fix: require signed execution security evidence

2026-09-02 11:12:28 +03:00
parent 259f52a02b
commit 7da2b72933
5 changed files with 180 additions and 16 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,7 @@ playwright-report/
 test-results/
 .env*
 config/site.production.json
+config/release-execution-trust.json
 release-evidence/
 *.release.tar
 *.release.tar.partial-*
--- a/docs/deployment/release-checklist.md
+++ b/docs/deployment/release-checklist.md
@@ -24,11 +24,15 @@ node scripts/supply-chain-check.mjs collect \
  --project . \
  --evidence /external/write-once/release-evidence/supply-chain \
  --triage APPROVED_COMMITTED_MEDIUM_TRIAGE.json \
+  --execution-security SIGNED_EXECUTION_SECURITY_ENVELOPE.json \
+  --tool-trust-policy config/release-execution-trust.json \
  --allow-registry-network yes \
-  --today YYYY-MM-DD
+  --now YYYY-MM-DDTHH:MM:SSZ
 ```

-The collector runs `npm ci --ignore-scripts`, production and full development audits, the pinned license checker, and the pinned CycloneDX generator. It strips the environment to a minimal credential-free set. The verifier fails when package metadata or the lockfile changes, evidence digests do not match, a license is not allowlisted, an SBOM is malformed, or a Critical/High finding exists. Every Medium finding must have one current, exact, committed triage entry; stale extras also fail.
+The collector runs `npm ci --ignore-scripts`, production and full development audits, the pinned license checker, and the pinned CycloneDX generator. It strips the environment to a minimal credential-free set. It also requires a separately signed execution-security envelope: all four privacy image roles must be digest-pinned with verified provenance and zero Critical/High findings; native tools must be integrity/signature verified and clean; repository secret/history scans, pinned CI actions, and distribution notices must all pass. The verifier checks that envelope against the protected public-key policy at `config/release-execution-trust.json`. Until Luca supplies and approves that public trust policy and the signed evidence, the supply-chain gate intentionally fails closed.
+
+The verifier also fails when package metadata or the lockfile changes, evidence digests do not match, a license is not allowlisted, an SBOM is malformed, or a Critical/High finding exists. Every Medium finding must have one current, exact, committed triage entry; stale extras also fail.

 - [ ] `npm run verify:supply-chain` passes against the selected immutable evidence directory.
 - [ ] `npm audit` evidence covers production dependencies and the complete development tree.
@@ -36,6 +40,8 @@ The collector runs `npm ci --ignore-scripts`, production and full development au
 - [ ] Every Medium finding has a current committed owner, rationale, and review date.
 - [ ] CycloneDX SBOM is bound by the evidence manifest and packaged with the release.
 - [ ] License inventory contains no unknown, copyleft, or unapproved expression.
+- [ ] Signed execution image/native-tool evidence is current, complete, digest-pinned, and has zero Critical/High findings.
+- [ ] Repository secret/history, CI action pinning, and distribution notice checks pass.
 - [ ] `npm run build:preview` passes.
 - [ ] Complete production build, unit/browser/accessibility/performance gates pass using the approved production config.
 - [ ] Privacy reconciliation and signed-release admission pass against external trust state.
--- a/package.json
+++ b/package.json
@@ -23,7 +23,7 @@
    "capture:runtime-budgets": "playwright test tests/performance/runtime-budget-trace.spec.ts --project=runtime-budget-desktop --workers=1",
    "verify:runtime-budgets": "node scripts/verify-runtime-budgets.mjs",
    "verify:phase3": "npm run verify:runtime-budgets && npm run test:browser",
-    "verify:supply-chain": "node scripts/supply-chain-check.mjs verify --project . --evidence release-evidence/supply-chain",
+    "verify:supply-chain": "node scripts/supply-chain-check.mjs verify --project . --evidence release-evidence/supply-chain --tool-trust-policy config/release-execution-trust.json",
    "smoke:production": "node scripts/smoke-production.mjs",
    "aggregate:performance": "node scripts/aggregate-drive-traces.mjs",
    "sign:performance": "node scripts/sign-drive-trace.mjs",
--- a/scripts/supply-chain-check.mjs
+++ b/scripts/supply-chain-check.mjs
@@ -1,10 +1,12 @@
 #!/usr/bin/env node
-import { createHash } from 'node:crypto';
+import { createHash, createPublicKey, verify } from 'node:crypto';
 import { execFileSync, spawnSync } from 'node:child_process';
 import { lstat, mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
 import { pathToFileURL } from 'node:url';

+import { canonicalValueBytes } from '../src/security/canonical-digest.ts';
+
 const sha256Pattern = /^[a-f0-9]{64}$/u;
 const datePattern = /^\d{4}-\d{2}-\d{2}$/u;
 const reportNames = [
@@ -13,6 +15,7 @@ const reportNames = [
  'licenses.json',
  'sbom.cdx.json',
  'medium-triage.json',
+  'execution-security.json',
 ];
 const allowedLicenses = new Set([
  '0BSD', 'Apache-2.0', 'BlueOak-1.0.0', 'BSD-2-Clause', 'BSD-3-Clause', 'CC0-1.0', 'ISC', 'MIT', 'Python-2.0', 'Unlicense',
@@ -113,6 +116,75 @@ function verifyToolProvenance(toolVersions, packageJson, packageLock) {
  }
 }

+function timestamp(value, label) {
+  if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/u.test(value) || Number.isNaN(Date.parse(value))) {
+    throw new Error(`${label} must be a UTC RFC 3339 timestamp.`);
+  }
+  return value;
+}
+
+async function verifyExecutionSecurity(envelope, trustPath, now) {
+  const trust = parseJson(await safeRead(resolve(trustPath), 'Execution evidence trust policy'), 'Execution evidence trust policy');
+  if (!exactKeys(trust, ['schema', 'keyId', 'issuerEpoch', 'scope', 'publicKeyPem', 'revoked', 'expectedImageRoles']) ||
+      trust.schema !== 'portfolio-execution-evidence-trust/v1' || trust.scope !== 'portfolio-execution-security-evidence/v1' ||
+      typeof trust.keyId !== 'string' || !Number.isSafeInteger(trust.issuerEpoch) || trust.issuerEpoch < 1 ||
+      typeof trust.publicKeyPem !== 'string' || trust.revoked !== false || !Array.isArray(trust.expectedImageRoles) ||
+      trust.expectedImageRoles.length === 0 || trust.expectedImageRoles.some((role) => typeof role !== 'string') ||
+      new Set(trust.expectedImageRoles).size !== trust.expectedImageRoles.length) {
+    throw new Error('Execution evidence trust policy is invalid or revoked.');
+  }
+  if (!exactKeys(envelope, ['schema', 'payload', 'signature']) || envelope.schema !== 'portfolio-execution-security-evidence-envelope/v1' ||
+      !isObject(envelope.payload) || !isObject(envelope.signature)) throw new Error('Execution security evidence envelope is invalid.');
+  const payload = envelope.payload;
+  if (!exactKeys(payload, ['schema', 'keyId', 'issuerEpoch', 'scope', 'generatedAt', 'expiresAt', 'images', 'nativeTools', 'repository']) ||
+      payload.schema !== 'portfolio-execution-security-evidence/v1' || payload.scope !== trust.scope || payload.keyId !== trust.keyId ||
+      payload.issuerEpoch !== trust.issuerEpoch || !Array.isArray(payload.images) || !Array.isArray(payload.nativeTools) || !isObject(payload.repository)) {
+    throw new Error('Execution security evidence payload is invalid.');
+  }
+  const generatedAt = timestamp(payload.generatedAt, 'Execution evidence generatedAt');
+  const expiresAt = timestamp(payload.expiresAt, 'Execution evidence expiresAt');
+  const current = timestamp(now, 'Execution evidence current time');
+  if (Date.parse(generatedAt) > Date.parse(current) || Date.parse(current) >= Date.parse(expiresAt)) throw new Error('Execution security evidence is expired or not yet valid.');
+  const expectedRoles = [...trust.expectedImageRoles].sort();
+  const roles = [];
+  for (const image of payload.images) {
+    if (!exactKeys(image, ['role', 'image', 'provenanceVerified', 'critical', 'high']) || typeof image.role !== 'string' ||
+        typeof image.image !== 'string' || !/@sha256:[a-f0-9]{64}$/u.test(image.image) || image.provenanceVerified !== true ||
+        !Number.isSafeInteger(image.critical) || !Number.isSafeInteger(image.high) || image.critical < 0 || image.high < 0) {
+      throw new Error('Execution image provenance evidence is invalid or unsigned.');
+    }
+    if (image.critical > 0 || image.high > 0) throw new Error('Execution image is blocked by Critical/High vulnerabilities.');
+    roles.push(image.role);
+  }
+  if (JSON.stringify(roles.sort()) !== JSON.stringify(expectedRoles)) throw new Error('Execution image role closure is incomplete or duplicated.');
+  if (payload.nativeTools.length === 0) throw new Error('Native tool security evidence is empty.');
+  const nativeNames = new Set();
+  for (const tool of payload.nativeTools) {
+    if (!exactKeys(tool, ['name', 'version', 'sha256', 'signatureVerified', 'critical', 'high']) || typeof tool.name !== 'string' ||
+        typeof tool.version !== 'string' || !sha256Pattern.test(tool.sha256) || tool.signatureVerified !== true ||
+        !Number.isSafeInteger(tool.critical) || !Number.isSafeInteger(tool.high) || tool.critical < 0 || tool.high < 0 || nativeNames.has(tool.name)) {
+      throw new Error('Native tool provenance evidence is invalid or unsigned.');
+    }
+    if (tool.critical > 0 || tool.high > 0) throw new Error('Native tool is blocked by Critical/High vulnerabilities.');
+    nativeNames.add(tool.name);
+  }
+  const repository = payload.repository;
+  if (!exactKeys(repository, ['commitSha', 'secretScanPassed', 'historyScanPassed', 'ciActionsPinned', 'distributionNoticesComplete']) ||
+      typeof repository.commitSha !== 'string' || !/^[a-f0-9]{40}$/u.test(repository.commitSha) || repository.secretScanPassed !== true ||
+      repository.historyScanPassed !== true || repository.ciActionsPinned !== true || repository.distributionNoticesComplete !== true) {
+    throw new Error('Repository secret/history/CI/distribution security evidence is incomplete.');
+  }
+  const signature = envelope.signature;
+  if (!exactKeys(signature, ['algorithm', 'encoding', 'value']) || signature.algorithm !== 'Ed25519' || signature.encoding !== 'base64url-nopad' ||
+      typeof signature.value !== 'string' || !/^[A-Za-z0-9_-]+$/u.test(signature.value)) throw new Error('Execution security evidence signature is invalid.');
+  let publicKey;
+  try { publicKey = createPublicKey(trust.publicKeyPem); } catch { throw new Error('Execution evidence public key is invalid.'); }
+  if (!verify(null, canonicalValueBytes(payload), publicKey, Buffer.from(signature.value, 'base64url'))) {
+    throw new Error('Execution security evidence signature verification failed.');
+  }
+  return { imageCount: roles.length, nativeToolCount: nativeNames.size };
+}
+
 function assertTracked(projectRoot, triagePath) {
  const rel = relative(projectRoot, triagePath);
  if (rel === '' || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw new Error('Committed Medium triage must be inside the project root.');
@@ -164,7 +236,10 @@ export async function verifySupplyChainEvidence(options) {
  if (options.requireTrackedTriage !== false && mediumFindings.length > 0) assertTracked(projectRoot, resolve(evidenceDir, 'medium-triage.json'));
  const licenseCount = verifyLicenses(reports['licenses.json'], options.allowedLicenses ?? allowedLicenses);
  const componentCount = verifySbom(reports['sbom.cdx.json'], packageJson);
+  if (typeof options.toolTrustPolicyPath !== 'string') throw new Error('Execution evidence trust policy is required.');
+  const execution = await verifyExecutionSecurity(reports['execution-security.json'], options.toolTrustPolicyPath, options.now ?? new Date().toISOString());
  return { schema: 'portfolio-supply-chain-verification/v1', critical, high, medium: mediumFindings.length, licenseCount, componentCount,
+    executionImages: execution.imageCount, nativeTools: execution.nativeToolCount,
    packageLockSha256: manifest.packageLockSha256, evidenceManifestSha256: sha256(await safeRead(resolve(evidenceDir, 'evidence-manifest.json'), 'Supply-chain evidence manifest')) };
 }

@@ -176,7 +251,7 @@ function runTool(command, args, cwd, options = {}) {
  return result.stdout;
 }

-async function collectEvidence(projectRoot, evidenceDir, triagePath) {
+async function collectEvidence(projectRoot, evidenceDir, triagePath, executionSecurityPath) {
  await mkdir(evidenceDir, { recursive: false });
  const beforePackage = await safeRead(resolve(projectRoot, 'package.json'), 'package.json');
  const beforeLock = await safeRead(resolve(projectRoot, 'package-lock.json'), 'package-lock.json');
@@ -193,9 +268,11 @@ async function collectEvidence(projectRoot, evidenceDir, triagePath) {
  const afterLock = await safeRead(resolve(projectRoot, 'package-lock.json'), 'package-lock.json');
  if (sha256(beforePackage) !== sha256(afterPackage) || sha256(beforeLock) !== sha256(afterLock)) throw new Error('npm ci changed package metadata or lockfile.');
  const triage = await safeRead(triagePath, 'Committed Medium triage');
+  const executionSecurity = await safeRead(executionSecurityPath, 'Signed execution security evidence');
  const output = {
    'npm-audit-production.json': Buffer.from(productionAudit), 'npm-audit-development.json': Buffer.from(developmentAudit),
    'licenses.json': Buffer.from(licenses), 'sbom.cdx.json': await safeRead(sbomPath, 'Generated CycloneDX SBOM'), 'medium-triage.json': triage,
+    'execution-security.json': executionSecurity,
  };
  for (const [name, bytes] of Object.entries(output)) if (name !== 'sbom.cdx.json') await writeFile(resolve(evidenceDir, name), bytes, { flag: 'wx', mode: 0o400 });
  const lock = parseJson(beforeLock, 'package-lock.json');
@@ -223,9 +300,11 @@ async function main() {
  if (command === 'collect') {
    if (values['allow-registry-network'] !== 'yes') throw new Error('Collection requires --allow-registry-network yes in a credentialless registry-only sandbox.');
    if (!values.triage) throw new Error('Collection requires --triage <committed-record>.');
-    await collectEvidence(projectRoot, evidenceDir, resolve(values.triage));
+    if (!values['execution-security']) throw new Error('Collection requires --execution-security <signed-evidence>.');
+    await collectEvidence(projectRoot, evidenceDir, resolve(values.triage), resolve(values['execution-security']));
  } else if (command !== 'verify') throw new Error('Usage: supply-chain-check.mjs <collect|verify> --project <root> --evidence <dir>.');
-  process.stdout.write(`${JSON.stringify(await verifySupplyChainEvidence({ projectRoot, evidenceDir, today: values.today }))}\n`);
+  if (!values['tool-trust-policy']) throw new Error('Verification requires --tool-trust-policy <protected-policy>.');
+  process.stdout.write(`${JSON.stringify(await verifySupplyChainEvidence({ projectRoot, evidenceDir, today: values.today, now: values.now, toolTrustPolicyPath: resolve(values['tool-trust-policy']) }))}\n`);
 }

 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
--- a/tests/deployment/headers.spec.ts
+++ b/tests/deployment/headers.spec.ts
@@ -1,9 +1,11 @@
-import { createHash } from 'node:crypto';
+import { createHash, generateKeyPairSync, sign } from 'node:crypto';
 import { mkdtemp, mkdir, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { describe, expect, it } from 'vitest';

+import { canonicalValueBytes } from '../../src/security/canonical-digest.ts';
+
 // @ts-expect-error The production release checker is an executable ESM module.
 import { verifySupplyChainEvidence } from '../../scripts/supply-chain-check.mjs';

@@ -21,12 +23,56 @@ async function evidenceFixture(overrides: Record<string, unknown> = {}) {
  } });
  await writeFile(join(root, 'package.json'), packageJson);
  await writeFile(join(root, 'package-lock.json'), packageLock);
+  const signingKeys = generateKeyPairSync('ed25519');
+  const trustPolicyPath = join(root, 'execution-trust.json');
+  await writeFile(trustPolicyPath, JSON.stringify({
+    schema: 'portfolio-execution-evidence-trust/v1',
+    keyId: 'supply-chain-test-key',
+    issuerEpoch: 1,
+    scope: 'portfolio-execution-security-evidence/v1',
+    publicKeyPem: signingKeys.publicKey.export({ type: 'spki', format: 'pem' }),
+    revoked: false,
+    expectedImageRoles: ['coordinator', 'matcher', 'worker-a', 'worker-b'],
+  }));
+  const executionPayload = overrides.executionPayload ?? {
+    schema: 'portfolio-execution-security-evidence/v1',
+    keyId: 'supply-chain-test-key',
+    issuerEpoch: 1,
+    scope: 'portfolio-execution-security-evidence/v1',
+    generatedAt: '2026-09-02T00:00:00Z',
+    expiresAt: '2026-09-03T00:00:00Z',
+    images: ['coordinator', 'matcher', 'worker-a', 'worker-b'].map((role, index) => ({
+      role,
+      image: `registry.invalid/portfolio-${role}@sha256:${String(index + 1).repeat(64)}`,
+      provenanceVerified: true,
+      critical: 0,
+      high: 0,
+    })),
+    nativeTools: [{ name: 'nginx', version: '1.29.1', sha256: 'a'.repeat(64), signatureVerified: true, critical: 0, high: 0 }],
+    repository: {
+      commitSha: 'b'.repeat(40),
+      secretScanPassed: true,
+      historyScanPassed: true,
+      ciActionsPinned: true,
+      distributionNoticesComplete: true,
+    },
+  };
+  const executionEnvelope = overrides.executionEnvelope ?? {
+    schema: 'portfolio-execution-security-evidence-envelope/v1',
+    payload: executionPayload,
+    signature: {
+      algorithm: 'Ed25519',
+      encoding: 'base64url-nopad',
+      value: sign(null, canonicalValueBytes(executionPayload), signingKeys.privateKey).toString('base64url'),
+    },
+  };
  const reports = {
    'npm-audit-production.json': JSON.stringify(overrides.productionAudit ?? { auditReportVersion: 2, vulnerabilities: {}, metadata: { vulnerabilities: { info: 0, low: 0, moderate: 0, high: 0, critical: 0, total: 0 } } }),
    'npm-audit-development.json': JSON.stringify(overrides.developmentAudit ?? { auditReportVersion: 2, vulnerabilities: {}, metadata: { vulnerabilities: { info: 0, low: 0, moderate: 0, high: 0, critical: 0, total: 0 } } }),
    'licenses.json': JSON.stringify(overrides.licenses ?? { 'portfolio@1.0.0': { licenses: 'ISC' } }),
    'sbom.cdx.json': JSON.stringify(overrides.sbom ?? { bomFormat: 'CycloneDX', specVersion: '1.6', version: 1, metadata: { component: { type: 'application', name: 'portfolio', version: '1.0.0' } }, components: [] }),
    'medium-triage.json': JSON.stringify(overrides.triage ?? { schema: 'portfolio-medium-vulnerability-triage/v1', findings: [] }),
+    'execution-security.json': JSON.stringify(executionEnvelope),
  };
  for (const [name, contents] of Object.entries(reports)) await writeFile(join(evidence, name), contents);
  const manifest = {
@@ -37,40 +83,72 @@ async function evidenceFixture(overrides: Record<string, unknown> = {}) {
    toolVersions: { npm: '11.0.0', cyclonedxNpm: '6.0.1', licenseChecker: '4.4.2' },
  };
  await writeFile(join(evidence, 'evidence-manifest.json'), JSON.stringify(manifest));
-  return { root, evidence };
+  return { root, evidence, trustPolicyPath };
 }

+const verifyFixture = (fixture: Awaited<ReturnType<typeof evidenceFixture>>, extra: Record<string, unknown> = {}) =>
+  verifySupplyChainEvidence({
+    projectRoot: fixture.root,
+    evidenceDir: fixture.evidence,
+    toolTrustPolicyPath: fixture.trustPolicyPath,
+    requireTrackedTriage: false,
+    ...extra,
+  });
+
 describe('supply-chain evidence', () => {
  it('accepts a digest-bound clean audit, allowlisted licenses, and CycloneDX SBOM', async () => {
    const fixture = await evidenceFixture();
-    await expect(verifySupplyChainEvidence({ projectRoot: fixture.root, evidenceDir: fixture.evidence, requireTrackedTriage: false })).resolves.toMatchObject({
-      critical: 0, high: 0, medium: 0, componentCount: 0,
+    await expect(verifyFixture(fixture, { now: '2026-09-02T12:00:00Z' })).resolves.toMatchObject({
+      critical: 0, high: 0, medium: 0, componentCount: 0, executionImages: 4,
    });
  });

  it('fails closed on altered evidence, Critical/High findings, or forbidden licenses', async () => {
    const fixture = await evidenceFixture();
    await writeFile(join(fixture.evidence, 'licenses.json'), JSON.stringify({ 'portfolio@1.0.0': { licenses: 'AGPL-3.0' } }));
-    await expect(verifySupplyChainEvidence({ projectRoot: fixture.root, evidenceDir: fixture.evidence, requireTrackedTriage: false })).rejects.toThrow(/digest/u);
+    await expect(verifyFixture(fixture)).rejects.toThrow(/digest/u);

    const high = await evidenceFixture({
      productionAudit: { auditReportVersion: 2, vulnerabilities: { unsafe: { name: 'unsafe', severity: 'high', via: [], effects: [], range: '*', nodes: [] } }, metadata: { vulnerabilities: { info: 0, low: 0, moderate: 0, high: 1, critical: 0, total: 1 } } },
    });
-    await expect(verifySupplyChainEvidence({ projectRoot: high.root, evidenceDir: high.evidence, requireTrackedTriage: false })).rejects.toThrow(/High|high/u);
+    await expect(verifyFixture(high)).rejects.toThrow(/High|high/u);

    const license = await evidenceFixture({ licenses: { 'portfolio@1.0.0': { licenses: 'AGPL-3.0-only' } } });
-    await expect(verifySupplyChainEvidence({ projectRoot: license.root, evidenceDir: license.evidence, requireTrackedTriage: false })).rejects.toThrow(/license/u);
+    await expect(verifyFixture(license)).rejects.toThrow(/license/u);
  });

  it('requires an exact, current triage record for every Medium finding', async () => {
    const audit = { auditReportVersion: 2, vulnerabilities: { packageA: { name: 'packageA', severity: 'moderate', via: [], effects: [], range: '<2', nodes: ['node_modules/packageA'] } }, metadata: { vulnerabilities: { info: 0, low: 0, moderate: 1, high: 0, critical: 0, total: 1 } } };
    const missing = await evidenceFixture({ developmentAudit: audit });
-    await expect(verifySupplyChainEvidence({ projectRoot: missing.root, evidenceDir: missing.evidence, requireTrackedTriage: false })).rejects.toThrow(/triage/u);
+    await expect(verifyFixture(missing)).rejects.toThrow(/triage/u);

    const accepted = await evidenceFixture({
      developmentAudit: audit,
      triage: { schema: 'portfolio-medium-vulnerability-triage/v1', findings: [{ scope: 'development', package: 'packageA', severity: 'moderate', range: '<2', disposition: 'accepted', rationale: 'Build-only tool; no deployed runtime exposure.', owner: 'Luca Pîslaru', reviewBy: '2027-01-01' }] },
    });
-    await expect(verifySupplyChainEvidence({ projectRoot: accepted.root, evidenceDir: accepted.evidence, requireTrackedTriage: false, today: '2026-09-02' })).resolves.toMatchObject({ medium: 1 });
+    await expect(verifyFixture(accepted, { today: '2026-09-02' })).resolves.toMatchObject({ medium: 1 });
+  });
+
+  it('fails closed on unsigned tooling, vulnerable images, or incomplete repository security evidence', async () => {
+    const unsigned = await evidenceFixture({ executionEnvelope: { schema: 'portfolio-execution-security-evidence-envelope/v1', payload: {}, signature: { algorithm: 'Ed25519', encoding: 'base64url-nopad', value: '' } } });
+    await expect(verifyFixture(unsigned)).rejects.toThrow(/execution|signature|payload/u);
+
+    const vulnerable = await evidenceFixture({ executionPayload: {
+      schema: 'portfolio-execution-security-evidence/v1', keyId: 'supply-chain-test-key', issuerEpoch: 1,
+      scope: 'portfolio-execution-security-evidence/v1', generatedAt: '2026-09-02T00:00:00Z', expiresAt: '2026-09-03T00:00:00Z',
+      images: ['coordinator', 'matcher', 'worker-a', 'worker-b'].map((role, index) => ({ role, image: `registry.invalid/${role}@sha256:${String(index + 1).repeat(64)}`, provenanceVerified: true, critical: 0, high: role === 'worker-a' ? 1 : 0 })),
+      nativeTools: [{ name: 'nginx', version: '1.29.1', sha256: 'a'.repeat(64), signatureVerified: true, critical: 0, high: 0 }],
+      repository: { commitSha: 'b'.repeat(40), secretScanPassed: true, historyScanPassed: true, ciActionsPinned: true, distributionNoticesComplete: true },
+    } });
+    await expect(verifyFixture(vulnerable)).rejects.toThrow(/Critical|High|vulnerab/u);
+
+    const unscanned = await evidenceFixture({ executionPayload: {
+      schema: 'portfolio-execution-security-evidence/v1', keyId: 'supply-chain-test-key', issuerEpoch: 1,
+      scope: 'portfolio-execution-security-evidence/v1', generatedAt: '2026-09-02T00:00:00Z', expiresAt: '2026-09-03T00:00:00Z',
+      images: ['coordinator', 'matcher', 'worker-a', 'worker-b'].map((role, index) => ({ role, image: `registry.invalid/${role}@sha256:${String(index + 1).repeat(64)}`, provenanceVerified: true, critical: 0, high: 0 })),
+      nativeTools: [{ name: 'nginx', version: '1.29.1', sha256: 'a'.repeat(64), signatureVerified: true, critical: 0, high: 0 }],
+      repository: { commitSha: 'b'.repeat(40), secretScanPassed: false, historyScanPassed: true, ciActionsPinned: true, distributionNoticesComplete: true },
+    } });
+    await expect(verifyFixture(unscanned)).rejects.toThrow(/repository|secret/u);
  });
 });