feat(sandbox): build and verify patch-validator image

Dockerfile.patch-validator

@@ -0,0 +1,94 @@
+# syntax=docker/dockerfile:1.7@sha256:a57df69d0ea827fb7266491f2813635de6f17269be881f696fbfdf2d83dda33e
+
+FROM alpine:3.24.1@sha256:79ff19e9084a00eece421b2523fb93e22d730e2c0e525905de047e848e56d95f AS node_builder
+
+ARG NODE_VERSION=24.19.0
+ARG NODE_SOURCE_SHA256=f6d95e10a0431ee1067fc6aabe9f762908b4716dd35324e1ddb4b1466b76659f
+
+RUN apk add --no-cache \
+      binutils-gold \
+      g++ \
+      gcc \
+      libgcc \
+      linux-headers \
+      make \
+      python3 \
+      py3-setuptools \
+      xz
+
+ADD --checksum=sha256:${NODE_SOURCE_SHA256} https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}.tar.xz /tmp/node.tar.xz
+
+RUN mkdir -p /usr/src/node \
+    && tar -xJf /tmp/node.tar.xz --strip-components=1 -C /usr/src/node \
+    && cd /usr/src/node \
+    && ./configure \
+      --prefix=/opt/node \
+      --fully-static \
+      --with-intl=small-icu \
+      --without-npm \
+      --without-corepack \
+      --disable-single-executable-application \
+    && make -j"$(getconf _NPROCESSORS_ONLN)" V= \
+    && make install \
+    && test "$(/opt/node/bin/node --version)" = "v${NODE_VERSION}" \
+    && /opt/node/bin/node --input-type=module --eval="new RegExp('\\p{ID_Continue}', 'u')" \
+    && ! readelf -l /opt/node/bin/node | grep -q 'Requesting program interpreter' \
+    && ! readelf -d /opt/node/bin/node | grep -q '(NEEDED)' \
+    && strip /opt/node/bin/node \
+    && printf '%s\n' \
+      '{"name":"node","version":"24.19.0","cpe":"cpe:2.3:a:nodejs:node.js:24.19.0:*:*:*:*:*:*:*","license":"MIT","type":"binary","architecture":"x86_64","appCpe":"cpe:2.3:a:nodejs:node.js:24.19.0:*:*:*:*:*:*:*","system":"nodejs","vendor":"nodejs","sourceRepo":"https://github.com/nodejs/node"}' \
+      >/tmp/node-package-note.json \
+    && objcopy \
+      --add-section .note.package=/tmp/node-package-note.json \
+      --set-section-flags .note.package=noload,readonly \
+      /opt/node/bin/node \
+    && readelf -p .note.package /opt/node/bin/node \
+      | grep -Fq 'cpe:2.3:a:nodejs:node.js:24.19.0:*:*:*:*:*:*:*' \
+    && test "$(/opt/node/bin/node --version)" = "v${NODE_VERSION}" \
+    && /opt/node/bin/node --input-type=module --eval="new RegExp('\\p{ID_Continue}', 'u')" \
+    && ! readelf -l /opt/node/bin/node | grep -q 'Requesting program interpreter' \
+    && ! readelf -d /opt/node/bin/node | grep -q '(NEEDED)'
+
+FROM node:24.18.0-alpine3.24@sha256:4ba75f835bb8802193e4c114572113d4b26f95f6f094f4b5229d2a77773e0afc AS dependencies
+
+WORKDIR /build
+
+COPY package.json package-lock.json ./
+RUN npm_config_os=wasip1-threads npm_config_cpu=wasm32 \
+      npm ci --include=optional --ignore-scripts --no-audit --no-fund \
+    && npm pkg delete devDependencies.@cloudflare/workers-types devDependencies.wrangler \
+    && npm_config_os=wasip1-threads npm_config_cpu=wasm32 \
+      npm prune --include=optional --ignore-scripts --no-audit --no-fund \
+    && test -f node_modules/typescript/bin/tsc \
+    && test -f node_modules/vitest/vitest.mjs \
+    && test -f node_modules/@vitest/coverage-v8/package.json \
+    && test -f node_modules/@rolldown/binding-wasm32-wasi/package.json \
+    && test -z "$(find node_modules -type f -name '*.node' -print -quit)" \
+    && test ! -e node_modules/@cloudflare/workers-types \
+    && test ! -e node_modules/wrangler \
+    && test ! -e node_modules/workerd \
+    && test ! -e node_modules/miniflare
+
+FROM scratch AS runtime
+
+ARG SOURCE_REVISION
+LABEL org.opencontainers.image.source="https://github.com/ContextualWisdomLab/noema" \
+      org.opencontainers.image.revision="${SOURCE_REVISION}" \
+      org.opencontainers.image.title="Noema Patch Validator" \
+      org.opencontainers.image.description="Credential-free exact-head text patch validation runtime" \
+      org.opencontainers.image.documentation="https://github.com/ContextualWisdomLab/noema/blob/main/docs/patch-validator-image.md"
+
+ENV NAPI_RS_FORCE_WASI=error
+
+USER 65532:65532
+WORKDIR /workspace
+
+COPY --from=node_builder --chown=65532:65532 /opt/node/bin/node /nodejs/bin/node
+COPY --from=dependencies --chown=65532:65532 /build/node_modules /opt/noema/node_modules
+COPY --chown=65532:65532 patch-validator/entrypoint.mjs /opt/noema/entrypoint.mjs
+COPY --chown=65532:65532 patch-validator/validate-patch.mjs /opt/noema/validate-patch.mjs
+COPY --chown=65532:65532 patch-validator/runtime.mjs /opt/noema/runtime.mjs
+COPY --chown=65532:65532 patch-validator/validator-tsconfig.json /opt/noema/validator-tsconfig.json
+COPY --chown=65532:65532 patch-validator/validator-vitest.config.mjs /opt/noema/validator-vitest.config.mjs
+
+ENTRYPOINT ["/nodejs/bin/node", "--input-type=module", "--eval", "import { runCli } from '/opt/noema/runtime.mjs'; import { runEntrypoint } from '/opt/noema/entrypoint.mjs'; process.exitCode = runEntrypoint({ runCliImpl: runCli, writeDiagnostic: (message) => process.stderr.write(message) });"]

Dockerfile.patch-validator.dockerignore

@@ -0,0 +1,10 @@
+*
+!package.json
+!package-lock.json
+!patch-validator/
+patch-validator/*
+!patch-validator/entrypoint.mjs
+!patch-validator/validate-patch.mjs
+!patch-validator/runtime.mjs
+!patch-validator/validator-tsconfig.json
+!patch-validator/validator-vitest.config.mjs

docs/doctoring/patch-validator-embedded-scan-assessment.md

@@ -0,0 +1,69 @@
+# Doctoring amendment: raw embedded-runtime scanner evidence
+
+## Status
+
+- **Decision date:** 2026-08-07
+- **Applies to:** PR #67 patch-validator static-runtime evidence
+- **Release claim:** none
+- **Production activation claim:** none
+- **Workflow migration state:** direct raw per-component scanning is implemented for the reviewed identity catalog; integrated acceptance remains fail-closed until the exact runtime component set is fully reviewed and exact-head verification passes
+
+This amendment supersedes the earlier locally synthesized completion model. The exact-head regressions demonstrated that a zero-match component could look complete without proving that Grype evaluated the reviewed package identity, and that independently valid per-component results could still be substituted across artifacts or vulnerability-database snapshots.
+
+## Finding
+
+An empty vulnerability match list is negative finding evidence, not proof that a particular package identity was evaluated. The earlier workflow constructed a local completion object after an aggregate SBOM scan and used generic package identities for native dependencies. That was insufficient for a fully static Node runtime because an unsupported or weak identity could produce zero matches without distinguishing “evaluated and clean” from “no applicable matcher.”
+
+The workflow now builds its inventory only from a bounded reviewed identity catalog, updates the Grype vulnerability database once, disables per-component automatic database updates, scans each reviewed PURL or CPE directly, and retains each raw scanner result. Any `process.versions` dependency without a reviewed identity aborts evidence generation instead of being omitted, converted to a generic package, or marked locally complete. The verifier independently rejects unsupported identities, synthetic completion fields, mismatched match artifacts, blocking findings, and database drift.
+
+## Control decision
+
+The embedded-runtime evidence boundary uses a **reviewed identity catalog** keyed by the exact `process.versions` key. A bundled dependency is eligible for scanning only when the catalog binds that key to the expected inventory name and to exactly one scanner-supported identity form:
+
+1. an exact npm PURL whose package name and version match the catalog and `process.versions`; or
+2. an exact CPE 2.3 application identity whose reviewed vendor, product, and version match the catalog and `process.versions`.
+
+Unknown keys, generic PURLs, wildcard or placeholder CPE vendors/products, arbitrary aliases, and identities inferred from receipt-controlled fields are explicit release blockers. Current catalog entries are deliberately bounded; adding a new native dependency requires evidence review rather than automatic identity fabrication.
+
+Every bundled dependency must carry **raw Grype** JSON for a direct scan of that exact reviewed identity. The verifier requires:
+
+- scanner descriptor `grype` at the pinned version;
+- scanner source type consistent with PURL or CPE and a source target exactly equal to the reviewed identity;
+- a valid vulnerability-database status record;
+- bounded provider metadata with capture timestamps and input digests;
+- no ignored matches;
+- every reported match artifact bound back to the same reviewed PURL or CPE and exact component version;
+- no MEDIUM, HIGH, CRITICAL, or UNKNOWN finding; and
+- the **same vulnerability database** identity across every component scan.
+
+The canonical shared database identity is derived from the database schema/build metadata plus sorted provider capture/input metadata and is retained in verification output. This makes database drift visible rather than allowing two components in one acceptance decision to be evaluated against different snapshots.
+
+The workflow updates Grype's vulnerability database once, freezes per-component auto-update for the scan set, invokes each reviewed PURL or CPE directly, and retains the raw scanner result. A local “completed” flag, aggregate-only SBOM result, scanner process exit alone, or grouped synthetic result is not evidence of component evaluation. The workflow and verifier both fail closed when the reviewed catalog is incomplete; a red exact-head action caused by an unmapped runtime dependency is therefore expected evidence of a missing review, not a reason to weaken the gate.
+
+## Why this is stricter than zero findings
+
+Grype's *Supported scan targets* documentation treats individual PURL and CPE identities as explicit scan targets. Its vulnerability-database documentation also explains that the database is locally cached and can be updated explicitly. Noema therefore binds acceptance to the literal scanner target and one shared database snapshot rather than inferring assessment from an empty match array.
+
+The National Vulnerability Database maintains the Official Common Platform Enumeration (CPE) Dictionary. Noema treats an authoritative NVD CPE mapping as reviewed identity evidence where a CPE is used; a merely syntactically valid CPE is not sufficient. For example, NVD records OpenSSL under vendor/product `openssl:openssl`, and NVD's analysis of CVE-2026-40170 maps ngtcp2 through reviewed CPE configurations including `nghttp2:ngtcp2` while identifying 1.22.1 as the fixed floor. Those mappings are controls, not heuristics generated from a package name at runtime.
+
+Node.js documents `process.versions` as version information for Node.js and its dependencies. Noema uses it as the exact-runtime dependency declaration that the reviewed component set must match, not as a cryptographic proof of binary composition. `modules` and `napi` remain explicitly reviewed runtime metadata rather than fabricated vulnerable packages.
+
+## Residual risk
+
+Raw scanner evidence does not prove that vulnerability databases are complete or that every upstream project has an authoritative ecosystem identity. Catalog omissions therefore fail closed. The scanner binary, database acquisition path, hosted runner, workflow source, CPE/PURL review process, and upstream advisory coverage remain part of the trust chain. Future registry publication must separately bind signature, SBOM, vulnerability evidence, SLSA provenance, and the published digest before release acceptance.
+
+## APA 7th references
+
+Anchore. (2026). *Supported scan targets*. Anchore Open Source. https://oss.anchore.com/docs/guides/vulnerability/scan-targets/
+
+Anchore. (2026). *Vulnerability database*. Anchore Open Source. https://oss.anchore.com/docs/guides/vulnerability/database/
+
+National Institute of Standards and Technology. (2025). *Official Common Platform Enumeration (CPE) dictionary*. National Vulnerability Database. https://nvd.nist.gov/products/cpe
+
+National Institute of Standards and Technology. (2026). *CVE-2026-40170 detail*. National Vulnerability Database. https://nvd.nist.gov/vuln/detail/CVE-2026-40170
+
+Node.js contributors. (2026). *Process: `process.versions`* (Node.js v24 documentation). OpenJS Foundation. https://nodejs.org/download/release/latest-v24.x/docs/api/process.html#processversions
+
+OWASP Foundation. (2025). *CycloneDX specification 1.7*. https://cyclonedx.org/specification/overview/
+
+Souppaya, M., Scarfone, K., & Dodson, D. (2022). *Secure Software Development Framework (SSDF) version 1.1: Recommendations for mitigating the risk of software vulnerabilities* (NIST Special Publication 800-218). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-218