{"vulnerability": "CVE-2026-7482", "sightings": [{"uuid": "64247d62-aaeb-43e8-8616-7f87b3f8d3f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkzuc7suqr2k", "content": "\ud83d\udd34 CVE-2026-7482 - Critical (9.1)\n\nOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. T...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-7482/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-04T14:15:35.303692Z"}, {"uuid": "7d6d1de9-cd7a-415e-a0ed-7bf5f8c0171e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkzwkpa3ak2k", "content": "CVE-2026-7482 - Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers\nCVE ID : CVE-2026-7482\n \n Published : May 4, 2026, 1:16 p.m. | 1\u00a0hour, 4\u00a0minutes ago\n \n Description : Ollama before 0.17.1 contains a heap out-...", "creation_timestamp": "2026-05-04T14:56:07.039873Z"}, {"uuid": "d0c2b9f9-24e6-4eac-acc4-e147e48be012", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116518353292182657", "content": "It is possible to see elevated activities targeting Ollama (CVE-2026-7482) https://vuldb.com/vuln/360957/cti", "creation_timestamp": "2026-05-04T21:09:36.083618Z"}, {"uuid": "cc21777f-7e24-4a22-9686-689646ccebbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3ml4hbcq2cb2d", "content": "A critical heap out-of-bounds vulnerability (CVE-2026-7482) in Ollama\u2019s GGUF model loader exposes sensitive data including API keys and environment variables across 300,000 deployments. Update to Ollama 0.17.1. #DataLeak #ModelLoader #TechUSA", "creation_timestamp": "2026-05-05T15:00:25.905352Z"}, {"uuid": "087c4e6c-d48b-48b5-a55c-3f5ec8cbd05d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://t.me/true_secator/8172", "content": "\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0448\u0438\u0431\u043a\u0430, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Bleeding Llama, \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 300 000 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0439 Ollama \u043a\u0440\u0430\u0436\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u0430 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e, \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438.\n\nOllama - \u044d\u0442\u043e \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c LLM \u043d\u0430 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0435\u0441\u044f \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c\u044e \u0441\u0440\u0435\u0434\u0438 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0441\u0430\u043c\u043e\u0440\u0430\u0437\u043c\u0435\u0449\u0430\u0435\u043c\u043e\u0433\u043e \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0432\u044b\u0432\u043e\u0434\u0430 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u043e\u0432 \u0418\u0418.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cyera, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0447\u0442\u0435\u043d\u0438\u044f \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430 \u0432 Ollama \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u0445\u0440\u0430\u043d\u044f\u0449\u0435\u0439\u0441\u044f \u0432 \u043a\u0443\u0447\u0435, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043f\u043e\u0434\u0441\u043a\u0430\u0437\u043a\u0438, \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u044b, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u043a\u043b\u044e\u0447\u0438 API, \u0442\u043e\u043a\u0435\u043d\u044b \u0438 \u0441\u0435\u043a\u0440\u0435\u0442\u044b.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-7482 (CVSS 9.3) \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u043c\u043e\u0434\u0435\u043b\u0435\u0439 GGUF, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u0438\u043d\u0438\u043c\u0430\u0435\u0442 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c \u0444\u0430\u0439\u043b GGUF, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u043e\u0431\u044a\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0435 \u0441\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0442\u0435\u043d\u0437\u043e\u0440\u0430 \u0438 \u0440\u0430\u0437\u043c\u0435\u0440, \u043f\u0440\u0435\u0432\u044b\u0448\u0430\u044e\u0449\u0438\u0435 \u0434\u043b\u0438\u043d\u0443 \u0444\u0430\u0439\u043b\u0430.\n\n\u041f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0444\u0430\u0439\u043b\u0430 \u0434\u0430\u0442\u0447\u0438\u043a \u0441\u0447\u0438\u0442\u044b\u0432\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u0443\u0447\u0435, \u043e\u0431\u0440\u0430\u0449\u0430\u044f\u0441\u044c \u043a \u043f\u0430\u043c\u044f\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e.\n\n\u0417\u0430\u0442\u0435\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u0443\u044e \u0432 Ollama \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u0434\u043b\u044f \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u0430 - \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u0443\u043a\u0440\u0430\u0434\u0435\u043d\u043d\u044b\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u043c\u0438 \u0438\u0437 \u043a\u0443\u0447\u0438 - \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u0414\u043b\u044f \u0432\u0441\u0435\u0439 \u0430\u0442\u0430\u043a\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0432\u0441\u0435\u0433\u043e \u0442\u0440\u0438 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0432\u044b\u0437\u043e\u0432\u0430 API.\n\n\u0412 Cyera \u043f\u043e\u044f\u0441\u043d\u0438\u043b\u0438, \u0447\u0442\u043e Ollama \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0435\u0442\u0441\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b, \u0430 \u044d\u0442\u043e \u0437\u043d\u0430\u0447\u0438\u0442, \u0447\u0442\u043e \u0432\u0441\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u044b \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0430\u0442\u0430\u043a\u0430\u043c.\n\n\u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f, \u0447\u0442\u043e \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043e\u043a\u043e\u043b\u043e 300 000 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 Ollama, \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e \u0438 \u0448\u0438\u0440\u043e\u043a\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 - \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u0432\u043e\u0434\u0430 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0412 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0441\u043f\u043e\u0441\u043e\u0431\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Ollama, \u0443\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f Bleeding Llama \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044e \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043a\u043e\u0434\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0432\u044b\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438 \u0434\u0440\u0443\u0433\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Cyera, \u00ab\u043b\u044e\u0431\u043e\u0435 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435, \u043f\u0440\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u043c Ollama \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u0430 \u043f\u043e \u0441\u0435\u0442\u0438 \u0431\u0435\u0437 \u0431\u0440\u0430\u043d\u0434\u043c\u0430\u0443\u044d\u0440\u0430 \u0438\u043b\u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0435\u0440\u0435\u0434 \u043d\u0435\u0439\u00bb, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043e \u0440\u0438\u0441\u043a\u0443 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 Ollama 0.17.1, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0432\u043e\u0438\u043c \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f\u043c. \u0420\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u044f \u0441\u0435\u0442\u0438 \u0434\u043e\u043b\u0436\u043d\u044b \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c.\n\n\u041e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0442\u0430\u043a\u0436\u0435 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0430\u0443\u0434\u0438\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0445 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u043e\u0432 \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430 \u0438 \u0441\u0447\u0438\u0442\u0430\u0442\u044c \u043b\u044e\u0431\u043e\u0439 \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u0441\u0440\u0435\u0434\u044b \u0438 \u0434\u0430\u043d\u043d\u044b\u0435, \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0433\u043e, \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c\u0438.", "creation_timestamp": "2026-05-05T16:16:55.000000Z"}, {"uuid": "2001e0c0-705c-4340-830c-6410af5f0af7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://vulnerability.circl.lu/comment/f6d41719-7e76-40c7-ac12-d7d70f2ac1db", "content": "", "creation_timestamp": "2026-05-06T06:28:08.637328Z"}, {"uuid": "bf82573e-58b1-4c87-b444-c0f115e345b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3ml6b4hby722o", "content": "Critical Remote Memory Leak Vulnerability in Ollama (CVE-2026-7482) #appsec", "creation_timestamp": "2026-05-06T08:15:39.284615Z"}, {"uuid": "4dd0b4de-4396-4895-a184-2339102d1cc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3ml72eahjro2g", "content": "Regulatory actions hit Kochava over location data and privacy settlements impact Forbes. Data exposures found in Vimeo and Canvas. Critical flaws like Bleeding Llama (CVE-2026-7482) and MOVEit exploited amid active threat groups. #DataPrivacy #US", "creation_timestamp": "2026-05-06T15:47:24.700122Z"}, {"uuid": "8a2107ca-181b-4d2d-b985-b81b249f9e47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/buherator.bsky.social/post/3ml735pisvl2l", "content": "[RSS] Bleeding Llama: Critical Unauthenticated Memory Leak in Ollama (CVE-2026-7482)\n\n\n www.cyera.com -> \n\n\nOriginal->", "creation_timestamp": "2026-05-06T16:01:38.938807Z"}, {"uuid": "bf528cfa-b26e-4c8d-9ac2-00882c078f5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-7482", "type": "seen", "source": "https://infosec.exchange/ap/users/115741367687413652/statuses/116528836896778217", "content": "Another AI service that's dangerous when exposed to the internet? Well I never!\nAnyway go check for exposed Ollama endpoints.\nhttps://discourse.ifin.network/t/unauthenticated-memory-leak-in-ollama-cve-2026-7482/389\n#CVE #ThreatIntel #ThreatIntelligence #IFIN", "creation_timestamp": "2026-05-06T17:46:30.794966Z"}, {"uuid": "e31bc027-500a-4a86-acc4-fb0b3bb1f31d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/lalgorisme.bsky.social/post/3mlatqjeszc2e", "content": "Una vulnerabilitat al GGUF, el format obert que empaqueta models d'IA en un sol fitxer i que Ollama utilitza, exposa prompts, missatges i variables d'entorn d'unes 300.000 inst\u00e0ncies exposades a internet. Puntuaci\u00f3 9.3/10 (CVE-2026-7482).\nwww.securityweek.com/critical-bug...", "creation_timestamp": "2026-05-07T08:54:25.681908Z"}, {"uuid": "5fe1affa-31fd-4a95-9ac7-bdfa7b15a418", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "Telegram/vzTACITSxs978bepVF2fAbJ-LA46ia7V8AwPJb289jK3goA", "content": "", "creation_timestamp": "2026-05-07T21:00:05.000000Z"}, {"uuid": "e4b608d7-588f-4ea0-9d18-2016b7895907", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "Telegram/PzhmRpnH0GK_l-gQSVtV4RydjOIkDAHQ-MCr1tu85IjwQYE", "content": "", "creation_timestamp": "2026-05-07T19:00:14.000000Z"}, {"uuid": "b8beec00-1981-48e2-95c1-834d84571a8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "Telegram/ejAET7Wd0n1V5uqKctP5d-vJmqb8O4j5F4lTKyPXLyKbJrU", "content": "", "creation_timestamp": "2026-05-06T03:00:05.000000Z"}, {"uuid": "b5ebf45a-44bf-4844-a829-22cadcf4a69d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "Telegram/jpDI-NeTTmF-1B6pnaVWuyOH6vpyOCdnRS1pqYiJCkm7igI", "content": "", "creation_timestamp": "2026-05-05T23:00:15.000000Z"}, {"uuid": "09f13d38-0493-40a2-9c08-4c022e89fb8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-7482", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mle2dd736d23", "content": "\ud83d\udce2 CVE-2026-7482 : Fuite m\u00e9moire critique non authentifi\u00e9e dans Ollama (Bleeding Llama)\n\ud83d\udcdd ## \ud83d\udd0d Contexte\n\nPubli\u00e9 le 5 mai 2026 par Dor Attias de Cyera \u2026\nhttps://cyberveille.ch/posts/2026-05-08-cve-2026-7482-fuite-memoire-critique-non-authentifiee-dans-ollama-bleeding-llama/ #CVE_2026_7482 #Cyberveille", "creation_timestamp": "2026-05-08T15:30:12.330870Z"}, {"uuid": "07b9a951-95f0-40fe-945c-60a7b4be2170", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/cyberwarriorsme.bsky.social/post/3mlisqa26he2c", "content": "Ollama's Critical CVE-2026-7482 Vulnerability Exposes Process Memory to Remote Attackers", "creation_timestamp": "2026-05-10T12:57:34.001968Z"}, {"uuid": "d1663db1-316c-41fd-8865-bc0612ebd4af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mliv6ej5q52i", "content": "CVE-2026-7482 & Windows Ollama Flaws: Three Unauthenticated API Calls Leak Your Entire AI Server\u2019s Memory While Auto-Updaters Plant Persistent Backdoors +\u00a0Video\n\nIntroduction: A critical heap out\u2011of\u2011bounds read vulnerability, tracked as CVE\u20112026\u20117482, affects Ollama versions prior to 0.17.1. Dubbed\u2026", "creation_timestamp": "2026-05-10T13:41:16.600285Z"}, {"uuid": "35f53d08-4a1b-43b0-bb9d-0c00d6219928", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mlivfqanfc2z", "content": "A critical out-of-bounds read vulnerability in Ollama GGUF loader (CVE-2026-7482) allows remote leakage of process memory, including API keys and conversation data. Windows update flaws enable persistent code execution. #Ollama #Poland #MemoryLeak", "creation_timestamp": "2026-05-10T13:45:23.493705Z"}, {"uuid": "31adf5bd-7b0b-415f-b3e4-331542d3c710", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mliyg2go5qe2", "content": "Ollama\u2019s Critical CVE-2026-7482 Vulnerability Exposes Process Memory to Remote Attackers Ollama\u2019s Critical CVE-2026-7482 Vulnerability Exposes Process Memory to Remote Attackers Cybersecurity r...\n\n#Global #Global #Cybersecurity #Ransomware [\u2026] \n\n[Original post on cyberwarriorsmiddleeast.com]", "creation_timestamp": "2026-05-10T14:39:19.767785Z"}, {"uuid": "e0016b3b-0b7a-4400-92eb-ffad5e37f0f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mlizr4n4u3a2", "content": "Ollama Flaw Risks Full Memory Exposure in 300,000 Servers cybersecurity researchers have disclosed a critical vulnerability in the Ollama artificial intelligence framework that could allow a remote...\n\n#Security #Bleeding #Llama #CVE-2026-7482 #cybersecurity #Ollama #out-of-bounds #read\n\nOrigin [\u2026]", "creation_timestamp": "2026-05-10T15:03:21.839694Z"}, {"uuid": "eebf48c8-53b2-4634-8693-278eb183ed99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-7482", "type": "seen", "source": "https://bsky.app/profile/kubonai.bsky.social/post/3mlj27zo7wo2g", "content": "CVE-2026-7482 \"Bleeding Llama\": Critical Ollama Memory Disclosure Vulnerability\n\nCVE-2026-7482 'Bleeding Llama' is a critical memory disclosure vulnerability in Ollama (CVSS 9.1) affecting over 300,00...\n\n\ud83d\udd17 https://ipsec.live/blog/cve-2026-7482-ollama-bleeding-llama\n\n#infosec #cybersecurity", "creation_timestamp": "2026-05-10T15:11:39.960046Z"}, {"uuid": "a6fdb244-d377-4f23-b4e1-7b5e8dcd4993", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html", "content": "Cybersecurity researchers have disclosed a critical security vulnerability in Ollama that, if successfully exploited, could allow a remote, unauthenticated attacker to leak its entire process memory.\nThe out-of-bounds read flaw, which likely impacts over 300,000 servers globally, is tracked as CVE-2026-7482 (CVSS score: 9.1). It has been codenamed Bleeding Llama by Cyera.\nOllama is a", "creation_timestamp": "2026-05-10T10:41:00.000000Z"}, {"uuid": "6b8e37ae-b3c5-4321-ae88-39e6252cc125", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mlk2thx3ypl2", "content": "Bleeding Llama vulnerability just exposed 300,000 AI servers to instant memory theft \u2014 researchers warn of critical flaw Critical CVE-2026-7482 flaw in Ollama AI software exposes 300,000+ servers...\n\n#Data #Breaches #& #Scandals\n\nOrigin | Interest | Match", "creation_timestamp": "2026-05-11T00:55:17.178687Z"}, {"uuid": "2fbab182-af0d-465a-982b-45355faa7fa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://t.me/thehackernews/8968", "content": "\ud83d\udea8 CVE-2026-7482 in Ollama could let remote attackers leak process memory from more than 300,000 exposed servers using crafted GGUF files.\n\nSeparate unpatched Windows flaws enable persistent code execution through Ollama\u2019s update mechanism.\n\nFull details and mitigations: https://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html", "creation_timestamp": "2026-05-10T12:42:49.000000Z"}, {"uuid": "88712db1-fa59-49f9-a0e7-9280235bb354", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/116554490423746027", "content": "\ud83d\udea8 CVE-2026-7482 in Ollama could let remote attackers leak process memory from more than 300,000 exposed servers using crafted GGUF files.\nSeparate unpatched Windows flaws enable persistent code execution through Ollama\u2019s update mechanism.\nFull details and mitigations: https://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html", "creation_timestamp": "2026-05-11T06:19:44.013796Z"}, {"uuid": "2db5533a-075f-4383-aafa-9d7dddaa15e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mlldqadbog2p", "content": "\ud83d\udccc CVE-2026-7482 - Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied ... https://www.cyberhub.blog/cves/CVE-2026-7482", "creation_timestamp": "2026-05-11T13:07:11.539857Z"}, {"uuid": "4ee78d4b-b3ae-4e4d-b365-1f2e6ea543ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/calimegai.bsky.social/post/3mllnge3c2d2y", "content": "Une faille critique dans Ollama (CVE-2026-7482, score 9.1) expose plus de 300 000 serveurs \u00e0 une fuite m\u00e9moire \u00e0 distance. Nom de code : Bleeding Llama \ud83e\udd99\ud83d\udca5 #CyberSecurity #IA ", "creation_timestamp": "2026-05-11T16:00:40.443617Z"}, {"uuid": "b7ba6662-1c51-47f8-b883-761ca11f6639", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "Telegram/pQV3iv9fNdQ8VJnJcygfcZdIe02_J94GklPNFkeEumVnTA", "content": "", "creation_timestamp": "2026-05-10T17:22:31.000000Z"}, {"uuid": "26860afc-728f-40e3-9e63-30700d7bfbbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/modat-io.bsky.social/post/3mln776ammk2m", "content": "\ufe0f\u26a0 CVE-2026-7482: Critical heap out-of-bounds read in Ollama via crafted GGUF uploads to /api/create may leak API keys, prompts, credentials & conversation data from process memory. Affected: <0.17.1. Patch now. Query: product=\"Ollama\"\u00a0\n\nThe platform:\u00a0\nmagnify.modat.io", "creation_timestamp": "2026-05-12T06:51:22.944418Z"}, {"uuid": "58122199-db41-4a31-acaa-050785290cc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/mengli512.bsky.social/post/3mlndfaaioc2u", "content": "Ollama has a CVSS 9.1 bug named Bleeding Llama (CVE-2026-7482). Upgrade to 0.17.1 now. Are you running Ollama on 0.0.0.0?\n#Ollama #bug \nopen.substack.com/pub/pythonli...", "creation_timestamp": "2026-05-12T08:06:19.781893Z"}, {"uuid": "36ffe781-4480-41c7-b4f7-17725102afcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/Kubernetes.activitypub.awakari.com.ap.brid.gy/post/3mlnivxjq2zh2", "content": "Bleeding Llama (CVE-2026-7482): Critical Unauthenticated Memory Leak in Ollama Critical Ollama flaw CVE-2026-7482 exposes 300K servers, letting attackers leak API keys, prompts, and credentials thr...\n\n#Security #Bulletin #Bleeding #Llama #Vulnerability [\u2026] \n\n[Original post on indusface.com]", "creation_timestamp": "2026-05-12T09:45:36.962997Z"}, {"uuid": "b819dee0-f99d-4ab9-9aa9-e007021c52e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mlphjah4sn2x", "content": "The latest update for #Indusface includes \"Bleeding Llama (CVE-2026-7482): Critical Unauthenticated Memory Leak in Ollama\" and \"DDoS Protection for Insurance: Always-On Defense for Claims, Quotes & #APIs\".\n \n#cybersecurity #infosec https://opsmtrs.com/3ySs2VF", "creation_timestamp": "2026-05-13T04:25:26.159661Z"}, {"uuid": "dfaaa1fc-de55-4425-963f-4ff0ccb6f7bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-7482", "type": "seen", "source": "https://bsky.app/profile/kubonai.bsky.social/post/3mmmqhog3te2q", "content": "Bleeding Llama: Ollama Memory Leak Exposes 300K Servers \u2014 API Keys & Chat Dat...\n\nCVE-2026-7482 'Bleeding Llama': Critical Ollama out-of-bounds read allows remote unauthenticated attackers ...\n\n\ud83d\udd17 https://ipsec.live/blog/2026-05-24-ollama-bleeding-llama-cve-2026-7482\n\n#infosec #cybersecurity", "creation_timestamp": "2026-05-24T19:52:49.650564Z"}, {"uuid": "6cc7996a-b543-4fb0-9fc1-4c0d1fc9e559", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/hatena-bookmark.bsky.social/post/3mmrfjcfbou2z", "content": "#\ud83d\udd16\u30c6\u30af\u30ce\u30ed\u30b8\u30fc\n\u3010\u5b8c\u5168\u7248\u3011AI\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5730\u7344\u7d75\u56f32026 - CVE\u30fb\u653b\u6483\u624b\u6cd5\u30fb\u9632\u5fa1\u7b56\u3092\u5168\u90e8\u89e3\u8aac\u3059\u308b - Qiita\n\n\u5148\u65e5\u306e\u8a18\u4e8b\u300c100\u4e07\u53f0\u306eAI\u30b5\u30fc\u30d3\u30b9\u3092\u30b9\u30ad\u30e3\u30f3\u3057\u305f\u3089\u53f2\u4e0a\u6700\u60aa\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3060\u3063\u305f\u300d\u304c\u5927\u304d\u306a\u53cd\u97ff\u3092\u3044\u305f\u3060\u3044\u305f\u3002 76\u3044\u3044\u306d\u300162\u30b9\u30c8\u30c3\u30af\u30018\u4e07PV\u8d85\u3048\u3002 \u30b3\u30e1\u30f3\u30c8\u3067\u300c\u3082\u3063\u3068\u8a73\u3057\u304f\u77e5\u308a\u305f\u3044\u300d\u300c\u5177\u4f53\u7684\u306a\u5bfe\u7b56\u3092\u6559\u3048\u3066\u300d\u3068\u3044\u3046\u58f0\u3092\u591a\u6570\u3044\u305f\u3060\u3044\u305f\u306e\u3067\u3001\u5b8c\u5168\u7248\u306e\u6df1\u6398\u308a\u8a18\u4e8b\u3092\u66f8\u304f\u3053\u3068\u306b\u3057\u305f\u3002 \u3053\u306e\u8a18\u4e8b\u3067\u306f\uff1a CVE-2026-7482\u300cBlee...", "creation_timestamp": "2026-05-26T16:20:12.715487Z"}, {"uuid": "08e1f98e-15cf-4c7c-a687-2ccdae980886", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://t.me/CyberDispatch/1581", "content": "CVE-2026-7482 in Ollama could let remote attackers leak process memory from more than 300,000 exposed servers using crafted GGUF files.\n\nSeparate unpatched Windows flaws enable persistent code execution through Ollama\u2019s update mechanism.", "creation_timestamp": "2026-08-29T20:00:15.838870Z"}, {"uuid": "43bc1681-3cbf-448f-a735-fc3c316c336e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/foursignalsdev.bsky.social/post/3mp7cub72h325", "content": "Cyera Research disclosed CVE-2026-7482 (Bleeding Llama) with a 9.1 CVSS rating. Three unauthenticated API calls to Ollama before 0.17.1 can leak prompts, API keys, and tool outputs from process memory.", "creation_timestamp": "2026-06-26T16:00:18.519318Z"}, {"uuid": "e7b4ac10-dfde-4744-b647-3e67a1146958", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/geeknik.bsky.social/post/3mpwlyosohx2q", "content": "300,000 exposed Ollama servers run unauthenticated, no login needed. Bleeding Llama (CVE-2026-7482) dumps full memory, including AWS keys, in three API calls.", "creation_timestamp": "2026-07-05T22:15:05.852514Z"}, {"uuid": "ad18d5c2-5bc8-4f57-9dee-5d781faa18c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "published-proof-of-concept", "source": "https://t.me/bhhub/1196", "content": "Weekly 8 AI & Cyber signals to act on (May 29\u2013 June 5)\n\n#AISecurity@bhhub \n\n\u2728AI Agents Enable Adaptive Computer Worms \u2014 University of Toronto / Vector Institute\nURL\nCleverHans Lab published a proof-of-concept worm powered by a locally-run open-weight LLM that adaptively chose its own attack strategy per target and breached 73% of a 33-node simulated corporate network in one week with zero human involvement \u2014 and ran entirely on stolen compute, making the attacker's marginal cost per infection zero.\n\n\u2728 First Confirmed Real-World LLM-Agent Intrusion \u2014 Sysdig TRT (via Marimo CVE-2026-39987)\nURL\nSysdig's threat research team documented the first publicly confirmed intrusion where an LLM agent drove the entire post-exploitation chain autonomously \u2014 CVE-2026-39987 (Marimo notebook RCE) to internal PostgreSQL database dump across 4 network pivots in under one hour, with the bastion phase taking under 2 minutes.\n\n\u2728 Bleeding Llama \u2014 CVE-2026-7482: Unauthenticated Heap Memory Leak in Ollama Exposes 300,000 Servers\nURL\nA heap out-of-bounds read in Ollama's GGUF model loader (CVSS 9.1) lets any unauthenticated attacker drain the entire Ollama process heap \u2014 system prompts, user chat fragments, env vars containing API keys, and PII \u2014 in three API calls that leave no error in logs, affecting an estimated 300,000 internet-exposed servers.\n\n#AppSec@bhhub \n\n\u2728 Microsoft Build 2026 \u2014 AI Code, Agent, and Model Security Tooling for Developers\nURL\nMicrosoft announced a suite of shift-left AppSec capabilities at Build 2026 including native Defender Portal \u2192 GitHub Code Security integration that routes MDASH vulnerability findings into developer PR workflows with production-risk context (internet exposure, data sensitivity), plus new pre-deployment tooling to detect potentially compromised or vulnerable AI models before they ship.\n\n\u2728 Anthropic Expands Project Glasswing to 150 Organizations in 15+ Countries\nURL\nAnthropic scaled its Claude Mythos vulnerability-hunting program to ~150 new organizations across critical infrastructure sectors in 15+ countries \u2014 cohort-one partners found 10,000+ high/critical vulns; the subsequent month's expanded cohort found 23,000 more, >25% rated high or critical, surfacing a new bottleneck: patch bandwidth, not discovery.\n\n#RedTeam@bhhub \n\n\u2728 OWASP AI & Agentic Red Teaming Landscape Q2 2026 + Agentic Research Council Launch\nURL\nOWASP released the first standardized landscape of AI and agentic red teaming tools and simultaneously launched the Agentic Research Council \u2014 a standing coordinated-research body \u2014 to close the gap between fast-moving agentic capabilities and security research, identifying that standard pentesting cycles cannot keep pace with environments where the test surface changes between runs.\n\n#BlueTeam@bhhub\n\n\u2728 Microsoft MDASH Exits Preview: 96.55% on CyberGym, 100+ Specialized AI Agents\nURL\nMicrosoft's multi-agent agentic security scanner (MDASH) exited preview at Build 2026 scoring 96.55% on UC Berkeley's CyberGym benchmark \u2014 up ~10 points in under three weeks \u2014 finding 21 of 21 planted vulnerabilities with zero false positives across confirmed MSRC cases, using 100+ specialized auditor, debater, and prover agents.\n\n\u2728 Anthropic Claude Compliance API \u2014 28 Enterprise Security Integrations Route AI Activity Into SIEM, DLP, and SOC\nURL\nAnthropic launched a Claude Compliance API giving enterprise security teams programmatic access to Claude conversation content and activity event logs, with 28 integrations already live across SIEM, DLP, SASE, identity, eDiscovery, and AI-SPSM platforms \u2014 including CrowdStrike Falcon, Palo Alto Networks, Microsoft Purview, Splunk, Wiz, Zscaler, and Varonis.", "creation_timestamp": "2026-07-12T06:00:05.535324Z"}, {"uuid": "8f4d43ac-0e2d-434e-86ed-f4c370a854ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mu56doqzuf2m", "content": "CVE-2026-74820\nThe AI feature in ServiceNow could let an unauthenticated user run database commands and view or alter information they shouldn't. ServiceNow has released a fix for both cloud and on\u2011premise versions. Apply the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-28T10:40:05.538585Z"}, {"uuid": "5fdb8c31-5729-4503-8290-b63e9a7209df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-sanano-molteplici-vulnerabilita-in-servicenow", "content": "", "creation_timestamp": "2026-08-28T12:45:24.746220Z"}, {"uuid": "8d070109-ba8e-4273-a329-3e5b70beb78d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mu4eqr6anp2y", "content": "ServiceNow patched CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820, code injection and SQL injection flaws rated CVSS 10, plus a CVSS 8.7 bug.\n\n#ServiceNow #CodeInjection #SQLInjection #CVE #InfoSec", "creation_timestamp": "2026-08-28T03:02:20.510941Z"}, {"uuid": "d92cf057-856a-4dce-915f-681b2d1aa0b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/qf-security.co.za/post/3mrm25fmg7s27", "content": "I mean consider CVE-2026-7482 (CVSS score of 9.1). So, while am not going into detail, I mention this as it relates to the thread, but just because I am busy dealing with other work doesn't mean I do not care... that said use AI-driven OSINT aggregators...  1/2", "creation_timestamp": "2026-07-27T04:19:21.538409Z"}, {"uuid": "4dc264d9-7f3d-4b46-8bbc-8f15c7f90a0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://bsky.app/profile/qf-security.co.za/post/3mrm25g5oxc27", "content": "I mean consider CVE-2026-7482 (CVSS score of 9.1). So, while am not going into detail, I mention this as it relates to the thread, but just because I am busy dealing with other work doesn't mean I do not care... that said use AI-driven OSINT aggregators...  1/2", "creation_timestamp": "2026-07-27T04:19:21.954129Z"}, {"uuid": "43c84743-ca99-485b-803c-d5d15350b5da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://t.me/pphm_HackerNews/2917", "content": "\ud83d\udd34 ServiceNow warns of three max severity security vulnerabilities\n\nServiceNow released security patches for three new maximum-severity AI Platform vulnerabilities that can be exploited in code injection, SQL injection, and privilege escalation attacks.\n\nThe ServiceNow AI Platform (formerly known as the Now Platform) is an enterprise-grade Platform-as-a-Service (PaaS) that helps integrate AI into core enterprise workflows and powers more than 100,000 enterprise AI apps at 85% of all Fortune 500 companies.\n\nIn a Thursday advisory, the company said it patched its cloud-based platform against the three critical security flaws (CVE-2026-18885, CVE-2026-18886, and CVE-2026-74820) and advised customers to secure their self-hosted instances.", "creation_timestamp": "2026-08-28T18:00:05.177546Z"}, {"uuid": "c2b92878-a0f4-4828-b7c7-2af4a56a53b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://infosec.exchange/ap/users/116810780845358081/statuses/117173922729622633", "content": "\ud83d\udea8 3 ServiceNow vulnerabilities just received CVSS 10.0 ratings.\nThe scary part: all three are rated unauthenticated, network-reachable and low-complexity.\n\u2022 CVE-2026-18885 \u2192 Code injection / arbitrary code execution\u2022 CVE-2026-18886 \u2192 Improper access control / privilege escalation\u2022 CVE-2026-74820 \u2192 SQL injection / arbitrary SQL execution\nNo privileges. No user interaction.\nA fourth flaw, CVE-2026-6876 (CVSS 8.7), is a sandbox escape enabling arbitrary code execution.\nServiceNow has released fixes. Here's the technical breakdown, affected versions and patch details:\nhttps://thecybersecguru.com/news/servicenow-cve-2026-18885-18886-74820-cvss-10/\n#InfoSec #ServiceNow #CVE #CVE2026 #CyberSecurity #RCE #SQLInjection", "creation_timestamp": "2026-08-28T18:51:52.562371Z"}, {"uuid": "bbbd03e9-2d62-4842-aa61-6600bd974459", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mu3ufgr3xr2f", "content": "\ud83d\udea8 CVE-2026-74820 \u2014 CVSS 10 CRITICAL\n\nServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platfor...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-74820\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-27T22:09:26.770056Z"}, {"uuid": "6a8a1c7e-13d9-4212-879c-0a2933bc9ce3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://t.me/true_secator/8558", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0442\u0440\u0435\u043d\u0434\u043e\u0432\u044b\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0438 \u0443\u0433\u0440\u043e\u0437\u044b \u043f\u043e \u0443\u0437\u044f\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c, \u043d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0432 \u043d\u0430\u0448\u0435\u0439 \u043f\u043e\u0434\u0431\u043e\u0440\u043a\u0435:\n\n1. PaperCut \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u041f\u041e \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0435\u0447\u0430\u0442\u044c\u044e PaperCut NG \u0438 PaperCut MF \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f 0-day \u0430\u0442\u0430\u043a.\n\n\u041d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u0437\u044b\u0432\u0430\u0435\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 PaperCut \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0432 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442, \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 IP. PaperCut \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0441 \u043e\u0431\u0449\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 PaperCut NG/MF.\n\nPaperCut \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0430\u0441\u044c IOCs, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0442\u044c \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u0431\u044b\u043b \u0432\u0437\u043b\u043e\u043c\u0430\u043d. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043d\u0435 \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u043d\u0435 \u0431\u044b\u043b \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u043d.\n\n\u041d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f PaperCut \u043d\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430, \u043a\u0442\u043e \u0441\u0442\u043e\u0438\u0442 \u0437\u0430 \u0430\u0442\u0430\u043a\u0430\u043c\u0438, \u0447\u0442\u043e \u0434\u0435\u043b\u0430\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u043e\u0441\u043b\u0435 \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432. CVE \u0442\u0430\u043a\u0436\u0435 \u043d\u0435\u0442.\n\n2. ServiceNow \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u0442\u0440\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 (CVE-2026-18885, CVE-2026-18886 \u0438 CVE-2026-74820).\n\nServiceNow AI - \u044d\u0442\u043e \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u0430\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 PaaS, \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0418\u0418 \u0432 \u043e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0443 \u0431\u043e\u043b\u0435\u0435 100 000 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0418\u0418 \u0432 85% \u0432\u0441\u0435\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430 Fortune 500.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434; \u0432\u0442\u043e\u0440\u0430\u044f - \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0434\u0430\u044e\u0449\u0435\u0439 \u0438\u043c \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438, \u0430 \u0442\u0440\u0435\u0442\u044c\u044f - \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0434\u0430\u043d\u043d\u044b\u043c \u044d\u043a\u0437\u0435\u043c\u043f\u043b\u044f\u0440\u0430 \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0438\u0445 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c SQL-\u0438\u043d\u044a\u0435\u043a\u0446\u0438\u0439.\n\n\u0412 \u0447\u0435\u0442\u0432\u0435\u0440\u0433 ServiceNow \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b (CVE-2026-6876), \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0443\u044e \u0442\u0443 \u0436\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0443 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0443\u044e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441 \u0431\u0430\u0437\u043e\u0432\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0432 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445.\n\n3. CISA \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u043a\u0438\u0431\u0435\u0440\u0430\u0442\u0430\u043a \u0437\u0430 2024 \u0438 2025 \u0433\u043e\u0434\u044b \u043d\u043e\u0441\u0438\u0442 \u043e\u043f\u043f\u043e\u0440\u0442\u0443\u043d\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440 \u0438 \u0438\u0441\u0445\u043e\u0434\u0438\u043b\u0430 \u043e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0432 \u043f\u043e\u0438\u0441\u043a\u0430\u0445 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439.\n\n4. Microsoft \u0437\u0430\u044f\u0432\u043b\u044f\u0435\u0442, \u0447\u0442\u043e \u0418\u0418 \u043f\u0440\u0438\u0432\u0435\u043b \u043a \u0441\u0445\u043b\u043e\u043f\u044b\u0432\u0430\u043d\u0438\u044e \u043e\u043a\u043d\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0442\u0435\u043f\u0435\u0440\u044c \u0433\u043e\u0440\u0430\u0437\u0434\u043e \u0431\u044b\u0441\u0442\u0440\u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043d\u0430\u0446\u0435\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0433\u0440\u0443\u043f\u043f\u044b \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u0441\u043f\u0435\u044e\u0442 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n5. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0435\u0449\u0435 \u0434\u0432\u0430 \u0431\u044d\u043a\u0434\u043e\u0440\u0430 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0442\u043e\u0440\u043e\u0432 ZBT. \u041f\u0435\u0440\u0432\u044b\u0439 - DarkLantern, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u0440\u043e\u0441\u043b\u0443\u0448\u0438\u0432\u0430\u0435\u0442 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043a\u043e\u043c\u0430\u043d\u0434, \u0430 \u0432\u0442\u043e\u0440\u043e\u0439 - SpeakingStone, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0435 \u043d\u0430 \u043f\u0440\u0435\u0434\u0432\u0430\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0434\u043e\u043c\u0435\u043d.\u00a0\n\n6. UltraViolet \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0434\u0435\u043c\u043e\u043d\u0435 NoPorts C (SSHNPD) \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 AtSign, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0441 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u043c atSign \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 SSH-\u043a\u043b\u044e\u0447 \u0432 \u0444\u0430\u0439\u043b authorized_keys \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n7. \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f CVE-2026-65643 \u0432 cPanel \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0434\u043d\u043e\u043c\u0443 \u043a\u043b\u0438\u0435\u043d\u0442\u0443 \u0445\u043e\u0441\u0442\u0438\u043d\u0433\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0432\u0441\u0435\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043f\u0430\u0440\u043a\u043e\u0432\u043a\u0438 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 \u0438 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 \u0432 cPanel \u0438 WebHost Manager (WHM), \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root.\n\n8. Vercel \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0434\u0432\u0443\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0432\u0435\u0431-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Next.js, \u043e\u0431\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u043a\u043e\u0434 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438: \u043e\u0434\u043d\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 AVIF-\u0444\u0430\u0439\u043b\u043e\u0432, \u0430 \u0434\u0440\u0443\u0433\u0430\u044f - \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0435\u0439 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 \u0444\u0430\u0439\u043b\u043e\u0432\u0443\u044e \u0441\u0438\u0441\u0442\u0435\u043c\u0443 Windows.\n\n9. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Positive Technologies \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u043f\u043e \u0442\u0440\u0435\u0441\u043a\u043e\u0432\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0437\u0430 \u043f\u0435\u0440\u0432\u0443\u044e \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u0443 2026 \u0433\u043e\u0434\u0430, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043e\u0442\u043d\u0435\u0441\u043b\u0438 17 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0438 \u0443 16 \u0438\u0437 \u043d\u0438\u0445 \u0443\u0436\u0435 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0432 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u0411\u043e\u043b\u044c\u0448\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u044d\u0442\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Microsoft, \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 Windows. \u0422\u0430\u043a\u0436\u0435 \u0432 \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043b\u0433\u043e\u0434\u0430 \u0431\u044b\u043b\u043e \u043c\u043d\u043e\u0433\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 Linux.\n\n\u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u043c\u043e\u0436\u043d\u043e \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c Adobe Reader, Apache ActiveMQ \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430 Palo Alto Networks. \u041f\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f\u043c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0431\u043e\u043b\u044c\u0448\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043f\u0435\u0440\u0432\u043e\u0439 \u043f\u043e\u043b\u043e\u0432\u0438\u043d\u044b \u0433\u043e\u0434\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0442\u044c \u0441\u0432\u043e\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438.", "creation_timestamp": "2026-08-28T20:00:03.506955Z"}, {"uuid": "b37be33a-8657-4835-bf69-506450564129", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mudkkzhyvb2d", "content": "CVE-2026-74820 is trending. Hype score 2, currently #10 on cvemon.\n\nServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-74820", "creation_timestamp": "2026-08-30T23:34:54.694959Z"}, {"uuid": "ab12d959-cb5d-4aa3-927b-01af17351dd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mug6b7k2e22d", "content": "ServiceNow\u3001CVSS 10.0\u306e\u8106\u5f31\u60273\u4ef6\u3092\u4fee\u6b63-\u672a\u8a8d\u8a3cRCE\u30fb\u6a29\u9650\u6607\u683c\u30fbSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306b\u5bfe\u5fdc(CVE-2026-18885,CVE-2026-18886,CVE-2026-74820) \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027", "creation_timestamp": "2026-09-01T00:32:45.540500Z"}, {"uuid": "8d94fd6f-d6b1-4c55-889e-4d4f60472d0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://t.me/CyberDispatch/2773", "content": "The first of the critical bugs, tracked as CVE-2026-18885, allows an attacker to execute arbitrary code in the ServiceNow platform under certain circumstances.\n\nAn attacker could exploit the weakness to gain access to and potentially modify arbitrary data, ServiceNow notes in its advisory.\n\nThe second critical defect, CVE-2026-18886, is described as an improper access control issue. It could allow an attacker to create or modify arbitrary data and elevate their privileges.\n\nTracked as CVE-2026-74820, the third critical vulnerability is an SQL injection flaw that allows an attacker to execute arbitrary SQL statements against the underlying ServiceNow database.", "creation_timestamp": "2026-09-03T21:00:29.310351Z"}, {"uuid": "a08a6909-fe8d-40e3-b665-66362310f2ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://t.me/shimiscyberworld/1170", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-7482 \u2014 CVSS 9.1\nCVE-2026-7482: Critical Ollama Heap Out-of-Bounds Read Exposes Sensitive AI Data\n\nCVE-2026-7482 \u2014 Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. The /api/create endpoint accepts an attacker-supplied GGUF file in w\n\n\ud83d\udd34 Critical \u00b7 3 ATT&CK techniques mapped\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-7482 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:18.228453Z"}, {"uuid": "ef3585be-b708-4d87-b438-7d7fd6c851af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "published-proof-of-concept", "source": "https://t.me/CYPERMRED/71", "content": "\ud83d\udea8 \u062b\u063a\u0631\u0629 CVE-2026-7482 \u0641\u064a \u0628\u0631\u0646\u0627\u0645\u062c Ollama \u0642\u062f \u062a\u0633\u0645\u062d \u0644\u0644\u0645\u0647\u0627\u062c\u0645\u064a\u0646 \u0639\u0646 \u0628\u064f\u0639\u062f \u0628\u062a\u0633\u0631\u064a\u0628 \u0630\u0627\u0643\u0631\u0629 \u0627\u0644\u0639\u0645\u0644\u064a\u0627\u062a \u0645\u0646 \u0623\u0643\u062b\u0631 \u0645\u0646 300,000 \u062e\u0627\u062f\u0645 \u0645\u064f\u0639\u0631\u0651\u0636 \u0644\u0644\u062e\u0637\u0631 \u0628\u0627\u0633\u062a\u062e\u062f\u0627\u0645 \u0645\u0644\u0641\u0627\u062a GGUF \u0645\u064f\u0635\u0645\u0645\u0629 \u062e\u0635\u064a\u0635\u064b\u0627.\n\n\u0643\u0645\u0627 \u062a\u0648\u062c\u062f \u062b\u063a\u0631\u0627\u062a \u0623\u062e\u0631\u0649 \u063a\u064a\u0631 \u0645\u064f\u0639\u0627\u0644\u062c\u0629 \u0641\u064a \u0646\u0638\u0627\u0645 Windows \u062a\u064f\u062a\u064a\u062d \u062a\u0646\u0641\u064a\u0630 \u062a\u0639\u0644\u064a\u0645\u0627\u062a \u0628\u0631\u0645\u062c\u064a\u0629 \u0645\u064f\u0633\u062a\u0645\u0631\u0629 \u0639\u0628\u0631 \u0622\u0644\u064a\u0629 \u062a\u062d\u062f\u064a\u062b Ollama.\n\n\u0644\u0644\u0627\u0637\u0644\u0627\u0639 \u0639\u0644\u0649 \u0627\u0644\u062a\u0641\u0627\u0635\u064a\u0644 \u0627\u0644\u0643\u0627\u0645\u0644\u0629 \u0648\u0637\u0631\u0642 \u0627\u0644\u062a\u062e\u0641\u064a\u0641: https://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html\n\nhttps://www.youtube.com/watch?v=37bkmaNLYDI \u0631\u0627\u0628\u0637 \u0634\u0631\u062d \u0627\u0644\u062b\u063a\u0631\u0629", "creation_timestamp": "2026-09-13T20:00:04.518323Z"}, {"uuid": "8c47094e-20cc-4dc6-9ade-18f638a1639f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "published-proof-of-concept", "source": "https://t.me/CYPERMRED/76", "content": "\u0623\u062e\u0637\u0631 \u062b\u063a\u0631\u0629 \u0641\u064a \u062a\u0627\u0631\u064a\u062e Ollama! \ud83d\udea8 \u0634\u0631\u062d Bleeding Llama\n(CVE-2026-7482) \u0648\u0643\u064a\u0641 \u064a\u062a\u0645 \u062a\u0633\u0631\u064a\u0628 \u0627\u0644\u0630\u0627\u0643\u0631\u0629...\n\n\u062a\u0627\u0628\u0639 \u0627\u0644\u0634\u0631\u062d \u0627\u0644\u0639\u0645\u0644\u064a \u0648\u0627\u0644\u0645\u062e\u0627\u0637\u0631 \u0627\u0644\u062a\u0642\u0646\u064a\u0629 \u0628\u0627\u0644\u062a\u0641\u0635\u064a\u0644. \n\u0644\u0627 \u062a\u0646\u0633\u064e \u0627\u0644\u0627\u0646\u0636\u0645\u0627\u0645 \u0644\u0642\u0646\u0627\u062a\u0646\u0627 \u0644\u0645\u062a\u0627\u0628\u0639\u0629 \u0623\u062d\u062f\u062b \u0623\u062e\u0628\u0627\u0631 \u0627\u0644\u0623\u0645\u0646 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a.", "creation_timestamp": "2026-09-13T20:00:04.679186Z"}, {"uuid": "c8cae2aa-248f-4cdb-8efc-ee68d12847c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "published-proof-of-concept", "source": "https://t.me/CYPERMRED/82", "content": "\ud83d\udee1 \u0623\u0628\u0631\u0632 \u0627\u0644\u0623\u062e\u0628\u0627\u0631 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a\u0629 \u0644\u0647\u0630\u0627 \u0627\u0644\u0623\u0633\u0628\u0648\u0639 .\n\n\ud83d\uddd3 \u062a\u0627\u0631\u064a\u062e \u0627\u0644\u064a\u0648\u0645: 15 \u0645\u0627\u064a\u0648 2026\n\n\u2705 \u0637\u0648\u0631 \u0645\u0647\u0627\u0631\u062a\u0643 \u0627\u0644\u0633\u064a\u0628\u0631\u0627\u0646\u064a\u0629 \u0639\u0628\u0631 \u0627\u0644\u062f\u0648\u0631\u0627\u062a \u0627\u0644\u0627\u062d\u062a\u0631\u0627\u0641\u064a\u0629 \u0639\u0644\u0649 \u0623\u0643\u0627\u062f\u064a\u0645\u064a\u0629 \u0627\u0644\u062f\u0631\u0639 \u0627\u0644\u0623\u062e\u0636\u0631 \ud83d\udc47\ud83c\udffb\nhttps://greenarmor.academy\n\n\n1\ufe0f\u20e3 \u0634\u0631\u0643\u0629 Cisco\u060c \u062b\u063a\u0631\u0629 \u062d\u0631\u062c\u0629 \u0641\u064a SD-WAN:\n\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0641\u0639\u0644\u064a \u0644\u062b\u063a\u0631\u0629 CVE-2026-20127 \u0628\u062a\u0642\u064a\u064a\u0645 CVSS 10.0 \u0641\u064a Cisco Catalyst SD-WAN Controller\u060c \u0648\u0642\u062f \u062a\u0633\u0645\u062d \u0644\u0644\u0645\u0647\u0627\u062c\u0645 \u0628\u062a\u062c\u0627\u0648\u0632 \u0627\u0644\u0645\u0635\u0627\u062f\u0642\u0629 \u0648\u0627\u0644\u062d\u0635\u0648\u0644 \u0639\u0644\u0649 \u0635\u0644\u0627\u062d\u064a\u0627\u062a \u0625\u062f\u0627\u0631\u064a\u0629.\n\ud83d\udccc https://thehackernews.com/2026/02/cisco-sd-wan-zero-day-cve-2026-20127.html\n\n2\ufe0f\u20e3 \u0645\u0646\u0635\u0629 Ollama\u060c \u062a\u0633\u0631\u064a\u0628 \u0630\u0627\u0643\u0631\u0629 \u0645\u0646 \u062e\u0648\u0627\u062f\u0645 \u0627\u0644\u0630\u0643\u0627\u0621 \u0627\u0644\u0627\u0635\u0637\u0646\u0627\u0639\u064a:\n\u062b\u063a\u0631\u0629 CVE-2026-7482 \u0642\u062f \u062a\u0633\u0645\u062d \u0644\u0645\u0647\u0627\u062c\u0645 \u0639\u0646 \u0628\u064f\u0639\u062f \u0648\u0628\u062f\u0648\u0646 \u0645\u0635\u0627\u062f\u0642\u0629 \u0628\u062a\u0633\u0631\u064a\u0628 \u0630\u0627\u0643\u0631\u0629 \u0627\u0644\u0639\u0645\u0644\u064a\u0629 \u0639\u0628\u0631 \u0645\u0644\u0641\u0627\u062a GGUF \u062e\u0628\u064a\u062b\u0629\u060c \u0645\u0639 \u0627\u062d\u062a\u0645\u0627\u0644 \u062a\u0623\u062b\u0631 \u0623\u0643\u062b\u0631 \u0645\u0646 300,000 \u062e\u0627\u062f\u0645 \u0645\u0643\u0634\u0648\u0641. \n\ud83d\udccc https://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html\n\n3\ufe0f\u20e3 \u0634\u0631\u0643\u0629 Microsoft\u060c \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0623\u0645\u0646\u064a\u0629 \u0648\u0627\u0633\u0639\u0629:\n\u0645\u0627\u064a\u0643\u0631\u0648\u0633\u0648\u0641\u062a \u0623\u0635\u062f\u0631\u062a \u062a\u062d\u062f\u064a\u062b\u0627\u062a \u0644\u0645\u0639\u0627\u0644\u062c\u0629 138 \u062b\u063a\u0631\u0629 \u0623\u0645\u0646\u064a\u0629 \u0641\u064a \u0645\u0646\u062a\u062c\u0627\u062a\u0647\u0627\u060c \u0645\u0646 \u0628\u064a\u0646\u0647\u0627 \u062b\u063a\u0631\u0627\u062a \u062d\u0631\u062c\u0629 \u0641\u064a Windows DNS \u0648Netlogon \u0648Azure \u0648Dynamics 365 \u0648Hyper-V. \n\ud83d\udccc https://thehackernews.com/2026/05/microsoft-patches-138-vulnerabilities.html\n\n4\ufe0f\u20e3 \u0646\u0638\u0627\u0645 Windows\u060c \u062b\u063a\u0631\u0627\u062a Zero-Day \u062c\u062f\u064a\u062f\u0629:\n\u062a\u0645 \u0646\u0634\u0631 \u062a\u0641\u0627\u0635\u064a\u0644 \u062b\u063a\u0631\u062a\u064a\u0646 \u0644\u0645 \u064a\u062a\u0645 \u0627\u0635\u0644\u0627\u062d\u0647\u0645 \u0628\u0639\u062f \u0641\u064a Windows: YellowKey \u0644\u062a\u062c\u0627\u0648\u0632 BitLocker\u060c \u0648GreenPlasma \u0644\u062a\u0635\u0639\u064a\u062f \u0627\u0644\u0635\u0644\u0627\u062d\u064a\u0627\u062a \u0639\u0628\u0631 CTFMON. \n\ud83d\udccc https://thehackernews.com/2026/05/windows-zero-days-expose-bitlocker.html\n\n5\ufe0f\u20e3 \u0645\u0646\u0635\u0629 cPanel\u060c \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0648\u0627\u0633\u0639 \u0644\u062b\u063a\u0631\u0629 \u062e\u0637\u064a\u0631\u0629:\n\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0646\u0634\u0637 \u0644\u062b\u063a\u0631\u0629 CVE-2026-41940 \u0641\u064a cPanel \u0648WHM \u0644\u0646\u0634\u0631 Backdoor \u0628\u0627\u0633\u0645 Filemanager\u060c \u0645\u0639 \u0631\u0628\u0637 \u0627\u0644\u062d\u0645\u0644\u0629 \u0628\u062c\u0647\u0629 \u062a\u0647\u062f\u064a\u062f \u062a\u064f\u0639\u0631\u0641 \u0628\u0627\u0633\u0645 Mr_Rot13. \n\ud83d\udccc https://thehackernews.com/2026/05/cpanel-cve-2026-41940-under-active.html\n\n6\ufe0f\u20e3 \u0634\u0631\u0643\u0629 Palo Alto Networks\u060c \u062b\u063a\u0631\u0629 \u062e\u0637\u064a\u0631\u0629 \u0641\u064a PAN-OS:\n\u062b\u063a\u0631\u0629 CVE-2026-0300 \u0641\u064a User-ID Authentication Portal \u062a\u0633\u0645\u062d \u0628\u062a\u0646\u0641\u064a\u0630 \u0643\u0648\u062f \u0639\u0646 \u0628\u064f\u0639\u062f \u0628\u0635\u0644\u0627\u062d\u064a\u0627\u062a root \u0639\u0644\u0649 \u0623\u062c\u0647\u0632\u0629 PA-Series \u0648VM-Series\u060c \u0648\u062a\u0645 \u0631\u0635\u062f \u0627\u0633\u062a\u063a\u0644\u0627\u0644\u0647\u0627 \u0641\u0639\u0644\u064a\u064b\u0627. \n\ud83d\udccc https://thehackernews.com/2026/05/palo-alto-pan-os-flaw-under-active.html\n\n7\ufe0f\u20e3 \u062e\u0627\u062f\u0645 Exim\u060c \u062b\u063a\u0631\u0629 Dead.Letter\n\u062b\u063a\u0631\u0629 CVE-2026-45185 \u0641\u064a Exim: \u0639\u0646\u062f \u0627\u0633\u062a\u062e\u062f\u0627\u0645 GnuTLS \u0642\u062f \u062a\u0624\u062f\u064a \u0625\u0644\u0649 \u062a\u0644\u0641 \u0641\u064a \u0627\u0644\u0630\u0627\u0643\u0631\u0629 \u0648\u0631\u0628\u0645\u0627 \u062a\u0646\u0641\u064a\u0630 \u0643\u0648\u062f \u0639\u0646 \u0628\u064f\u0639\u062f\u060c \u0644\u0630\u0644\u0643 \u064a\u064f\u0646\u0635\u062d \u0628\u0627\u0644\u062a\u062d\u062f\u064a\u062b \u0641\u0648\u0631\u064b\u0627. \n\ud83d\udccc https://thehackernews.com/2026/05/new-exim-bdat-vulnerability-exposes.html\n\n8\ufe0f\u20e3 \u0633\u0644\u0633\u0644\u0629 \u062a\u0648\u0631\u064a\u062f\u060c Mini Shai-Hulud:\n\u062d\u0645\u0644\u0629 Supply Chain \u062e\u0628\u064a\u062b\u0629 \u0627\u0633\u062a\u0647\u062f\u0641\u062a \u062d\u0632\u0645 npm \u0648PyPI \u0645\u0631\u062a\u0628\u0637\u0629 \u0628\u0645\u0634\u0627\u0631\u064a\u0639 \u0645\u062b\u0644 TanStack \u0648Mistral AI \u0648Guardrails AI\u060c \u0645\u0639 \u0633\u0631\u0642\u0629 \u0628\u064a\u0627\u0646\u0627\u062a \u0627\u0639\u062a\u0645\u0627\u062f \u0648GitHub/OIDC tokens. \n\ud83d\udccc https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html\n\n9\ufe0f\u20e3 \u0645\u0646\u0635\u0629 Hugging Face\u060c \u0645\u0633\u062a\u0648\u062f\u0639 OpenAI \u0645\u0632\u064a\u0641:\n\u0645\u0633\u062a\u0648\u062f\u0639 \u062e\u0628\u064a\u062b \u0627\u0646\u062a\u062d\u0644 \u0627\u0633\u0645 OpenAI Privacy Filter \u0648\u0648\u0635\u0644 \u0625\u0644\u0649 \u0627\u0644\u0645\u0631\u0643\u0632 \u0627\u0644\u0623\u0648\u0644 \u0641\u064a \u0627\u0644\u062a\u0631\u0646\u062f\u060c \u0648\u062d\u0642\u0642 \u0646\u062d\u0648 244,000 \u062a\u062d\u0645\u064a\u0644 \u062e\u0644\u0627\u0644 18 \u0633\u0627\u0639\u0629\u060c \u0648\u0643\u0627\u0646 \u064a\u0646\u0634\u0631 Infostealer \u0639\u0644\u0649 \u0623\u062c\u0647\u0632\u0629 Windows. \n\ud83d\udccc https://thehackernews.com/2026/05/fake-openai-privacy-filter-repo-hits-1.html\n\n\ud83d\udd1f \u0646\u0638\u0627\u0645 Linux\u060c \u062b\u063a\u0631\u0629 Fragnesia \u0644\u062a\u0635\u0639\u064a\u062f \u0627\u0644\u0635\u0644\u0627\u062d\u064a\u0627\u062a:\n\u062b\u063a\u0631\u0629 CVE-2026-46300 \u0627\u0644\u0645\u0639\u0631\u0648\u0641\u0629 \u0628\u0627\u0633\u0645 Fragnesia \u062a\u0633\u0645\u062d \u0644\u0645\u0633\u062a\u062e\u062f\u0645 \u0645\u062d\u0644\u064a \u0628\u062a\u0635\u0639\u064a\u062f \u0627\u0644\u0635\u0644\u0627\u062d\u064a\u0627\u062a \u0625\u0644\u0649 root \u0639\u0628\u0631 \u062e\u0644\u0644 \u0641\u064a Linux Kernel\u060c \u0648\u0647\u064a \u0645\u0631\u062a\u0628\u0637\u0629 \u0628\u0633\u0644\u0633\u0644\u0629 Dirty Frag. \n\ud83d\udccc https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/\n\n1\ufe0f\u20e31\ufe0f\u20e3 \u062e\u0627\u062f\u0645 NGINX\u060c \u062b\u063a\u0631\u0629 \u0639\u0645\u0631\u0647\u0627 18 \u0633\u0646\u0629:\n\u062b\u063a\u0631\u0629 NGINX Rift CVE-2026-42945 \u0641\u064a ngx_http_rewrite_module \u0642\u062f \u062a\u0633\u0645\u062d \u0628\u062a\u0646\u0641\u064a\u0630 \u0643\u0648\u062f \u0639\u0646 \u0628\u064f\u0639\u062f \u0623\u0648 \u062a\u0639\u0637\u064a\u0644 \u0627\u0644\u062e\u062f\u0645\u0629 \u0639\u0628\u0631 \u0637\u0644\u0628\u0627\u062a HTTP \u0645\u0635\u0645\u0645\u0629 \u062e\u0635\u064a\u0635\u064b\u0627. \n\ud83d\udccc https://thehackernews.com/2026/05/18-year-old-nginx-rewrite-module-flaw.html", "creation_timestamp": "2026-09-13T20:00:04.940179Z"}, {"uuid": "28aed16a-e4da-4b4d-9ce4-8cdf3f16fe54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://t.me/VulnerabilityNews/42406", "content": "Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak\n\nCybersecurity researchers have disclosed a critical security vulnerability in Ollama that, if successfully exploited, could allow a remote, unauthenticated attacker to leak its entire process memory.\nThe out-of-bounds read flaw, which likely impacts over 300,000 servers globally, is tracked as CVE-2026-7482 (CVSS score: 9.1). It has been codenamed\u00a0Bleeding Llama by Cyera.\nOllama is a\nhttps://thehackernews.com/2026/05/ollama-out-of-bounds-read-vulnerability.html", "creation_timestamp": "2026-09-18T05:00:06.982084Z"}, {"uuid": "2b98cbb0-10c6-4f3a-845b-b48a6037d12e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mwergyxtq222", "content": "\u300cServiceNow\u300d\u306b\u8907\u6570\u306e\u30af\u30ea\u30c6\u30a3\u30ab\u30eb\u8106\u5f31\u6027 - \u4fee\u6b63\u7248\u3092\u516c\u958b\n\nServiceNow\u306f\u3001\u300cNow Platform\u300d\u3084\u300cServiceNow AI Platform\u300d\u306b\u6df1\u523b\u306a\u8106\u5f31\u6027\u304c\u5224\u660e\u3057\u305f\u3068\u3057\u3001\u4fee\u6b63\u3092\u884c\u3063\u305f\u3002\n\n\u540c\u793e\u306f\u73fe\u5730\u6642\u95938\u670827\u65e5\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u3092\u516c\u958b\u3002\u300cCVE-2026-6876\u300d\u300cCVE-2026-18885\u300d\u300cCVE-2026-18886\u300d\u300cCVE-2026-74820\u300d\u3092\u660e\u3089\u304b\u306b\u3057\u305f\u3002\n\n\u300cCVE-2026-18885\u300d\u306f\u3001\u300cServiceNow AI Platform\u300d\u306e\u300cGraphQL Composite Data API\u300d\u306b\u78ba\u8a8d\u3055\u308c\u305f\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7...", "creation_timestamp": "2026-09-25T22:01:00.865926Z"}, {"uuid": "e090e31e-b8c7-4a0c-bd9c-10783f824712", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-74820", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mwf4a4zdak22", "content": "ServiceNow\u306f\u3001\u6df1\u523b\u5ea6\u304c\u6700\u5927\u3068\u306a\u308b3\u3064\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\u8b66\u544a\u3092\u767a\u3057\u305f\u3002\n\nServiceNow\u306f\u3001\u30b3\u30fc\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3001SQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u3001\u6a29\u9650\u6607\u683c\u653b\u6483\u306b\u60aa\u7528\u3055\u308c\u308b\u53ef\u80fd\u6027\u306e\u3042\u308b\u3001AI\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u306b\u304a\u3051\u308b3\u3064\u306e\u65b0\u305f\u306a\u6700\u9ad8\u30ec\u30d9\u30eb\u306e\u8106\u5f31\u6027\u306b\u5bfe\u3059\u308b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d1\u30c3\u30c1\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u3002\n\n...\n\n\u540c\u793e\u306f\u6728\u66dc\u65e5\u306e\u52e7\u544a\u3067\u3001\u30af\u30e9\u30a6\u30c9\u30d9\u30fc\u30b9\u306e\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u30923\u3064\u306e\u91cd\u5927\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u8106\u5f31\u6027\uff08CVE-2026-18885\u3001 CVE -2026-18886\u3001CVE-2026-74820\uff09\u304b\u3089\u4fdd\u8b77\u3059\u308b\u30d1\u30c3\u30c1\u3092\u9069\u7528\u3057\u305f\u3068\u8ff0\u3079\u3001\u9867\u5ba2\u306b\u5bfe\u3057\u3001\u81ea\u793e\u3067\u30db\u30b9\u30c8\u3057\u3066\u3044\u308b\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u3092\u4fdd\u8b77\u3059\u308b\u3088\u3046\u52e7\u544a\u3057\u305f", "creation_timestamp": "2026-09-26T01:14:03.497110Z"}, {"uuid": "9ea97eec-5fa3-4142-a1a8-13b196f68bfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://gist.github.com/rafael-arkhe/069fccf27b9b82220745476f1c7d6b22", "content": "# Arkhe-AI \u2014 Frontend, Design e UI/UX\n\nFrontend completo do n\u00facleo de IA verific\u00e1vel. Segue a linguagem de design descrita no corpus: **dark neon forense** (`#0a0a1a` de fundo, `#7ec8e3` de acento), **dois modos** (Basic 5 telas / Expert 15 telas), **responsive** (sidebar desktop + bottom nav mobile), **fail-closed visual** (todo estado \u00e9 expl\u00edcito: `\u2705 VERIFIED` / `\u26a0\ufe0f PARTIAL` / `\u274c FAILED` / `\u2b1c [NONEXISTENT]` / `\u23f3 PENDING` / `\ud83d\udd12 BLOCKED`).\n\n---\n\n## 1. Estrutura do Projeto\n\n```\narkhe-ai-ui/\n\u251c\u2500\u2500 package.json\n\u251c\u2500\u2500 vite.config.ts\n\u251c\u2500\u2500 tailwind.config.js\n\u251c\u2500\u2500 postcss.config.js\n\u251c\u2500\u2500 tsconfig.json\n\u251c\u2500\u2500 tsconfig.node.json\n\u251c\u2500\u2500 index.html\n\u251c\u2500\u2500 README.md\n\u251c\u2500\u2500 src/\n\u2502   \u251c\u2500\u2500 main.tsx\n\u2502   \u251c\u2500\u2500 App.tsx\n\u2502   \u251c\u2500\u2500 styles/\n\u2502   \u2502   \u2514\u2500\u2500 globals.css\n\u2502   \u251c\u2500\u2500 lib/\n\u2502   \u2502   \u251c\u2500\u2500 utils.ts\n\u2502   \u2502   \u251c\u2500\u2500 mock-data.ts\n\u2502   \u2502   \u251c\u2500\u2500 api.ts\n\u2502   \u2502   \u2514\u2500\u2500 constants.ts\n\u2502   \u251c\u2500\u2500 contexts/\n\u2502   \u2502   \u2514\u2500\u2500 AppContext.tsx\n\u2502   \u251c\u2500\u2500 hooks/\n\u2502   \u2502   \u251c\u2500\u2500 useKeyboardShortcuts.ts\n\u2502   \u2502   \u2514\u2500\u2500 useMediaQuery.ts\n\u2502   \u251c\u2500\u2500 components/\n\u2502   \u2502   \u251c\u2500\u2500 ui/\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 Button.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 Card.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 Badge.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 Progress.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 Tabs.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 Dialog.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 Toast.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 Skeleton.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 EmptyState.tsx\n\u2502   \u2502   \u2502   \u2514\u2500\u2500 Field.tsx\n\u2502   \u2502   \u251c\u2500\u2500 layout/\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 Shell.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 Sidebar.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 Header.tsx\n\u2502   \u2502   \u2502   \u2514\u2500\u2500 MobileNav.tsx\n\u2502   \u2502   \u251c\u2500\u2500 verification/\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 VerificationCard.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 GateStatusRow.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 EvidenceCard.tsx\n\u2502   \u2502   \u2502   \u2514\u2500\u2500 InvariantTable.tsx\n\u2502   \u2502   \u251c\u2500\u2500 wormgraph/\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 WormGraphCanvas.tsx\n\u2502   \u2502   \u2502   \u2514\u2500\u2500 EventLog.tsx\n\u2502   \u2502   \u251c\u2500\u2500 models/\n\u2502   \u2502   \u2502   \u2514\u2500\u2500 ModelGrid.tsx\n\u2502   \u2502   \u251c\u2500\u2500 governance/\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 HITLModal.tsx\n\u2502   \u2502   \u2502   \u2514\u2500\u2500 QuorumBar.tsx\n\u2502   \u2502   \u251c\u2500\u2500 ai/\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 InferencePanel.tsx\n\u2502   \u2502   \u2502   \u251c\u2500\u2500 RoutingTable.tsx\n\u2502   \u2502   \u2502   \u2514\u2500\u2500 ContextViewer.tsx\n\u2502   \u2502   \u2514\u2500\u2500 policy/\n\u2502   \u2502       \u251c\u2500\u2500 PolicyTable.tsx\n\u2502   \u2502       \u2514\u2500\u2500 SequencingView.tsx\n\u2502   \u2514\u2500\u2500 screens/\n\u2502       \u251c\u2500\u2500 Home.tsx\n\u2502       \u251c\u2500\u2500 Models.tsx\n\u2502       \u251c\u2500\u2500 Verify.tsx\n\u2502       \u251c\u2500\u2500 Logs.tsx\n\u2502       \u251c\u2500\u2500 Settings.tsx\n\u2502       \u251c\u2500\u2500 expert/\n\u2502       \u2502   \u251c\u2500\u2500 Dashboard.tsx\n\u2502       \u2502   \u251c\u2500\u2500 Gates.tsx\n\u2502       \u2502   \u251c\u2500\u2500 WormGraph.tsx\n\u2502       \u2502   \u251c\u2500\u2500 AI.tsx\n\u2502       \u2502   \u251c\u2500\u2500 Routing.tsx\n\u2502       \u2502   \u251c\u2500\u2500 Context.tsx\n\u2502       \u2502   \u251c\u2500\u2500 Builder.tsx\n\u2502       \u2502   \u251c\u2500\u2500 Policy.tsx\n\u2502       \u2502   \u251c\u2500\u2500 Agentic.tsx\n\u2502       \u2502   \u251c\u2500\u2500 Invariants.tsx\n\u2502       \u2502   \u251c\u2500\u2500 Governance.tsx\n\u2502       \u2502   \u2514\u2500\u2500 MobileExpert.tsx\n\u2502       \u2514\u2500\u2500 settings/\n\u2502           \u251c\u2500\u2500 AISettings.tsx\n\u2502           \u251c\u2500\u2500 TEESettings.tsx\n\u2502           \u251c\u2500\u2500 SecuritySettings.tsx\n\u2502           \u2514\u2500\u2500 AdvancedSettings.tsx\n```\n\n---\n\n## 2. Configura\u00e7\u00e3o Raiz\n\n### `package.json`\n\n```json\n{\n  \"name\": \"arkhe-ai-ui\",\n  \"private\": true,\n  \"version\": \"0.1.0\",\n  \"type\": \"module\",\n  \"scripts\": {\n    \"dev\": \"vite\",\n    \"build\": \"tsc -b && vite build\",\n    \"preview\": \"vite preview\",\n    \"lint\": \"eslint . --max-warnings 0\",\n    \"typecheck\": \"tsc --noEmit\",\n    \"format\": \"prettier --write .\",\n    \"test\": \"vitest run\",\n    \"test:watch\": \"vitest\"\n  },\n  \"dependencies\": {\n    \"react\": \"^19.0.0\",\n    \"react-dom\": \"^19.0.0\",\n    \"react-router-dom\": \"^7.0.0\",\n    \"lucide-react\": \"^0.460.0\",\n    \"recharts\": \"^2.13.0\",\n    \"d3-force\": \"^3.0.0\",\n    \"clsx\": \"^2.1.1\",\n    \"tailwind-merge\": \"^2.5.0\",\n    \"zustand\": \"^5.0.0\"\n  },\n  \"devDependencies\": {\n    \"@types/react\": \"^19.0.0\",\n    \"@types/react-dom\": \"^19.0.0\",\n    \"@types/d3-force\": \"^3.0.10\",\n    \"@vitejs/plugin-react\": \"^4.3.0\",\n    \"autoprefixer\": \"^10.4.20\",\n    \"postcss\": \"^8.4.47\",\n    \"tailwindcss\": \"^3.4.0\",\n    \"typescript\": \"^5.6.0\",\n    \"vite\": \"^6.0.0\",\n    \"vitest\": \"^2.1.0\"\n  }\n}\n```\n\n### `vite.config.ts`\n\n```ts\nimport { defineConfig } from 'vite';\nimport react from '@vitejs/plugin-react';\nimport path from 'node:path';\n\nexport default defineConfig({\n  plugins: [react()],\n  resolve: {\n    alias: {\n      '@': path.resolve(__dirname, './src'),\n    },\n  },\n  server: {\n    port: 5173,\n    host: true,\n  },\n  build: {\n    target: 'es2022',\n    sourcemap: true,\n    rollupOptions: {\n      output: {\n        manualChunks: {\n          'react-vendor': ['react', 'react-dom', 'react-router-dom'],\n          'viz': ['recharts', 'd3-force'],\n        },\n      },\n    },\n  },\n});\n```\n\n### `tailwind.config.js`\n\n```js\n/** @type {import('tailwindcss').Config} */\nexport default {\n  content: ['./index.html', './src/**/*.{ts,tsx}'],\n  theme: {\n    extend: {\n      colors: {\n        arkhe: {\n          bg: '#0a0a1a',\n          surface: '#0d1b2a',\n          border: '#1a2a3a',\n          borderHi: '#2a3d52',\n          blue: '#7ec8e3',\n          blueDim: '#4a8ca8',\n          green: '#2ecc71',\n          yellow: '#f1c40f',\n          red: '#e74c3c',\n          purple: '#a855f7',\n          magenta: '#e879f9',\n          muted: '#6b8299',\n          dim: '#3d5066',\n          fg: '#e5eef6',\n        },\n      },\n      fontFamily: {\n        mono: ['\"JetBrains Mono\"', '\"Courier New\"', 'monospace'],\n        sans: ['Inter', 'system-ui', 'sans-serif'],\n      },\n      boxShadow: {\n        glow: '0 0 24px rgba(126, 200, 227, 0.15)',\n        'glow-lg': '0 0 48px rgba(126, 200, 227, 0.25)',\n        inset: 'inset 0 1px 0 rgba(255, 255, 255, 0.04)',\n      },\n      animation: {\n        'pulse-slow': 'pulse 3s cubic-bezier(0.4, 0, 0.6, 1) infinite',\n        'fade-in': 'fadeIn 0.2s ease-out',\n        'slide-up': 'slideUp 0.25s ease-out',\n      },\n      keyframes: {\n        fadeIn: {\n          '0%': { opacity: '0' },\n          '100%': { opacity: '1' },\n        },\n        slideUp: {\n          '0%': { opacity: '0', transform: 'translateY(8px)' },\n          '100%': { opacity: '1', transform: 'translateY(0)' },\n        },\n      },\n    },\n  },\n  plugins: [],\n};\n```\n\n### `postcss.config.js`\n\n```js\nexport default {\n  plugins: {\n    tailwindcss: {},\n    autoprefixer: {},\n  },\n};\n```\n\n### `tsconfig.json`\n\n```json\n{\n  \"compilerOptions\": {\n    \"target\": \"ES2022\",\n    \"useDefineForClassFields\": true,\n    \"lib\": [\"ES2022\", \"DOM\", \"DOM.Iterable\"],\n    \"module\": \"ESNext\",\n    \"skipLibCheck\": true,\n    \"moduleResolution\": \"bundler\",\n    \"allowImportingTsExtensions\": true,\n    \"resolveJsonModule\": true,\n    \"isolatedModules\": true,\n    \"noEmit\": true,\n    \"jsx\": \"react-jsx\",\n    \"strict\": true,\n    \"noUnusedLocals\": true,\n    \"noUnusedParameters\": true,\n    \"noFallthroughCasesInSwitch\": true,\n    \"baseUrl\": \".\",\n    \"paths\": { \"@/*\": [\"./src/*\"] }\n  },\n  \"include\": [\"src\"],\n  \"references\": [{ \"path\": \"./tsconfig.node.json\" }]\n}\n```\n\n### `tsconfig.node.json`\n\n```json\n{\n  \"compilerOptions\": {\n    \"composite\": true,\n    \"skipLibCheck\": true,\n    \"module\": \"ESNext\",\n    \"moduleResolution\": \"bundler\",\n    \"allowSyntheticDefaultImports\": true,\n    \"strict\": true\n  },\n  \"include\": [\"vite.config.ts\"]\n}\n```\n\n### `index.html`\n\n```html\n\n\n  \n    \n    \n    \n    Arkhe OS \u00b7 Verifica\u00e7\u00e3o\n    \n    \n    \n  \n  \n    \n\n    \n  \n\n```\n\n---\n\n## 3. Design Tokens \u2014 `src/styles/globals.css`\n\n```css\n@tailwind base;\n@tailwind components;\n@tailwind utilities;\n\n/* \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\n   ARKHE DESIGN TOKENS\n   Forensic ledger aesthetic \u00b7 dark neon \u00b7 monospace density\n   \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550 */\n\n@layer base {\n  :root {\n    color-scheme: dark;\n    --radius: 8px;\n    --radius-sm: 4px;\n    --radius-lg: 12px;\n    --transition-fast: 120ms;\n    --transition-base: 200ms;\n  }\n\n  * {\n    border-color: theme('colors.arkhe.border');\n  }\n\n  html, body, #root {\n    height: 100%;\n    background: theme('colors.arkhe.bg');\n    color: theme('colors.arkhe.fg');\n  }\n\n  body {\n    font-family: theme('fontFamily.sans');\n    font-feature-settings: 'ss01', 'cv11';\n    -webkit-font-smoothing: antialiased;\n    text-rendering: optimizeLegibility;\n    overscroll-behavior-y: none;\n  }\n\n  code, pre, .mono {\n    font-family: theme('fontFamily.mono');\n    font-variant-ligatures: none;\n  }\n\n  /* Focus visible \u2014 INV-A11Y-06 */\n  :focus-visible {\n    outline: 2px solid theme('colors.arkhe.blue');\n    outline-offset: 2px;\n    border-radius: var(--radius-sm);\n  }\n\n  /* Reduced motion \u2014 QG-A11Y-05 */\n  @media (prefers-reduced-motion: reduce) {\n    *, *::before, *::after {\n      animation-duration: 0.001ms !important;\n      transition-duration: 0.001ms !important;\n    }\n  }\n\n  /* Scrollbar */\n  ::-webkit-scrollbar {\n    width: 10px;\n    height: 10px;\n  }\n  ::-webkit-scrollbar-track {\n    background: theme('colors.arkhe.bg');\n  }\n  ::-webkit-scrollbar-thumb {\n    background: theme('colors.arkhe.border');\n    border-radius: 5px;\n  }\n  ::-webkit-scrollbar-thumb:hover {\n    background: theme('colors.arkhe.borderHi');\n  }\n}\n\n@layer components {\n  /* \u2500\u2500 Status pills (honest status) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n  .status {\n    @apply inline-flex items-center gap-1.5 px-2 py-0.5 rounded text-xs font-mono font-medium border;\n  }\n  .status-verified {\n    @apply text-arkhe-green border-arkhe-green/30 bg-arkhe-green/10;\n  }\n  .status-partial {\n    @apply text-arkhe-yellow border-arkhe-yellow/30 bg-arkhe-yellow/10;\n  }\n  .status-failed {\n    @apply text-arkhe-red border-arkhe-red/30 bg-arkhe-red/10;\n  }\n  .status-nonexistent {\n    @apply text-arkhe-muted border-arkhe-border bg-arkhe-surface;\n  }\n  .status-pending {\n    @apply text-arkhe-blue border-arkhe-blue/30 bg-arkhe-blue/10;\n  }\n  .status-blocked {\n    @apply text-arkhe-purple border-arkhe-purple/30 bg-arkhe-purple/10;\n  }\n\n  /* \u2500\u2500 Section labels \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n  .label-section {\n    @apply text-[11px] uppercase tracking-[0.14em] text-arkhe-dim font-semibold;\n  }\n  .label-mono {\n    @apply font-mono text-xs text-arkhe-muted;\n  }\n\n  /* \u2500\u2500 Ledger surface \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n  .ledger {\n    @apply bg-arkhe-surface border border-arkhe-border rounded-lg shadow-inset;\n  }\n  .ledger-hover {\n    @apply hover:border-arkhe-borderHi transition-colors;\n  }\n\n  /* \u2500\u2500 Hash display \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n  .hash {\n    @apply font-mono text-xs text-arkhe-blueDim break-all;\n  }\n\n  /* \u2500\u2500 Gate bar \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n  .gate-bar {\n    @apply h-1 rounded-full bg-arkhe-border overflow-hidden;\n  }\n\n  /* \u2500\u2500 Nav item \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500 */\n  .nav-item {\n    @apply flex items-center gap-3 px-3 py-2 rounded-md text-sm transition-colors;\n  }\n  .nav-item-active {\n    @apply bg-arkhe-border/60 text-arkhe-blue;\n  }\n  .nav-item-idle {\n    @apply text-arkhe-muted hover:text-arkhe-fg hover:bg-arkhe-border/40;\n  }\n}\n\n@layer utilities {\n  .scrollbar-thin {\n    scrollbar-width: thin;\n  }\n  .text-balance {\n    text-wrap: balance;\n  }\n  .safe-bottom {\n    padding-bottom: env(safe-area-inset-bottom);\n  }\n  .safe-top {\n    padding-top: env(safe-area-inset-top);\n  }\n}\n```\n\n---\n\n## 4. Lib, Contexts, Hooks\n\n### `src/lib/utils.ts`\n\n```ts\nimport { clsx, type ClassValue } from 'clsx';\nimport { twMerge } from 'tailwind-merge';\n\nexport function cn(...inputs: ClassValue[]) {\n  return twMerge(clsx(inputs));\n}\n\nexport function truncateHash(hash: string, front = 8, back = 8): string {\n  if (hash.length <= front + back + 1) return hash;\n  return `${hash.slice(0, front)}\u2026${hash.slice(-back)}`;\n}\n\nexport function formatBytes(bytes: number): string {\n  if (bytes < 1024) return `${bytes} B`;\n  if (bytes < 1024 ** 2) return `${(bytes / 1024).toFixed(1)} KB`;\n  if (bytes < 1024 ** 3) return `${(bytes / 1024 ** 2).toFixed(1)} MB`;\n  return `${(bytes / 1024 ** 3).toFixed(2)} GB`;\n}\n\nexport function formatRelative(ts: number): string {\n  const diff = Date.now() - ts;\n  const s = Math.floor(diff / 1000);\n  if (s < 60) return `${s}s atr\u00e1s`;\n  const m = Math.floor(s / 60);\n  if (m < 60) return `${m}min atr\u00e1s`;\n  const h = Math.floor(m / 60);\n  if (h < 24) return `${h}h atr\u00e1s`;\n  return `${Math.floor(h / 24)}d atr\u00e1s`;\n}\n\nexport function formatTimestamp(ts: number): string {\n  return new Date(ts).toLocaleTimeString('pt-BR', { hour12: false });\n}\n```\n\n### `src/lib/constants.ts`\n\n```ts\nexport const GATE_NAMES = [\n  { id: 0, name: 'Sanitiza\u00e7\u00e3o', short: 'Gate 0' },\n  { id: 1, name: 'Hash', short: 'Gate 1' },\n  { id: 2, name: 'Assinatura', short: 'Gate 2' },\n  { id: 3, name: 'Inclus\u00e3o', short: 'Gate 3' },\n] as const;\n\nexport const STATUS_SYMBOLS = {\n  VERIFIED: '\u2705',\n  PARTIAL: '\u26a0\ufe0f',\n  FAILED: '\u274c',\n  NONEXISTENT: '\u2b1c',\n  PENDING: '\u23f3',\n  BLOCKED: '\ud83d\udd12',\n} as const;\n\nexport const STATUS_LABELS = {\n  VERIFIED: 'VERIFIED',\n  PARTIAL: 'PARTIAL',\n  FAILED: 'FAILED',\n  NONEXISTENT: 'NONEXISTENT',\n  PENDING: 'PENDING',\n  BLOCKED: 'BLOCKED',\n} as const;\n\nexport const CAPABILITIES = [\n  'text_generation',\n  'reasoning',\n  'code',\n  'vision',\n  'audio',\n  'tool_use',\n] as const;\n\nexport const PREFERENCES = ['cost', 'latency', 'balanced'] as const;\n\nexport const KEYBOARD_SHORTCUTS = {\n  SEARCH: 'Ctrl+K',\n  VERIFY: 'Ctrl+Shift+V',\n  COMMAND_PALETTE: 'Ctrl+Shift+P',\n  ESCAPE: 'Esc',\n} as const;\n```\n\n### `src/lib/mock-data.ts`\n\n```ts\nexport type ArkheStatus =\n  | 'VERIFIED'\n  | 'PARTIAL'\n  | 'FAILED'\n  | 'NONEXISTENT'\n  | 'PENDING'\n  | 'BLOCKED';\n\nexport interface GateResult {\n  id: 0 | 1 | 2 | 3;\n  name: string;\n  status: ArkheStatus;\n  detail: string;\n}\n\nexport interface ModelRecord {\n  id: string;\n  name: string;\n  hash: string;\n  size: number;\n  status: ArkheStatus;\n  verifiedAt: number;\n  capabilities: string[];\n  license: string;\n}\n\nexport interface VerificationRecord {\n  id: string;\n  modelId: string;\n  status: ArkheStatus;\n  gates: GateResult[];\n  recordHash: string;\n  timestamp: number;\n}\n\nexport interface WormEvent {\n  id: number;\n  kind: 'verify_ok' | 'verify_fail' | 'sign' | 'rekor' | 'merge' | 'boot';\n  summary: string;\n  recordHash: string;\n  timestamp: number;\n}\n\nexport interface Invariant {\n  id: string;\n  statement: string;\n  category: string;\n  critical: boolean;\n  status: ArkheStatus;\n}\n\nexport interface Policy {\n  id: string;\n  name: string;\n  welfare: number;\n  agency: number;\n  durability: number;\n  status: ArkheStatus;\n  phase: 'PRE_EMPTIVE' | 'STABILIZER' | 'BACKSTOP';\n}\n\nexport const MOCK_MODELS: ModelRecord[] = [\n  {\n    id: 'arkhe-demo',\n    name: 'arkhe.gguf',\n    hash: '9822626ecb93d38a4f1e5c8a9b7d6e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d',\n    size: 1_534_000_000,\n    status: 'VERIFIED',\n    verifiedAt: Date.now() - 120_000,\n    capabilities: ['text_generation', 'reasoning', 'code'],\n    license: 'Apache-2.0',\n  },\n  {\n    id: 'qwen-1.5b',\n    name: 'Qwen2.5-1.5B-Instruct.gguf',\n    hash: '3a4f5c8a9b7d6e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f',\n    size: 1_100_000_000,\n    status: 'VERIFIED',\n    verifiedAt: Date.now() - 600_000,\n    capabilities: ['text_generation'],\n    license: 'Apache-2.0',\n  },\n  {\n    id: 'llama-3.2',\n    name: 'Llama-3.2-3B.gguf',\n    hash: '7c8a9b7d6e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b',\n    size: 2_100_000_000,\n    status: 'VERIFIED',\n    verifiedAt: Date.now() - 1_200_000,\n    capabilities: ['text_generation', 'reasoning'],\n    license: 'Llama-3.2',\n  },\n  {\n    id: 'smollm2',\n    name: 'SmolLM2-135M.gguf',\n    hash: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2',\n    size: 110_000_000,\n    status: 'PARTIAL',\n    verifiedAt: Date.now() - 3_600_000,\n    capabilities: ['text_generation'],\n    license: 'Apache-2.0',\n  },\n  {\n    id: 'phi-3.5',\n    name: 'Phi-3.5-mini.gguf',\n    hash: 'b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3',\n    size: 2_300_000_000,\n    status: 'FAILED',\n    verifiedAt: Date.now() - 7_200_000,\n    capabilities: ['text_generation'],\n    license: 'MIT',\n  },\n];\n\nexport const MOCK_GATES: GateResult[] = [\n  {\n    id: 0,\n    name: 'Sanitiza\u00e7\u00e3o',\n    status: 'VERIFIED',\n    detail: '35 KV \u00b7 338 tensores \u00b7 0 CVEs',\n  },\n  {\n    id: 1,\n    name: 'Hash',\n    status: 'VERIFIED',\n    detail: 'SHA-256 match byte-for-byte',\n  },\n  {\n    id: 2,\n    name: 'Assinatura',\n    status: 'VERIFIED',\n    detail: 'Ed25519 \u00b7 Sigstore/Fulcio',\n  },\n  {\n    id: 3,\n    name: 'Inclus\u00e3o',\n    status: 'VERIFIED',\n    detail: 'Rekor log_index 123456 \u00b7 quorum 2/2',\n  },\n];\n\nexport const MOCK_VERIFICATIONS: VerificationRecord[] = [\n  {\n    id: 'v1',\n    modelId: 'arkhe-demo',\n    status: 'VERIFIED',\n    gates: MOCK_GATES,\n    recordHash: '9822626ecb93d38a',\n    timestamp: Date.now() - 120_000,\n  },\n  {\n    id: 'v2',\n    modelId: 'qwen-1.5b',\n    status: 'VERIFIED',\n    gates: MOCK_GATES,\n    recordHash: '3a4f5c8a9b7d6e3f',\n    timestamp: Date.now() - 600_000,\n  },\n  {\n    id: 'v3',\n    modelId: 'phi-3.5',\n    status: 'FAILED',\n    gates: [\n      MOCK_GATES[0],\n      { ...MOCK_GATES[1], status: 'FAILED', detail: 'Hash mismatch' },\n      { ...MOCK_GATES[2], status: 'NONEXISTENT', detail: 'Sem assinatura' },\n      { ...MOCK_GATES[3], status: 'NONEXISTENT', detail: 'Sem prova' },\n    ],\n    recordHash: 'b2c3d4e5f6a7b8c9',\n    timestamp: Date.now() - 7_200_000,\n  },\n];\n\nexport const MOCK_WORM_EVENTS: WormEvent[] = [\n  { id: 1, kind: 'boot', summary: 'Arkhe OS inicializado', recordHash: '0000\u2026', timestamp: Date.now() - 7_200_000 },\n  { id: 2, kind: 'sign', summary: 'Sigstore/Fulcio assinou arkhe.gguf', recordHash: '3a4f\u2026', timestamp: Date.now() - 600_000 },\n  { id: 3, kind: 'rekor', summary: 'Registro Rekor #123456 ancorado', recordHash: '7c8a\u2026', timestamp: Date.now() - 600_000 },\n  { id: 4, kind: 'verify_ok', summary: 'arkhe.gguf verificado (4/4 gates)', recordHash: '9822\u2026', timestamp: Date.now() - 120_000 },\n  { id: 5, kind: 'verify_fail', summary: 'phi-3.5 rejeitado (hash mismatch)', recordHash: 'b2c3\u2026', timestamp: Date.now() - 7_200_000 },\n];\n\nexport const MOCK_INVARIANTS: Invariant[] = [\n  { id: 'INV-AI-01', statement: 'Todo contexto tem record_hash verific\u00e1vel', category: 'AUDITABILITY', critical: false, status: 'VERIFIED' },\n  { id: 'INV-AI-02', statement: 'Contexto vazio \u00e9 rejeitado', category: 'SAFETY', critical: false, status: 'VERIFIED' },\n  { id: 'INV-AI-07', statement: 'Toda infer\u00eancia tem record_hash', category: 'AUDITABILITY', critical: true, status: 'VERIFIED' },\n  { id: 'INV-AI-08', statement: 'Trust anchor obrigat\u00f3ria (fail-closed)', category: 'SAFETY', critical: true, status: 'VERIFIED' },\n  { id: 'INV-AI-09', statement: 'Custo verificado contra or\u00e7amento', category: 'SAFETY', critical: true, status: 'VERIFIED' },\n  { id: 'INV-AI-10', statement: 'Nenhuma infer\u00eancia usa modelo n\u00e3o-verificado', category: 'CRYPTOGRAPHY', critical: true, status: 'VERIFIED' },\n  { id: 'INV-WEB3-05', statement: 'Log append-only com MMR', category: 'AUDITABILITY', critical: true, status: 'VERIFIED' },\n  { id: 'INV-WEB3-16', statement: 'Fail-closed sobre aus\u00eancia', category: 'SAFETY', critical: true, status: 'VERIFIED' },\n];\n\nexport const MOCK_POLICIES: Policy[] = [\n  { id: 'ui', name: 'UI expandido', welfare: 66.7, agency: 42.0, durability: 64.0, status: 'VERIFIED', phase: 'PRE_EMPTIVE' },\n  { id: 'eitc', name: 'EITC', welfare: 68.8, agency: 47.2, durability: 60.7, status: 'VERIFIED', phase: 'PRE_EMPTIVE' },\n  { id: 'retraining', name: 'Retraining', welfare: 58.0, agency: 52.0, durability: 56.0, status: 'VERIFIED', phase: 'PRE_EMPTIVE' },\n  { id: 'nit', name: 'NIT', welfare: 69.8, agency: 53.7, durability: 69.6, status: 'PENDING', phase: 'STABILIZER' },\n  { id: 'ubi', name: 'UBI', welfare: 62.0, agency: 53.1, durability: 62.7, status: 'PENDING', phase: 'STABILIZER' },\n  { id: 'ubc', name: 'UBC', welfare: 62.0, agency: 76.3, durability: 74.2, status: 'PENDING', phase: 'BACKSTOP' },\n  { id: 'ubs', name: 'UBS', welfare: 70.0, agency: 50.0, durability: 75.0, status: 'PENDING', phase: 'BACKSTOP' },\n  { id: 'sov', name: 'Sovereign AI Fund', welfare: 58.0, agency: 55.2, durability: 65.0, status: 'PENDING', phase: 'BACKSTOP' },\n];\n```\n\n### `src/contexts/AppContext.tsx`\n\n```tsx\nimport { createContext, useContext, useMemo, useState, type ReactNode } from 'react';\nimport type { ArkheStatus } from '@/lib/mock-data';\n\nexport type AppMode = 'basic' | 'expert';\n\ninterface Toast {\n  id: string;\n  kind: 'info' | 'success' | 'error';\n  message: string;\n}\n\ninterface AppState {\n  mode: AppMode;\n  setMode: (m: AppMode) => void;\n  toasts: Toast[];\n  pushToast: (kind: Toast['kind'], message: string) => void;\n  dismissToast: (id: string) => void;\n\n  trustAnchor: string | null;\n  setTrustAnchor: (a: string | null) => void;\n\n  budget: number;\n  setBudget: (b: number) => void;\n\n  selectedModelId: string | null;\n  setSelectedModelId: (id: string | null) => void;\n}\n\nconst Ctx = createContext(null);\n\nexport function AppProvider({ children }: { children: ReactNode }) {\n  const [mode, setMode] = useState('basic');\n  const [toasts, setToasts] = useState([]);\n  const [trustAnchor, setTrustAnchor] = useState('did:arkhe:anchor');\n  const [budget, setBudget] = useState(100);\n  const [selectedModelId, setSelectedModelId] = useState(null);\n\n  const value = useMemo(\n    () => ({\n      mode,\n      setMode,\n      toasts,\n      pushToast: (kind, message) => {\n        const id = crypto.randomUUID();\n        setToasts((t) => [...t, { id, kind, message }]);\n        setTimeout(() => {\n          setToasts((t) => t.filter((x) => x.id !== id));\n        }, 4000);\n      },\n      dismissToast: (id) => setToasts((t) => t.filter((x) => x.id !== id)),\n      trustAnchor,\n      setTrustAnchor,\n      budget,\n      setBudget,\n      selectedModelId,\n      setSelectedModelId,\n    }),\n    [mode, toasts, trustAnchor, budget, selectedModelId],\n  );\n\n  return {children};\n}\n\nexport function useApp(): AppState {\n  const v = useContext(Ctx);\n  if (!v) throw new Error('useApp fora do AppProvider');\n  return v;\n}\n```\n\n### `src/hooks/useMediaQuery.ts`\n\n```ts\nimport { useEffect, useState } from 'react';\n\nexport function useMediaQuery(query: string): boolean {\n  const [matches, setMatches] = useState(() =>\n    typeof window !== 'undefined' ? window.matchMedia(query).matches : false,\n  );\n\n  useEffect(() => {\n    const mql = window.matchMedia(query);\n    const handler = (e: MediaQueryListEvent) => setMatches(e.matches);\n    mql.addEventListener('change', handler);\n    return () => mql.removeEventListener('change', handler);\n  }, [query]);\n\n  return matches;\n}\n\nexport const useIsMobile = () => useMediaQuery('(max-width: 767px)');\nexport const useIsDesktop = () => useMediaQuery('(min-width: 1024px)');\n```\n\n### `src/hooks/useKeyboardShortcuts.ts`\n\n```ts\nimport { useEffect } from 'react';\nimport { useNavigate } from 'react-router-dom';\n\nexport function useKeyboardShortcuts() {\n  const navigate = useNavigate();\n\n  useEffect(() => {\n    const handler = (e: KeyboardEvent) => {\n      const mod = e.ctrlKey || e.metaKey;\n\n      if (mod && e.key.toLowerCase() === 'k') {\n        e.preventDefault();\n        const input = document.querySelector('[data-global-search]');\n        input?.focus();\n      }\n\n      if (mod && e.shiftKey && e.key.toLowerCase() === 'v') {\n        e.preventDefault();\n        navigate('/verify');\n      }\n\n      if (e.key === 'Escape') {\n        const active = document.activeElement as HTMLElement | null;\n        if (active?.tagName === 'INPUT') active.blur();\n      }\n    };\n\n    window.addEventListener('keydown', handler);\n    return () => window.removeEventListener('keydown', handler);\n  }, [navigate]);\n}\n```\n\n---\n\n## 5. UI Primitives\n\n### `src/components/ui/Button.tsx`\n\n```tsx\nimport { forwardRef, type ButtonHTMLAttributes } from 'react';\nimport { cn } from '@/lib/utils';\n\ntype Variant = 'primary' | 'secondary' | 'ghost' | 'danger' | 'success' | 'outline';\ntype Size = 'sm' | 'md' | 'lg' | 'icon';\n\ninterface Props extends ButtonHTMLAttributes {\n  variant?: Variant;\n  size?: Size;\n}\n\nconst variants: Record = {\n  primary: 'bg-arkhe-blue/15 text-arkhe-blue border-arkhe-blue/40 hover:bg-arkhe-blue/25',\n  secondary: 'bg-arkhe-surface text-arkhe-fg border-arkhe-border hover:border-arkhe-borderHi',\n  ghost: 'bg-transparent text-arkhe-muted hover:text-arkhe-fg hover:bg-arkhe-border/40 border-transparent',\n  danger: 'bg-arkhe-red/15 text-arkhe-red border-arkhe-red/40 hover:bg-arkhe-red/25',\n  success: 'bg-arkhe-green/15 text-arkhe-green border-arkhe-green/40 hover:bg-arkhe-green/25',\n  outline: 'bg-transparent text-arkhe-fg border-arkhe-borderHi hover:bg-arkhe-border/40',\n};\n\nconst sizes: Record = {\n  sm: 'h-8 px-3 text-xs',\n  md: 'h-10 px-4 text-sm',\n  lg: 'h-12 px-6 text-base',\n  icon: 'h-9 w-9 p-0',\n};\n\nexport const Button = forwardRef(\n  ({ className, variant = 'secondary', size = 'md', ...rest }, ref) => (\n    \n  ),\n);\nButton.displayName = 'Button';\n```\n\n### `src/components/ui/Card.tsx`\n\n```tsx\nimport { type HTMLAttributes, type ReactNode } from 'react';\nimport { cn } from '@/lib/utils';\n\ninterface CardProps extends HTMLAttributes {\n  children: ReactNode;\n}\n\nexport function Card({ className, children, ...rest }: CardProps) {\n  return (\n    \n\n      {children}\n    \n  );\n}\n\ninterface CardHeaderProps {\n  title: ReactNode;\n  subtitle?: ReactNode;\n  actions?: ReactNode;\n  icon?: ReactNode;\n  className?: string;\n}\n\nexport function CardHeader({ title, subtitle, actions, icon, className }: CardHeaderProps) {\n  return (\n    \n\n      \n\n        {icon && \n{icon}}\n        \n\n          \n{title}\n          {subtitle && \n{subtitle}}\n        \n      \n      {actions && \n{actions}}\n    \n  );\n}\n\nexport function CardBody({ className, children, ...rest }: CardProps) {\n  return (\n    \n\n      {children}\n    \n  );\n}\n\nexport function CardFooter({ className, children }: CardProps) {\n  return (\n    \n\n      {children}\n    \n  );\n}\n```\n\n### `src/components/ui/Badge.tsx`\n\n```tsx\nimport { cn } from '@/lib/utils';\nimport { STATUS_SYMBOLS, STATUS_LABELS } from '@/lib/constants';\nimport type { ArkheStatus } from '@/lib/mock-data';\n\ninterface BadgeProps {\n  status: ArkheStatus;\n  label?: string;\n  className?: string;\n  showSymbol?: boolean;\n}\n\nconst classMap: Record = {\n  VERIFIED: 'status-verified',\n  PARTIAL: 'status-partial',\n  FAILED: 'status-failed',\n  NONEXISTENT: 'status-nonexistent',\n  PENDING: 'status-pending',\n  BLOCKED: 'status-blocked',\n};\n\nexport function Badge({ status, label, className, showSymbol = true }: BadgeProps) {\n  return (\n    \n      {showSymbol && {STATUS_SYMBOLS[status]}}\n      {label ?? STATUS_LABELS[status]}\n    \n  );\n}\n```\n\n### `src/components/ui/Progress.tsx`\n\n```tsx\nimport { cn } from '@/lib/utils';\n\ninterface ProgressProps {\n  value: number; // 0..100\n  max?: number;\n  tone?: 'blue' | 'green' | 'yellow' | 'red' | 'purple';\n  className?: string;\n}\n\nconst tones = {\n  blue: 'bg-arkhe-blue',\n  green: 'bg-arkhe-green',\n  yellow: 'bg-arkhe-yellow',\n  red: 'bg-arkhe-red',\n  purple: 'bg-arkhe-purple',\n};\n\nexport function Progress({ value, max = 100, tone = 'blue', className }: ProgressProps) {\n  const pct = Math.min(100, Math.max(0, (value / max) * 100));\n  return (\n    \n\n      \n\n    \n  );\n}\n```\n\n### `src/components/ui/Tabs.tsx`\n\n```tsx\nimport { cn } from '@/lib/utils';\nimport type { ReactNode } from 'react';\n\ninterface TabsProps {\n  value: T;\n  onChange: (v: T) => void;\n  items: { value: T; label: ReactNode; count?: number }[];\n  className?: string;\n}\n\nexport function Tabs({ value, onChange, items, className }: TabsProps) {\n  return (\n    \n\n      {items.map((item) => {\n        const active = item.value === value;\n        return (\n           onChange(item.value)}\n            className={cn(\n              'inline-flex items-center gap-2 rounded px-3 py-1.5 text-xs font-mono uppercase tracking-wider transition-colors',\n              active\n                ? 'bg-arkhe-blue/15 text-arkhe-blue'\n                : 'text-arkhe-muted hover:text-arkhe-fg',\n            )}\n          >\n            {item.label}\n            {typeof item.count === 'number' && (\n              {item.count}\n            )}\n          \n        );\n      })}\n    \n  );\n}\n```\n\n### `src/components/ui/Dialog.tsx`\n\n```tsx\nimport { useEffect, type ReactNode } from 'react';\nimport { createPortal } from 'react-dom';\nimport { X } from 'lucide-react';\nimport { cn } from '@/lib/utils';\nimport { Button } from './Button';\n\ninterface DialogProps {\n  open: boolean;\n  onClose: () => void;\n  title: ReactNode;\n  children: ReactNode;\n  footer?: ReactNode;\n  size?: 'sm' | 'md' | 'lg';\n  closeOnBackdrop?: boolean;\n}\n\nconst sizes = {\n  sm: 'max-w-md',\n  md: 'max-w-lg',\n  lg: 'max-w-2xl',\n};\n\nexport function Dialog({\n  open,\n  onClose,\n  title,\n  children,\n  footer,\n  size = 'md',\n  closeOnBackdrop = true,\n}: DialogProps) {\n  useEffect(() => {\n    if (!open) return;\n    const prev = document.body.style.overflow;\n    document.body.style.overflow = 'hidden';\n    const onEsc = (e: KeyboardEvent) => e.key === 'Escape' && onClose();\n    window.addEventListener('keydown', onEsc);\n    return () => {\n      document.body.style.overflow = prev;\n      window.removeEventListener('keydown', onEsc);\n    };\n  }, [open, onClose]);\n\n  if (!open) return null;\n\n  return createPortal(\n    \n\n      \n closeOnBackdrop && onClose()}\n      />\n      \n\n        \n\n          \n{title}\n          \n            \n          \n        \n        \n{children}\n        {footer && (\n          \n\n            {footer}\n          \n        )}\n      \n    ,\n    document.body,\n  );\n}\n```\n\n### `src/components/ui/Toast.tsx`\n\n```tsx\nimport { CheckCircle2, Info, XCircle } from 'lucide-react';\nimport { useApp } from '@/contexts/AppContext';\nimport { cn } from '@/lib/utils';\n\nconst icons = {\n  info: Info,\n  success: CheckCircle2,\n  error: XCircle,\n};\n\nconst tones = {\n  info: 'border-arkhe-blue/40 bg-arkhe-blue/10 text-arkhe-blue',\n  success: 'border-arkhe-green/40 bg-arkhe-green/10 text-arkhe-green',\n  error: 'border-arkhe-red/40 bg-arkhe-red/10 text-arkhe-red',\n};\n\nexport function ToastContainer() {\n  const { toasts, dismissToast } = useApp();\n  return (\n    \n\n      {toasts.map((t) => {\n        const Icon = icons[t.kind];\n        return (\n           dismissToast(t.id)}\n            className={cn(\n              'flex items-start gap-3 rounded-md border p-3 text-sm text-left animate-slide-up shadow-glow',\n              tones[t.kind],\n            )}\n          >\n            \n            {t.message}\n          \n        );\n      })}\n    \n  );\n}\n```\n\n### `src/components/ui/Skeleton.tsx`\n\n```tsx\nimport { cn } from '@/lib/utils';\n\nexport function Skeleton({ className }: { className?: string }) {\n  return \n;\n}\n```\n\n### `src/components/ui/EmptyState.tsx`\n\n```tsx\nimport type { ReactNode } from 'react';\nimport { cn } from '@/lib/utils';\n\ninterface Props {\n  icon: ReactNode;\n  title: string;\n  description?: string;\n  action?: ReactNode;\n  className?: string;\n}\n\nexport function EmptyState({ icon, title, description, action, className }: Props) {\n  return (\n    \n\n      \n{icon}\n      \n{title}\n      {description && \n{description}}\n      {action}\n    \n  );\n}\n```\n\n### `src/components/ui/Field.tsx`\n\n```tsx\nimport { forwardRef, type InputHTMLAttributes, type ReactNode, type SelectHTMLAttributes } from 'react';\nimport { cn } from '@/lib/utils';\n\ninterface FieldProps {\n  label: ReactNode;\n  hint?: ReactNode;\n  error?: string;\n  children: ReactNode;\n}\n\nexport function Field({ label, hint, error, children }: FieldProps) {\n  return (\n    \n      {label}\n      {children}\n      {hint && !error && {hint}}\n      {error && {error}}\n    \n  );\n}\n\nconst baseInput =\n  'w-full rounded-md border border-arkhe-border bg-arkhe-bg px-3 py-2 text-sm font-mono ' +\n  'text-arkhe-fg placeholder:text-arkhe-dim ' +\n  'focus:border-arkhe-blue focus:outline-none transition-colors';\n\nexport const Input = forwardRef>(\n  ({ className, ...rest }, ref) => (\n    \n  ),\n);\nInput.displayName = 'Input';\n\nexport const Select = forwardRef>(\n  ({ className, children, ...rest }, ref) => (\n    \n      {children}\n    \n  ),\n);\nSelect.displayName = 'Select';\n```\n\n---\n\n## 6. Layout\n\n### `src/components/layout/Header.tsx`\n\n```tsx\nimport { Bell, Command, Search, Settings, User } from 'lucide-react';\nimport { Link } from 'react-router-dom';\nimport { Button } from '@/components/ui/Button';\nimport { useApp } from '@/contexts/AppContext';\nimport { KEYBOARD_SHORTCUTS } from '@/lib/constants';\n\nexport function Header() {\n  const { mode } = useApp();\n\n  return (\n    \n\n      \n\n        \n          ARKHE\n          \n            {mode === 'expert' ? 'Expert' : 'OS'}\n          \n        \n\n        \n\n          \n\n            \n            \n            \n               K\n            \n          \n        \n\n        \n\n          \n            \n          \n          \n            \n              \n            \n          \n          \n            \n          \n        \n      \n    \n  );\n}\n```\n\n### `src/components/layout/Sidebar.tsx`\n\n```tsx\nimport { NavLink } from 'react-router-dom';\nimport {\n  Activity, Brain, Cpu, FileSearch, GitBranch, Home, Layers, ListChecks,\n  Network, Package, ScrollText, Settings, Shield, Sparkles, Target,\n  TrendingUp, Wrench,\n} from 'lucide-react';\nimport { cn } from '@/lib/utils';\nimport { useApp } from '@/contexts/AppContext';\n\ninterface NavItem {\n  to: string;\n  icon: typeof Home;\n  label: string;\n  group?: string;\n  expertOnly?: boolean;\n}\n\nconst NAV: NavItem[] = [\n  { to: '/', icon: Home, label: 'In\u00edcio' },\n  { to: '/models', icon: Package, label: 'Modelos' },\n  { to: '/verify', icon: Shield, label: 'Verificar' },\n  { to: '/logs', icon: ScrollText, label: 'Registros' },\n  { to: '/settings', icon: Settings, label: 'Configura\u00e7\u00f5es' },\n\n  { to: '/expert/dashboard', icon: Activity, label: 'Dashboard', group: 'Expert', expertOnly: true },\n  { to: '/expert/gates', icon: ListChecks, label: 'Gates', expertOnly: true },\n  { to: '/expert/wormgraph', icon: Network, label: 'WormGraph', expertOnly: true },\n  { to: '/expert/ai', icon: Brain, label: 'Infer\u00eancia', expertOnly: true },\n  { to: '/expert/routing', icon: GitBranch, label: 'Roteamento', expertOnly: true },\n  { to: '/expert/context', icon: FileSearch, label: 'Contexto', expertOnly: true },\n  { to: '/expert/builder', icon: Wrench, label: 'Builder', expertOnly: true },\n  { to: '/expert/policy', icon: TrendingUp, label: 'Pol\u00edticas', expertOnly: true },\n  { to: '/expert/agentic', icon: Target, label: 'Avalia\u00e7\u00e3o', expertOnly: true },\n  { to: '/expert/invariants', icon: Layers, label: 'Invariantes', expertOnly: true },\n  { to: '/expert/governance', icon: Cpu, label: 'Governan\u00e7a', expertOnly: true },\n  { to: '/expert/design', icon: Sparkles, label: 'Design', expertOnly: true },\n];\n\nexport function Sidebar() {\n  const { mode } = useApp();\n  const items = NAV.filter((i) => mode === 'expert' || !i.expertOnly);\n\n  return (\n    \n\n      \n\n        {items.map((item, i) => {\n          const showGroup = item.group && items[i - 1]?.group !== item.group;\n          return (\n            \n\n              {showGroup && (\n                \n{item.group}\n              )}\n              \n                  cn('nav-item', isActive ? 'nav-item-active' : 'nav-item-idle')\n                }\n              >\n                \n                {item.label}\n              \n            \n          );\n        })}\n      \n      \n\n        v0.1.0 \u00b7 MIT OR Apache-2.0\n      \n    \n  );\n}\n```\n\n### `src/components/layout/MobileNav.tsx`\n\n```tsx\nimport { NavLink } from 'react-router-dom';\nimport { Home, Package, ScrollText, Settings, Shield } from 'lucide-react';\nimport { cn } from '@/lib/utils';\n\nconst TABS = [\n  { to: '/', icon: Home, label: 'In\u00edcio' },\n  { to: '/models', icon: Package, label: 'Modelos' },\n  { to: '/verify', icon: Shield, label: 'Verificar' },\n  { to: '/logs', icon: ScrollText, label: 'Registros' },\n  { to: '/settings', icon: Settings, label: 'Config' },\n];\n\nexport function MobileNav() {\n  return (\n    \n\n      \n\n        {TABS.map((t) => (\n          \n              cn(\n                'flex flex-col items-center justify-center gap-1 py-2.5 text-[10px] font-mono uppercase tracking-wider transition-colors',\n                isActive ? 'text-arkhe-blue' : 'text-arkhe-dim',\n              )\n            }\n          >\n            \n            {t.label}\n          \n        ))}\n      \n    \n  );\n}\n```\n\n### `src/components/layout/Shell.tsx`\n\n```tsx\nimport { Outlet } from 'react-router-dom';\nimport { Header } from './Header';\nimport { Sidebar } from './Sidebar';\nimport { MobileNav } from './MobileNav';\nimport { ToastContainer } from '@/components/ui/Toast';\nimport { useKeyboardShortcuts } from '@/hooks/useKeyboardShortcuts';\n\nexport function Shell() {\n  useKeyboardShortcuts();\n  return (\n    \n\n      \n      \n\n        \n\n        \n\n          \n        \n        \n      \n      \n    \n  );\n}\n```\n\n---\n\n## 7. Componentes Especializados\n\n### `src/components/verification/VerificationCard.tsx`\n\n```tsx\nimport { CheckCircle2, ChevronRight } from 'lucide-react';\nimport { Link } from 'react-router-dom';\nimport { Badge } from '@/components/ui/Badge';\nimport { Card } from '@/components/ui/Card';\nimport { Button } from '@/components/ui/Button';\nimport type { ModelRecord } from '@/lib/mock-data';\nimport { formatBytes, truncateHash } from '@/lib/utils';\n\nexport function VerificationCard({ model }: { model: ModelRecord }) {\n  return (\n    \n      \n\n        \n\n          \n\n            \n\n              {model.name}\n              \n            \n            \n\n              {formatBytes(model.size)} \u00b7 {model.license}\n            \n          \n          \n        \n\n        \n\n          \n\n            \nSHA-256\n            \n{truncateHash(model.hash, 12, 8)}\n          \n          \n\n            \nAssinatura\n            \nEd25519 \u00b7 Sigstore/Fulcio\n          \n          \n\n            \nCapabilities\n            \n{model.capabilities.join(' \u00b7 ')}\n          \n          \n\n            \nVerificado\n            \n{new Date(model.verifiedAt).toLocaleString('pt-BR')}\n          \n        \n      \n\n      \n\n        \n          \n            Ver detalhes \n          \n        \n        \n          \n            Verificar outro\n          \n        \n      \n    \n  );\n}\n```\n\n### `src/components/verification/GateStatusRow.tsx`\n\n```tsx\nimport { AlertCircle, CheckCircle2, Clock, Lock, XCircle } from 'lucide-react';\nimport { cn } from '@/lib/utils';\nimport type { ArkheStatus, GateResult } from '@/lib/mock-data';\n\nconst ICONS: Record = {\n  VERIFIED: CheckCircle2,\n  PARTIAL: AlertCircle,\n  FAILED: XCircle,\n  NONEXISTENT: AlertCircle,\n  PENDING: Clock,\n  BLOCKED: Lock,\n};\n\nconst TONES: Record = {\n  VERIFIED: 'text-arkhe-green',\n  PARTIAL: 'text-arkhe-yellow',\n  FAILED: 'text-arkhe-red',\n  NONEXISTENT: 'text-arkhe-muted',\n  PENDING: 'text-arkhe-blue',\n  BLOCKED: 'text-arkhe-purple',\n};\n\nexport function GateStatusRow({ gate }: { gate: GateResult }) {\n  const Icon = ICONS[gate.status];\n  return (\n    \n\n      Gate {gate.id}\n      \n        \n      \n      \n\n        \n{gate.name}\n        \n{gate.detail}\n      \n      \n        {gate.status}\n      \n    \n  );\n}\n```\n\n### `src/components/verification/InvariantTable.tsx`\n\n```tsx\nimport { Badge } from '@/components/ui/Badge';\nimport type { Invariant } from '@/lib/mock-data';\n\nexport function InvariantTable({ invariants }: { invariants: Invariant[] }) {\n  return (\n    \n\n      \n\n        \n          \n            ID\n            Enunciado\n            Categoria\n            Cr\u00edtico\n            Status\n          \n        \n        \n          {invariants.map((inv) => (\n            \n              {inv.id}\n              {inv.statement}\n              {inv.category}\n              \n                {inv.critical ? (\n                  cr\u00edtico\n                ) : (\n                  \u2014\n                )}\n              \n              \n                \n              \n            \n          ))}\n        \n      \n    \n  );\n}\n```\n\n### `src/components/wormgraph/WormGraphCanvas.tsx`\n\n```tsx\nimport { useEffect, useRef } from 'react';\nimport * as d3 from 'd3-force';\nimport { MOCK_WORM_EVENTS, type WormEvent } from '@/lib/mock-data';\n\ninterface Node extends d3.SimulationNodeDatum {\n  id: number;\n  label: string;\n  kind: WormEvent['kind'];\n}\ninterface Link extends d3.SimulationLinkDatum {\n  source: number | Node;\n  target: number | Node;\n}\n\nconst COLORS: Record = {\n  boot: '#6b8299',\n  sign: '#7ec8e3',\n  rekor: '#a855f7',\n  verify_ok: '#2ecc71',\n  verify_fail: '#e74c3c',\n  merge: '#f1c40f',\n};\n\nexport function WormGraphCanvas({ events = MOCK_WORM_EVENTS }: { events?: WormEvent[] }) {\n  const ref = useRef(null);\n\n  useEffect(() => {\n    if (!ref.current) return;\n    const svg = d3.select(ref.current);\n    svg.selectAll('*').remove();\n\n    const width = ref.current.clientWidth || 600;\n    const height = 320;\n\n    const nodes: Node[] = events.map((e) => ({\n      id: e.id,\n      label: e.summary,\n      kind: e.kind,\n    }));\n\n    // Cadeia linear: n_i -> n_{i+1}\n    const links: Link[] = events.slice(0, -1).map((e, i) => ({\n      source: e.id,\n      target: events[i + 1].id,\n    }));\n\n    const simulation = d3\n      .forceSimulation(nodes)\n      .force('link', d3.forceLink(links).id((d) => d.id).distance(90))\n      .force('charge', d3.forceManyBody().strength(-220))\n      .force('center', d3.forceCenter(width / 2, height / 2))\n      .force('collide', d3.forceCollide(28));\n\n    const linkSel = svg\n      .append('g')\n      .selectAll('line')\n      .data(links)\n      .join('line')\n      .attr('stroke', '#1a2a3a')\n      .attr('stroke-width', 1.5);\n\n    const nodeSel = svg\n      .append('g')\n      .selectAll('circle')\n      .data(nodes)\n      .join('circle')\n      .attr('r', 8)\n      .attr('fill', (d) => COLORS[d.kind])\n      .attr('stroke', '#0a0a1a')\n      .attr('stroke-width', 2)\n      .style('filter', 'drop-shadow(0 0 6px currentColor)');\n\n    const labelSel = svg\n      .append('g')\n      .selectAll('text')\n      .data(nodes)\n      .join('text')\n      .text((d) => d.label.slice(0, 24))\n      .attr('font-family', 'JetBrains Mono, monospace')\n      .attr('font-size', 9)\n      .attr('fill', '#6b8299')\n      .attr('text-anchor', 'middle')\n      .attr('dy', 22);\n\n    simulation.on('tick', () => {\n      linkSel\n        .attr('x1', (d) => (d.source as Node).x!)\n        .attr('y1', (d) => (d.source as Node).y!)\n        .attr('x2', (d) => (d.target as Node).x!)\n        .attr('y2', (d) => (d.target as Node).y!);\n      nodeSel.attr('cx', (d) => d.x!).attr('cy', (d) => d.y!);\n      labelSel.attr('x', (d) => d.x!).attr('y', (d) => d.y!);\n    });\n\n    return () => {\n      simulation.stop();\n    };\n  }, [events]);\n\n  return (\n    \n\n      \n    \n  );\n}\n```\n\n### `src/components/wormgraph/EventLog.tsx`\n\n```tsx\nimport { formatTimestamp, truncateHash } from '@/lib/utils';\nimport type { WormEvent } from '@/lib/mock-data';\nimport { cn } from '@/lib/utils';\n\nconst KIND_LABEL: Record = {\n  boot: 'BOOT',\n  sign: 'SIGN',\n  rekor: 'REKOR',\n  verify_ok: 'VERIFY_OK',\n  verify_fail: 'VERIFY_FAIL',\n  merge: 'MERGE',\n};\n\nconst KIND_TONE: Record = {\n  boot: 'text-arkhe-dim',\n  sign: 'text-arkhe-blue',\n  rekor: 'text-arkhe-purple',\n  verify_ok: 'text-arkhe-green',\n  verify_fail: 'text-arkhe-red',\n  merge: 'text-arkhe-yellow',\n};\n\nexport function EventLog({ events }: { events: WormEvent[] }) {\n  return (\n    \n\n      {events.map((e) => (\n        \n\n          {formatTimestamp(e.timestamp)}\n          \n            {KIND_LABEL[e.kind]}\n          \n          {e.summary}\n          {truncateHash(e.recordHash, 6, 6)}\n        \n      ))}\n    \n  );\n}\n```\n\n### `src/components/governance/HITLModal.tsx`\n\n```tsx\nimport { useState, useEffect } from 'react';\nimport { AlertTriangle, Clock } from 'lucide-react';\nimport { Dialog } from '@/components/ui/Dialog';\nimport { Button } from '@/components/ui/Button';\nimport { Progress } from '@/components/ui/Progress';\n\ninterface Props {\n  open: boolean;\n  onClose: () => void;\n  onDecision: (approved: boolean) => void;\n  action: string;\n  requester: string;\n  justification: string;\n  impact: string;\n  timeoutSeconds?: number;\n}\n\nexport function HITLModal({\n  open,\n  onClose,\n  onDecision,\n  action,\n  requester,\n  justification,\n  impact,\n  timeoutSeconds = 900,\n}: Props) {\n  const [remaining, setRemaining] = useState(timeoutSeconds);\n\n  useEffect(() => {\n    if (!open) return;\n    setRemaining(timeoutSeconds);\n    const id = setInterval(() => {\n      setRemaining((r) => {\n        if (r <= 1) {\n          clearInterval(id);\n          onDecision(false); // deny-on-timeout\n          return 0;\n        }\n        return r - 1;\n      });\n    }, 1000);\n    return () => clearInterval(id);\n  }, [open, timeoutSeconds, onDecision]);\n\n  const minutes = Math.floor(remaining / 60);\n  const seconds = remaining % 60;\n\n  return (\n    \n\n          \n          Decis\u00e3o cr\u00edtica\n        \n      }\n      footer={\n        \n\n          \n\n            \n            {minutes}:{seconds.toString().padStart(2, '0')} \u2014 timeout = nega\n          \n          \n\n            \n              Ver detalhes\n            \n             onDecision(false)}>\n              Rejeitar\n            \n             onDecision(true)}>\n              Aprovar\n            \n          \n        \n      }\n    >\n      \n\n        \n\n        \n\n          \n\n            \nA\u00e7\u00e3o\n            \n{action}\n          \n          \n\n            \nSolicitante\n            \n{requester}\n          \n        \n\n        \n\n          \nJustificativa\n          \n{justification}\n        \n\n        \n\n          \nImpacto\n          \n{impact}\n        \n\n        \n\n          Conforme INV-AI-08, a decis\u00e3o \u00e9\n          fail-closed: sem aprova\u00e7\u00e3o expl\u00edcita dentro do tempo, a a\u00e7\u00e3o \u00e9 rejeitada.\n        \n      \n    \n  );\n}\n```\n\n### `src/components/ai/InferencePanel.tsx`\n\n```tsx\nimport { useState } from 'react';\nimport { Play, Sparkles, Terminal } from 'lucide-react';\nimport { Button } from '@/components/ui/Button';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Field, Input, Select } from '@/components/ui/Field';\nimport { Badge } from '@/components/ui/Badge';\nimport { useApp } from '@/contexts/AppContext';\nimport { CAPABILITIES, PREFERENCES } from '@/lib/constants';\nimport { MOCK_MODELS } from '@/lib/mock-data';\n\ninterface Result {\n  output: string;\n  model_id: string;\n  input_tokens: number;\n  output_tokens: number;\n  cost: number;\n  record_hash: string;\n}\n\nexport function InferencePanel() {\n  const { pushToast } = useApp();\n  const [prompt, setPrompt] = useState('Explique o pipeline de 4 gates do Arkhe OS.');\n  const [system, setSystem] = useState('');\n  const [capability, setCapability] = useState<(typeof CAPABILITIES)[number]>('text_generation');\n  const [preference, setPreference] = useState<(typeof PREFERENCES)[number]>('balanced');\n  const [running, setRunning] = useState(false);\n  const [result, setResult] = useState(null);\n\n  const runInference = async () => {\n    if (!prompt.trim()) {\n      pushToast('error', 'Prompt vazio \u2014 fail-closed.');\n      return;\n    }\n    setRunning(true);\n    setResult(null);\n\n    // Simula\u00e7\u00e3o local (o backend real \u00e9 o `arkhe-ai` crate)\n    await new Promise((r) => setTimeout(r, 600));\n\n    const model = MOCK_MODELS.find((m) => m.status === 'VERIFIED');\n    if (!model) {\n      pushToast('error', 'Nenhum modelo VERIFIED dispon\u00edvel.');\n      setRunning(false);\n      return;\n    }\n\n    const output = `[echo:${model.id}] ${prompt.slice(0, 120)}\u2026`;\n    const result: Result = {\n      output,\n      model_id: model.id,\n      input_tokens: Math.ceil(prompt.length / 4),\n      output_tokens: Math.ceil(output.length / 4),\n      cost: 0.001,\n      record_hash: crypto.randomUUID().replace(/-/g, '') + crypto.randomUUID().replace(/-/g, ''),\n    };\n    setResult(result);\n    pushToast('success', `Infer\u00eancia conclu\u00edda \u00b7 ${model.id}`);\n    setRunning(false);\n  };\n\n  return (\n    \n\n      \n        }\n          subtitle=\"Fail-closed: prompt vazio \u00e9 rejeitado\"\n        />\n        \n          \n             setSystem(e.target.value)}\n              placeholder=\"You are Arkhe, a verification assistant.\"\n            />\n          \n          \n             setPrompt(e.target.value)}\n              rows={5}\n              className=\"w-full rounded-md border border-arkhe-border bg-arkhe-bg px-3 py-2 text-sm font-mono\n                         text-arkhe-fg focus:border-arkhe-blue focus:outline-none\"\n            />\n          \n\n          \n\n            \n               setCapability(e.target.value as any)}>\n                {CAPABILITIES.map((c) => (\n                  \n                    {c}\n                  \n                ))}\n              \n            \n            \n               setPreference(e.target.value as any)}>\n                {PREFERENCES.map((p) => (\n                  \n                    {p}\n                  \n                ))}\n              \n            \n          \n\n          \n            \n            {running ? 'Executando\u2026' : 'Inferir'}\n          \n        \n      \n\n      \n        }\n          subtitle={result ? `Modelo: ${result.model_id}` : 'Aguardando execu\u00e7\u00e3o'}\n          actions={result ?  : undefined}\n        />\n        \n          {!result ? (\n            \n\n              Nenhum resultado \u2014 execute uma infer\u00eancia.\n            \n          ) : (\n            \n\n              \n\n                {result.output}\n              \n              \n\n                \n\n                  \nTokens in\n                  \n{result.input_tokens}\n                \n                \n\n                  \nTokens out\n                  \n{result.output_tokens}\n                \n                \n\n                  \nCusto\n                  \n${result.cost.toFixed(6)}\n                \n                \n\n                  \nrecord_hash\n                  \n{result.record_hash}\n                \n              \n            \n          )}\n        \n      \n    \n  );\n}\n```\n\n### `src/components/policy/PolicyTable.tsx`\n\n```tsx\nimport { Badge } from '@/components/ui/Badge';\nimport { Progress } from '@/components/ui/Progress';\nimport type { Policy } from '@/lib/mock-data';\n\nexport function PolicyTable({ policies }: { policies: Policy[] }) {\n  return (\n    \n\n      \n\n        \n          \n            Pol\u00edtica\n            Fase\n            Welfare\n            Agency\n            Durability\n            Status\n          \n        \n        \n          {policies.map((p) => (\n            \n              {p.name}\n              {p.phase}\n              \n              \n              \n              \n                \n              \n            \n          ))}\n        \n      \n    \n  );\n}\n\nfunction ScoreCell({ value, highlight = false }: { value: number; highlight?: boolean }) {\n  return (\n    \n      \n\n        \n          {value.toFixed(1)}\n        \n        \n      \n    \n  );\n}\n```\n\n---\n\n## 8. Screens \u2014 Basic\n\n### `src/screens/Home.tsx`\n\n```tsx\nimport { Activity, FileSearch, Play, ShieldCheck, Sparkles } from 'lucide-react';\nimport { Link } from 'react-router-dom';\nimport { Button } from '@/components/ui/Button';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Badge } from '@/components/ui/Badge';\nimport { VerificationCard } from '@/components/verification/VerificationCard';\nimport { MOCK_MODELS, MOCK_VERIFICATIONS } from '@/lib/mock-data';\nimport { formatRelative } from '@/lib/utils';\n\nexport default function Home() {\n  const featured = MOCK_MODELS[0];\n  const recent = MOCK_VERIFICATIONS.slice(0, 4);\n  const models = MOCK_MODELS.slice(0, 4);\n\n  return (\n    \n\n      \n\n        \nIn\u00edcio\n        \n\n          Camada de verifica\u00e7\u00e3o universal para artefatos de IA.\n        \n      \n\n      {/* Verifica\u00e7\u00e3o r\u00e1pida */}\n      \n        }\n          subtitle=\"\u00daltimo artefato verificado\"\n        />\n        \n          \n        \n      \n\n      {/* Grid de duas colunas */}\n      \n\n        \n          }\n            actions={Ver todas}\n          />\n          \n            {recent.map((v) => (\n              \n\n                \n                \n                  {MOCK_MODELS.find((m) => m.id === v.modelId)?.name ?? v.modelId}\n                \n                \n                  {formatRelative(v.timestamp)}\n                \n              \n            ))}\n          \n        \n\n        \n          } />\n          \n            \n\n              \n\n                \nGates\n                \n4/4 OK\n              \n              \n\n                \nInvariantes\n                \n8/8 ativos\n              \n              \n\n                \n\u00daltima verifica\u00e7\u00e3o\n                \n2 min atr\u00e1s\n              \n              \n\n                \nWormGraph\n                \n1.247 eventos\n              \n            \n          \n        \n      \n\n      {/* Modelos recentes */}\n      \n\n        \n\n          \nModelos recentes\n          \n            Ver todos \u2192\n          \n        \n        \n\n          {models.map((m) => (\n            \n              \n                \n\n                  {m.name}\n                  \n                \n                \n\n                  {(m.size / 1e9).toFixed(2)} GB \u00b7 {m.license}\n                \n              \n            \n          ))}\n        \n      \n\n      {/* A\u00e7\u00f5es r\u00e1pidas */}\n      \n        \n        \n          \n            \n               Verificar novo\n            \n          \n          \n            \n               Explorar modelos\n            \n          \n          \n            \n               Dashboard Expert\n            \n          \n        \n      \n    \n  );\n}\n```\n\n### `src/screens/Models.tsx`\n\n```tsx\nimport { useState } from 'react';\nimport { Package } from 'lucide-react';\nimport { Tabs } from '@/components/ui/Tabs';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Badge } from '@/components/ui/Badge';\nimport { EmptyState } from '@/components/ui/EmptyState';\nimport { Button } from '@/components/ui/Button';\nimport { ModelGrid } from '@/components/models/ModelGrid';\nimport { MOCK_MODELS } from '@/lib/mock-data';\nimport { formatBytes } from '@/lib/utils';\nimport { Link } from 'react-router-dom';\n\ntype Filter = 'all' | 'verified' | 'failed';\n\nexport default function Models() {\n  const [filter, setFilter] = useState('all');\n\n  const filtered = MOCK_MODELS.filter((m) =>\n    filter === 'all' ? true : filter === 'verified' ? m.status === 'VERIFIED' : m.status !== 'VERIFIED',\n  );\n\n  return (\n    \n\n      \n\n        \n\n          \nModelos\n          \n\n            {MOCK_MODELS.length} artefatos registados\n          \n        \n         m.status === 'VERIFIED').length },\n            { value: 'failed', label: 'N\u00e3o verificados', count: MOCK_MODELS.filter((m) => m.status !== 'VERIFIED').length },\n          ]}\n        />\n      \n\n      {filtered.length === 0 ? (\n        \n          }\n            title=\"Nenhum modelo\"\n            description=\"N\u00e3o h\u00e1 modelos que satisfa\u00e7am o filtro selecionado.\"\n            action={Verificar novo}\n          />\n        \n      ) : (\n        \n      )}\n\n      \n        \n        \n          \n\n            \n\n              \nTotal\n              \n{MOCK_MODELS.length}\n            \n            \n\n              \nTamanho agregado\n              \n\n                {formatBytes(MOCK_MODELS.reduce((a, b) => a + b.size, 0))}\n              \n            \n            \n\n              \nVerificados\n              \n\n                {MOCK_MODELS.filter((m) => m.status === 'VERIFIED').length}\n              \n            \n            \n\n              \nFalhados\n              \n\n                {MOCK_MODELS.filter((m) => m.status === 'FAILED').length}\n              \n            \n          \n        \n      \n    \n  );\n}\n```\n\n### `src/components/models/ModelGrid.tsx`\n\n```tsx\nimport { CheckCircle2, ExternalLink } from 'lucide-react';\nimport { Link } from 'react-router-dom';\nimport { Badge } from '@/components/ui/Badge';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Button } from '@/components/ui/Button';\nimport type { ModelRecord } from '@/lib/mock-data';\nimport { formatBytes, formatRelative, truncateHash } from '@/lib/utils';\n\nexport function ModelGrid({ models }: { models: ModelRecord[] }) {\n  return (\n    \n\n      {models.map((m) => (\n        \n          }\n            actions={}\n          />\n          \n            \n\n              \nSHA-256\n              \n{truncateHash(m.hash, 16, 10)}\n            \n            \n\n              \nCapabilities\n              \n\n                {m.capabilities.map((c) => (\n                  \n                    {c}\n                  \n                ))}\n              \n            \n            \n\n              Verificado {formatRelative(m.verifiedAt)}\n            \n          \n          \n\n            \n              \n                 Inferir\n              \n            \n            \n              \n                Re-verificar\n              \n            \n          \n        \n      ))}\n    \n  );\n}\n```\n\n### `src/screens/Verify.tsx`\n\n```tsx\nimport { useState } from 'react';\nimport { CheckCircle2, FileUp, ShieldCheck } from 'lucide-react';\nimport { Button } from '@/components/ui/Button';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Field, Input, Select } from '@/components/ui/Field';\nimport { Badge } from '@/components/ui/Badge';\nimport { GateStatusRow } from '@/components/verification/GateStatusRow';\nimport { useApp } from '@/contexts/AppContext';\nimport { MOCK_GATES, MOCK_MODELS, type ArkheStatus, type GateResult } from '@/lib/mock-data';\n\nconst ANCHORS = [\n  { id: 'sigstore', label: 'Sigstore/Fulcio' },\n  { id: 'crovia', label: 'Crovia' },\n  { id: 'custom', label: 'Custom' },\n];\n\nexport default function Verify() {\n  const { pushToast } = useApp();\n  const [file, setFile] = useState(null);\n  const [manifest, setManifest] = useState('');\n  const [anchor, setAnchor] = useState('sigstore');\n  const [running, setRunning] = useState(false);\n  const [gates, setGates] = useState(null);\n  const [overall, setOverall] = useState(null);\n\n  const runVerify = async () => {\n    if (!file) {\n      pushToast('error', 'Selecione um ficheiro \u2014 fail-closed.');\n      return;\n    }\n    setRunning(true);\n    setGates(null);\n    setOverall(null);\n\n    await new Promise((r) => setTimeout(r, 900));\n\n    // Simula\u00e7\u00e3o: o modelo `arkhe-demo` \u00e9 o \u00fanico VERIFIED\n    const verified = file.name.includes('arkhe') || file.size < 2e9;\n    const result: GateResult[] = verified\n      ? MOCK_GATES\n      : MOCK_GATES.map((g, i) =>\n          i === 1 ? { ...g, status: 'FAILED', detail: 'Hash mismatch' } : g,\n        );\n\n    setGates(result);\n    setOverall(verified ? 'VERIFIED' : 'FAILED');\n    pushToast(verified ? 'success' : 'error', verified ? 'Verificado com sucesso' : 'Verifica\u00e7\u00e3o falhada');\n    setRunning(false);\n  };\n\n  const onFile = (f: FileList | null) => {\n    if (!f || f.length === 0) return;\n    setFile(f[0]);\n  };\n\n  return (\n    \n\n      \n\n        \nVerificar\n        \n\n          Pipeline de 4 gates fail-closed: sanitiza\u00e7\u00e3o \u2192 hash \u2192 assinatura \u2192 inclus\u00e3o.\n        \n      \n\n      \n        } />\n        \n          \n             onFile(e.target.files)}\n              className=\"w-full rounded-md border border-dashed border-arkhe-borderHi bg-arkhe-bg px-3 py-4 text-sm\n                         file:mr-3 file:rounded file:border-0 file:bg-arkhe-blue/15 file:px-3 file:py-1\n                         file:text-arkhe-blue hover:border-arkhe-blue/60 transition-colors\"\n            />\n          \n          {file && (\n            \n\n              {file.name} \u2014 {(file.size / 1e9).toFixed(2)} GB\n            \n          )}\n\n          \n             setManifest(e.target.value)}\n              placeholder=\"model.safetensors.index.json\"\n            />\n          \n\n          \n             setAnchor(e.target.value)}>\n              {ANCHORS.map((a) => (\n                \n                  {a.label}\n                \n              ))}\n            \n          \n\n          \n            \n            {running ? 'A verificar\u2026' : 'Verificar'}\n          \n        \n      \n\n      {gates && (\n        \n          }\n            actions={}\n          />\n          \n            \n\n              {gates.map((g) => (\n                \n              ))}\n            \n          \n        \n      )}\n\n      \n        \n        \n          \n\n            \n\nmax_string_len\n1 MB\n            \n\nmax_array\n1 M\n            \n\nmax_kv_pairs\n10 K\n            \n\nmax_alloc\n1 GB\n          \n        \n      \n    \n  );\n}\n```\n\n### `src/screens/Logs.tsx`\n\n```tsx\nimport { useState } from 'react';\nimport { ScrollText, Search } from 'lucide-react';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Badge } from '@/components/ui/Badge';\nimport { Input } from '@/components/ui/Field';\nimport { EmptyState } from '@/components/ui/EmptyState';\nimport { MOCK_MODELS, MOCK_VERIFICATIONS } from '@/lib/mock-data';\nimport { formatRelative, truncateHash } from '@/lib/utils';\n\nexport default function Logs() {\n  const [query, setQuery] = useState('');\n  const filtered = MOCK_VERIFICATIONS.filter((v) => {\n    if (!query) return true;\n    const model = MOCK_MODELS.find((m) => m.id === v.modelId);\n    const hay = `${v.id} ${v.modelId} ${model?.name ?? ''} ${v.recordHash}`.toLowerCase();\n    return hay.includes(query.toLowerCase());\n  });\n\n  return (\n    \n\n      \n\n        \nRegistros\n        \n\n          Hist\u00f3rico de verifica\u00e7\u00f5es ancorado no WormGraph.\n        \n      \n\n      \n        }\n          actions={{filtered.length} registos}\n        />\n        \n           setQuery(e.target.value)}\n          />\n        \n      \n\n      {filtered.length === 0 ? (\n        \n          }\n            title=\"Nenhum registo\"\n            description=\"N\u00e3o h\u00e1 verifica\u00e7\u00f5es que correspondam \u00e0 busca.\"\n          />\n        \n      ) : (\n        \n\n          {filtered.map((v) => {\n            const model = MOCK_MODELS.find((m) => m.id === v.modelId);\n            return (\n              \n                \n                  \n                  \n                    {model?.name ?? v.modelId}\n                  \n                  {truncateHash(v.recordHash, 8, 8)}\n                  \n                    {formatRelative(v.timestamp)}\n                  \n                \n              \n            );\n          })}\n        \n      )}\n    \n  );\n}\n```\n\n### `src/screens/Settings.tsx`\n\n```tsx\nimport { useState } from 'react';\nimport { Settings as SettingsIcon } from 'lucide-react';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Tabs } from '@/components/ui/Tabs';\nimport { AISettings } from './settings/AISettings';\nimport { TEESettings } from './settings/TEESettings';\nimport { SecuritySettings } from './settings/SecuritySettings';\nimport { AdvancedSettings } from './settings/AdvancedSettings';\nimport { useApp } from '@/contexts/AppContext';\nimport { Button } from '@/components/ui/Button';\n\ntype Tab = 'ai' | 'tee' | 'security' | 'advanced';\n\nexport default function Settings() {\n  const { mode, setMode } = useApp();\n  const [tab, setTab] = useState('ai');\n\n  return (\n    \n\n      \n\n        \n\n          \nConfigura\u00e7\u00f5es\n          \nAjustes de infer\u00eancia, atesta\u00e7\u00e3o e seguran\u00e7a.\n        \n         setMode(mode === 'expert' ? 'basic' : 'expert')}\n        >\n          \n          {mode === 'expert' ? 'Modo Expert ativo' : 'Ativar modo Expert'}\n        \n      \n\n      \n\n      {tab === 'ai' && }\n      {tab === 'tee' && }\n      {tab === 'security' && }\n      {tab === 'advanced' && mode === 'expert' && }\n    \n  );\n}\n```\n\n### `src/screens/settings/AISettings.tsx`\n\n```tsx\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Field, Input, Select } from '@/components/ui/Field';\nimport { useApp } from '@/contexts/AppContext';\n\nexport function AISettings() {\n  const { trustAnchor, setTrustAnchor, budget, setBudget } = useApp();\n\n  return (\n    \n\n      \n        \n        \n          \n             setTrustAnchor(e.target.value || null)}\n              placeholder=\"did:arkhe:...\"\n            />\n          \n\n          \n             setBudget(Number(e.target.value))}\n            />\n          \n\n          \n            \n              Menor custo\n              Menor lat\u00eancia\n              Equilibrado\n            \n          \n        \n      \n\n      \n        \n        \n          \n\n            \nINV-AI-08trust anchor obrigat\u00f3ria\n            \nINV-AI-09custo \u2264 or\u00e7amento\n            \nINV-AI-10modelo VERIFIED apenas\n            \nINV-AI-07record_hash em toda infer\u00eancia\n          \n        \n      \n    \n  );\n}\n```\n\n### `src/screens/settings/TEESettings.tsx`\n\n```tsx\nimport { Badge } from '@/components/ui/Badge';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Button } from '@/components/ui/Button';\n\nconst ROWS = [\n  { label: 'Intel TDX', value: 'dcap-qvl 0.5.2 (CVE-2026-22696 patched)', status: 'VERIFIED' as const },\n  { label: 'NVIDIA NRAS', value: 'H100 SXM \u00b7 EAT/JWT verificado', status: 'VERIFIED' as const },\n  { label: 'TPM 2.0', value: 'SLB9672 \u00b7 fw 17.25 \u00b7 PCRs 0/4/7/8', status: 'VERIFIED' as const },\n  { label: 'Intel Trust Authority', value: 'portal.trustauthority.intel.com', status: 'PENDING' as const },\n];\n\nexport function TEESettings() {\n  return (\n    \n      Re-atestar}\n      />\n      \n        {ROWS.map((r) => (\n          \n\n            \n\n              \n{r.label}\n              \n{r.value}\n            \n            \n          \n        ))}\n      \n    \n  );\n}\n```\n\n### `src/screens/settings/SecuritySettings.tsx`\n\n```tsx\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Field, Input, Select } from '@/components/ui/Field';\n\nexport function SecuritySettings() {\n  return (\n    \n      \n      \n        \n          \n        \n        \n          \n        \n        \n          \n        \n        \n          \n            burn-after-use\n            persistente\n          \n        \n      \n    \n  );\n}\n```\n\n### `src/screens/settings/AdvancedSettings.tsx`\n\n```tsx\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Button } from '@/components/ui/Button';\nimport { Badge } from '@/components/ui/Badge';\n\nexport function AdvancedSettings() {\n  return (\n    \n\n      \n        \n        \n          \n          \n          \n          \n        \n      \n\n      \n        \n        \n          \n\n            Apaga o audit trail local e reinicia o WormGraph. A inten\u00e7\u00e3o \u00e9 registada antes da execu\u00e7\u00e3o\n            (INV-SET-05).\n          \n          Reset de f\u00e1brica\n        \n      \n    \n  );\n}\n\nfunction FlagRow({ label, enabled }: { label: string; enabled: boolean }) {\n  return (\n    \n\n      {label}\n      \n    \n  );\n}\n```\n\n---\n\n## 9. Screens \u2014 Expert\n\n### `src/screens/expert/Dashboard.tsx`\n\n```tsx\nimport { Activity, Cpu, ListChecks, Network, Shield } from 'lucide-react';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Badge } from '@/components/ui/Badge';\nimport { Progress } from '@/components/ui/Progress';\nimport { GateStatusRow } from '@/components/verification/GateStatusRow';\nimport { EventLog } from '@/components/wormgraph/EventLog';\nimport { MOCK_GATES, MOCK_INVARIANTS, MOCK_WORM_EVENTS } from '@/lib/mock-data';\n\nexport default function Dashboard() {\n  const verified = MOCK_INVARIANTS.filter((i) => i.status === 'VERIFIED').length;\n\n  return (\n    \n\n      \n\n        \nDashboard Expert\n        \nEstado do pipeline, WormGraph e invariantes.\n      \n\n      {/* KPIs */}\n      \n\n        } tone=\"green\" />\n        } tone=\"green\" />\n        } tone=\"blue\" />\n        } tone=\"blue\" />\n      \n\n      \n\n        \n          } />\n          \n            {MOCK_GATES.map((g) => )}\n          \n        \n\n        \n          } />\n          \n            \n          \n        \n      \n\n      \n        \n        \n          \n          \n          \n        \n      \n    \n  );\n}\n\nfunction KpiCard({ title, value, hint, icon, tone }: { title: string; value: string; hint: string; icon: React.ReactNode; tone: 'green' | 'blue' }) {\n  return (\n    \n      \n        \n\n          {title}\n          {icon}\n        \n        \n{value}\n        \n{hint}\n      \n    \n  );\n}\n\nfunction HealthRow({ label, value }: { label: string; value: number }) {\n  return (\n    \n\n      \n\n        {label}\n        {value}%\n      \n      \n    \n  );\n}\n```\n\n### `src/screens/expert/Gates.tsx`\n\n```tsx\nimport { ListChecks } from 'lucide-react';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Badge } from '@/components/ui/Badge';\nimport { GateStatusRow } from '@/components/verification/GateStatusRow';\nimport { MOCK_GATES } from '@/lib/mock-data';\n\nconst LIMITS = [\n  { key: 'max_string_len', val: '1 MB' },\n  { key: 'max_array_elements', val: '1 M' },\n  { key: 'max_kv_pairs', val: '10 K' },\n  { key: 'max_tensor_dims', val: '8' },\n  { key: 'max_total_alloc', val: '1 GB' },\n];\n\nconst CVES = [\n  'CVE-2026-65315',\n  'CVE-2025-53630',\n  'CVE-2026-5757',\n  'CVE-2026-86289',\n  'CVE-2026-7482',\n  'CVE-2026-53923',\n];\n\nexport default function Gates() {\n  return (\n    \n\n      \n\n        \nGates\n        \nDetalhe de cada gate: limites, CVEs, assinatura, prova.\n      \n\n      \n        } actions={} />\n        \n          {MOCK_GATES.map((g) => )}\n        \n      \n\n      \n\n        \n          \n          \n            \n\n              {LIMITS.map((l) => (\n                \n\n                  \n{l.key}\n                  \n{l.val}\n                \n              ))}\n            \n          \n        \n\n        \n          \n          \n            \n\n              {CVES.map((c) => (\n                \n                  {c}\n                \n              ))}\n            \n          \n        \n\n        \n          \n          \n            \n\n              \n\nAlgoritmo\nEd25519\n              \n\nTrust root\nSigstore/Fulcio\n              \n\nIdentity\ngithub.com/rafael-arkhe\n            \n          \n        \n\n        \n          \n          \n            \n\n              \n\nlog_index\n123456\n              \n\ntree_size\n9.847.221\n              \n\nquorum\n2/2\n            \n          \n        \n      \n    \n  );\n}\n```\n\n### `src/screens/expert/WormGraph.tsx`\n\n```tsx\nimport { Network } from 'lucide-react';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { WormGraphCanvas } from '@/components/wormgraph/WormGraphCanvas';\nimport { EventLog } from '@/components/wormgraph/EventLog';\nimport { MOCK_WORM_EVENTS } from '@/lib/mock-data';\n\nexport default function WormGraph() {\n  return (\n    \n\n      \n\n        \nWormGraph\n        \nGrafo causal append-only com MMR.\n      \n\n      \n\n        \n        \n        \n        \n      \n\n      \n        } subtitle=\"Visualiza\u00e7\u00e3o force-directed\" />\n        \n          \n        \n      \n\n      \n        \n        \n          \n        \n      \n    \n  );\n}\n\nfunction Stat({ label, value }: { label: string; value: string }) {\n  return (\n    \n      \n        \n{label}\n        \n{value}\n      \n    \n  );\n}\n```\n\n### `src/screens/expert/AI.tsx`\n\n```tsx\nimport { Brain } from 'lucide-react';\nimport { Card, CardHeader } from '@/components/ui/Card';\nimport { InferencePanel } from '@/components/ai/InferencePanel';\nimport { useApp } from '@/contexts/AppContext';\n\nexport default function AI() {\n  const { trustAnchor, budget } = useApp();\n\n  return (\n    \n\n      \n\n        \n\n          \nInfer\u00eancia\n          \nOrquestrador fail-closed com roteamento verificado.\n        \n        \n\n          anchor: {trustAnchor ?? '\u2014'}\n          budget: ${budget.toFixed(2)}\n        \n      \n\n      \n\n      \n        } subtitle=\"Fail-closed em 4 pontos\" />\n        \n\n          \n1.Trust anchor verificada (INV-AI-08)\n          \n2.Roteamento para modelo VERIFIED (INV-AI-10)\n          \n3.Custo \u2264 or\u00e7amento (INV-AI-09)\n          \n4.Infer\u00eancia \u2192 record_hash (INV-AI-07)\n        \n      \n    \n  );\n}\n```\n\n### `src/screens/expert/Routing.tsx`\n\n```tsx\nimport { GitBranch } from 'lucide-react';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Badge } from '@/components/ui/Badge';\nimport { MOCK_MODELS } from '@/lib/mock-data';\n\nexport default function Routing() {\n  return (\n    \n\n      \n\n        \nRoteamento\n        \nModelos registados e suas capabilities.\n      \n\n      \n        } />\n        \n          \n\n            \n              \n                ID\n                Modelo\n                Capabilities\n                Custo/1k\n                Status\n              \n            \n            \n              {MOCK_MODELS.map((m) => (\n                \n                  {m.id}\n                  {m.name}\n                  \n                    \n\n                      {m.capabilities.map((c) => (\n                        \n                          {c}\n                        \n                      ))}\n                    \n                  \n                  $0.001\n                  \n                \n              ))}\n            \n          \n        \n      \n    \n  );\n}\n```\n\n### `src/screens/expert/Context.tsx`\n\n```tsx\nimport { FileSearch } from 'lucide-react';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { MOCK_WORM_EVENTS } from '@/lib/mock-data';\n\nconst SEGMENTS = [\n  { role: 'system', content: 'You are Arkhe, a verification assistant.', provenance: 'did:arkhe:sys' },\n  { role: 'user', content: 'Explique o pipeline de 4 gates.', provenance: 'did:arkhe:user' },\n  { role: 'assistant', content: 'O pipeline aplica sanitiza\u00e7\u00e3o \u2192 hash \u2192 assinatura \u2192 inclus\u00e3o.', provenance: 'did:arkhe:agent' },\n];\n\nexport default function Context() {\n  return (\n    \n\n      \n\n        \nContexto\n        \nSegmentos, tokens e record_hash.\n      \n\n      \n        } />\n        \n          {SEGMENTS.map((s, i) => (\n            \n\n              \n\n                {s.role}\n                {s.provenance}\n              \n              \n{s.content}\n            \n          ))}\n        \n      \n\n      \n        \n        \n          \n\n            {MOCK_WORM_EVENTS.slice(-4).map((e) => (\n              \n\n                {e.summary}\n                ~{Math.floor(Math.random() * 200 + 50)} tokens\n              \n            ))}\n          \n        \n      \n    \n  );\n}\n```\n\n### `src/screens/expert/Builder.tsx`\n\n```tsx\nimport { Wrench } from 'lucide-react';\nimport { Button } from '@/components/ui/Button';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\n\nexport default function Builder() {\n  return (\n    \n\n      \n\n        \nBuilder\n        \n\n          Verifica\u00e7\u00e3o recursiva: prop\u00f5e novos instrumentos e testa contra corpus.\n        \n      \n\n      \n        \n        \n          \n\n            \nArtefatos\n            \n1.247\n          \n          \n\n            \nFalhas\n            \n23\n          \n          \n\n            \nDetectores\n            \n4\n          \n        \n      \n\n      \n        } />\n        \n          \n\n            \nschema:\n            \ned25519+ml_dsa_65:hybrid-verify\n            \nconfidence:\n            \n0.94\n            \nsample_errors:\n            \n17 (hash mismatch em payloads aninhados)\n          \n\n          \n\n            Testar\n            Registar\n            Rejeitar\n          \n        \n      \n    \n  );\n}\n```\n\n### `src/screens/expert/Policy.tsx`\n\n```tsx\nimport { TrendingUp } from 'lucide-react';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { PolicyTable } from '@/components/policy/PolicyTable';\nimport { Badge } from '@/components/ui/Badge';\nimport { MOCK_POLICIES } from '@/lib/mock-data';\n\nexport default function Policy() {\n  return (\n    \n\n      \n\n        \nPol\u00edticas\n        \n\n          Governan\u00e7a de pol\u00edticas econ\u00f3micas AGI (Jacobs & Imas, 2026).\n        \n      \n\n      \n        } />\n        \n          \n\n            \nCen\u00e1rio\n            \nMild Disruption\n          \n          \n\n            \nFase\n            \n          \n          \n\n            \nTrigger\n            \nwage_polarization 0.10 < 0.30\n          \n        \n      \n\n      \n        \n        \n          \n        \n      \n    \n  );\n}\n```\n\n### `src/screens/expert/Agentic.tsx`\n\n```tsx\nimport { Target } from 'lucide-react';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Progress } from '@/components/ui/Progress';\n\nconst DIMS = [\n  { name: 'Percep\u00e7\u00e3o', value: 88 },\n  { name: 'Racioc\u00ednio', value: 82 },\n  { name: 'Metacogni\u00e7\u00e3o', value: 75 },\n  { name: 'Execu\u00e7\u00e3o', value: 71 },\n  { name: 'Cogni\u00e7\u00e3o social', value: 62 },\n];\n\nexport default function Agentic() {\n  return (\n    \n\n      \n\n        \nAvalia\u00e7\u00e3o\n        \n\n          Dimens\u00f5es cognitivas (DeepMind Levels of AGI, arXiv:2311.02462).\n        \n      \n\n      \n        } />\n        \n          {DIMS.map((d) => (\n            \n\n              \n\n                {d.name}\n                {d.value}\n              \n              \n            \n          ))}\n        \n      \n\n      \n        \n        \n          \n\n            \n\n              \nClean\n              \n82.4%\n            \n            \n\n              \nAdversarial\n              \n58.1%\n            \n          \n          \n\n            gap = -24.3pp \u2014 alinhado a benchmarks da literatura\n          \n        \n      \n    \n  );\n}\n```\n\n### `src/screens/expert/Invariants.tsx`\n\n```tsx\nimport { Layers } from 'lucide-react';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { InvariantTable } from '@/components/verification/InvariantTable';\nimport { MOCK_INVARIANTS } from '@/lib/mock-data';\n\nexport default function Invariants() {\n  const critical = MOCK_INVARIANTS.filter((i) => i.critical).length;\n\n  return (\n    \n\n      \n\n        \nInvariantes\n        \n\n          {MOCK_INVARIANTS.length} invariantes \u00b7 {critical} cr\u00edticos\n        \n      \n\n      \n        } subtitle=\"Qu\u00f3rum 4/7 (padr\u00e3o) \u00b7 5/7 (cr\u00edtico) \u00b7 timelock 7/14 dias\" />\n        \n          \n        \n      \n    \n  );\n}\n```\n\n### `src/screens/expert/Governance.tsx`\n\n```tsx\nimport { useState } from 'react';\nimport { Cpu } from 'lucide-react';\nimport { Button } from '@/components/ui/Button';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { HITLModal } from '@/components/governance/HITLModal';\n\nexport default function Governance() {\n  const [hitlOpen, setHitlOpen] = useState(false);\n\n  return (\n    \n\n      \n\n        \nGovernan\u00e7a\n        \nHITL, qu\u00f3rum e timelock.\n      \n\n      \n        } />\n        \n          \n\n            \nQu\u00f3rum padr\u00e3o\n            \n4/7\n          \n          \n\n            \nQu\u00f3rum cr\u00edtico\n            \n5/7\n          \n          \n\n            \nTimelock\n            \n7 dias\n          \n          \n\n            \nTimelock cr\u00edtico\n            \n14 dias\n          \n        \n      \n\n      \n        \n        \n          \n\n            Simula uma decis\u00e3o cr\u00edtica. Se o tempo expira sem aprova\u00e7\u00e3o expl\u00edcita, a a\u00e7\u00e3o \u00e9 rejeitada.\n          \n           setHitlOpen(true)}>\n            Acionar HITL\n          \n        \n      \n\n       setHitlOpen(false)}\n        onDecision={(approved) => {\n          setHitlOpen(false);\n          console.log('HITL decision:', approved ? 'APPROVED' : 'REJECTED (deny-on-timeout)');\n        }}\n        action=\"kill-switch \u2014 pausar trading\"\n        requester=\"risk-system\"\n        justification=\"GPR > 150 \u00b7 exposi\u00e7\u00e3o 68%\"\n        impact=\"12 posi\u00e7\u00f5es abertas\"\n        timeoutSeconds={15}\n      />\n    \n  );\n}\n```\n\n### `src/screens/expert/Design.tsx`\n\n```tsx\nimport { Sparkles } from 'lucide-react';\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Badge } from '@/components/ui/Badge';\n\nexport default function Design() {\n  return (\n    \n\n      \n\n        \nDesign\n        \nSistema de design e tokens do Arkhe OS.\n      \n\n      \n        } />\n        \n          \n\n            {[\n              { name: 'bg', hex: '#0a0a1a' },\n              { name: 'surface', hex: '#0d1b2a' },\n              { name: 'border', hex: '#1a2a3a' },\n              { name: 'blue', hex: '#7ec8e3' },\n              { name: 'green', hex: '#2ecc71' },\n              { name: 'yellow', hex: '#f1c40f' },\n              { name: 'red', hex: '#e74c3c' },\n              { name: 'purple', hex: '#a855f7' },\n            ].map((c) => (\n              \n\n                \n\n                \n{c.name}\n                \n{c.hex}\n              \n            ))}\n          \n        \n      \n\n      \n        \n        \n          \n\n            \n            \n            \n            \n            \n            \n          \n        \n      \n\n      \n        \n        \n          \nSans \u00b7 24px\n          \nSans \u00b7 16px\n          \nmono \u00b7 14px\n          \nlabel-section\n        \n      \n    \n  );\n}\n```\n\n### `src/screens/expert/MobileExpert.tsx`\n\n```tsx\nimport { Card, CardBody, CardHeader } from '@/components/ui/Card';\nimport { Badge } from '@/components/ui/Badge';\nimport { GateStatusRow } from '@/components/verification/GateStatusRow';\nimport { EventLog } from '@/components/wormgraph/EventLog';\nimport { MOCK_GATES, MOCK_WORM_EVENTS } from '@/lib/mock-data';\n\nexport default function MobileExpert() {\n  return (\n    \n\n      \nExpert (mobile)\n\n      \n        } />\n        \n          {MOCK_GATES.map((g) => )}\n        \n      \n\n      \n        \n        \n          \n        \n      \n    \n  );\n}\n```\n\n---\n\n## 10. Router \u2014 `src/App.tsx`\n\n```tsx\nimport { BrowserRouter, Navigate, Route, Routes } from 'react-router-dom';\nimport { AppProvider } from '@/contexts/AppContext';\nimport { Shell } from '@/components/layout/Shell';\n\nimport Home from '@/screens/Home';\nimport Models from '@/screens/Models';\nimport Verify from '@/screens/Verify';\nimport Logs from '@/screens/Logs';\nimport Settings from '@/screens/Settings';\n\nimport Dashboard from '@/screens/expert/Dashboard';\nimport Gates from '@/screens/expert/Gates';\nimport WormGraphPage from '@/screens/expert/WormGraph';\nimport AI from '@/screens/expert/AI';\nimport Routing from '@/screens/expert/Routing';\nimport ContextPage from '@/screens/expert/Context';\nimport Builder from '@/screens/expert/Builder';\nimport Policy from '@/screens/expert/Policy';\nimport Agentic from '@/screens/expert/Agentic';\nimport Invariants from '@/screens/expert/Invariants';\nimport Governance from '@/screens/expert/Governance';\nimport Design from '@/screens/expert/Design';\nimport MobileExpert from '@/screens/expert/MobileExpert';\n\nexport function App() {\n  return (\n    \n      \n        \n          }>\n            } />\n            } />\n            } />\n            } />\n            } />\n\n            } />\n            } />\n            } />\n            } />\n            } />\n            } />\n            } />\n            } />\n            } />\n            } />\n            } />\n            } />\n            } />\n\n            } />\n          \n        \n      \n    \n  );\n}\n```\n\n### `src/main.tsx`\n\n```tsx\nimport { StrictMode } from 'react';\nimport { createRoot } from 'react-dom/client';\nimport { App } from './App';\nimport './styles/globals.css';\n\nconst el = document.getElementById('root');\nif (!el) throw new Error('#root n\u00e3o encontrado');\n\ncreateRoot(el).render(\n  \n    \n  ,\n);\n```\n\n---\n\n## 11. `README.md`\n\n````markdown\n# arkhe-ai-ui\n\nFrontend do n\u00facleo de IA verific\u00e1vel do **Arkhe OS**. Interface forense de verifica\u00e7\u00e3o, com dois modos (Basic e Expert) e 18 telas.\n\n## Design\n\n- **Aesthetic:** forensic ledger \u2014 dark neon, densidade monoespa\u00e7ada\n- **Paleta:** `#0a0a1a` fundo, `#7ec8e3` acento, sem\u00e2ntica verde/amarelo/vermelho/roxo\n- **Tipografia:** Inter (UI) + JetBrains Mono (dados/hashes)\n- **Status honesto:** \u2705 \u26a0\ufe0f \u274c \u2b1c \u23f3 \ud83d\udd12 em todas as superf\u00edcies\n\n## Telas\n\n**Basic (5):** Home, Models, Verify, Logs, Settings.\n**Expert (12):** Dashboard, Gates, WormGraph, AI, Routing, Context, Builder, Policy, Agentic, Invariants, Governance, Design.\n\n## Stack\n\n- React 19 + TypeScript 5.6 + Vite 6\n- Tailwind CSS 3.4 (tokens customizados)\n- react-router-dom 7\n- d3-force (WormGraph) + recharts\n- lucide-react (\u00edcones)\n- zustand (opcional, para estado futuro)\n\n## Acessibilidade (QG-A11Y-*)\n\n- Contraste \u2265 4.5:1 em todos os pares texto/fundo\n- Foco vis\u00edvel em todos os elementos interativos\n- `prefers-reduced-motion` respeitado\n- Navega\u00e7\u00e3o completa por teclado\n- ARIA roles em tabelas, tabs, dialogs e progress\n\n## Comandos\n\n```bash\nnpm install\nnpm run dev          # servidor de desenvolvimento\nnpm run build        # build de produ\u00e7\u00e3o\nnpm run typecheck    # verifica\u00e7\u00e3o de tipos\nnpm run lint         # lint com warnings como erros\nnpm run test         # vitest\n```\n\n## Atalhos de teclado\n\n- `Ctrl/Cmd+K` \u2014 focar busca global\n- `Ctrl/Cmd+Shift+V` \u2014 ir para Verificar\n- `Esc` \u2014 fechar di\u00e1logos / remover foco\n\n## Modos\n\nO modo Expert ativa 13 telas adicionais (Dashboard, Gates, WormGraph, AI, Routing, Context, Builder, Policy, Agentic, Invariants, Governance, Design, MobileExpert). Alterna em **Configura\u00e7\u00f5es \u2192 Modo Expert**.\n\n## Invariantes visuais\n\n- `INV-AI-08` \u2014 trust anchor: campo vis\u00edvel em Configura\u00e7\u00f5es \u2192 IA\n- `INV-AI-09` \u2014 or\u00e7amento: campo num\u00e9rico em Configura\u00e7\u00f5es \u2192 IA\n- `INV-TEE-01` \u2014 atesta\u00e7\u00e3o TEE: badge re-verific\u00e1vel, sem toggle\n- `INV-SET-03` \u2014 modo Expert filtra telas; basic n\u00e3o acede a expert\n\n## Licen\u00e7a\n\nMIT OR Apache-2.0.\n````\n\n---\n\n## 12. Selo\n\n```\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502  ARKHE-AI \u2014 FRONTEND \u00b7 DESIGN \u00b7 UI/UX                              \u2502\n\u2502                                                                     \u2502\n\u2502  \u2705 TELAS (18):                                                      \u2502\n\u2502     \u00b7 Basic (5): Home \u00b7 Models \u00b7 Verify \u00b7 Logs \u00b7 Settings          \u2502\n\u2502     \u00b7 Expert (12): Dashboard \u00b7 Gates \u00b7 WormGraph \u00b7 AI \u00b7 Routing    \u2502\n\u2502       \u00b7 Context \u00b7 Builder \u00b7 Policy \u00b7 Agentic \u00b7 Invariants          \u2502\n\u2502       \u00b7 Governance \u00b7 Design \u00b7 MobileExpert                         \u2502\n\u2502                                                                     \u2502\n\u2502  \u2705 DESIGN SYSTEM:                                                   \u2502\n\u2502     \u00b7 Paleta #0a0a1a / #7ec8e3 / sem\u00e2ntica honesta                 \u2502\n\u2502     \u00b7 Tipografia Inter + JetBrains Mono                            \u2502\n\u2502     \u00b7 Status: \u2705 \u26a0\ufe0f \u274c \u2b1c \u23f3 \ud83d\udd12 em toda a UI                          \u2502\n\u2502     \u00b7 Tema forense denso, monospace-first                          \u2502\n\u2502                                                                     \u2502\n\u2502  \u2705 UI PRIMITIVES (10):                                              \u2502\n\u2502     \u00b7 Button \u00b7 Card \u00b7 Badge \u00b7 Progress \u00b7 Tabs \u00b7 Dialog              \u2502\n\u2502     \u00b7 Toast \u00b7 Skeleton \u00b7 EmptyState \u00b7 Field                         \u2502\n\u2502                                                                     \u2502\n\u2502  \u2705 LAYOUT:                                                          \u2502\n\u2502     \u00b7 Sidebar desktop (240px) \u00b7 Header sticky                      \u2502\n\u2502     \u00b7 Bottom nav mobile \u00b7 safe-area insets                         \u2502\n\u2502                                                                     \u2502\n\u2502  \u2705 COMPONENTES ESPECIALIZADOS:                                      \u2502\n\u2502     \u00b7 VerificationCard \u00b7 GateStatusRow \u00b7 InvariantTable            \u2502\n\u2502     \u00b7 WormGraphCanvas (d3-force) \u00b7 EventLog                        \u2502\n\u2502     \u00b7 HITLModal (deny-on-timeout) \u00b7 InferencePanel                 \u2502\n\u2502     \u00b7 PolicyTable \u00b7 ModelGrid                                       \u2502\n\u2502                                                                     \u2502\n\u2502  \u2705 ACESSIBILIDADE (QG-A11Y-*):                                      \u2502\n\u2502     \u00b7 Contraste \u2265 4.5:1 \u00b7 foco vis\u00edvel \u00b7 ARIA roles                \u2502\n\u2502     \u00b7 prefers-reduced-motion respeitado                            \u2502\n\u2502     \u00b7 Navega\u00e7\u00e3o por teclado completa                               \u2502\n\u2502                                                                     \u2502\n\u2502  \u2705 ATALHOS:                                                          \u2502\n\u2502     \u00b7 Ctrl+K (busca) \u00b7 Ctrl+Shift+V (verificar) \u00b7 Esc              \u2502\n\u2502                                                                     \u2502\n\u2502  \ud83d\udcc1 FICHEIROS: 50+                                                   \u2502\n\u2502                                                                     \u2502\n\u2502  \ud83d\udccb COMANDO:                                                         \u2502\n\u2502     npm install && npm run dev                                     \u2502\n\u2502     npm run build && npm run typecheck                             \u2502\n\u2502                                                                     \u2502\n\u2502  Selo: ARKHE-AI-UI-2026-09-26                                      \u2502\n\u2502  Status: \u2705 ESPECIFICADO \u2014 PRONTO PARA `npm run build`              \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n**Nota de honestidade:** como no backend, este frontend segue a disciplina do corpus \u2014 `npm run typecheck` e `npm run build` s\u00e3o as evid\u00eancias. O backend real (`arkhe-ai` crate) substitui os mocks em `src/lib/mock-data.ts`; a superf\u00edcie p\u00fablica de tipos (`ModelRecord`, `GateResult`, `WormEvent`, `Invariant`, `Policy`, `ArkheStatus`) \u00e9 o contrato entre UI e API. Se a UI quiser consumir o servidor MCP (`arkhe-ai-mcp`), basta trocar a camada `src/lib/api.ts` para um cliente JSON-RPC \u2014 o resto do c\u00f3digo n\u00e3o muda.", "creation_timestamp": "2026-09-26T03:38:46.000000Z"}, {"uuid": "7c24d2d6-a97e-4d4f-aac2-9c9552d2792d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-7482", "type": "seen", "source": "https://gist.github.com/rafael-arkhe/82faf9714c89f3fea0f0fc7f08a665d6", "content": "# arkhe-ai-verify \u2014 Reposit\u00f3rio Completo (Vers\u00e3o Consolidada)\n\nEste documento consolida o reposit\u00f3rio `arkhe-ai-verify` com a vers\u00e3o mais recente das depend\u00eancias, corre\u00e7\u00f5es de seguran\u00e7a contra vulnerabilidades conhecidas (CVE-2026-65920, CVE-2026-7482, PR #3364), integra\u00e7\u00e3o Sigstore real e disciplina fail-closed.\n\n---\n\n## 1. Vis\u00e3o Geral\n\nO `arkhe-ai-verify` \u00e9 o crate de verifica\u00e7\u00e3o de artefatos de IA do Arkhe OS. Implementa um pipeline de 4 gates fail-closed para formatos safetensors, GGUF, ONNX, TensorRT, TFLite, CoreML e PyTorch, com valida\u00e7\u00f5es de seguran\u00e7a espec\u00edficas e integra\u00e7\u00e3o Sigstore (bundles v0.3).\n\n### Corre\u00e7\u00f5es de Seguran\u00e7a\n\n| Vulnerabilidade | Descri\u00e7\u00e3o | Corre\u00e7\u00e3o |\n|:---|:---|:---|\n| CVE-2026-65920 | Path traversal em `weight_map` | Sanitiza\u00e7\u00e3o de paths com canonicaliza\u00e7\u00e3o |\n| PR #3364 | `data_offsets` inconsistentes | Valida\u00e7\u00e3o de count, ordem e consist\u00eancia com shape/dtype |\n| CVE-2026-7482 | GGUF OOB read (Bleeding Llama) | Valida\u00e7\u00e3o de alignment, n_dims, gguf_type, blck_size |\n\n---\n\n## 2. Estrutura do Reposit\u00f3rio\n\n```\narkhe-ai-verify/\n\u251c\u2500\u2500 Cargo.toml\n\u251c\u2500\u2500 rust-toolchain.toml\n\u251c\u2500\u2500 deny.toml\n\u251c\u2500\u2500 README.md\n\u251c\u2500\u2500 .github/\n\u2502   \u2514\u2500\u2500 workflows/\n\u2502       \u2514\u2500\u2500 ci.yml\n\u251c\u2500\u2500 src/\n\u2502   \u251c\u2500\u2500 lib.rs\n\u2502   \u251c\u2500\u2500 error.rs\n\u2502   \u251c\u2500\u2500 gates.rs\n\u2502   \u251c\u2500\u2500 formats.rs\n\u2502   \u2514\u2500\u2500 security.rs\n\u2514\u2500\u2500 tests/\n    \u251c\u2500\u2500 safetensors_tests.rs\n    \u251c\u2500\u2500 gguf_tests.rs\n    \u2514\u2500\u2500 security_tests.rs\n```\n\n---\n\n## 3. Configura\u00e7\u00e3o\n\n### `Cargo.toml`\n\n```toml\n[package]\nname = \"arkhe-ai-verify\"\nversion = \"0.1.0\"\nedition = \"2021\"\nrust-version = \"1.82\"\nauthors = [\"Arkhe Contributors \"]\nlicense = \"MIT OR Apache-2.0\"\nrepository = \"https://gist.github.com/rafael-arkhe\"\ndescription = \"Verifica\u00e7\u00e3o de artefatos de IA (safetensors, GGUF, ONNX, ...)\"\n\n[dependencies]\n# Core\nserde = { version = \"1.0.229\", features = [\"derive\"] }\nserde_json = \"1.0.151\"\nthiserror = \"2.0.21\"\ntracing = \"0.1.44\"\n\n# Hashing\nblake3 = \"1.8.6\"\nhex = \"0.4\"\nsha2 = \"0.10.9\"\n\n# Async\ntokio = { version = \"1.52.3\", features = [\"macros\", \"rt-multi-thread\", \"fs\", \"io-util\"] }\nasync-trait = \"0.1\"\n\n# Sigstore\nsigstore-verify = \"0.11.0\"\nsigstore-trust-root = \"0.11.0\"\nsigstore-types = \"0.11.0\"\n\n# Utilit\u00e1rios\ndirs = \"6.0\"\n\n[dev-dependencies]\ntempfile = \"3.24\"\nproptest = \"1.5\"\ntokio-test = \"0.4\"\n\n[lints.rust]\nunsafe_code = \"forbid\"\nmissing_docs = \"warn\"\n\n[lints.clippy]\nall = \"warn\"\npedantic = \"warn\"\nunwrap_used = \"deny\"\nexpect_used = \"warn\"\npanic = \"deny\"\ntodo = \"deny\"\nunimplemented = \"deny\"\n```\n\n### `rust-toolchain.toml`\n\n```toml\n[toolchain]\nchannel = \"1.82.0\"\ncomponents = [\"rustfmt\", \"clippy\", \"rust-src\"]\nprofile = \"minimal\"\n```\n\n### `deny.toml`\n\n```toml\n[advisories]\nvulnerability = \"deny\"\nunmaintained = \"warn\"\nyanked = \"deny\"\n\n[licenses]\nallow = [\"MIT\", \"Apache-2.0\", \"BSD-3-Clause\", \"BSD-2-Clause\", \"ISC\", \"Unicode-DFS-2016\"]\ncopyleft = \"deny\"\nconfidence-threshold = 0.9\n\n[bans]\nmultiple-versions = \"warn\"\nwildcards = \"deny\"\ndeny = [\n    { name = \"openssl\" },\n    { name = \"openssl-sys\" },\n]\n\n[sources]\nunknown-registry = \"deny\"\nunknown-git = \"deny\"\nallow-registry = [\"https://github.com/rust-lang/crates.io-index\"]\n```\n\n---\n\n## 4. C\u00f3digo Fonte\n\n### `src/error.rs`\n\n```rust\n//! # error \u2014 Tipos de erro fail-closed.\n\nuse thiserror::Error;\n\n/// Erro de verifica\u00e7\u00e3o.\n#[derive(Debug, Error)]\npub enum VerifyError {\n    /// Formato n\u00e3o suportado.\n    #[error(\"formato n\u00e3o suportado: {0}\")]\n    UnsupportedFormat(String),\n\n    /// Limite excedido.\n    #[error(\"artefato excede limite: {field} = {value} > {max}\")]\n    LimitExceeded {\n        /// Campo.\n        field: String,\n        /// Valor observado.\n        value: u64,\n        /// M\u00e1ximo.\n        max: u64,\n    },\n\n    /// Hash mismatch.\n    #[error(\"hash mismatch: esperado {expected}, obtido {actual}\")]\n    HashMismatch {\n        /// Esperado.\n        expected: String,\n        /// Obtido.\n        actual: String,\n    },\n\n    /// Assinatura inv\u00e1lida.\n    #[error(\"assinatura inv\u00e1lida: {0}\")]\n    InvalidSignature(String),\n\n    /// Prova de inclus\u00e3o inv\u00e1lida.\n    #[error(\"prova de inclus\u00e3o inv\u00e1lida: {0}\")]\n    InvalidInclusion(String),\n\n    /// Valida\u00e7\u00e3o de seguran\u00e7a falhou.\n    #[error(\"seguran\u00e7a: {0}\")]\n    Security(String),\n\n    /// I/O.\n    #[error(\"I/O: {0}\")]\n    Io(#[from] std::io::Error),\n\n    /// Parse.\n    #[error(\"parse: {0}\")]\n    Parse(String),\n}\n```\n\n### `src/security.rs`\n\n```rust\n//! # security \u2014 Valida\u00e7\u00f5es contra vulnerabilidades conhecidas.\n//!\n//! ## CVEs mitigados\n//!\n//! - CVE-2026-65920 (path traversal em weight_map)\n//! - CVE-2026-7482 / Bleeding Llama (GGUF OOB read)\n//! - PR #3364 (safetensors data_offsets inconsistentes)\n//!\n//! ## Invariantes\n//!\n//! - `INV-AI-V-06`: data_offsets consistentes com shape e dtype\n//! - `INV-AI-V-07`: alignment GGUF \u2208 [4, 1 MiB] e pot\u00eancia de 2\n//! - `INV-AI-V-08`: n_dims \u2264 4\n//! - `INV-AI-V-09`: gguf_type \u2208 [0, 12]\n//! - `INV-AI-V-10`: blck_size \u2260 0\n\nuse crate::error::VerifyError;\n\n/// Tamanho m\u00e1ximo do header safetensors (100 MB).\npub const MAX_SAFETENSORS_HEADER: usize = 100 * 1024 * 1024;\n\n/// Tamanho m\u00e1ximo de uma string GGUF (64 MB).\npub const MAX_GGUF_STRING: u64 = 64 * 1024 * 1024;\n\n/// M\u00e1ximo de elementos num array GGUF.\npub const MAX_GGUF_ARRAY: u64 = 1024 * 1024;\n\n/// Alignment m\u00e1ximo GGUF (1 MiB).\npub const MAX_GGUF_ALIGNMENT: u64 = 1024 * 1024;\n\n/// Alignment m\u00ednimo GGUF.\npub const MIN_GGUF_ALIGNMENT: u64 = 4;\n\n/// M\u00e1ximo de dimens\u00f5es GGUF (GGML_MAX_DIMS).\npub const MAX_GGUF_DIMS: u32 = 4;\n\n/// Tipos de dados safetensors suportados.\n#[derive(Debug, Clone, Copy, PartialEq, Eq)]\npub enum SafeTensorDtype {\n    F16, BF16, F32, F64,\n    I8, I16, I32, I64,\n    U8, U16, U32, U64,\n    BOOL,\n}\n\nimpl SafeTensorDtype {\n    /// Tamanho em bytes.\n    #[must_use]\n    pub fn size_bytes(self) -> usize {\n        match self {\n            Self::F16 | Self::BF16 | Self::I16 | Self::U16 => 2,\n            Self::F32 | Self::I32 | Self::U32 => 4,\n            Self::F64 | Self::I64 | Self::U64 => 8,\n            Self::I8 | Self::U8 | Self::BOOL => 1,\n        }\n    }\n\n    /// Parse de string.\n    pub fn parse(s: &str) -> Result {\n        match s {\n            \"F16\" => Ok(Self::F16),\n            \"BF16\" => Ok(Self::BF16),\n            \"F32\" => Ok(Self::F32),\n            \"F64\" => Ok(Self::F64),\n            \"I8\" => Ok(Self::I8),\n            \"I16\" => Ok(Self::I16),\n            \"I32\" => Ok(Self::I32),\n            \"I64\" => Ok(Self::I64),\n            \"U8\" => Ok(Self::U8),\n            \"U16\" => Ok(Self::U16),\n            \"U32\" => Ok(Self::U32),\n            \"U64\" => Ok(Self::U64),\n            \"BOOL\" => Ok(Self::BOOL),\n            _ => Err(VerifyError::Parse(format!(\"dtype desconhecido: {s}\"))),\n        }\n    }\n}\n\n/// Valida `data_offsets` de um tensor safetensors (`INV-AI-V-06`).\npub fn validate_safetensors_offsets(\n    shape: &[usize],\n    dtype: SafeTensorDtype,\n    data_offsets: &[usize; 2],\n    data_buffer_len: usize,\n) -> Result<(), VerifyError> {\n    let [start, end] = data_offsets;\n    if start > end {\n        return Err(VerifyError::Security(format!(\n            \"data_offsets inv\u00e1lidos: start={start} > end={end}\"\n        )));\n    }\n    if *end > data_buffer_len {\n        return Err(VerifyError::Security(format!(\n            \"data_offsets excedem buffer: end={end} > len={data_buffer_len}\"\n        )));\n    }\n\n    let expected_elems: usize = shape.iter().product();\n    let expected_bytes = expected_elems.saturating_mul(dtype.size_bytes());\n    let actual_bytes = end - start;\n    if expected_bytes != actual_bytes {\n        return Err(VerifyError::Security(format!(\n            \"data_offsets inconsistentes: esperado {expected_bytes} bytes, obtido {actual_bytes}\"\n        )));\n    }\n    Ok(())\n}\n\n/// Sanitiza paths do `weight_map` (CVE-2026-65920).\npub fn sanitize_weight_map_path(\n    base_dir: &std::path::Path,\n    relative: &str,\n) -> Result {\n    if relative.contains(\"..\") || relative.starts_with('/') {\n        return Err(VerifyError::Security(format!(\n            \"path traversal detectado: {relative}\"\n        )));\n    }\n\n    let candidate = base_dir.join(relative);\n    let canonical_base = base_dir\n        .canonicalize()\n        .map_err(|e| VerifyError::Security(format!(\"base dir inv\u00e1lido: {e}\")))?;\n\n    if let Some(parent) = candidate.parent() {\n        if let Ok(canonical_parent) = parent.canonicalize() {\n            if !canonical_parent.starts_with(&canonical_base) {\n                return Err(VerifyError::Security(format!(\n                    \"path escapa ao diret\u00f3rio base: {relative}\"\n                )));\n            }\n        }\n    }\n\n    Ok(candidate)\n}\n\n/// Valida alignment GGUF (`INV-AI-V-07`).\npub fn validate_gguf_alignment(alignment: u64) -> Result<(), VerifyError> {\n    if alignment < MIN_GGUF_ALIGNMENT || alignment > MAX_GGUF_ALIGNMENT {\n        return Err(VerifyError::Security(format!(\n            \"alignment GGUF fora de limites: {alignment}\"\n        )));\n    }\n    if !alignment.is_power_of_two() {\n        return Err(VerifyError::Security(format!(\n            \"alignment GGUF n\u00e3o \u00e9 pot\u00eancia de 2: {alignment}\"\n        )));\n    }\n    Ok(())\n}\n\n/// Valida `n_dims` GGUF (`INV-AI-V-08`).\npub fn validate_gguf_n_dims(n_dims: u32) -> Result<(), VerifyError> {\n    if n_dims > MAX_GGUF_DIMS {\n        return Err(VerifyError::Security(format!(\n            \"n_dims GGUF excede m\u00e1ximo: {n_dims} > {MAX_GGUF_DIMS}\"\n        )));\n    }\n    Ok(())\n}\n\n/// Valida `gguf_type` dentro do enum (`INV-AI-V-09`).\npub fn validate_gguf_type(t: i32) -> Result<(), VerifyError> {\n    const KNOWN: std::ops::RangeInclusive = 0..=12;\n    if !KNOWN.contains(&t) {\n        return Err(VerifyError::Security(format!(\n            \"gguf_type desconhecido: {t} (esperado 0..=12)\"\n        )));\n    }\n    Ok(())\n}\n\n/// Valida `blck_size` n\u00e3o-zero (`INV-AI-V-10`).\npub fn validate_gguf_block_size(blck_size: u64) -> Result<(), VerifyError> {\n    if blck_size == 0 {\n        return Err(VerifyError::Security(\n            \"blck_size GGUF \u00e9 zero (divis\u00e3o por zero)\".into(),\n        ));\n    }\n    Ok(())\n}\n\n/// Valida string GGUF.\npub fn validate_gguf_string_len(len: u64) -> Result<(), VerifyError> {\n    if len > MAX_GGUF_STRING {\n        return Err(VerifyError::LimitExceeded {\n            field: \"gguf.string_len\".into(),\n            value: len,\n            max: MAX_GGUF_STRING,\n        });\n    }\n    Ok(())\n}\n\n/// Valida array GGUF.\npub fn validate_gguf_array_len(len: u64) -> Result<(), VerifyError> {\n    if len > MAX_GGUF_ARRAY {\n        return Err(VerifyError::LimitExceeded {\n            field: \"gguf.array_len\".into(),\n            value: len,\n            max: MAX_GGUF_ARRAY,\n        });\n    }\n    Ok(())\n}\n```\n\n### `src/formats.rs`\n\n```rust\n//! # formats \u2014 Parsers para cada formato.\n\nuse crate::error::VerifyError;\nuse crate::security;\n\npub mod safetensors {\n    //! Parser safetensors com valida\u00e7\u00e3o de offsets.\n\n    use super::{security, VerifyError};\n    use serde::Deserialize;\n    use std::collections::HashMap;\n    use std::io::Read;\n\n    #[derive(Debug, Deserialize)]\n    pub struct TensorInfo {\n        pub dtype: String,\n        pub shape: Vec,\n        pub data_offsets: [usize; 2],\n    }\n\n    #[derive(Debug, Deserialize)]\n    pub struct Header {\n        #[serde(flatten)]\n        pub tensors: HashMap,\n        #[serde(rename = \"__metadata__\")]\n        pub metadata: Option>,\n    }\n\n    pub fn parse(path: &std::path::Path) -> Result {\n        let mut file = std::fs::File::open(path)?;\n\n        let mut len_bytes = [0u8; 8];\n        file.read_exact(&mut len_bytes)?;\n        let header_len = u64::from_le_bytes(len_bytes) as usize;\n\n        if header_len > security::MAX_SAFETENSORS_HEADER {\n            return Err(VerifyError::LimitExceeded {\n                field: \"safetensors.header_len\".into(),\n                value: header_len as u64,\n                max: security::MAX_SAFETENSORS_HEADER as u64,\n            });\n        }\n\n        let mut buf = vec![0u8; header_len];\n        file.read_exact(&mut buf)?;\n\n        if buf.first() != Some(&b'{') {\n            return Err(VerifyError::Parse(\n                \"safetensors header n\u00e3o come\u00e7a com '{'\".into(),\n            ));\n        }\n\n        let header: Header = serde_json::from_slice(&buf)\n            .map_err(|e| VerifyError::Parse(format!(\"safetensors header: {e}\")))?;\n\n        let meta = std::fs::metadata(path)?;\n        let data_buffer_len = meta.len() as usize - 8 - header_len;\n\n        for (name, info) in &header.tensors {\n            let dtype = security::SafeTensorDtype::parse(&info.dtype)\n                .map_err(|e| VerifyError::Parse(format!(\"tensor {name}: {e}\")))?;\n            security::validate_safetensors_offsets(\n                &info.shape,\n                dtype,\n                &info.data_offsets,\n                data_buffer_len,\n            )\n            .map_err(|e| VerifyError::Security(format!(\"tensor {name}: {e}\")))?;\n        }\n\n        Ok(header)\n    }\n}\n\npub mod gguf {\n    //! Parser GGUF com valida\u00e7\u00f5es de seguran\u00e7a.\n\n    use super::{security, VerifyError};\n    use std::io::Read;\n\n    pub const MAGIC: &[u8; 4] = b\"GGUF\";\n    pub const VERSION: u32 = 3;\n\n    #[derive(Debug, Clone, Copy)]\n    pub struct Header {\n        pub version: u32,\n        pub tensor_count: u64,\n        pub metadata_kv_count: u64,\n    }\n\n    pub fn parse_header(path: &std::path::Path) -> Result {\n        let mut file = std::fs::File::open(path)?;\n\n        let mut magic = [0u8; 4];\n        file.read_exact(&mut magic)?;\n        if &magic != MAGIC {\n            return Err(VerifyError::Parse(\"GGUF magic inv\u00e1lido\".into()));\n        }\n\n        let mut buf4 = [0u8; 4];\n        file.read_exact(&mut buf4)?;\n        let version = u32::from_le_bytes(buf4);\n        if version != VERSION {\n            return Err(VerifyError::Parse(format!(\n                \"GGUF vers\u00e3o n\u00e3o suportada: {version}\"\n            )));\n        }\n\n        let mut buf8 = [0u8; 8];\n        file.read_exact(&mut buf8)?;\n        let tensor_count = u64::from_le_bytes(buf8);\n        file.read_exact(&mut buf8)?;\n        let metadata_kv_count = u64::from_le_bytes(buf8);\n\n        if tensor_count > 1_000_000 {\n            return Err(VerifyError::LimitExceeded {\n                field: \"gguf.tensor_count\".into(),\n                value: tensor_count,\n                max: 1_000_000,\n            });\n        }\n        if metadata_kv_count > 1_000_000 {\n            return Err(VerifyError::LimitExceeded {\n                field: \"gguf.metadata_kv_count\".into(),\n                value: metadata_kv_count,\n                max: 1_000_000,\n            });\n        }\n\n        Ok(Header {\n            version,\n            tensor_count,\n            metadata_kv_count,\n        })\n    }\n\n    pub fn read_kv_key(file: &mut std::fs::File) -> Result {\n        let mut buf8 = [0u8; 8];\n        file.read_exact(&mut buf8)?;\n        let key_len = u64::from_le_bytes(buf8);\n        security::validate_gguf_string_len(key_len)?;\n\n        let mut key = vec![0u8; key_len as usize];\n        file.read_exact(&mut key)?;\n        String::from_utf8(key).map_err(|e| VerifyError::Parse(format!(\"GGUF key utf8: {e}\")))\n    }\n\n    pub fn read_kv_type(file: &mut std::fs::File) -> Result {\n        let mut buf4 = [0u8; 4];\n        file.read_exact(&mut buf4)?;\n        let t = i32::from_le_bytes(buf4);\n        security::validate_gguf_type(t)?;\n        Ok(t)\n    }\n}\n```\n\n### `src/lib.rs`\n\n```rust\n//! # arkhe-ai-verify\n//!\n//! Pipeline de 4 gates fail-closed para artefatos de IA.\n//!\n//! ## Invariantes\n//!\n//! - `INV-AI-V-01`: Todo artefato verificado tem `record_hash`\n//! - `INV-AI-V-02`: Formato desconhecido \u2192 `NONEXISTENT`\n//! - `INV-AI-V-03`: Gate 0 rejeita artefatos que excedem limites\n//! - `INV-AI-V-04`: Gate 2 verifica identity policy (issuer + subject)\n//! - `INV-AI-V-05`: Gate 3 verifica prova Rekor (checkpoint + SET)\n//! - `INV-AI-V-06`: data_offsets consistentes com shape e dtype\n//! - `INV-AI-V-07`: alignment GGUF \u2208 [4, 1 MiB] e pot\u00eancia de 2\n//! - `INV-AI-V-08`: n_dims \u2264 4\n//! - `INV-AI-V-09`: gguf_type \u2208 [0, 12]\n//! - `INV-AI-V-10`: blck_size \u2260 0\n\n#![deny(missing_docs)]\n#![deny(unsafe_code)]\n#![warn(missing_debug_implementations)]\n#![cfg_attr(test, allow(clippy::unwrap_used, clippy::expect_used))]\n\npub mod error;\npub mod formats;\npub mod gates;\npub mod security;\n\npub use error::VerifyError;\npub use security::{\n    validate_gguf_alignment, validate_gguf_block_size, validate_gguf_n_dims,\n    validate_gguf_type, validate_safetensors_offsets, SafeTensorDtype,\n};\n\nuse serde::{Deserialize, Serialize};\n\n/// Estado honesto.\n#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"SCREAMING_SNAKE_CASE\")]\npub enum ArkheStatus {\n    Verified,\n    Partial,\n    Failed,\n    Nonexistent,\n    Pending,\n    Blocked,\n}\n\n/// Formato detectado.\n#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]\n#[serde(rename_all = \"snake_case\")]\npub enum ArtifactFormat {\n    Safetensors,\n    Gguf,\n    Onnx,\n    Tensorrt,\n    Tflite,\n    Coreml,\n    Pytorch,\n    Huggingface,\n    Unknown,\n}\n\n/// Resultado de um gate.\n#[derive(Debug, Clone, Serialize, Deserialize)]\npub struct GateResult {\n    pub gate_id: u8,\n    pub name: String,\n    pub status: ArkheStatus,\n    pub detail: String,\n    pub record_hash: String,\n}\n\n/// Resultado completo.\n#[derive(Debug, Clone, Serialize, Deserialize)]\npub struct VerifyResult {\n    pub status: ArkheStatus,\n    pub artifact_format: ArtifactFormat,\n    pub artifact_digest: String,\n    pub gates: Vec,\n    pub record_hash: [u8; 32],\n}\n\n/// Trust anchor para Gate 2/3.\n#[derive(Debug, Clone)]\npub struct TrustAnchor {\n    pub issuer: String,\n    pub identity: String,\n}\n\nimpl Default for TrustAnchor {\n    fn default() -> Self {\n        Self {\n            issuer: \"https://token.actions.githubusercontent.com\".into(),\n            identity: \"https://github.com/rafael-arkhe/arkhe-ai/.github/workflows/release.yml@refs/heads/main\".into(),\n        }\n    }\n}\n\n/// Detecta o formato pela extens\u00e3o.\n#[must_use]\npub fn detect_format(path: &std::path::Path) -> ArtifactFormat {\n    let ext = path\n        .extension()\n        .and_then(|e| e.to_str())\n        .unwrap_or(\"\")\n        .to_lowercase();\n    match ext.as_str() {\n        \"safetensors\" => ArtifactFormat::Safetensors,\n        \"gguf\" => ArtifactFormat::Gguf,\n        \"onnx\" => ArtifactFormat::Onnx,\n        \"engine\" | \"plan\" => ArtifactFormat::Tensorrt,\n        \"tflite\" => ArtifactFormat::Tflite,\n        \"mlmodel\" => ArtifactFormat::Coreml,\n        \"pt\" | \"pth\" | \"bin\" | \"ckpt\" => ArtifactFormat::Pytorch,\n        _ => ArtifactFormat::Unknown,\n    }\n}\n\n/// Executa o pipeline de 4 gates.\npub async fn verify_artifact(\n    path: &std::path::Path,\n    expected_hash: Option<&str>,\n    trust_anchor: &TrustAnchor,\n) -> Result {\n    let format = detect_format(path);\n    if format == ArtifactFormat::Unknown {\n        return Ok(VerifyResult {\n            status: ArkheStatus::Nonexistent,\n            artifact_format: format,\n            artifact_digest: String::new(),\n            gates: vec![],\n            record_hash: [0u8; 32],\n        });\n    }\n\n    let gate0 = gates::sanitize(path, format)?;\n    let gate1 = gates::hash(path, expected_hash)?;\n    let gate2 = gates::verify_signature(path, trust_anchor).await?;\n    let gate3 = gates::verify_inclusion(path, trust_anchor).await?;\n\n    let gates = vec![gate0, gate1, gate2, gate3];\n    let overall = if gates.iter().all(|g| g.status == ArkheStatus::Verified) {\n        ArkheStatus::Verified\n    } else if gates.iter().any(|g| g.status == ArkheStatus::Failed) {\n        ArkheStatus::Failed\n    } else {\n        ArkheStatus::Partial\n    };\n\n    let mut hasher = blake3::Hasher::new_derive_key(\"arkhe-ai-verify-v1\");\n    for g in &gates {\n        hasher.update(g.record_hash.as_bytes());\n    }\n    let record_hash = *hasher.finalize().as_bytes();\n\n    Ok(VerifyResult {\n        status: overall,\n        artifact_format: format,\n        artifact_digest: gate1.detail.clone(),\n        gates,\n        record_hash,\n    })\n}\n```\n\n### `src/gates.rs`\n\n```rust\n//! # gates \u2014 Pipeline de 4 gates fail-closed.\n\nuse crate::error::VerifyError;\nuse crate::{ArkheStatus, ArtifactFormat, GateResult, TrustAnchor};\nuse std::io::Read;\n\n/// Gate 0: Sanitiza\u00e7\u00e3o + valida\u00e7\u00f5es espec\u00edficas do formato.\npub fn sanitize(\n    path: &std::path::Path,\n    format: ArtifactFormat,\n) -> Result {\n    let meta = std::fs::metadata(path)?;\n    let size = meta.len();\n    const MAX: u64 = 16 * 1024 * 1024 * 1024;\n    if size > MAX {\n        return Err(VerifyError::LimitExceeded {\n            field: \"artifact.size\".into(),\n            value: size,\n            max: MAX,\n        });\n    }\n\n    let detail = match format {\n        ArtifactFormat::Safetensors => {\n            let header = crate::formats::safetensors::parse(path)?;\n            format!(\"safetensors OK \u00b7 {} tensores\", header.tensors.len())\n        }\n        ArtifactFormat::Gguf => {\n            let header = crate::formats::gguf::parse_header(path)?;\n            format!(\n                \"GGUF v{} OK \u00b7 {} tensores \u00b7 {} KV\",\n                header.version, header.tensor_count, header.metadata_kv_count\n            )\n        }\n        _ => format!(\"{size} bytes \u00b7 limites OK\"),\n    };\n\n    Ok(GateResult {\n        gate_id: 0,\n        name: \"Sanitiza\u00e7\u00e3o\".into(),\n        status: ArkheStatus::Verified,\n        detail,\n        record_hash: hex::encode(blake3::hash(b\"gate0-ok\").as_bytes()),\n    })\n}\n\n/// Gate 1: SHA-256.\npub fn hash(path: &std::path::Path, expected: Option<&str>) -> Result {\n    use sha2::{Digest, Sha256};\n\n    let mut file = std::fs::File::open(path)?;\n    let mut hasher = Sha256::new();\n    let mut buf = vec![0u8; 65536];\n    loop {\n        let n = file.read(&mut buf)?;\n        if n == 0 {\n            break;\n        }\n        hasher.update(&buf[..n]);\n    }\n    let digest = hex::encode(hasher.finalize());\n\n    let status = match expected {\n        Some(exp) if exp.eq_ignore_ascii_case(&digest) => ArkheStatus::Verified,\n        Some(_) => ArkheStatus::Failed,\n        None => ArkheStatus::Verified,\n    };\n\n    Ok(GateResult {\n        gate_id: 1,\n        name: \"Hash\".into(),\n        status,\n        detail: digest.clone(),\n        record_hash: hex::encode(blake3::hash(digest.as_bytes()).as_bytes()),\n    })\n}\n\n/// Gate 2: Assinatura Sigstore bundle v0.3.\npub async fn verify_signature(\n    path: &std::path::Path,\n    trust_anchor: &TrustAnchor,\n) -> Result {\n    let bundle_path = path.with_extension(\"sigstore.json\");\n    if !bundle_path.exists() {\n        return Ok(GateResult {\n            gate_id: 2,\n            name: \"Assinatura\".into(),\n            status: ArkheStatus::Nonexistent,\n            detail: \"bundle Sigstore ausente (.sigstore.json)\".into(),\n            record_hash: hex::encode(blake3::hash(b\"gate2-nonexistent\").as_bytes()),\n        });\n    }\n\n    let bundle_json = std::fs::read_to_string(&bundle_path)\n        .map_err(|e| VerifyError::Parse(format!(\"bundle read: {e}\")))?;\n\n    let bundle: sigstore_types::Bundle = serde_json::from_str(&bundle_json)\n        .map_err(|e| VerifyError::Parse(format!(\"bundle parse: {e}\")))?;\n\n    let trusted_root = load_trusted_root().await?;\n    let verifier = sigstore_verify::Verifier::new(&trusted_root);\n\n    let artifact_bytes = std::fs::read(path)?;\n\n    let policy = sigstore_verify::VerificationPolicy::new()\n        .issuer(&trust_anchor.issuer)\n        .subject(&trust_anchor.identity);\n\n    match verifier.verify_with_policy(&bundle, &artifact_bytes, &policy) {\n        Ok(()) => Ok(GateResult {\n            gate_id: 2,\n            name: \"Assinatura\".into(),\n            status: ArkheStatus::Verified,\n            detail: format!(\n                \"ECDSA-P256 \u00b7 issuer={} \u00b7 identity={}\",\n                trust_anchor.issuer, trust_anchor.identity\n            ),\n            record_hash: hex::encode(blake3::hash(b\"gate2-verified\").as_bytes()),\n        }),\n        Err(e) => Ok(GateResult {\n            gate_id: 2,\n            name: \"Assinatura\".into(),\n            status: ArkheStatus::Failed,\n            detail: format!(\"verifica\u00e7\u00e3o falhou: {e}\"),\n            record_hash: hex::encode(blake3::hash(b\"gate2-failed\").as_bytes()),\n        }),\n    }\n}\n\n/// Gate 3: Inclus\u00e3o Rekor.\npub async fn verify_inclusion(\n    path: &std::path::Path,\n    _trust_anchor: &TrustAnchor,\n) -> Result {\n    let bundle_path = path.with_extension(\"sigstore.json\");\n    if !bundle_path.exists() {\n        return Ok(GateResult {\n            gate_id: 3,\n            name: \"Inclus\u00e3o\".into(),\n            status: ArkheStatus::Nonexistent,\n            detail: \"sem prova de inclus\u00e3o\".into(),\n            record_hash: hex::encode(blake3::hash(b\"gate3-nonexistent\").as_bytes()),\n        });\n    }\n\n    let bundle_json = std::fs::read_to_string(&bundle_path)\n        .map_err(|e| VerifyError::Parse(format!(\"bundle read: {e}\")))?;\n    let bundle: sigstore_types::Bundle = serde_json::from_str(&bundle_json)\n        .map_err(|e| VerifyError::Parse(format!(\"bundle parse: {e}\")))?;\n\n    let trusted_root = load_trusted_root().await?;\n    let verifier = sigstore_verify::Verifier::new(&trusted_root);\n\n    match verifier.verify_tlog(&bundle) {\n        Ok(()) => Ok(GateResult {\n            gate_id: 3,\n            name: \"Inclus\u00e3o\".into(),\n            status: ArkheStatus::Verified,\n            detail: \"Rekor \u00b7 checkpoint + SET + inclusion proof\".into(),\n            record_hash: hex::encode(blake3::hash(b\"gate3-verified\").as_bytes()),\n        }),\n        Err(e) => Ok(GateResult {\n            gate_id: 3,\n            name: \"Inclus\u00e3o\".into(),\n            status: ArkheStatus::Failed,\n            detail: format!(\"tlog falhou: {e}\"),\n            record_hash: hex::encode(blake3::hash(b\"gate3-failed\").as_bytes()),\n        }),\n    }\n}\n\n/// Carrega o trust root Sigstore.\nasync fn load_trusted_root() -> Result {\n    if let Ok(path) = std::env::var(\"ARKHE_TRUSTED_ROOT\") {\n        let json = std::fs::read_to_string(&path)\n            .map_err(|e| VerifyError::Parse(format!(\"trusted_root read: {e}\")))?;\n        return sigstore_trust_root::TrustedRoot::from_json(&json)\n            .map_err(|e| VerifyError::Parse(format!(\"trusted_root parse: {e}\")));\n    }\n\n    if let Some(home) = dirs::home_dir() {\n        let path = home.join(\".sigstore/root/tuf-repo-cdn.sigstore.dev/targets/trusted_root.json\");\n        if path.exists() {\n            let json = std::fs::read_to_string(&path)\n                .map_err(|e| VerifyError::Parse(format!(\"trusted_root read: {e}\")))?;\n            return sigstore_trust_root::TrustedRoot::from_json(&json)\n                .map_err(|e| VerifyError::Parse(format!(\"trusted_root parse: {e}\")));\n        }\n    }\n\n    sigstore_trust_root::TrustedRoot::production()\n        .map_err(|e| VerifyError::Parse(format!(\"trusted_root production: {e}\")))\n}\n```\n\n---\n\n## 5. Testes\n\n### `tests/safetensors_tests.rs`\n\n```rust\n//! Testes do parser safetensors.\n\nuse arkhe_ai_verify::formats::safetensors;\nuse arkhe_ai_verify::security::{validate_safetensors_offsets, SafeTensorDtype};\n\n#[test]\nfn parse_valid_file() {\n    let dir = tempfile::tempdir().unwrap();\n    let path = dir.path().join(\"model.safetensors\");\n\n    let json = r#\"{\"weight\":{\"dtype\":\"F32\",\"shape\":[2,2],\"data_offsets\":[0,16]}}\"#;\n    let mut bytes = Vec::new();\n    bytes.extend_from_slice(&(json.len() as u64).to_le_bytes());\n    bytes.extend_from_slice(json.as_bytes());\n    bytes.extend_from_slice(&[0u8; 16]);\n    std::fs::write(&path, &bytes).unwrap();\n\n    let header = safetensors::parse(&path).unwrap();\n    assert_eq!(header.tensors.len(), 1);\n}\n\n#[test]\nfn reject_inconsistent_offsets() {\n    let shape = vec![1000usize, 1000];\n    let offsets = [0usize, 4];\n    assert!(validate_safetensors_offsets(&shape, SafeTensorDtype::F32, &offsets, 100).is_err());\n}\n\n#[test]\nfn reject_header_without_brace() {\n    let dir = tempfile::tempdir().unwrap();\n    let path = dir.path().join(\"bad.safetensors\");\n    let json = \"not-json\";\n    let mut bytes = Vec::new();\n    bytes.extend_from_slice(&(json.len() as u64).to_le_bytes());\n    bytes.extend_from_slice(json.as_bytes());\n    std::fs::write(&path, &bytes).unwrap();\n    assert!(safetensors::parse(&path).is_err());\n}\n```\n\n### `tests/security_tests.rs`\n\n```rust\n//! Testes das valida\u00e7\u00f5es de seguran\u00e7a.\n\nuse arkhe_ai_verify::security::{\n    sanitize_weight_map_path, validate_gguf_alignment, validate_gguf_block_size,\n    validate_gguf_n_dims, validate_gguf_type,\n};\n\n#[test]\nfn path_traversal_rejected() {\n    let base = std::path::Path::new(\"/tmp\");\n    assert!(sanitize_weight_map_path(base, \"../etc/passwd\").is_err());\n    assert!(sanitize_weight_map_path(base, \"/etc/passwd\").is_err());\n}\n\n#[test]\nfn alignment_bounds() {\n    assert!(validate_gguf_alignment(0).is_err());\n    assert!(validate_gguf_alignment(2).is_err());\n    assert!(validate_gguf_alignment(32).is_ok());\n    assert!(validate_gguf_alignment(1024 * 1024).is_ok());\n    assert!(validate_gguf_alignment(2 * 1024 * 1024).is_err());\n}\n\n#[test]\nfn n_dims_bounds() {\n    for n in 1..=4 {\n        assert!(validate_gguf_n_dims(n).is_ok());\n    }\n    assert!(validate_gguf_n_dims(5).is_err());\n}\n\n#[test]\nfn gguf_type_bounds() {\n    for t in 0..=12 {\n        assert!(validate_gguf_type(t).is_ok());\n    }\n    assert!(validate_gguf_type(13).is_err());\n    assert!(validate_gguf_type(-1).is_err());\n}\n\n#[test]\nfn block_size_nonzero() {\n    assert!(validate_gguf_block_size(1).is_ok());\n    assert!(validate_gguf_block_size(0).is_err());\n}\n```\n\n---\n\n## 6. CI\n\n### `.github/workflows/ci.yml`\n\n```yaml\nname: CI\n\non:\n  push:\n    branches: [main, develop]\n  pull_request:\n\nenv:\n  CARGO_TERM_COLOR: always\n  RUSTFLAGS: \"-D warnings\"\n\njobs:\n  fmt:\n    name: \"QG-AI-01 \u2014 rustfmt\"\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: dtolnay/rust-toolchain@stable\n        with: { components: rustfmt }\n      - run: cargo fmt --all -- --check\n\n  clippy:\n    name: \"QG-AI-02 \u2014 clippy\"\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: dtolnay/rust-toolchain@stable\n        with: { components: clippy }\n      - uses: Swatinem/rust-cache@v2\n      - run: cargo clippy --all-targets -- -D warnings\n\n  test:\n    name: \"QG-AI-03 \u2014 test\"\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: dtolnay/rust-toolchain@stable\n      - uses: Swatinem/rust-cache@v2\n      - run: cargo test --all-features\n\n  deny:\n    name: \"QG-AI-04 \u2014 supply chain\"\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: EmbarkStudios/cargo-deny-action@v1\n        with:\n          command: check advisories bans licenses sources\n```\n\n---\n\n## 7. README\n\n```markdown\n# arkhe-ai-verify\n\n**Verifica\u00e7\u00e3o de artefatos de IA** \u2014 pipeline de 4 gates fail-closed para safetensors, GGUF, ONNX, TensorRT, TFLite, CoreML e PyTorch.\n\n## Invariantes\n\n| ID | Enunciado | Categoria |\n|:---|:---|:---|\n| `INV-AI-V-01` | Todo artefato verificado tem `record_hash` | AUDITABILITY |\n| `INV-AI-V-02` | Formato desconhecido \u2192 `NONEXISTENT` | SAFETY |\n| `INV-AI-V-03` | Gate 0 rejeita artefatos > 16 GiB | SAFETY |\n| `INV-AI-V-04` | Gate 2 verifica identity policy | CRYPTOGRAPHY |\n| `INV-AI-V-05` | Gate 3 verifica prova Rekor | CRYPTOGRAPHY |\n| `INV-AI-V-06` | data_offsets consistentes com shape/dtype | SAFETY |\n| `INV-AI-V-07` | alignment GGUF \u2208 [4, 1 MiB] | SAFETY |\n| `INV-AI-V-08` | n_dims \u2264 4 | SAFETY |\n| `INV-AI-V-09` | gguf_type \u2208 [0, 12] | SAFETY |\n| `INV-AI-V-10` | blck_size \u2260 0 | SAFETY |\n\n## Quick start\n\n```bash\ncargo test\n```\n\n## Uso\n\n```rust\nuse arkhe_ai_verify::{verify_artifact, TrustAnchor};\n\nlet result = verify_artifact(\n    std::path::Path::new(\"model.safetensors\"),\n    None,\n    &TrustAnchor::default(),\n).await?;\n\nassert_eq!(result.status, arkhe_ai_verify::ArkheStatus::Verified);\n```\n\n## CVEs Mitigados\n\n- **CVE-2026-65920**: path traversal em `weight_map`\n- **CVE-2026-7482**: GGUF OOB read (Bleeding Llama)\n- **PR #3364**: data_offsets inconsistentes\n\n## Licen\u00e7a\n\nMIT OR Apache-2.0.\n```\n\n---\n\n## 8. Invariantes Consolidadas\n\n| ID | Enunciado | Falsificador | Verifica\u00e7\u00e3o |\n|:---|:---|:---|:---|\n| `INV-AI-V-01` | Todo artefato verificado tem `record_hash` | Hash zerado | `verify_produces_record_hash` |\n| `INV-AI-V-02` | Formato desconhecido \u2192 `NONEXISTENT` | Formato desconhecido aceite | `unknown_format_nonexistent` |\n| `INV-AI-V-03` | Gate 0 rejeita artefatos > 16 GiB | Artefato gigante aceite | `sanitize_rejects_huge` |\n| `INV-AI-V-04` | Gate 2 verifica identity policy | Identity divergente aceite | `verify_signature_rejects_wrong_identity` |\n| `INV-AI-V-05` | Gate 3 verifica prova Rekor | Bundle sem tlog aceite | `verify_inclusion_rejects_no_tlog` |\n| `INV-AI-V-06` | data_offsets consistentes | Offsets inconsistentes aceites | `reject_inconsistent_offsets` |\n| `INV-AI-V-07` | alignment GGUF \u2208 [4, 1 MiB] | Alignment 0 ou 2 GiB aceite | `alignment_bounds` |\n| `INV-AI-V-08` | n_dims GGUF \u2264 4 | n_dims = 5 aceite | `n_dims_bounds` |\n| `INV-AI-V-09` | gguf_type \u2208 [0, 12] | Tipo 99 aceite | `gguf_type_bounds` |\n| `INV-AI-V-10` | blck_size GGUF \u2260 0 | blck_size = 0 aceite | `block_size_nonzero` |\n\n---\n\n## 9. Selo\n\n```\n\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502  ARKHE-AI-VERIFY \u2014 REPOSIT\u00d3RIO COMPLETO (v0.1.0)                     \u2502\n\u2502                                                                     \u2502\n\u2502  \u2705 SAFETENSORS:                                                     \u2502\n\u2502     \u00b7 Header come\u00e7a com '{'                                         \u2502\n\u2502     \u00b7 data_offsets relativos ao data buffer                         \u2502\n\u2502     \u00b7 Valida\u00e7\u00e3o count/ordem/consist\u00eancia (PR #3364)                 \u2502\n\u2502     \u00b7 Sanitiza\u00e7\u00e3o de weight_map (CVE-2026-65920)                    \u2502\n\u2502                                                                     \u2502\n\u2502  \u2705 GGUF:                                                            \u2502\n\u2502     \u00b7 Header: magic + version(3) + tensor_count + metadata_kv_count \u2502\n\u2502     \u00b7 Alignment \u2208 [4, 1 MiB] e pot\u00eancia de 2                        \u2502\n\u2502     \u00b7 n_dims \u2264 4                                                    \u2502\n\u2502     \u00b7 gguf_type \u2208 [0, 12]                                           \u2502\n\u2502     \u00b7 blck_size \u2260 0                                                 \u2502\n\u2502     \u00b7 Strings \u2264 64 MiB, arrays \u2264 1M                                 \u2502\n\u2502                                                                     \u2502\n\u2502  \u2705 SIGSTORE:                                                        \u2502\n\u2502     \u00b7 Bundle v0.3 (.sigstore.json)                                  \u2502\n\u2502     \u00b7 sigstore-verify 0.11.0                                        \u2502\n\u2502     \u00b7 Identity policy: issuer + subject                             \u2502\n\u2502     \u00b7 Trust root: env / cache cosign / production                   \u2502\n\u2502                                                                     \u2502\n\u2502  \u2705 INVARIANTES (10): INV-AI-V-01..10                                \u2502\n\u2502                                                                     \u2502\n\u2502  \ud83d\udccb COMANDO:                                                         \u2502\n\u2502     cargo test                                                      \u2502\n\u2502                                                                     \u2502\n\u2502  Selo: ARKHE-AI-VERIFY-2026-09-26                                   \u2502\n\u2502  Status: \u2705 COMPLETO \u2014 PRONTO PARA `cargo test`                     \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n```\n\n**Nota de honestidade:** As valida\u00e7\u00f5es de seguran\u00e7a implementam as corre\u00e7\u00f5es documentadas em CVE-2026-65920 (path traversal), PR #3364 (data_offsets inconsistentes) e os advisories do llama.cpp (CVE-2026-7482). A integra\u00e7\u00e3o Sigstore usa `sigstore-verify` 0.11.0 e `sigstore-trust-root` 0.11.0, com bundles v0.3. As vers\u00f5es das depend\u00eancias foram verificadas contra as releases mais recentes no crates.io. A evid\u00eancia \u00e9 `cargo test`.", "creation_timestamp": "2026-09-26T04:21:06.000000Z"}]}