fix: enforce exact local evidence defaults

tests/unit/local-promotion-evidence.test.ts

@@ -2,12 +2,18 @@ import { readFile } from "node:fs/promises";
 
 import { describe, expect, it } from "vitest";
 
+import {
+  supplyChainVerificationArtifactSchema,
+  vulnerabilityReportArtifactSchema,
+} from "../../scripts/contracts/release-artifacts.ts";
 import {
   compareStoredDependencyEvidence,
   compareStoredLicenseEvidence,
+  compareStoredLocalVulnerabilityReport,
   distChecksumsText,
   recomputeDependencyEvidence,
   recomputeLicenseEvidence,
+  verifyLocalSupplyChainDefaults,
   verifyStoredDistChecksums,
 } from "../../scripts/lib/local-policy-evidence.ts";
 import {
@@ -173,4 +179,74 @@ describe("recomputed local promotion evidence", () => {
       ]),
     );
   });
+
+  it("rejects schema-valid verified provider statuses in local supply-chain evidence", () => {
+    const localVerification = {
+      schemaVersion: 1 as const,
+      localStatus: "PASS" as const,
+      promotionStatus: "FAIL_UNVERIFIED" as const,
+      lockfileSha256: "1".repeat(64),
+      sourceSetSha256: "2".repeat(64),
+      distSha256: "3".repeat(64),
+      sbomSha256: "4".repeat(64),
+      dependencyDiff: {
+        added: [],
+        removed: [],
+        changed: [],
+        upgrades: [],
+      },
+      highRiskReview: [],
+      vulnerabilityStatus: "FAIL_UNVERIFIED" as const,
+      provenanceAttestationStatus: "FAIL_UNVERIFIED" as const,
+      failures: [],
+    };
+    const tampered = [
+      { ...localVerification, promotionStatus: "PASS" as const },
+      { ...localVerification, vulnerabilityStatus: "PASS" as const },
+      {
+        ...localVerification,
+        provenanceAttestationStatus: "PASS" as const,
+      },
+    ].map((value) => supplyChainVerificationArtifactSchema.parse(value));
+
+    for (const value of tampered) {
+      expect(verifyLocalSupplyChainDefaults(value)).toEqual([
+        "supply-chain verification provider defaults are not local FAIL_UNVERIFIED",
+      ]);
+    }
+  });
+
+  it("rejects every schema-valid drift from the exact local vulnerability report", () => {
+    const currentLockfileSha256 = "1".repeat(64);
+    const localReport = {
+      schemaVersion: 1 as const,
+      provider: "UNCONFIGURED",
+      scannedLockfileSha256: currentLockfileSha256,
+      status: "FAIL_UNVERIFIED" as const,
+      findings: [],
+      exceptionsApplied: [],
+      failures: ["external vulnerability provider report is missing"],
+      blocking: [],
+    };
+    const tampered = [
+      { ...localReport, provider: "forged-provider" },
+      { ...localReport, scannedLockfileSha256: "2".repeat(64) },
+      { ...localReport, status: "PASS" as const },
+      { ...localReport, findings: [{ id: "forged" }] },
+      { ...localReport, exceptionsApplied: [{ id: "forged" }] },
+      { ...localReport, failures: [] },
+      { ...localReport, blocking: ["forged"] },
+    ].map((value) => vulnerabilityReportArtifactSchema.parse(value));
+
+    for (const value of tampered) {
+      expect(
+        compareStoredLocalVulnerabilityReport(
+          currentLockfileSha256,
+          value,
+        ),
+      ).toEqual([
+        "local vulnerability report does not match exact unconfigured defaults",
+      ]);
+    }
+  });
 });