tribunal-kit 9.2.5 → 9.2.7

package/.agent/scripts/evidence_verifier.js

@@ -0,0 +1,171 @@
+#!/usr/bin/env node
+/**
+ * evidence_verifier.js — Source Evidence Verification
+ *
+ * Verifies that evidence locations actually exist in the repository.
+ * Detects fabricated source locations and stale evidence.
+ *
+ * Trust boundary: evidence is UNTRUSTED until this module confirms it.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+
+/**
+ * Parse an evidence location string into file and line.
+ * Accepts formats: "file.py:42", "file.py", "path/to/file.py:100"
+ */
+function parseEvidenceLocation(loc) {
+  if (!loc || typeof loc !== 'string') return null;
+  const match = loc.match(/^(.+?)(?::(\d+))?$/);
+  if (!match) return null;
+  return { file: match[1], line: match[2] ? parseInt(match[2], 10) : null };
+}
+
+/**
+ * Verify a single evidence item against the repository.
+ *
+ * Returns:
+ *   { verified: true, content_hash, actual_content }  — if file+line exist
+ *   { verified: false, reason }                       — if fabricated/stale
+ */
+function verifyEvidence(evidence, repoRoot) {
+  if (!evidence.location) {
+    return { verified: false, reason: 'No location specified in evidence.' };
+  }
+
+  const parsed = parseEvidenceLocation(evidence.location);
+  if (!parsed) {
+    return { verified: false, reason: `Cannot parse location: ${evidence.location}` };
+  }
+
+  // Resolve and enforce path boundary
+  const resolvedFile = path.resolve(repoRoot, parsed.file);
+  const normalizedRepo = path.resolve(repoRoot);
+  if (!resolvedFile.startsWith(normalizedRepo)) {
+    return { verified: false, reason: `Path traversal detected: ${parsed.file}` };
+  }
+
+  if (!fs.existsSync(resolvedFile)) {
+    return { verified: false, reason: `File does not exist: ${parsed.file}` };
+  }
+
+  let fileContent;
+  try {
+    fileContent = fs.readFileSync(resolvedFile, 'utf8');
+  } catch (e) {
+    return { verified: false, reason: `Cannot read file: ${e.message}` };
+  }
+
+  const lines = fileContent.split('\n');
+
+  if (parsed.line !== null) {
+    if (parsed.line < 1 || parsed.line > lines.length) {
+      return {
+        verified: false,
+        reason: `Line ${parsed.line} does not exist in ${parsed.file} (file has ${lines.length} lines)`,
+      };
+    }
+
+    const actualLine = lines[parsed.line - 1];
+    const lineHash = crypto.createHash('sha256').update(actualLine).digest('hex').substring(0, 16);
+
+    return {
+      verified: true,
+      actual_content: actualLine.trim(),
+      content_hash: lineHash,
+      file: parsed.file,
+      line: parsed.line,
+    };
+  }
+
+  // File exists but no line specified
+  const fileHash = crypto.createHash('sha256').update(fileContent).digest('hex').substring(0, 16);
+  return {
+    verified: true,
+    content_hash: fileHash,
+    file: parsed.file,
+    line: null,
+  };
+}
+
+/**
+ * Verify all evidence items in a finding.
+ * Returns the finding with evidence_verification results attached.
+ */
+function verifyFindingEvidence(finding, repoRoot) {
+  if (!finding.evidence || !Array.isArray(finding.evidence)) {
+    return { ...finding, evidence_verification: { status: 'NO_EVIDENCE' } };
+  }
+
+  const results = finding.evidence.map(e => ({
+    evidence: e,
+    verification: verifyEvidence(e, repoRoot),
+  }));
+
+  const verifiedCount = results.filter(r => r.verification.verified).length;
+  const totalCount = results.length;
+
+  let status;
+  if (verifiedCount === 0) {
+    status = 'ALL_FABRICATED';
+  } else if (verifiedCount === totalCount) {
+    status = 'ALL_VERIFIED';
+  } else {
+    status = 'PARTIAL';
+  }
+
+  return {
+    ...finding,
+    evidence_verification: {
+      status,
+      verified_count: verifiedCount,
+      total_count: totalCount,
+      details: results.map(r => ({
+        location: r.evidence.location,
+        verified: r.verification.verified,
+        reason: r.verification.reason,
+        content_hash: r.verification.content_hash,
+      })),
+    },
+  };
+}
+
+/**
+ * Check if evidence has become stale by comparing content hashes.
+ * A hash mismatch means the code changed after the finding was generated.
+ */
+function checkStaleEvidence(finding, repoRoot) {
+  if (!finding.evidence || !Array.isArray(finding.evidence)) return finding;
+
+  const staleItems = [];
+  for (const e of finding.evidence) {
+    if (!e.location || !e.content_hash) continue;
+    const current = verifyEvidence(e, repoRoot);
+    if (current.verified && current.content_hash !== e.content_hash) {
+      staleItems.push({
+        location: e.location,
+        original_hash: e.content_hash,
+        current_hash: current.content_hash,
+      });
+    }
+  }
+
+  if (staleItems.length > 0) {
+    return {
+      ...finding,
+      stale_evidence: staleItems,
+    };
+  }
+  return finding;
+}
+
+module.exports = {
+  parseEvidenceLocation,
+  verifyEvidence,
+  verifyFindingEvidence,
+  checkStaleEvidence,
+};

package/.agent/scripts/finding_schema.js

@@ -0,0 +1,104 @@
+const { z } = require('zod');
+
+const FindingSchema = z
+  .object({
+    id: z.string().min(1, 'Finding must have a stable identifier (id)'),
+    category: z.string().min(1, 'Finding must have a category'),
+    type: z.string().optional(),
+    severity: z.enum([
+      'CRITICAL',
+      'HIGH',
+      'MEDIUM',
+      'LOW',
+      'INFO',
+      'Critical',
+      'Important',
+      'Minor',
+    ]),
+    confidence: z
+      .number()
+      .min(0)
+      .max(1)
+      .or(z.enum(['High', 'Medium', 'Low'])),
+    status: z.enum(['DETECTED', 'VERIFIED', 'UNVERIFIED', 'FIXED', 'REGRESSION-PROTECTED']),
+    title: z.string().min(1, 'Finding must have a title or description'),
+    location: z
+      .object({
+        file: z.string().optional(),
+        line: z.number().optional(),
+      })
+      .strict()
+      .optional(),
+    evidence: z
+      .array(
+        z
+          .object({
+            type: z.string(),
+            description: z.string(),
+            location: z.string().optional(),
+          })
+          .strict(),
+      )
+      .min(1, 'Finding must contain concrete evidence'),
+    impact: z.string().optional(),
+    remediation: z.string().optional(),
+    validation: z
+      .object({
+        required: z.boolean().default(true),
+      })
+      .passthrough()
+      .optional(),
+    verification: z
+      .object({
+        test_executed: z.boolean().optional(),
+        test_output: z.string().optional(),
+        command: z.string().optional(),
+        exit_code: z.number().optional(),
+        static_proof: z.boolean().optional(),
+        tool: z.string().optional(),
+        tool_output: z.string().optional(),
+      })
+      .passthrough()
+      .optional(),
+    related_findings: z.array(z.string()).optional().default([]),
+  })
+  .strict();
+
+const FindingsReportSchema = z.object({
+  findings: z.array(FindingSchema),
+});
+
+function validateFinding(finding) {
+  const result = FindingSchema.safeParse(finding);
+  if (!result.success) {
+    return {
+      valid: false,
+      errors: result.error.issues.map(issue => ({
+        path: issue.path.join('.'),
+        message: issue.message,
+      })),
+    };
+  }
+  return { valid: true, data: result.data };
+}
+
+function validateFindingsReport(report) {
+  const result = FindingsReportSchema.safeParse(report);
+  if (!result.success) {
+    return {
+      valid: false,
+      errors: result.error.issues.map(issue => ({
+        path: issue.path.join('.'),
+        message: issue.message,
+      })),
+    };
+  }
+  return { valid: true, data: result.data };
+}
+
+module.exports = {
+  FindingSchema,
+  FindingsReportSchema,
+  validateFinding,
+  validateFindingsReport,
+};

package/.agent/scripts/findings_validator.js

@@ -0,0 +1,147 @@
+#!/usr/bin/env node
+/**
+ * findings_validator.js — Validates reviewer output against the finding contract.
+ * Malformed output is quarantined, and only valid findings are passed forward.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const { validateFinding } = require('./finding_schema');
+const { BOLD, RESET, RED, YELLOW, GREEN } = require('./_colors');
+
+function main() {
+  const args = process.argv.slice(2);
+  const inputPath = args.find(a => a.startsWith('--in='))?.split('=')[1];
+  const outPath = args.find(a => a.startsWith('--out='))?.split('=')[1];
+  const quarantinePath =
+    args.find(a => a.startsWith('--quarantine='))?.split('=')[1] || 'quarantined_findings.json';
+
+  if (!inputPath || !outPath) {
+    console.log(
+      RED +
+        'Usage: node findings_validator.js --in=<file> --out=<file> [--quarantine=<file>]' +
+        RESET,
+    );
+    process.exit(1);
+  }
+
+  console.log(`${BOLD}Tribunal — Findings Schema Validator${RESET}`);
+  console.log(`Validating: ${inputPath}`);
+
+  if (!fs.existsSync(inputPath)) {
+    console.log(YELLOW + `Input file not found: ${inputPath}. Emitting empty valid array.` + RESET);
+    fs.writeFileSync(outPath, JSON.stringify({ findings: [] }, null, 2));
+    process.exit(0);
+  }
+
+  let data;
+  try {
+    data = JSON.parse(fs.readFileSync(inputPath, 'utf8'));
+  } catch (e) {
+    console.error(RED + `Failed to parse JSON: ${e.message}` + RESET);
+    console.log(YELLOW + `Quarantining entire file.` + RESET);
+    fs.writeFileSync(
+      quarantinePath,
+      JSON.stringify({ error: e.message, raw: fs.readFileSync(inputPath, 'utf8') }, null, 2),
+    );
+    fs.writeFileSync(outPath, JSON.stringify({ findings: [] }, null, 2));
+    process.exit(0);
+  }
+
+  const rawFindings = Array.isArray(data) ? data : data.findings || [];
+  const validFindings = [];
+  const quarantinedFindings = [];
+
+  // Resource limits (§18)
+  const MAX_FINDINGS = 5000;
+  const MAX_EVIDENCE_PER_FINDING = 100;
+  const MAX_STRING_LENGTH = 10240; // 10KB
+
+  if (rawFindings.length > MAX_FINDINGS) {
+    console.log(
+      YELLOW +
+        `WARNING: ${rawFindings.length} findings exceed limit of ${MAX_FINDINGS}. Processing first ${MAX_FINDINGS}.` +
+        RESET,
+    );
+    quarantinedFindings.push({
+      finding: {
+        _diagnostic: `${rawFindings.length - MAX_FINDINGS} findings exceeded limit and were dropped`,
+      },
+      errors: [{ path: 'findings', message: `Exceeded maximum of ${MAX_FINDINGS} findings` }],
+    });
+  }
+
+  const processable = rawFindings.slice(0, MAX_FINDINGS);
+
+  for (const finding of processable) {
+    // Check evidence array size limit
+    if (
+      finding.evidence &&
+      Array.isArray(finding.evidence) &&
+      finding.evidence.length > MAX_EVIDENCE_PER_FINDING
+    ) {
+      quarantinedFindings.push({
+        finding,
+        errors: [
+          {
+            path: 'evidence',
+            message: `${finding.evidence.length} evidence items exceeds limit of ${MAX_EVIDENCE_PER_FINDING}`,
+          },
+        ],
+      });
+      continue;
+    }
+
+    // Check string length limits
+    const stringFields = ['title', 'impact', 'remediation'];
+    let oversized = false;
+    for (const field of stringFields) {
+      if (
+        finding[field] &&
+        typeof finding[field] === 'string' &&
+        finding[field].length > MAX_STRING_LENGTH
+      ) {
+        quarantinedFindings.push({
+          finding,
+          errors: [
+            {
+              path: field,
+              message: `${field} length ${finding[field].length} exceeds limit of ${MAX_STRING_LENGTH}`,
+            },
+          ],
+        });
+        oversized = true;
+        break;
+      }
+    }
+    if (oversized) continue;
+
+    const result = validateFinding(finding);
+    if (result.valid) {
+      validFindings.push(result.data);
+    } else {
+      quarantinedFindings.push({
+        finding,
+        errors: result.errors,
+      });
+    }
+  }
+
+  fs.writeFileSync(outPath, JSON.stringify({ findings: validFindings }, null, 2));
+
+  if (quarantinedFindings.length > 0) {
+    fs.writeFileSync(quarantinePath, JSON.stringify({ quarantined: quarantinedFindings }, null, 2));
+    console.log(
+      YELLOW +
+        `Quarantined ${quarantinedFindings.length} invalid findings to ${quarantinePath}` +
+        RESET,
+    );
+  }
+
+  console.log(GREEN + `Passed ${validFindings.length} valid findings to ${outPath}` + RESET);
+}
+
+if (require.main === module) {
+  main();
+}

package/.agent/scripts/guardrail_engine.js

@@ -416,44 +416,60 @@ function ruleImportPhantom(content, _manifest, ctx) {
     try {
       const absPath = path.resolve(projectRoot || process.cwd(), filePath);
       const binName = process.platform === 'win32' ? 'tribunal-core.exe' : 'tribunal-core';
-      let corePath = path.join(__dirname, '..', '..', 'crates', 'core', 'target', 'release', binName);
+      let corePath = path.join(
+        __dirname,
+        '..',
+        '..',
+        'crates',
+        'core',
+        'target',
+        'release',
+        binName,
+      );
       if (!fs.existsSync(corePath)) {
-          corePath = path.join(__dirname, '..', '..', 'crates', 'core', 'target', 'debug', binName);
+        corePath = path.join(__dirname, '..', '..', 'crates', 'core', 'target', 'debug', binName);
       }
       if (fs.existsSync(corePath)) {
-        const result = require('child_process').execFileSync(corePath, ['ast-extract', '--file', absPath], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 500 });
+        const result = require('child_process').execFileSync(
+          corePath,
+          ['ast-extract', '--file', absPath],
+          { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 500 },
+        );
         const data = JSON.parse(result);
         if (data && data.success) {
-           extractedImports = data.imports;
+          extractedImports = data.imports;
         }
       }
-    } catch(_e) {
+    } catch (_e) {
       // Fallback
     }
   }
 
   const checkPackageName = (pkgName, locationString) => {
-      if (!builtins.has(pkgName) && !deps.has(pkgName)) {
-        violations.push({
-          rule: 'import-phantom',
-          severity: 'info',
-          location: locationString,
-          message: `Package "${pkgName}" is not in package.json`,
-          suggestion: `Verify "${pkgName}" is installed or add it to dependencies`,
-          autoFixable: false,
-        });
-      }
+    if (!builtins.has(pkgName) && !deps.has(pkgName)) {
+      violations.push({
+        rule: 'import-phantom',
+        severity: 'info',
+        location: locationString,
+        message: `Package "${pkgName}" is not in package.json`,
+        suggestion: `Verify "${pkgName}" is installed or add it to dependencies`,
+        autoFixable: false,
+      });
+    }
   };
 
   if (extractedImports) {
-     extractedImports.forEach(imp => {
-        const pkg = imp.source;
-        if (!pkg.startsWith('.') && !pkg.startsWith('/')) { // Only check external packages
-           const pkgName = pkg.startsWith('@') ? pkg.split('/').slice(0, 2).join('/') : pkg.split('/')[0];
-           checkPackageName(pkgName, `import from: "${pkg}"`);
-        }
-     });
-     return violations;
+    extractedImports.forEach(imp => {
+      const pkg = imp.source;
+      if (!pkg.startsWith('.') && !pkg.startsWith('/')) {
+        // Only check external packages
+        const pkgName = pkg.startsWith('@')
+          ? pkg.split('/').slice(0, 2).join('/')
+          : pkg.split('/')[0];
+        checkPackageName(pkgName, `import from: "${pkg}"`);
+      }
+    });
+    return violations;
   }
 
   const requireRegex = /require\s*\(\s*['"]([^'"./][^'"]*)['"]\s*\)/g;
@@ -508,7 +524,10 @@ function ruleRustModuleRegistration(content, manifest, _ctx) {
   const wrapperJs = path.join(root, 'bin', 'wrapper.js');
   if (fs.existsSync(wrapperJs)) {
     const wrapperContent = fs.readFileSync(wrapperJs, 'utf8');
-    if (!wrapperContent.includes('"context-broker"') && !wrapperContent.includes("'context-broker'")) {
+    if (
+      !wrapperContent.includes('"context-broker"') &&
+      !wrapperContent.includes("'context-broker'")
+    ) {
       violations.push({
         rule: 'rust-module-registration',
         severity: 'warning',

package/.agent/scripts/harness_manager.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * harness_manager.js
- * CLI entry point for the Harness Manager. 
+ * CLI entry point for the Harness Manager.
  * Replaces direct `node .agent/scripts/...` calls with:
  * `node .agent/scripts/harness_manager.js --syscall <name> [...args]`
  */
@@ -14,9 +14,9 @@ const { executeSyscall } = require('./syscall_registry');
 function main() {
   const args = process.argv.slice(2);
   const syscallIndex = args.indexOf('--syscall');
-  
+
   if (syscallIndex === -1 || syscallIndex === args.length - 1) {
-    console.error("Usage: node harness_manager.js --syscall <name> [...args]");
+    console.error('Usage: node harness_manager.js --syscall <name> [...args]');
     process.exit(1);
   }
 
@@ -24,29 +24,41 @@ function main() {
   const syscallArgs = args.filter((_, i) => i !== syscallIndex && i !== syscallIndex + 1);
 
   // 1. Log ToolRequested
-  const eventId = appendEvent('ToolRequested', {
-    tool: syscall,
-    args: syscallArgs
-  }, 'harness-manager');
+  const eventId = appendEvent(
+    'ToolRequested',
+    {
+      tool: syscall,
+      args: syscallArgs,
+    },
+    'harness-manager',
+  );
 
   // 2. Execute Safely
   const result = executeSyscall(syscall, syscallArgs);
 
   // 3. Log ToolCompleted or ErrorEncountered
   if (result.exitCode === 0) {
-    appendEvent('ToolCompleted', {
-      exitCode: result.exitCode,
-      stdout: result.stdout,
-      requestEventId: eventId
-    }, 'harness-manager');
+    appendEvent(
+      'ToolCompleted',
+      {
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        requestEventId: eventId,
+      },
+      'harness-manager',
+    );
     console.log(result.stdout);
   } else {
-    appendEvent('ErrorEncountered', {
-      exitCode: result.exitCode,
-      message: result.stderr,
-      stdout: result.stdout,
-      requestEventId: eventId
-    }, 'harness-manager');
+    appendEvent(
+      'ErrorEncountered',
+      {
+        exitCode: result.exitCode,
+        message: result.stderr,
+        stdout: result.stdout,
+        requestEventId: eventId,
+      },
+      'harness-manager',
+    );
     if (result.stderr) console.error(result.stderr);
     if (result.stdout) console.log(result.stdout);
     process.exit(result.exitCode);

package/.agent/scripts/impact_classifier.js

@@ -78,11 +78,12 @@ function classifyImpact(opts = {}) {
   let score = 0.2; // Base baseline score
   const reasoning = [];
 
-  // Check 1: Critical File Patterns
+  // Check 1: Critical File Patterns & Diff
   const isCriticalFile = files.some(file => CRITICAL_PATTERNS.some(pat => pat.test(file)));
   const isCriticalTask = CRITICAL_PATTERNS.some(pat => pat.test(task));
+  const isCriticalDiff = diff && CRITICAL_PATTERNS.some(pat => pat.test(diff));
 
-  if (isCriticalFile || isCriticalTask) {
+  if (isCriticalFile || isCriticalTask || isCriticalDiff) {
     score += 0.6;
     reasoning.push('Critical path detected (auth/security/schema/payment)');
   }
@@ -135,15 +136,15 @@ function classifyImpact(opts = {}) {
   let maxReviewers = 1;
   let requireGate = false;
 
-  if (score < 0.15 && !isCriticalFile && !isCriticalTask) {
+  if (score < 0.15 && !isCriticalFile && !isCriticalTask && !isCriticalDiff) {
     tier = 0;
     maxReviewers = 0;
     requireGate = false;
-  } else if (score < 0.35 && !isCriticalFile && !isCriticalTask) {
+  } else if (score < 0.35 && !isCriticalFile && !isCriticalTask && !isCriticalDiff) {
     tier = 1;
     maxReviewers = 1;
     requireGate = false;
-  } else if (score < 0.7 && !isCriticalFile) {
+  } else if (score < 0.7 && !isCriticalFile && !isCriticalDiff) {
     tier = 2;
     maxReviewers = 2;
     requireGate = true; // Conditional gate