Running one project: verify
[CALLSITE_BYPASS]: getTLogTimestamp() returned a trusted timestamp (2025-12-14T02:05:09.000Z) for an entry whose inclusionPromise is FORGED (presence-check passes, SET not yet validated); integratedTime=1765677909
[BYPASS_OK]: Verifier.verify() (cert path) SUCCEEDED on a DECOUPLED SignedEntity (tlogEntries empty) whose sole timestamp is a tlog entry carrying a FORGED inclusionPromise + attacker integratedTime=1765677909; cert is EXPIRED now (notBefore=2025-12-14T02:04:39.000Z, notAfter=2025-12-14T02:14:39.000Z, now=2026-07-02T18:16:44.926Z); fix presence-check passed, SET never validated -> original CVE impact (expired-cert-accepted) reproduced on this version
[BYPASS_OK]: Verifier.verify() (public-key path) SUCCEEDED on a DECOUPLED SignedEntity whose sole timestamp is a tlog entry with a FORGED inclusionPromise + attacker integratedTime=1763174679; timestampThreshold satisfied & key validity accepted on attacker-chosen, unvalidated time
[NC_REJECT]: bundle-path (coupled) verify rejected a FORGED inclusionPromise with code=TLOG_INCLUSION_PROMISE_ERROR: inclusion promise could not be verified -> verifyTLogSET validated the SET and rejected (coupling protection holds on this version)
[ORIG_REJECT]: original vector (inclusionProof-only) verify rejected with code=TIMESTAMP_ERROR: expected 1 timestamps, got 0 -> fix closes the original inclusionProof-only vector on this version
PASS verify packages/verify/src/__tests__/cve_variant.test.ts
  CVE-2026-48816 variant/bypass
    Part 1: BYPASS - decoupled SignedEntity + forged inclusionPromise (cert path)
      ✓ records whether verify() accepts an expired cert via a forged, unvalidated inclusionPromise (17 ms)
    Part 0: BYPASS - decoupled SignedEntity + forged inclusionPromise (public-key path)
      ✓ records whether verify() satisfies timestampThreshold via a forged, unvalidated inclusionPromise (5 ms)
    Part 2: NEGATIVE CONTROL - bundle path (coupled) + forged inclusionPromise
      ✓ records whether the coupled bundle path rejects a forged inclusionPromise SET (8 ms)
    Part 3: ORIGINAL VECTOR - bundle path (coupled) + inclusionProof-only
      ✓ records whether the original inclusionProof-only vector is open on this version (1 ms)

Test Suites: 1 passed, 1 total
Tests:       4 passed, 4 total
Snapshots:   0 total
Time:        0.139 s, estimated 1 s
Ran all test suites matching cve_variant.test.ts.