/** * SMI-6033 Wave 4 (Gap 1 + Gap 6) — code_execution co-signal escalation model * * Covers the two halves of Wave 4's escalation-core change, kept out of * packages/core/tests/SecurityScanner.exec.test.ts (already 393 lines) the * same way scanner-regression-guard.exec-locality.test.ts was split out: * * 1. Gap 1 — `IMPERATIVE_FETCH_EXEC_PROSE`: free-text install-and-run * imperatives now emit the SAME `code_execution` medium finding the * literal-syntax detector does, with the same single-emission * cardinality. TP + FP-control fixtures. * 2. Gap 6 — `CO_SIGNAL_MIN_SEVERITY` replaces the flat * `CODE_EXECUTION_CO_OCCURRENCE` set: * path (a) one `'high'`-minimum co-signal at high/critical (today's * behavior, pinned here as an explicit per-type regression); * path (b) TWO DISTINCT `'medium'`-minimum types, each non-doc, * each `confidence: 'high'`, each inside the 40-line window. * 3. The end-to-end ClawHavoc fixture (Wave 4 task-list item 5) and its * legitimate-vendor-install control. * 4. A lint-style guard that no Wave 2/4 advisory category ever emits * `'high'` severity. * * Path (a) fixtures are driven through the exported `escalateCodeExecution` * with hand-built finding arrays (not full scans) so each of the four * high-tier types is pinned INDIVIDUALLY — a full-scan fixture can only * exercise whichever types its content happens to trip, and would silently * stop covering a type whose detector later changes shape. */ export {}; //# sourceMappingURL=co-signal-escalation.test.d.ts.map