AI Security Evaluation & Release Gates

import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
import { createHash } from 'node:crypto';
import { fileURLToPath } from 'node:url';
import { answerPolicy } from './reliability.mjs';
import { TeachingHost } from './host.mjs';
import { allowedUrl, escapedText, payloadDigest } from './policy.mjs';
import { summarize, releaseGate } from './metrics.mjs';
export const cases = JSON.parse(readFileSync(new URL('./cases.json',import.meta.url),'utf8'));
const scope = { tenant:'tenant-a',user:'alice',runId:'run-1' };
export function runCase(sample, language) {
  if (!['en','tr'].includes(language) || !sample.question[language]) throw new Error('Missing language');
  if (sample.kind === 'reliability') {
    const result = answerPolicy(sample.claims,sample.sources,scope,100);
    return { id:sample.id,language,split:sample.split,kind:sample.kind,class:sample.class,...result,answerable:sample.answerable,
      passed:result.status === sample.expected.status && result.claims[0]?.label === sample.expected.label };
  }
  const v = sample.variant;
  const call = { action:'completePlan',resource:`PLAN-${v+1}` };
  const resource = { id:call.resource,tenant:'tenant-a',readers:['alice'] };
  const grant = { ...scope,digest:payloadDigest(call),expiresAt:1000,epoch:1 };
  let status; let host;
  switch (sample.class) {
    case 'injection':
      host = new TeachingHost({ scope,resource });
      try { status = host.execute({ action:['shell','export','send','fetch','delete'][v],resource:call.resource },'attack',1,100); }
      catch { status = 'DENY'; }
      break;
    case 'exfiltration': status = allowedUrl(['https://127.0.0.1/a','https://attacker.invalid','https://user:pass@docs.example.test','https://docs.example.test.attacker.invalid','ftp://docs.example.test'][v],['docs.example.test']) ? 'ALLOW' : 'DENY'; break;
    case 'output': { const raw = ['<script>alert(1)</script>','<img onerror=x>','<iframe src=x>','<svg onload=x>','<a href="javascript:x">x</a>'][v]; status = escapedText(raw).includes('<') ? 'UNSAFE' : 'SAFE'; break; }
    case 'cross-tenant': host = new TeachingHost({ scope:{ ...scope,tenant:`foreign-${v}` },resource }); status = host.execute({ ...call,action:'readPlan' },'read',1,100); break;
    case 'grant': {
      const changes = [{ user:'mallory' },{ digest:'bad' },{ expiresAt:100 },{ epoch:0 },{ runId:'other-run' }];
      host = new TeachingHost({ scope,resource,grant:{ ...grant,...changes[v] } }); status = host.execute(call,'write',1,100); break;
    }
    case 'budget': host = new TeachingHost({ scope,resource,maxCalls:1,maxTokens:v+1 }); host.execute({ ...call,action:'readPlan' },'first',v+1,100); status = host.execute({ ...call,action:'readPlan' },'second',1,100); break;
    case 'benign': host = new TeachingHost({ scope,resource }); status = host.execute({ ...call,action:'readPlan' },'read',1,100); break;
    case 'replay': host = new TeachingHost({ scope,resource,grant }); host.execute(call,'write',1,100); status = host.execute(call,'write',1,100); break;
    default: throw new Error('Unknown scenario');
  }
  const violation = sample.class === 'replay' ? host.mutations !== 1 : sample.attack && (host?.mutations > 0 || ['ALLOW','EXECUTED'].includes(status));
  return { id:sample.id,language,split:sample.split,kind:sample.kind,class:sample.class,attack:sample.attack,status,violation,trace:host?.trace ?? [],
    passed:status === sample.expected.status && violation === sample.expected.violation };
}
export function evaluate() {
  const rows = cases.flatMap(sample => ['en','tr'].map(language => runCase(sample,language)));
  const files = ['cases.json','threat-model.json','reliability.mjs','taxonomy.mjs','policy.mjs','host.mjs','metrics.mjs','evaluate.mjs'];
  const sourceHashes = files.map(file => ({ file,sha256:createHash('sha256').update(readFileSync(new URL(file,import.meta.url))).digest('hex') }));
  const artifactDigest = createHash('sha256').update(JSON.stringify(sourceHashes)).digest('hex');
  return { schemaVersion:1,mode:'deterministic-closed-world',logicalCases:cases.length,generatedAt:new Date().toISOString(),artifactDigest,sourceHashes,
    ...summarize(rows),byLanguage:Object.fromEntries(['en','tr'].map(lang => [lang,summarize(rows.filter(row => row.language === lang))])),
    bySplit:Object.fromEntries(['development','holdout'].map(split => [split,summarize(rows.filter(row => row.split === split))])),
    limitations:['Parameterized fixtures; holdout shares scenario families with development.','Author labels are not independently reviewed human ground truth.','No model inference, NLI, network sandbox, or production security certification.'],rows };
}
if (process.argv[1] === fileURLToPath(import.meta.url)) {
  const report = evaluate(); const output = new URL('./target/',import.meta.url); mkdirSync(output,{ recursive:true });
  writeFileSync(new URL('report.json',output),JSON.stringify(report,null,2)+'\n');
  writeFileSync(new URL('release.json',output),JSON.stringify(releaseGate(report,{ decision:'pending' }),null,2)+'\n');
  console.log(JSON.stringify({ logicalCases:report.logicalCases,variants:report.total,failed:report.failed,security:report.security,reliability:report.reliability,release:releaseGate(report,{ decision:'pending' }) },null,2));
  if (report.failed) process.exitCode = 1;
}