swarm-orchestrator 7.0.0-alpha.0

package/dist/src/verification/attestation.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signWithCosignKey = exports.signWithCosign = void 0;
+exports.createAttestationEnvelope = createAttestationEnvelope;
+exports.unsignedTestSigner = unsignedTestSigner;
+exports.generateSignedAttestation = generateSignedAttestation;
+exports.attachAttestationNote = attachAttestationNote;
+exports.readAttestationNote = readAttestationNote;
+exports.verifyAttestation = verifyAttestation;
+const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+const cosign_attestation_1 = require("./cosign-attestation");
+var cosign_attestation_2 = require("./cosign-attestation");
+Object.defineProperty(exports, "signWithCosign", { enumerable: true, get: function () { return cosign_attestation_2.signWithCosign; } });
+Object.defineProperty(exports, "signWithCosignKey", { enumerable: true, get: function () { return cosign_attestation_2.signWithCosignKey; } });
+const NOTE_REF = 'refs/notes/swarm-attestation';
+const BUILD_TYPE = 'https://github.com/moonrunnerkc/swarm-orchestrator/attestation/v7';
+function sha256(text) {
+    return (0, crypto_1.createHash)('sha256').update(text).digest('hex');
+}
+function git(repoPath, args) {
+    return (0, child_process_1.execFileSync)('git', args, {
+        cwd: repoPath,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    }).trim();
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function parseSignedAttestation(raw) {
+    const parsed = JSON.parse(raw);
+    if (!isRecord(parsed) || !isRecord(parsed.envelope) || !isRecord(parsed.signature)) {
+        throw new Error('attestation note is not a signed attestation object');
+    }
+    return parsed;
+}
+/**
+ * Build an in-toto SLSA v1.0 provenance statement for an agent-authored commit.
+ *
+ * @param input - Attestation fields collected from the verification run.
+ * @returns Unsigned in-toto statement.
+ */
+function createAttestationEnvelope(input) {
+    const timestamp = input.timestamp ?? new Date().toISOString();
+    return {
+        _type: 'https://in-toto.io/Statement/v1',
+        subject: [{
+                name: 'git-commit',
+                digest: { sha1: input.commit },
+            }],
+        predicateType: 'https://slsa.dev/provenance/v1',
+        predicate: {
+            buildType: BUILD_TYPE,
+            invocation: {
+                parameters: {
+                    goalHash: sha256(input.goalText),
+                    planHash: input.planHash,
+                },
+            },
+            buildConfig: input.agent,
+            metadata: {
+                transcriptHash: sha256(input.transcript),
+                layerResults: input.layerResults,
+                compositeScore: input.compositeScore,
+                timestamp,
+            },
+        },
+    };
+}
+/**
+ * Deterministic non-production signer for local tests.
+ *
+ * @param envelope - In-toto statement to mark as test-signed.
+ * @returns Test signature marker.
+ */
+async function unsignedTestSigner(envelope) {
+    return {
+        kind: 'unsigned-test',
+        signature: sha256(JSON.stringify(envelope)),
+    };
+}
+/**
+ * Generate and sign an attestation.
+ *
+ * @param input - Attestation input and optional signer override.
+ * @returns Signed attestation object.
+ */
+async function generateSignedAttestation(input) {
+    const envelope = createAttestationEnvelope(input);
+    const signer = input.signer ?? cosign_attestation_1.signWithCosign;
+    return {
+        envelope,
+        signature: await signer(envelope, input.repoPath),
+    };
+}
+/**
+ * Attach a signed attestation to a commit as a git note.
+ *
+ * @param repoPath - Repository root.
+ * @param commit - Commit hash to annotate.
+ * @param attestation - Signed attestation payload.
+ */
+function attachAttestationNote(repoPath, commit, attestation) {
+    git(repoPath, [
+        'notes',
+        `--ref=${NOTE_REF}`,
+        'add',
+        '-f',
+        '-m',
+        JSON.stringify(attestation),
+        commit,
+    ]);
+}
+/**
+ * Read a swarm attestation git note for a commit.
+ *
+ * @param repoPath - Repository root.
+ * @param commit - Commit hash.
+ * @returns Parsed attestation, or undefined when no note exists.
+ */
+function readAttestationNote(repoPath, commit) {
+    try {
+        return parseSignedAttestation(git(repoPath, ['notes', `--ref=${NOTE_REF}`, 'show', commit]));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Verify a swarm attestation note.
+ *
+ * Cosign signatures are verified with `cosign verify-blob` when present. The
+ * `unsigned-test` signature kind is accepted only for local deterministic tests.
+ *
+ * @param repoPath - Repository root.
+ * @param commit - Commit hash to verify.
+ * @returns Verification result and parsed attestation when found.
+ */
+async function verifyAttestation(repoPath, commit) {
+    const attestation = readAttestationNote(repoPath, commit);
+    if (!attestation) {
+        return { found: false, verified: false, reason: 'no attestation found' };
+    }
+    const subject = attestation.envelope.subject[0]?.digest.sha1;
+    if (subject !== commit) {
+        return {
+            found: true,
+            verified: false,
+            reason: `attestation subject ${subject ?? 'missing'} does not match commit ${commit}`,
+            attestation,
+        };
+    }
+    if (attestation.signature.kind === 'unsigned-test') {
+        const expected = sha256(JSON.stringify(attestation.envelope));
+        return {
+            found: true,
+            verified: attestation.signature.signature === expected,
+            reason: attestation.signature.signature === expected
+                ? 'unsigned test attestation verified structurally'
+                : 'unsigned test attestation signature mismatch',
+            attestation,
+        };
+    }
+    return (0, cosign_attestation_1.verifyCosignSignature)(repoPath, attestation);
+}

package/dist/src/verification/cheat-detector.js

@@ -0,0 +1,240 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCheatDetector = runCheatDetector;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const diff_analysis_1 = require("./diff-analysis");
+const command_runner_1 = require("./command-runner");
+function gitDiff(input) {
+    if (input.diffText !== undefined)
+        return input.diffText;
+    const args = input.baseRef && input.patchRef
+        ? ['diff', '--unified=0', `${input.baseRef}..${input.patchRef}`]
+        : ['diff', '--unified=0'];
+    return (0, child_process_1.execFileSync)('git', args, {
+        cwd: input.repoPath,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+}
+function findSemgrepConfig(input) {
+    const candidates = [
+        input.semgrepConfigDir,
+        path.join(process.cwd(), 'config', 'semgrep-rules'),
+        path.join(__dirname, '..', '..', '..', 'config', 'semgrep-rules'),
+        path.join(__dirname, '..', '..', 'config', 'semgrep-rules'),
+    ].filter((candidate) => Boolean(candidate));
+    return candidates.find(candidate => fs.existsSync(candidate));
+}
+function addedLineCount(files) {
+    return files.reduce((sum, file) => (sum + file.lines.filter(line => line.kind === 'add' && line.content.trim()).length), 0);
+}
+function changedImplementationFiles(files) {
+    return files.filter(file => !(0, diff_analysis_1.isTestFilePath)(file.newPath));
+}
+function changedTestFiles(files) {
+    return files.filter(file => (0, diff_analysis_1.isTestFilePath)(file.newPath));
+}
+function detectTestModification(files, allowedTestFiles) {
+    const allowed = new Set(allowedTestFiles ?? []);
+    return changedTestFiles(files)
+        .filter(file => !allowed.has(file.newPath))
+        .map(file => ({
+        rule: 'test-modification',
+        severity: 'high',
+        filePath: file.newPath,
+        explanation: 'patch modifies a test file that was not listed in the goal allowlist',
+    }));
+}
+function detectComplexityMismatch(files, goalText) {
+    // Only scan the goal title (first non-empty line). Long-form issue prose
+    // contains many commas and conjunctions that do not represent goal steps.
+    const title = goalText.split(/\r?\n/).find(line => line.trim() !== '') ?? '';
+    const multiStepSignals = (title.match(/\b(?:and|with|including|plus|also|all|multiple)\b|[,;]/gi) ?? []).length;
+    if (multiStepSignals < 3 || addedLineCount(files) >= 5)
+        return [];
+    return [{
+            rule: 'complexity-mismatch',
+            severity: 'low',
+            filePath: changedImplementationFiles(files)[0]?.newPath ?? 'unknown',
+            explanation: 'goal describes multiple behaviors but the patch adds fewer than five substantive lines',
+        }];
+}
+function detectMockMutation(files) {
+    const implementationChanged = changedImplementationFiles(files).length > 0;
+    if (implementationChanged)
+        return [];
+    const mockRe = /\b(mock(?:ReturnValue|ResolvedValue|Implementation)?|fixture|beforeEach|setUp|setup)\b/i;
+    const findings = [];
+    for (const file of changedTestFiles(files)) {
+        const line = file.lines.find(entry => (entry.kind === 'add' || entry.kind === 'remove') && mockRe.test(entry.content));
+        if (line) {
+            findings.push({
+                rule: 'mock-mutation',
+                severity: 'high',
+                filePath: file.newPath,
+                ...(line.newLine ? { line: line.newLine } : {}),
+                explanation: 'patch changes mock or fixture setup without changing implementation code',
+            });
+        }
+    }
+    return findings;
+}
+function detectExceptionSwallowing(files) {
+    const findings = [];
+    for (const file of changedImplementationFiles(files)) {
+        const added = file.lines.filter(line => line.kind === 'add');
+        for (let i = 0; i < added.length; i += 1) {
+            const line = added[i];
+            const next = added.slice(i + 1, i + 4).map(entry => entry.content.trim());
+            const body = next.join(' ');
+            if (/catch\s*(?:\([^)]*\))?\s*\{\s*\}?/.test(line.content)
+                && (/\bcatch[^{]*\{\s*\}\s*$/.test(line.content)
+                    || /^(?:\}|console\.|logger\.)/.test(body))) {
+                findings.push({
+                    rule: 'exception-swallowing',
+                    severity: 'high',
+                    filePath: file.newPath,
+                    ...(line.newLine ? { line: line.newLine } : {}),
+                    explanation: 'patch adds a catch handler that appears empty or log-only',
+                });
+            }
+        }
+    }
+    return findings;
+}
+function expectedLiteralsFromTests(files) {
+    const literals = new Set();
+    for (const file of changedTestFiles(files)) {
+        for (const line of file.lines) {
+            if (line.kind === 'add' && /\b(assert|expect|toEqual|strictEqual|deepStrictEqual)\b/.test(line.content)) {
+                for (const literal of (0, diff_analysis_1.extractLiterals)(line.content))
+                    literals.add(literal);
+            }
+        }
+    }
+    return literals;
+}
+function detectHardcodedAnswers(files) {
+    const expected = expectedLiteralsFromTests(files);
+    if (expected.size === 0)
+        return [];
+    const findings = [];
+    for (const file of changedImplementationFiles(files)) {
+        for (const line of file.lines.filter(entry => entry.kind === 'add')) {
+            const overlap = (0, diff_analysis_1.extractLiterals)(line.content).find(literal => expected.has(literal));
+            if (overlap) {
+                findings.push({
+                    rule: 'hardcoded-answer',
+                    severity: 'medium',
+                    filePath: file.newPath,
+                    ...(line.newLine ? { line: line.newLine } : {}),
+                    explanation: `implementation adds literal "${overlap}" that also appears in test expectations`,
+                });
+            }
+        }
+    }
+    return findings;
+}
+function scoreFindings(findings) {
+    const penalty = findings.reduce((sum, finding) => {
+        if (finding.severity === 'high')
+            return sum + 0.35;
+        if (finding.severity === 'medium')
+            return sum + 0.2;
+        return sum + 0.1;
+    }, 0);
+    return Math.max(0, Number((1 - penalty).toFixed(3)));
+}
+async function runSemgrep(input, files) {
+    if (input.runSemgrep === false)
+        return { status: 'not-run', findings: [] };
+    const configDir = findSemgrepConfig(input);
+    if (!configDir)
+        return { status: 'unavailable', findings: [] };
+    const fileArgs = files.map(file => `'${file.newPath.replace(/'/g, `'\\''`)}'`).join(' ');
+    if (!fileArgs)
+        return { status: 'not-run', findings: [] };
+    const command = `semgrep --config '${configDir.replace(/'/g, `'\\''`)}' --json ${fileArgs}`;
+    const result = await (0, command_runner_1.runVerificationCommand)(command, input.repoPath, 120_000);
+    if (result.exitCode !== 0 && !result.stdout.trim())
+        return { status: 'failed', findings: [] };
+    try {
+        const parsed = JSON.parse(result.stdout);
+        const findings = (parsed.results ?? []).flatMap((entry) => {
+            if (!entry || typeof entry !== 'object')
+                return [];
+            const record = entry;
+            const pathValue = typeof record.path === 'string' ? record.path : 'unknown';
+            const checkId = typeof record.check_id === 'string' ? record.check_id : 'semgrep';
+            return [{
+                    rule: checkId,
+                    severity: 'medium',
+                    filePath: pathValue,
+                    explanation: 'semgrep rule pack finding',
+                }];
+        });
+        return { status: 'passed', findings };
+    }
+    catch {
+        return { status: 'failed', findings: [] };
+    }
+}
+/**
+ * Detect common ways agent patches game verification instead of fixing code.
+ *
+ * @param input - Repo, goal text, diff source, and Semgrep settings.
+ * @returns Per-rule findings and advisory score.
+ */
+async function runCheatDetector(input) {
+    const diff = gitDiff(input);
+    const files = (0, diff_analysis_1.parseUnifiedDiff)(diff);
+    const diffFindings = [
+        ...detectHardcodedAnswers(files),
+        ...detectExceptionSwallowing(files),
+        ...detectTestModification(files, input.allowedTestFiles),
+        ...detectComplexityMismatch(files, input.goalText),
+        ...detectMockMutation(files),
+    ];
+    const semgrep = await runSemgrep(input, files);
+    const findings = [...diffFindings, ...semgrep.findings];
+    return {
+        score: scoreFindings(findings),
+        findings,
+        semgrepStatus: semgrep.status,
+    };
+}

package/dist/src/verification/command-runner.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runVerificationCommand = runVerificationCommand;
+const child_process_1 = require("child_process");
+/**
+ * Run a shell command for a verification gate and capture its complete output.
+ *
+ * @param command - Shell command to run.
+ * @param cwd - Working directory for the command.
+ * @param timeoutMs - Maximum runtime before the process is killed.
+ * @returns Structured command output, exit code, timeout flag, and duration.
+ */
+function runVerificationCommand(command, cwd, timeoutMs = 120_000) {
+    const started = Date.now();
+    return new Promise((resolve) => {
+        const proc = (0, child_process_1.spawn)(command, {
+            cwd,
+            shell: true,
+            env: {
+                ...process.env,
+                GIT_TERMINAL_PROMPT: '0',
+            },
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        let stdout = '';
+        let stderr = '';
+        let timedOut = false;
+        let resolved = false;
+        const finish = (exitCode) => {
+            if (resolved)
+                return;
+            resolved = true;
+            clearTimeout(timeout);
+            resolve({
+                command,
+                cwd,
+                exitCode,
+                stdout,
+                stderr,
+                durationMs: Date.now() - started,
+                timedOut,
+            });
+        };
+        const timeout = setTimeout(() => {
+            timedOut = true;
+            proc.kill('SIGTERM');
+            setTimeout(() => {
+                try {
+                    proc.kill('SIGKILL');
+                }
+                catch {
+                    // Process already exited.
+                }
+            }, 2_000);
+        }, timeoutMs);
+        proc.stdout?.on('data', (data) => {
+            stdout += data.toString();
+        });
+        proc.stderr?.on('data', (data) => {
+            stderr += data.toString();
+        });
+        proc.on('close', (code) => {
+            finish(code ?? 1);
+        });
+        proc.on('error', (err) => {
+            stderr += stderr ? `\n${err.message}` : err.message;
+            finish(1);
+        });
+    });
+}

package/dist/src/verification/composite-score.js

@@ -0,0 +1,157 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_COMPOSITE_CONFIG = void 0;
+exports.loadCompositeScoreConfig = loadCompositeScoreConfig;
+exports.computeCompositeScore = computeCompositeScore;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const yaml = __importStar(require("js-yaml"));
+exports.DEFAULT_COMPOSITE_CONFIG = {
+    threshold: 0.7,
+    weights: {
+        cheatDetector: 0.4,
+        propertyGate: 0.4,
+        attestation: 0.2,
+    },
+    advisoryGatePenalty: 0.02,
+    gateWeights: {},
+};
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function readNumber(record, key) {
+    const value = record[key];
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+function clampScore(score) {
+    return Math.max(0, Math.min(1, score));
+}
+function mergeConfig(config) {
+    return {
+        ...exports.DEFAULT_COMPOSITE_CONFIG,
+        ...config,
+        weights: {
+            ...exports.DEFAULT_COMPOSITE_CONFIG.weights,
+            ...config?.weights,
+        },
+        gateWeights: {
+            ...exports.DEFAULT_COMPOSITE_CONFIG.gateWeights,
+            ...config?.gateWeights,
+        },
+    };
+}
+/**
+ * Load composite scoring configuration from `.swarm/gates.yaml`.
+ *
+ * @param projectRoot - Target repository root.
+ * @returns Composite score configuration.
+ */
+function loadCompositeScoreConfig(projectRoot) {
+    const configPath = path.join(projectRoot, '.swarm', 'gates.yaml');
+    if (!fs.existsSync(configPath))
+        return mergeConfig();
+    const parsed = yaml.load(fs.readFileSync(configPath, 'utf8'));
+    if (!isRecord(parsed) || !isRecord(parsed.verification))
+        return mergeConfig();
+    const composite = parsed.verification.composite;
+    if (!isRecord(composite))
+        return mergeConfig();
+    const weights = isRecord(composite.weights) ? composite.weights : {};
+    const gateWeights = isRecord(composite.gateWeights) ? composite.gateWeights : {};
+    const cleanedGateWeights = {};
+    for (const [key, value] of Object.entries(gateWeights)) {
+        if (typeof value === 'number' && Number.isFinite(value))
+            cleanedGateWeights[key] = value;
+    }
+    const override = {
+        weights: {
+            cheatDetector: readNumber(weights, 'cheatDetector') ?? exports.DEFAULT_COMPOSITE_CONFIG.weights.cheatDetector,
+            propertyGate: readNumber(weights, 'propertyGate') ?? exports.DEFAULT_COMPOSITE_CONFIG.weights.propertyGate,
+            attestation: readNumber(weights, 'attestation') ?? exports.DEFAULT_COMPOSITE_CONFIG.weights.attestation,
+        },
+        gateWeights: cleanedGateWeights,
+    };
+    const threshold = readNumber(composite, 'threshold');
+    const advisoryGatePenalty = readNumber(composite, 'advisoryGatePenalty');
+    if (threshold !== undefined)
+        override.threshold = threshold;
+    if (advisoryGatePenalty !== undefined)
+        override.advisoryGatePenalty = advisoryGatePenalty;
+    return mergeConfig(override);
+}
+function layerScore(input, config) {
+    const weightSum = config.weights.cheatDetector + config.weights.propertyGate + config.weights.attestation;
+    if (weightSum <= 0)
+        return 0;
+    const weighted = clampScore(input.cheatDetectorScore) * config.weights.cheatDetector +
+        clampScore(input.propertyGateScore) * config.weights.propertyGate +
+        clampScore(input.attestationScore) * config.weights.attestation;
+    return weighted / weightSum;
+}
+function advisoryPenalty(gates, config) {
+    if (!gates || gates.length === 0)
+        return 0;
+    return gates
+        .filter(gate => gate.status === 'fail')
+        .reduce((sum, gate) => sum + (config.gateWeights[gate.id] ?? config.advisoryGatePenalty), 0);
+}
+function advisoryLayerTriggered(statuses) {
+    if (statuses === undefined)
+        return false;
+    const values = Array.isArray(statuses) ? statuses : Object.values(statuses);
+    return values.some(status => status === 'advisory-warn' || status === 'WARNING');
+}
+/**
+ * Compute the P1 advisory composite score.
+ *
+ * @param input - Layer 3-5 scores, advisory gates, and optional config.
+ * @returns Composite score and human-review decision.
+ */
+function computeCompositeScore(input) {
+    const config = mergeConfig(input.config);
+    const weightedLayerScore = layerScore(input, config);
+    const penalty = advisoryPenalty(input.advisoryGateResults, config);
+    const score = Number(clampScore(weightedLayerScore - penalty).toFixed(3));
+    const advisoryTriggered = advisoryLayerTriggered(input.advisoryLayerStatuses);
+    return {
+        score,
+        threshold: config.threshold,
+        humanReviewRequired: score < config.threshold || advisoryTriggered,
+        advisoryLayerTriggered: advisoryTriggered,
+        advisoryPenalty: Number(penalty.toFixed(3)),
+        weightedLayerScore: Number(weightedLayerScore.toFixed(3)),
+    };
+}