[Foundation] Bundle evidence contracts and templates in each exploit checker #13

Completed production distribution — 2026-10-26 UTC

Resolved by adopting existing company-controlled GitHub OIDC/Sigstore publisher identity, rather than requiring unprovisioned human-held offline keys. PR #24 implements publication/expiry/durable rollback; PR #26 corrects an actual gh flag incompatibility and makes verification a pre-publication gate. The exact certificate identity pins the main-branch workflow; numeric repository/owner IDs, issuer, source/signer digests and hosted-runner policy are enforced using maintained gh cryptography and independently sourced Sigstore roots.

Production receipt: rules-v1-3-1, source 019b7b31486953e022b9e8d6d02b28e9de820e1e, artifact SHA-256 0a55c25853f0b099697d1a55a02d0beeb25ad6d2c1f4348a3793c5acd7cb44ef, publisher including self-verification passed. Independent local verification of three real releases succeeded. After accepting sequence 2001, the authentic sequence-1001 release was cryptographically verified then rejected as rollback. Tampered bytes, wrong numeric publisher and authentic artifact at expiry were rejected without changing prior output/state. All 13 hosted jobs on that production source commit passed (12 normal/optional tests plus publisher).

Existing repository administrators own publishing access and recovery; the runbook documents disabling publishing, revoking unauthorized access, independent policy recovery, offline revocation limits and monotonic rollback releases. No persistent project private key or invented named custodian was provisioned. The earlier 2-of-3 TUF-root recommendation remains an optional alternative, not a prerequisite or claimed production deployment. Trust/recovery procedure.

Copilot completed the substantive feature and stale-run remediation reviews before exhausting its monthly quota. The focused CLI compatibility correction was validated against actual signed releases, regression tests, manual review and hosted CI; no additional Copilot review is claimed for that correction. Core offline use, embedded snapshots and not_tested exploitability remain independent of publication. Historical blocker/planning notes below are superseded by this completion record.

Current delivery — 2026-10-26 UTC

The bundled contracts and optional offline signed-bundle verifier are merged in PR #21, at 5bfd4caee620543889e11c4b6c3af7a0e57a1965. Local validation passes 65 core/metadata tests plus 13 synthetic trust-lifecycle tests. GitHub Copilot hosted and CLI review findings were addressed; the final Copilot CLI remediation review found no actionable defect. The verifier authenticates a local artifact for review/release preparation; it neither installs rules automatically nor changes standalone checker dependencies.

Remaining operational blocker: establish company-controlled production trust. Recommended design: three independent offline Ed25519 root custodians with a 2-of-3 threshold, separate release-role keys, an independently distributed public bootstrap root and recorded digest, plus an authenticated release/feed channel and recovery ownership. The publisher public root, custodians and feed endpoint have not been supplied or provisioned. Synthetic fixture keys cannot serve as production trust. Keep this issue open until those operational inputs and end-to-end production distribution are verified. Provisioning and recovery procedure.

The result bridge explicitly versions actual canonical/legacy profiles rather than claiming every checker implements an identical schema. Local exploitability remains not_tested.

Delivery reconciliation — 2026-10-25

Contracts, embedded snapshots, schemas, protected I/O and standalone distributions are bundled into the merged exploit checkers; the October 23 statement that the initial implementation PRs remain unmerged is obsolete.

Still open: signed distribution/update trust, publisher keys, rotation/revocation, expiry and rollback tests. Those capabilities remain explicitly deferred; hashes only identify bytes and are not publisher signatures. Also reconcile the proposed result vocabulary against each actual per-checker schema rather than asserting a universal contract that implementations do not share. Do not introduce a separate mandatory shared-rules service.

Full dated audit and exact commit/CI receipts · merged reconciliation PR #20

Bundled contract/template delivery — October 23, 2026

The initial evidence contract, standard-library helpers, schema, renderers, protected I/O and repository guidance are bundled into each of the first exploit-specific implementations:

• Next.js PR #1
• NetScaler CVE-2026-88771 PR #1
• NetScaler CVE-2026-88772 PR #1

Each runs when its Python executable is copied alone, includes 27 contract conformance tests, and passed the six-job cross-platform matrix. Node2Shell PR #15 documents the one-exploit-per-repository policy.

No separate foundation repository or installed shared package is required. SHA-256 digests identify content; they are not publisher signatures. Signed distribution, key rotation, rollback and update trust remain deferred and are not claimed complete. Implementation PRs remain open; keep this issue open for the remaining work.

User clarification — one repository per exploit (2026-10-23)

Each distinct exploit/advisory must ship in its own standalone repository. This issue is a planning/coordination grouping; it must not become a scanner aggregating unrelated vulnerabilities. Common parsing, evidence contracts and output code may be bundled into each checker without requiring a shared runtime. See parent issue #2 for the current repository mapping.

Implement common contracts/template code as bundled development support inside the individual exploit repositories. A separate shared-rules repository is not part of this delivery; hosted/signed feed work remains deferred.

Priority: P2/foundation | Deliverable: evidence contracts and reusable templates bundled into each exploit repository
Estimate from report: MVP 8–12 person-days; hardened 20–30 person-days (rough estimates, not commitments).
Parent: Security checker family roadmap

Outcome

Define the common evidence/result specification and publish reviewed, versioned advisory rule snapshots.

Scope

• Start the result/evidence schema and repository template immediately despite the broader feed's P2 priority; use Node2Shell as reference.
• Specify per-rule sources, verification dates, affected/fixed branches, applicability, mitigation, confidence, uncertainty and remediation.
• Provide embedded offline snapshots and an optional authenticated signed-feed update path with trusted keys, expiry/rollback policy and changelog.
• Define review/rollback procedure, reusable synthetic fixtures, AGPL/commercial licensing consistency and separately controlled trademarks.

Acceptance criteria

• Schema keeps local exploitability not_tested; KEV/vendor exploitation is separate threat metadata, not a local exploitation result.
• Define potentially_affected, precondition_present, likely_exposed, mitigated_configuration, fixed_version_reported, unsupported_runtime and unknown with explicit minimum evidence.
• Reject tampered/untrusted/invalid updates and retain embedded rules; test key rotation, stale snapshots and rollback behavior.
• Every threshold/precondition has reviewed primary-source provenance; missing/conflicting/vendor data cannot become safe.
• Apply the parent roadmap's shared release gates: primary-source verification, uncertainty handling, bounded parsing, deterministic outputs, meaningful synthetic tests, privacy and documentation.
• Keep the core independently usable offline with an embedded rule snapshot; default to Python 3.10+ standard library and document any justified exception.
• Preserve local exploitability: not_tested; record actual observations separately from inference and external exploitation reports.

Dependencies and sequencing

First deliverable: schema/template; validate it against Next.js and edge pilots before finalizing. Signed distribution can follow later.

This is a planning issue in the reference repository. The proposed artifact name identifies the intended destination; creating this issue does not create that repository or require implementing an unrelated scanner inside node2shell-check.

Verification plan

Use synthetic version boundaries, absent/present/ambiguous preconditions, conflicting and vendor-qualified evidence, malformed/bounded inputs and output escaping/privacy cases. No production-target scanning in CI. Verify applicable Linux/Windows/macOS behavior, CLI help and documented examples before release.

Sources to verify

Origin: user-supplied Research Report: High-Value Security Checkers to Build After Node2Shell, dated 2026-10-23. Advisory statements and thresholds above are research leads, not independently verified facts. Check the primary sources and record exact validated claims/dates before enabling any detection rule; omit unsupported claims.

• https://github.com/CompleteTech-LLC/node2shell-check
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog