}
+.card .big{font-size:24px;font-weight:600;color:#fff}
+.card .detail{font-size:12px;color:#888;margin-top:4px}
+table{width:100%;border-collapse:collapse}
+table th{text-align:left;font-size:11px;color:#666;padding:8px 12px;border-bottom:1px solid #222}
+table td{font-size:13px;padding:8px 12px;border-bottom:1px solid #111}
+table tr:hover td{background:#151515}
+.tag{padding:2px 8px;border-radius:4px;font-size:11px;font-weight:600}
+.tag-pass{background:#052e16;color:#22c55e}
+.tag-fail{background:#450a0a;color:#ef4444}
+.footer{text-align:center;padding:24px;color:#444;font-size:11px}
+.bar{height:6px;border-radius:3px;background:#222;margin-top:8px;overflow:hidden}
+.bar-fill{height:100%;border-radius:3px;transition:width .3s}
+</style>
+</head>
+<body>
+<div class="header">
+  <div>
+    <h1>Progmune Governance</h1>
+    <div class="sub">AI Code Governance Dashboard</div>
+  </div>
+  <div class="sub" id="time">—</div>
+</div>
+<div id="app">Loading...</div>
+<div class="footer">
+  Progmune Runtime — AI Generated Software Governance
+  &nbsp;·&nbsp;
+  <a href="https://github.com/shenlian19831109/progmune-runtime" style="color:#666">GitHub</a>
+</div>
+<script>
+async function load() {
+  try {
+    const r = await fetch('/api/dashboard');
+    const d = await r.json();
+    render(d);
+  } catch(e) {
+    document.getElementById('app').innerHTML =
+      '<div style="text-align:center;padding:60px;color:#ef4444">⚠️ Unable to load dashboard data</div>';
+  }
+}
+
+function render(d) {
+  document.getElementById('time').textContent =
+    new Date(d.timestamp).toLocaleString();
+
+  const pct = d.assets.total > 0
+    ? Math.round(d.assets.validated / d.assets.total * 100) : 0;
+
+  const html = '<div class="risk-banner">' +
+    '<div class="risk-badge" style="background:'+d.risk.color+'15;color:'+d.risk.color+';border:1px solid '+d.risk.color+'40">' +
+    'Risk Level: <strong>' + d.risk.level + '</strong>' +
+    '</div></div>' +
+
+    '<div class="grid">' +
+    metric(d.assets.total, 'AI Assets', '#fff', 'Total AI-generated code files tracked') +
+    metric(d.assets.validated, 'Verified', '#22c55e', pct+'% validation rate') +
+    metric(d.assets.failed, 'Failed', '#f59e0b', d.assets.failed + ' files with violations') +
+    metric(d.assets.tampered, 'Tampered', '#ef4444', d.assets.tampered + ' broken provenance chains') +
+    '</div>' +
+
+    '<div class="section"><h2>System Overview</h2><div class="cards">' +
+    card('Fingerprints', d.fingerprints.verified + ' / ' + d.fingerprints.total,
+      d.fingerprints.tampered + ' tampered',
+      (d.fingerprints.total > 0 ? Math.round(d.fingerprints.verified/d.fingerprints.total*100) : 0) + '%') +
+    card('PLSB Coverage', d.plsb.categoriesCovered + ' / ' + d.plsb.categoriesTotal,
+      d.plsb.entries + ' entries · recall ' + d.plsb.recall + '%',
+      Math.round(d.plsb.categoriesCovered/d.plsb.categoriesTotal*100) + '%') +
+    card('Immune System', d.antibodies.totalHits + ' hits',
+      d.antibodies.llmSaved + ' LLM calls · ' + (d.antibodies.tokensSaved||0).toLocaleString() + ' tokens saved',
+      (d.antibodies.totalHits > 0 ? Math.round(d.antibodies.fastPath/d.antibodies.totalHits*100) : 0) + '% fast-path') +
+    '</div></div>' +
+
+    '<div class="section"><h2>Recent Activity</h2>' +
+    '<table><tr><th>Session</th><th>Intent</th><th>Transitions</th><th>Status</th></tr>' +
+    d.recent.map(s =>
+      '<tr>' +
+      '<td style="font-family:monospace;font-size:11px">' + esc(s.sessionId) + '</td>' +
+      '<td>' + esc(s.intent) + '</td>' +
+      '<td>' + s.transitions + '</td>' +
+      '<td><span class="tag '+(s.outcome==='pass'?'tag-pass':'tag-fail')+'">' +
+      (s.outcome==='pass' ? '✓ PASS' : '✗ '+s.violations+' violations') +
+      '</span></td></tr>'
+    ).join('') +
+    '</table></div>';
+
+  document.getElementById('app').innerHTML = html;
+}
+
+function metric(value, label, color, detail) {
+  return '<div class="metric">' +
+    '<div class="value" style="color:'+color+'">' + value.toLocaleString() + '</div>' +
+    '<div class="label">' + label + '</div>' +
+    '<div style="font-size:11px;color:#555;margin-top:4px">' + detail + '</div>' +
+    '</div>';
+}
+
+function card(title, big, detail, pct) {
+  return '<div class="card">' +
+    '<div class="title">' + title + '</div>' +
+    '<div class="big">' + big + '</div>' +
+    '<div class="detail">' + detail + '</div>' +
+    '<div class="bar"><div class="bar-fill" style="width:'+pct+';background:#333"></div></div>' +
+    '</div>';
+}
+
+function esc(s) { const d=document.createElement('div');d.textContent=s||'';return d.innerHTML }
+
+load();
+</script>
+</body>
+</html>`;
+}
+// ═══════════════════════════════════════════════════════════════
+// Server
+// ═══════════════════════════════════════════════════════════════
+const server = http.createServer((req, res) => {
+    const url = req.url || "/";
+    // API: dashboard data
+    if (url === "/api/dashboard") {
+        try {
+            const data = getDashboardData();
+            res.writeHead(200, { "Content-Type": "application/json", "Access-Control-Allow-Origin": "*" });
+            res.end(JSON.stringify(data));
+        }
+        catch (e) {
+            res.writeHead(500, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: e.message }));
+        }
+        return;
+    }
+    // HTML: dashboard page
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(renderHTML());
+});
+server.listen(PORT, () => {
+    console.error(`\n  Governance Dashboard: http://localhost:${PORT}\n`);
+});