From f1dfd10bb0d24caa19c2972b6a9fc7749ca5d2dc Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Sat, 24 Oct 2026 02:49:00 +0800
Subject: [PATCH] fix(evidence): reject runtime locations for managed static
 facts

---
 .../javascriptApplicationGraph.fixture.ts     |  1 +
 .../javascriptApplicationGraph.test.ts        | 25 +++++++++++--------
 .../javascript/javascriptApplicationGraph.ts  |  1 +
 3 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/src/domain/javascript/javascriptApplicationGraph.fixture.ts b/src/domain/javascript/javascriptApplicationGraph.fixture.ts
index 0e78e5115b..2a61db1869 100644
--- a/src/domain/javascript/javascriptApplicationGraph.fixture.ts
+++ b/src/domain/javascript/javascriptApplicationGraph.fixture.ts
@@ -50,6 +50,7 @@ export const artifactEvidence = (
   authority:
     | "artifact-bytes"
     | "ast-static-analysis"
+    | "managed-static-analysis"
     | "native-analysis-provider" = "artifact-bytes",
 ): ApplicationGraphEvidence => ({
   authority,
diff --git a/src/domain/javascript/javascriptApplicationGraph.test.ts b/src/domain/javascript/javascriptApplicationGraph.test.ts
index 5a9e50568e..082aa41fb7 100644
--- a/src/domain/javascript/javascriptApplicationGraph.test.ts
+++ b/src/domain/javascript/javascriptApplicationGraph.test.ts
@@ -886,17 +886,20 @@ describe("JavaScript Application Graph: identity strategy requirements", () => {
     );
   });
 
-  it("prevents static authorities from claiming runtime locations", () => {
-    const evidence = artifactEvidence(
-      APPLICATION_GRAPH_DIGESTS.asar,
-      "dist/module.js",
-      "ast-static-analysis",
-    );
-    evidence.location = runtimeEvidence("script-module").location;
-    expect(() => graphForNode(contentNode(evidence))).toThrow(
-      /cannot claim a runtime location/u,
-    );
-  });
+  it.each(["ast-static-analysis", "managed-static-analysis"] as const)(
+    "prevents %s from claiming runtime locations",
+    (authority) => {
+      const evidence = artifactEvidence(
+        APPLICATION_GRAPH_DIGESTS.asar,
+        "dist/module.js",
+        authority,
+      );
+      evidence.location = runtimeEvidence("script-module").location;
+      expect(() => graphForNode(contentNode(evidence))).toThrow(
+        /cannot claim a runtime location/u,
+      );
+    },
+  );
 
   it("enforces epistemic truthfulness and content-addressed artifacts", () => {
     const inferredAsObserved = inferredArtifactEvidence(
diff --git a/src/domain/javascript/javascriptApplicationGraph.ts b/src/domain/javascript/javascriptApplicationGraph.ts
index 2769d358bc..93b8fa97d6 100644
--- a/src/domain/javascript/javascriptApplicationGraph.ts
+++ b/src/domain/javascript/javascriptApplicationGraph.ts
@@ -155,6 +155,7 @@ const checkEvidenceNormalization = (
     "ast-static-analysis",
     "static-relationship-inference",
     "native-analysis-provider",
+    "managed-static-analysis",
   ].includes(evidence.authority);
   if (runtimeLocation && staticAuthority)
     context.addIssue({