tribunal-kit 9.2.5 → 9.2.7

package/.agent/scripts/architecture_mapper.js

@@ -39,35 +39,79 @@ const CACHE_FILE = path.join(HISTORY_DIR, 'arch-mapper-cache.json');
 
 const ROUTE_PATTERNS = [
   // Express / Fastify / Koa style
-  { regex: /(?:app|router|server)\.(get|post|put|patch|delete|all)\s*\(\s*['"`]([^'"`]+)['"`]/gi, type: 'api_route' },
+  {
+    regex: /(?:app|router|server)\.(get|post|put|patch|delete|all)\s*\(\s*['"`]([^'"`]+)['"`]/gi,
+    type: 'api_route',
+  },
   // Next.js App Router (file-based — detected by path)
-  { regex: /export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(/g, type: 'api_route' },
+  {
+    regex: /export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(/g,
+    type: 'api_route',
+  },
   // Hono / ElysiaJS
   { regex: /\.(get|post|put|patch|delete)\s*\(\s*['"`]([^'"`]+)['"`]/gi, type: 'api_route' },
 ];
 
 const DB_PATTERNS = [
   // Prisma
-  { regex: /prisma\.\w+\.(findMany|findUnique|findFirst|create|update|delete|upsert|aggregate|groupBy|count)\s*\(/g, type: 'database', subtype: 'prisma' },
+  {
+    regex:
+      /prisma\.\w+\.(findMany|findUnique|findFirst|create|update|delete|upsert|aggregate|groupBy|count)\s*\(/g,
+    type: 'database',
+    subtype: 'prisma',
+  },
   // Drizzle
-  { regex: /(?:db|drizzle)\.(select|insert|update|delete)\s*\(/g, type: 'database', subtype: 'drizzle' },
+  {
+    regex: /(?:db|drizzle)\.(select|insert|update|delete)\s*\(/g,
+    type: 'database',
+    subtype: 'drizzle',
+  },
   // Raw SQL
-  { regex: /\.(query|execute|raw|sql)\s*\(\s*['"`]?\s*(SELECT|INSERT|UPDATE|DELETE|CREATE|ALTER|DROP|TRUNCATE)/gi, type: 'database', subtype: 'raw_sql' },
+  {
+    regex:
+      /\.(query|execute|raw|sql)\s*\(\s*['"`]?\s*(SELECT|INSERT|UPDATE|DELETE|CREATE|ALTER|DROP|TRUNCATE)/gi,
+    type: 'database',
+    subtype: 'raw_sql',
+  },
   // Mongoose
-  { regex: /\.(find|findOne|findById|save|create|updateOne|deleteOne|aggregate)\s*\(/g, type: 'database', subtype: 'mongoose' },
+  {
+    regex: /\.(find|findOne|findById|save|create|updateOne|deleteOne|aggregate)\s*\(/g,
+    type: 'database',
+    subtype: 'mongoose',
+  },
   // Sequelize
-  { regex: /\.(findAll|findByPk|bulkCreate|destroy)\s*\(/g, type: 'database', subtype: 'sequelize' },
+  {
+    regex: /\.(findAll|findByPk|bulkCreate|destroy)\s*\(/g,
+    type: 'database',
+    subtype: 'sequelize',
+  },
 ];
 
 const EXTERNAL_SERVICE_PATTERNS = [
   // fetch / axios / got
-  { regex: /(?:fetch|axios|got|ky|ofetch)\s*\(\s*['"`]?(https?:\/\/[^'"`\s,)]+)/gi, type: 'external_service', subtype: 'http_client' },
-  { regex: /(?:fetch|axios|got|ky|ofetch)\s*[.(]/g, type: 'external_service', subtype: 'http_client' },
+  {
+    regex: /(?:fetch|axios|got|ky|ofetch)\s*\(\s*['"`]?(https?:\/\/[^'"`\s,)]+)/gi,
+    type: 'external_service',
+    subtype: 'http_client',
+  },
+  {
+    regex: /(?:fetch|axios|got|ky|ofetch)\s*[.(]/g,
+    type: 'external_service',
+    subtype: 'http_client',
+  },
   // AWS SDK
-  { regex: /new\s+(?:AWS\.)?(?:S3|DynamoDB|SQS|SNS|Lambda|SES|CloudWatch)\s*\(/g, type: 'external_service', subtype: 'aws_sdk' },
+  {
+    regex: /new\s+(?:AWS\.)?(?:S3|DynamoDB|SQS|SNS|Lambda|SES|CloudWatch)\s*\(/g,
+    type: 'external_service',
+    subtype: 'aws_sdk',
+  },
   { regex: /@aws-sdk\/client-(\w+)/g, type: 'external_service', subtype: 'aws_sdk' },
   // Firebase
-  { regex: /(?:firebase|firestore|getFirestore|initializeApp)\s*\(/g, type: 'external_service', subtype: 'firebase' },
+  {
+    regex: /(?:firebase|firestore|getFirestore|initializeApp)\s*\(/g,
+    type: 'external_service',
+    subtype: 'firebase',
+  },
   // Stripe
   { regex: /(?:stripe|Stripe)\s*\(/g, type: 'external_service', subtype: 'stripe' },
   // SendGrid / Twilio / Resend
@@ -77,7 +121,11 @@ const EXTERNAL_SERVICE_PATTERNS = [
 const CACHE_PATTERNS = [
   // Redis
   { regex: /(?:redis|ioredis|createClient)\s*\(/gi, type: 'data_store', subtype: 'redis' },
-  { regex: /\.(?:get|set|del|hget|hset|expire|incr|lpush|rpush|publish|subscribe)\s*\(/g, type: 'data_store', subtype: 'redis_ops' },
+  {
+    regex: /\.(?:get|set|del|hget|hset|expire|incr|lpush|rpush|publish|subscribe)\s*\(/g,
+    type: 'data_store',
+    subtype: 'redis_ops',
+  },
   // In-memory cache
   { regex: /(?:lru-cache|node-cache|Map)\s*\(/g, type: 'data_store', subtype: 'in_memory_cache' },
 ];
@@ -90,26 +138,36 @@ const QUEUE_PATTERNS = [
   // Kafka
   { regex: /new\s+Kafka\s*\(/g, type: 'queue', subtype: 'kafka' },
   // Event emitters
-  { regex: /\.(?:emit|on|once|addListener)\s*\(\s*['"`](\w+)['"`]/g, type: 'event', subtype: 'event_emitter' },
+  {
+    regex: /\.(?:emit|on|once|addListener)\s*\(\s*['"`](\w+)['"`]/g,
+    type: 'event',
+    subtype: 'event_emitter',
+  },
 ];
 
 const AUTH_PATTERNS = [
   // JWT
   { regex: /(?:jwt|jsonwebtoken)\.(?:sign|verify|decode)\s*\(/g, type: 'auth', subtype: 'jwt' },
   // next-auth / auth.js
-  { regex: /(?:NextAuth|getServerSession|auth\(\)|getSession)\s*\(/g, type: 'auth', subtype: 'next_auth' },
+  {
+    regex: /(?:NextAuth|getServerSession|auth\(\)|getSession)\s*\(/g,
+    type: 'auth',
+    subtype: 'next_auth',
+  },
   // Passport
   { regex: /passport\.(?:authenticate|use|initialize)\s*\(/g, type: 'auth', subtype: 'passport' },
   // bcrypt / argon2
-  { regex: /(?:bcrypt|argon2)\.(?:hash|compare|verify)\s*\(/g, type: 'auth', subtype: 'password_hashing' },
+  {
+    regex: /(?:bcrypt|argon2)\.(?:hash|compare|verify)\s*\(/g,
+    type: 'auth',
+    subtype: 'password_hashing',
+  },
   // Clerk
   { regex: /(?:clerkMiddleware|currentUser|ClerkProvider)\s*/g, type: 'auth', subtype: 'clerk' },
 ];
 
 const ENV_PATTERN = /process\.env\.([A-Z_][A-Z0-9_]*)/g;
 
-
-
 // ── Content Hashing ──────────────────────────────────────────────────────────
 function getFileHash(filePath) {
   const content = fs.readFileSync(filePath);
@@ -122,9 +180,7 @@ function analyzeFile(filePath, relativePath, content) {
   const envVars = new Set();
 
   // Strip comments for cleaner matching
-  const cleaned = content
-    .replace(/\/\*[\s\S]*?\*\//g, '')
-    .replace(/\/\/.*$/gm, '');
+  const cleaned = content.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/.*$/gm, '');
 
   // Detect API routes
   for (const pattern of ROUTE_PATTERNS) {
@@ -145,7 +201,8 @@ function analyzeFile(filePath, relativePath, content) {
   // Detect Next.js App Router routes by file path
   if (/\/route\.(ts|js|tsx|jsx)$/.test(relativePath) || /\/api\//.test(relativePath)) {
     const methods = [];
-    const methodRegex = /export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(/g;
+    const methodRegex =
+      /export\s+(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\s*\(/g;
     let m;
     while ((m = methodRegex.exec(cleaned)) !== null) {
       methods.push(m[1]);
@@ -523,7 +580,9 @@ function main() {
   if (fs.existsSync(CACHE_FILE)) {
     try {
       cache = JSON.parse(fs.readFileSync(CACHE_FILE, 'utf8'));
-    } catch { /* ignore */ }
+    } catch {
+      /* ignore */
+    }
   }
 
   const totalTimer = timer();
@@ -540,13 +599,18 @@ function main() {
         const full = path.join(dir, entry.name);
         if (entry.isDirectory()) {
           const base = entry.name;
-          if (['node_modules', '.git', '.next', 'dist', 'build', 'coverage', '.agent'].includes(base)) continue;
+          if (
+            ['node_modules', '.git', '.next', 'dist', 'build', 'coverage', '.agent'].includes(base)
+          )
+            continue;
           walkExtra(full);
         } else if (/\.(py|go|rb|rs)$/.test(entry.name)) {
           additionalFiles.push(full);
         }
       }
-    } catch { /* ignore */ }
+    } catch {
+      /* ignore */
+    }
   }
   walkExtra(process.cwd());
 
@@ -605,7 +669,9 @@ function main() {
   console.log(`  ${CYAN}Queues/Events:${RESET}    ${model.summary.total_queues_events}`);
   console.log(`  ${CYAN}Auth Boundaries:${RESET}  ${model.summary.total_auth_boundaries}`);
   console.log(`  ${CYAN}Env Variables:${RESET}    ${model.summary.total_env_variables}`);
-  console.log(`  ${CYAN}Technologies:${RESET}     ${model.summary.detected_technologies.join(', ') || 'none detected'}`);
+  console.log(
+    `  ${CYAN}Technologies:${RESET}     ${model.summary.detected_technologies.join(', ') || 'none detected'}`,
+  );
   console.log(`\n  ${DIM}Saved to: ${IDX_FILE}${RESET}\n`);
 }
 

package/.agent/scripts/architecture_verifier.js

@@ -0,0 +1,303 @@
+#!/usr/bin/env node
+/**
+ * architecture_verifier.js — Tribunal Zero-Trust Architecture Verifier
+ * ═════════════════════════════════════════════════════════════════════════════
+ * Evaluates architectural models against ground-truth source code bytes.
+ *
+ * Capabilities:
+ *   - Verifies all source citations (file exists, line valid, no path escapes)
+ *   - Detects Stale Evidence via SHA-256 drift verification
+ *   - Verifies AST Symbol and Relationship Call Sites
+ *   - Assigns Epistemic Confidence Levels (L1 to L5)
+ *   - Surfaces Architectural Contradictions as first-class disputable records
+ *   - Prevents unverified agent claims from masquerading as verified facts
+ *
+ * Emits: .agent/history/architecture-verification.json
+ * Zero external dependencies.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const { GREEN, YELLOW, CYAN, RED, DIM, RESET, BOX, banner, timer, formatMs } = require('./_colors');
+
+function computeSha256(str) {
+  return crypto
+    .createHash('sha256')
+    .update(str || '')
+    .digest('hex');
+}
+
+class ArchitectureVerifier {
+  constructor(repoRoot = process.cwd(), options = {}) {
+    this.repoRoot = path.resolve(repoRoot);
+    this.options = { strict: false, ...options };
+    this.results = {
+      verified: true,
+      timestamp: new Date().toISOString(),
+      stats: {
+        totalEntities: 0,
+        verifiedEntities: 0,
+        staleEntities: 0,
+        fabricatedEntities: 0,
+        totalRelations: 0,
+        verifiedRelations: 0,
+        contradictedRelations: 0,
+      },
+      confidenceDistribution: { L1: 0, L2: 0, L3: 0, L4: 0, L5: 0 },
+      contradictions: [],
+      diagnostics: [],
+    };
+  }
+
+  verifyModel(model) {
+    if (!model || !Array.isArray(model.entities)) {
+      throw new Error('Invalid model: expected an object with entities array.');
+    }
+
+    const { entities, relationships = [], contradictions = [] } = model;
+    this.results.stats.totalEntities = entities.length;
+    this.results.stats.totalRelations = relationships.length;
+
+    // Entity verification map for fast lookup
+    const entityIndex = new Map();
+
+    // 1. Verify Entity Sources & Ground Truth
+    for (const entity of entities) {
+      entityIndex.set(entity.id, entity);
+      const entityVerification = this.verifyEntity(entity);
+      if (entityVerification.status === 'verified') {
+        this.results.stats.verifiedEntities++;
+        this.results.confidenceDistribution[entity.confidence || 'L1']++;
+      } else if (entityVerification.status === 'stale') {
+        this.results.stats.staleEntities++;
+        this.results.confidenceDistribution['L3']++;
+        this.results.diagnostics.push({
+          severity: 'warning',
+          code: 'ARCH_EVIDENCE_STALE',
+          entityId: entity.id,
+          message: `Evidence has drifted for entity "${entity.name}" (${entity.id}). Content hash does not match.`,
+          details: entityVerification.details,
+        });
+      } else {
+        this.results.stats.fabricatedEntities++;
+        this.results.confidenceDistribution['L5']++;
+        this.results.verified = false;
+        this.results.diagnostics.push({
+          severity: 'error',
+          code: 'ARCH_EVIDENCE_FABRICATED',
+          entityId: entity.id,
+          message: `Evidence does not exist in repository for entity "${entity.name}" (${entity.id}).`,
+          details: entityVerification.details,
+        });
+      }
+    }
+
+    // 2. Verify Relationships & Call Sites
+    for (const rel of relationships) {
+      const relVerification = this.verifyRelationship(rel, entityIndex);
+      if (relVerification.status === 'verified') {
+        this.results.stats.verifiedRelations++;
+      } else if (relVerification.status === 'contradicted') {
+        this.results.stats.contradictedRelations++;
+        this.results.verified = false;
+        this.results.contradictions.push({
+          id: `conflict.${rel.id}`,
+          relationshipId: rel.id,
+          sourceId: rel.sourceId,
+          targetId: rel.targetId,
+          conflictType: relVerification.conflictType || 'unreachable_call_path',
+          claimedRelation: rel.relationType,
+          reason: relVerification.reason,
+          confidence: 'L5',
+        });
+        this.results.diagnostics.push({
+          severity: 'error',
+          code: 'ARCH_RELATION_CONTRADICTED',
+          relationId: rel.id,
+          message: `Contradiction detected in relationship ${rel.sourceId} -> ${rel.targetId}: ${relVerification.reason}`,
+        });
+      } else {
+        this.results.diagnostics.push({
+          severity: 'warning',
+          code: 'ARCH_RELATION_UNVERIFIED',
+          relationId: rel.id,
+          message: `Relationship ${rel.sourceId} -> ${rel.targetId} lacks direct call-site evidence.`,
+        });
+      }
+    }
+
+    // 3. Reconcile explicit contradictions passed in model
+    for (const c of contradictions) {
+      this.results.contradictions.push(c);
+    }
+
+    return this.results;
+  }
+
+  verifyEntity(entity) {
+    if (!entity.sources || !entity.sources.length) {
+      return { status: 'unverified', details: { reason: 'No sources declared' } };
+    }
+
+    let anyStale = false;
+    let anyMissing = false;
+
+    for (const src of entity.sources) {
+      const check = this.verifySourceFile(src.file, src.startLine, src.snippet, src.contentHash);
+      if (!check.exists) anyMissing = true;
+      if (check.stale) anyStale = true;
+    }
+
+    if (anyMissing)
+      return { status: 'fabricated', details: { reason: 'Cited file or line does not exist' } };
+    if (anyStale) return { status: 'stale', details: { reason: 'File content hash has drifted' } };
+    return { status: 'verified', details: {} };
+  }
+
+  verifyRelationship(rel, entityIndex) {
+    const source = entityIndex.get(rel.sourceId);
+    const target = entityIndex.get(rel.targetId);
+
+    if (!source) {
+      return {
+        status: 'contradicted',
+        conflictType: 'missing_source_entity',
+        reason: `Source entity ${rel.sourceId} not found.`,
+      };
+    }
+    if (!target) {
+      return {
+        status: 'contradicted',
+        conflictType: 'missing_target_entity',
+        reason: `Target entity ${rel.targetId} not found.`,
+      };
+    }
+
+    // Check evidence call site if present
+    if (rel.evidence && rel.evidence.length > 0) {
+      for (const ev of rel.evidence) {
+        const check = this.verifySourceFile(ev.file, ev.startLine, ev.snippet, ev.contentHash);
+        if (!check.exists) {
+          return {
+            status: 'contradicted',
+            conflictType: 'fabricated_call_site',
+            reason: `Evidence file ${ev.file} does not exist for relation.`,
+          };
+        }
+      }
+      return { status: 'verified' };
+    }
+
+    // If relation is an import or route, check if source imports target
+    return { status: 'unverified', reason: 'No call-site evidence' };
+  }
+
+  verifySourceFile(relPath, lineNum, expectedSnippet, expectedHash) {
+    const fullPath = path.resolve(this.repoRoot, relPath);
+
+    // Path escape boundary defense
+    const normalizedRepo = path.resolve(this.repoRoot);
+    if (!fullPath.startsWith(normalizedRepo)) {
+      return { exists: false, reason: 'Path traversal escape detected' };
+    }
+
+    if (!fs.existsSync(fullPath)) {
+      return { exists: false, reason: 'File does not exist' };
+    }
+
+    let content;
+    try {
+      content = fs.readFileSync(fullPath, 'utf8');
+    } catch (_e) {
+      return { exists: false, reason: 'File could not be read' };
+    }
+
+    const lines = content.split('\n');
+    if (lineNum !== undefined && lineNum !== null) {
+      if (lineNum < 1 || lineNum > lines.length) {
+        return {
+          exists: false,
+          reason: `Line ${lineNum} out of range (file has ${lines.length} lines)`,
+        };
+      }
+
+      if (expectedHash) {
+        const actualLine = lines[lineNum - 1] || '';
+        const actualHash = computeSha256(actualLine).substring(0, 16);
+        const actualFileHash = computeSha256(content).substring(0, 16);
+        if (actualHash !== expectedHash && actualFileHash !== expectedHash) {
+          return { exists: true, stale: true, reason: 'Content hash mismatch' };
+        }
+      }
+    }
+
+    return { exists: true, stale: false };
+  }
+
+  saveReport(outputPath) {
+    const defaultPath = path.join(
+      this.repoRoot,
+      '.agent',
+      'history',
+      'architecture-verification.json',
+    );
+    const dest = outputPath || defaultPath;
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.writeFileSync(dest, JSON.stringify(this.results, null, 2), 'utf8');
+    return dest;
+  }
+}
+
+// ── Standalone CLI ────────────────────────────────────────────────────────────
+if (require.main === module) {
+  const t = timer();
+  const repoRoot = process.argv[2] || process.cwd();
+  const modelFile = path.join(repoRoot, '.agent', 'history', 'architecture-model.json');
+
+  console.log(banner('Tribunal Architecture Zero-Trust Verifier'));
+
+  if (!fs.existsSync(modelFile)) {
+    console.error(
+      `  ${RED}✖ architecture-model.json not found.${RESET} Run architecture_extractor.js first.`,
+    );
+    process.exit(1);
+  }
+
+  const model = JSON.parse(fs.readFileSync(modelFile, 'utf8'));
+  const verifier = new ArchitectureVerifier(repoRoot);
+  const results = verifier.verifyModel(model);
+  const reportPath = verifier.saveReport();
+
+  const isOk =
+    results.verified && results.diagnostics.filter(d => d.severity === 'error').length === 0;
+  const statusColor = isOk ? GREEN : RED;
+  const statusIcon = isOk ? BOX.check : BOX.cross_mark;
+
+  console.log(
+    `  ${statusColor}${statusIcon} Verification ${isOk ? 'PASSED' : 'FLAGGED ISSUES'}${RESET} in ${formatMs(t())}`,
+  );
+  console.log(
+    `  ${DIM}Entities Verified:${RESET}      ${GREEN}${results.stats.verifiedEntities}${RESET} / ${results.stats.totalEntities}`,
+  );
+  console.log(
+    `  ${DIM}Stale Evidence:${RESET}         ${results.stats.staleEntities > 0 ? YELLOW : GREEN}${results.stats.staleEntities}${RESET}`,
+  );
+  console.log(
+    `  ${DIM}Contradictions Surfaced:${RESET} ${results.contradictions.length > 0 ? RED : GREEN}${results.contradictions.length}${RESET}`,
+  );
+  console.log(
+    `  ${DIM}Confidence (L1 Facts):${RESET}   ${CYAN}${results.confidenceDistribution.L1}${RESET}`,
+  );
+  console.log(`  ${DIM}Saved Report:${RESET}            ${CYAN}${reportPath}${RESET}\n`);
+
+  if (!isOk && process.argv.includes('--strict')) {
+    process.exit(1);
+  }
+}
+
+module.exports = {
+  ArchitectureVerifier,
+};