tribunal-kit 9.2.4 → 9.2.6

package/.agent/scripts/evidence_verifier.js

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+/**
+ * evidence_verifier.js — Source Evidence Verification
+ *
+ * Verifies that evidence locations actually exist in the repository.
+ * Detects fabricated source locations and stale evidence.
+ *
+ * Trust boundary: evidence is UNTRUSTED until this module confirms it.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+/**
+ * Parse an evidence location string into file and line.
+ * Accepts formats: "file.py:42", "file.py", "path/to/file.py:100"
+ */
+function parseEvidenceLocation(loc) {
+  if (!loc || typeof loc !== 'string') return null;
+  const match = loc.match(/^(.+?)(?::(\d+))?$/);
+  if (!match) return null;
+  return { file: match[1], line: match[2] ? parseInt(match[2], 10) : null };
+}
+
+/**
+ * Verify a single evidence item against the repository.
+ *
+ * Returns:
+ *   { verified: true, content_hash, actual_content }  — if file+line exist
+ *   { verified: false, reason }                       — if fabricated/stale
+ */
+function verifyEvidence(evidence, repoRoot) {
+  if (!evidence.location) {
+    return { verified: false, reason: 'No location specified in evidence.' };
+  }
+
+  const parsed = parseEvidenceLocation(evidence.location);
+  if (!parsed) {
+    return { verified: false, reason: `Cannot parse location: ${evidence.location}` };
+  }
+
+  // Resolve and enforce path boundary
+  const resolvedFile = path.resolve(repoRoot, parsed.file);
+  const normalizedRepo = path.resolve(repoRoot);
+  if (!resolvedFile.startsWith(normalizedRepo)) {
+    return { verified: false, reason: `Path traversal detected: ${parsed.file}` };
+  }
+
+  if (!fs.existsSync(resolvedFile)) {
+    return { verified: false, reason: `File does not exist: ${parsed.file}` };
+  }
+
+  let fileContent;
+  try {
+    fileContent = fs.readFileSync(resolvedFile, 'utf8');
+  } catch (e) {
+    return { verified: false, reason: `Cannot read file: ${e.message}` };
+  }
+
+  const lines = fileContent.split('\n');
+
+  if (parsed.line !== null) {
+    if (parsed.line < 1 || parsed.line > lines.length) {
+      return {
+        verified: false,
+        reason: `Line ${parsed.line} does not exist in ${parsed.file} (file has ${lines.length} lines)`,
+      };
+    }
+
+    const actualLine = lines[parsed.line - 1];
+    const lineHash = crypto.createHash('sha256').update(actualLine).digest('hex').substring(0, 16);
+
+    return {
+      verified: true,
+      actual_content: actualLine.trim(),
+      content_hash: lineHash,
+      file: parsed.file,
+      line: parsed.line,
+    };
+  }
+
+  // File exists but no line specified
+  const fileHash = crypto.createHash('sha256').update(fileContent).digest('hex').substring(0, 16);
+  return {
+    verified: true,
+    content_hash: fileHash,
+    file: parsed.file,
+    line: null,
+  };
+}
+
+/**
+ * Verify all evidence items in a finding.
+ * Returns the finding with evidence_verification results attached.
+ */
+function verifyFindingEvidence(finding, repoRoot) {
+  if (!finding.evidence || !Array.isArray(finding.evidence)) {
+    return { ...finding, evidence_verification: { status: 'NO_EVIDENCE' } };
+  }
+
+  const results = finding.evidence.map(e => ({
+    evidence: e,
+    verification: verifyEvidence(e, repoRoot),
+  }));
+
+  const verifiedCount = results.filter(r => r.verification.verified).length;
+  const totalCount = results.length;
+
+  let status;
+  if (verifiedCount === 0) {
+    status = 'ALL_FABRICATED';
+  } else if (verifiedCount === totalCount) {
+    status = 'ALL_VERIFIED';
+  } else {
+    status = 'PARTIAL';
+  }
+
+  return {
+    ...finding,
+    evidence_verification: {
+      status,
+      verified_count: verifiedCount,
+      total_count: totalCount,
+      details: results.map(r => ({
+        location: r.evidence.location,
+        verified: r.verification.verified,
+        reason: r.verification.reason,
+        content_hash: r.verification.content_hash,
+      })),
+    },
+  };
+}
+
+/**
+ * Check if evidence has become stale by comparing content hashes.
+ * A hash mismatch means the code changed after the finding was generated.
+ */
+function checkStaleEvidence(finding, repoRoot) {
+  if (!finding.evidence || !Array.isArray(finding.evidence)) return finding;
+
+  const staleItems = [];
+  for (const e of finding.evidence) {
+    if (!e.location || !e.content_hash) continue;
+    const current = verifyEvidence(e, repoRoot);
+    if (current.verified && current.content_hash !== e.content_hash) {
+      staleItems.push({
+        location: e.location,
+        original_hash: e.content_hash,
+        current_hash: current.content_hash,
+      });
+    }
+  }
+
+  if (staleItems.length > 0) {
+    return {
+      ...finding,
+      stale_evidence: staleItems,
+    };
+  }
+  return finding;
+}
+
+module.exports = {
+  parseEvidenceLocation,
+  verifyEvidence,
+  verifyFindingEvidence,
+  checkStaleEvidence,
+};

package/.agent/scripts/finding_schema.js

@@ -0,0 +1,104 @@
+const { z } = require('zod');
+
+const FindingSchema = z
+  .object({
+    id: z.string().min(1, 'Finding must have a stable identifier (id)'),
+    category: z.string().min(1, 'Finding must have a category'),
+    type: z.string().optional(),
+    severity: z.enum([
+      'CRITICAL',
+      'HIGH',
+      'MEDIUM',
+      'LOW',
+      'INFO',
+      'Critical',
+      'Important',
+      'Minor',
+    ]),
+    confidence: z
+      .number()
+      .min(0)
+      .max(1)
+      .or(z.enum(['High', 'Medium', 'Low'])),
+    status: z.enum(['DETECTED', 'VERIFIED', 'UNVERIFIED', 'FIXED', 'REGRESSION-PROTECTED']),
+    title: z.string().min(1, 'Finding must have a title or description'),
+    location: z
+      .object({
+        file: z.string().optional(),
+        line: z.number().optional(),
+      })
+      .strict()
+      .optional(),
+    evidence: z
+      .array(
+        z
+          .object({
+            type: z.string(),
+            description: z.string(),
+            location: z.string().optional(),
+          })
+          .strict(),
+      )
+      .min(1, 'Finding must contain concrete evidence'),
+    impact: z.string().optional(),
+    remediation: z.string().optional(),
+    validation: z
+      .object({
+        required: z.boolean().default(true),
+      })
+      .passthrough()
+      .optional(),
+    verification: z
+      .object({
+        test_executed: z.boolean().optional(),
+        test_output: z.string().optional(),
+        command: z.string().optional(),
+        exit_code: z.number().optional(),
+        static_proof: z.boolean().optional(),
+        tool: z.string().optional(),
+        tool_output: z.string().optional(),
+      })
+      .passthrough()
+      .optional(),
+    related_findings: z.array(z.string()).optional().default([]),
+  })
+  .strict();
+
+const FindingsReportSchema = z.object({
+  findings: z.array(FindingSchema),
+});
+
+function validateFinding(finding) {
+  const result = FindingSchema.safeParse(finding);
+  if (!result.success) {
+    return {
+      valid: false,
+      errors: result.error.issues.map(issue => ({
+        path: issue.path.join('.'),
+        message: issue.message,
+      })),
+    };
+  }
+  return { valid: true, data: result.data };
+}
+
+function validateFindingsReport(report) {
+  const result = FindingsReportSchema.safeParse(report);
+  if (!result.success) {
+    return {
+      valid: false,
+      errors: result.error.issues.map(issue => ({
+        path: issue.path.join('.'),
+        message: issue.message,
+      })),
+    };
+  }
+  return { valid: true, data: result.data };
+}
+
+module.exports = {
+  FindingSchema,
+  FindingsReportSchema,
+  validateFinding,
+  validateFindingsReport,
+};

package/.agent/scripts/findings_validator.js

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+/**
+ * findings_validator.js — Validates reviewer output against the finding contract.
+ * Malformed output is quarantined, and only valid findings are passed forward.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const { validateFinding } = require('./finding_schema');
+const { BOLD, RESET, RED, YELLOW, GREEN } = require('./_colors');
+
+function main() {
+  const args = process.argv.slice(2);
+  const inputPath = args.find(a => a.startsWith('--in='))?.split('=')[1];
+  const outPath = args.find(a => a.startsWith('--out='))?.split('=')[1];
+  const quarantinePath =
+    args.find(a => a.startsWith('--quarantine='))?.split('=')[1] || 'quarantined_findings.json';
+
+  if (!inputPath || !outPath) {
+    console.log(
+      RED +
+        'Usage: node findings_validator.js --in=<file> --out=<file> [--quarantine=<file>]' +
+        RESET,
+    );
+    process.exit(1);
+  }
+
+  console.log(`${BOLD}Tribunal — Findings Schema Validator${RESET}`);
+  console.log(`Validating: ${inputPath}`);
+
+  if (!fs.existsSync(inputPath)) {
+    console.log(YELLOW + `Input file not found: ${inputPath}. Emitting empty valid array.` + RESET);
+    fs.writeFileSync(outPath, JSON.stringify({ findings: [] }, null, 2));
+    process.exit(0);
+  }
+
+  let data;
+  try {
+    data = JSON.parse(fs.readFileSync(inputPath, 'utf8'));
+  } catch (e) {
+    console.error(RED + `Failed to parse JSON: ${e.message}` + RESET);
+    console.log(YELLOW + `Quarantining entire file.` + RESET);
+    fs.writeFileSync(
+      quarantinePath,
+      JSON.stringify({ error: e.message, raw: fs.readFileSync(inputPath, 'utf8') }, null, 2),
+    );
+    fs.writeFileSync(outPath, JSON.stringify({ findings: [] }, null, 2));
+    process.exit(0);
+  }
+
+  const rawFindings = Array.isArray(data) ? data : data.findings || [];
+  const validFindings = [];
+  const quarantinedFindings = [];
+
+  // Resource limits (§18)
+  const MAX_FINDINGS = 5000;
+  const MAX_EVIDENCE_PER_FINDING = 100;
+  const MAX_STRING_LENGTH = 10240; // 10KB
+
+  if (rawFindings.length > MAX_FINDINGS) {
+    console.log(
+      YELLOW +
+        `WARNING: ${rawFindings.length} findings exceed limit of ${MAX_FINDINGS}. Processing first ${MAX_FINDINGS}.` +
+        RESET,
+    );
+    quarantinedFindings.push({
+      finding: {
+        _diagnostic: `${rawFindings.length - MAX_FINDINGS} findings exceeded limit and were dropped`,
+      },
+      errors: [{ path: 'findings', message: `Exceeded maximum of ${MAX_FINDINGS} findings` }],
+    });
+  }
+
+  const processable = rawFindings.slice(0, MAX_FINDINGS);
+
+  for (const finding of processable) {
+    // Check evidence array size limit
+    if (
+      finding.evidence &&
+      Array.isArray(finding.evidence) &&
+      finding.evidence.length > MAX_EVIDENCE_PER_FINDING
+    ) {
+      quarantinedFindings.push({
+        finding,
+        errors: [
+          {
+            path: 'evidence',
+            message: `${finding.evidence.length} evidence items exceeds limit of ${MAX_EVIDENCE_PER_FINDING}`,
+          },
+        ],
+      });
+      continue;
+    }
+
+    // Check string length limits
+    const stringFields = ['title', 'impact', 'remediation'];
+    let oversized = false;
+    for (const field of stringFields) {
+      if (
+        finding[field] &&
+        typeof finding[field] === 'string' &&
+        finding[field].length > MAX_STRING_LENGTH
+      ) {
+        quarantinedFindings.push({
+          finding,
+          errors: [
+            {
+              path: field,
+              message: `${field} length ${finding[field].length} exceeds limit of ${MAX_STRING_LENGTH}`,
+            },
+          ],
+        });
+        oversized = true;
+        break;
+      }
+    }
+    if (oversized) continue;
+
+    const result = validateFinding(finding);
+    if (result.valid) {
+      validFindings.push(result.data);
+    } else {
+      quarantinedFindings.push({
+        finding,
+        errors: result.errors,
+      });
+    }
+  }
+
+  fs.writeFileSync(outPath, JSON.stringify({ findings: validFindings }, null, 2));
+
+  if (quarantinedFindings.length > 0) {
+    fs.writeFileSync(quarantinePath, JSON.stringify({ quarantined: quarantinedFindings }, null, 2));
+    console.log(
+      YELLOW +
+        `Quarantined ${quarantinedFindings.length} invalid findings to ${quarantinePath}` +
+        RESET,
+    );
+  }
+
+  console.log(GREEN + `Passed ${validFindings.length} valid findings to ${outPath}` + RESET);
+}
+
+if (require.main === module) {
+  main();
+}