still_active 2.0.0 → 3.0.0.rc1

data/lib/still_active/poison_security_correlator.rb

@@ -0,0 +1,232 @@
+# frozen_string_literal: true
+
+require_relative "../helpers/vulnerability_helper"
+require_relative "../helpers/constraint_helper"
+require_relative "../helpers/semver_satisfaction"
+
+module StillActive
+  # Whole-tree correlation, run once after the fan-out: a poison cap is far more
+  # urgent when the dependency it pins is ITSELF vulnerable in the same tree --
+  # "a dormant package is holding you on a known-vulnerable dependency, below the
+  # version that fixes it." Both facts are already assembled (the poison
+  # constraints and every dependency's vulnerability count), so this is one pass,
+  # no extra fetches. It marks the security-relevant caps so the report can lead
+  # with them and demote the FYI caps on healthy dependencies.
+  #
+  # The moat's strongest case (verified on real repos): several archived Google
+  # client libraries pin a vulnerable `protobuf` three majors below the fix.
+  module PoisonSecurityCorrelator
+    extend self
+
+    # Only a HIGH-or-above advisory on the capped dep makes the cap security-
+    # relevant. Most advisories are low-threat noise (research: ~95% of vulnerable
+    # deps are unreachable/low-impact), so a low/medium CVE on the pinned dep isn't
+    # the "you're stuck below the fix" story. Unscored advisories fail CLOSED (a
+    # confirmed advisory we can't score could be severe), matching --fail-if-
+    # vulnerable. Reachability/exploitability is beyond static, metadata-only sight
+    # and deliberately out of scope -- this gates on severity, not exploitability.
+    SECURITY_THRESHOLD = "high"
+
+    # The severity labels that let an advisory establish "below the fix". Only a
+    # confirmed HIGH+ advisory with a known fix can: an unscored advisory (which the
+    # capped_dep_vulnerable gate accepts fail-closed) has no reliable fix analysis.
+    BELOW_FIX_LABELS = ["high", "critical"].freeze
+
+    def correlate(result_object)
+      advisories = flat_advisories(result_object)
+      copies = copy_index(result_object)
+
+      result_object.each_value do |data|
+        # FLAT (rubygems/pypi): mark below-fix on the poison caps already attached.
+        mark_flat_constraints(data, advisories)
+        # NESTED (npm/cargo): promote a genuine below-fix candidate into :constraints.
+        promote_nested_below_fix(data, copies) if data[:capped_deps]
+
+        constraints = hashes(data[:constraints])
+        next if constraints.empty?
+
+        data[:poison_security_relevant] = true if constraints.any? { |c| c[:capped_dep_vulnerable] }
+        data[:poison_below_fix] = true if constraints.any? { |c| c[:capped_below_fix] }
+      end
+    end
+
+    private
+
+    # This runs OUTSIDE the per-gem rescue (a whole-tree pass after the barrier),
+    # so a malformed shape must degrade that one entry's enrichment, never raise and
+    # crash the audit after every fetch is paid for. The pipeline always assigns
+    # arrays of hashes here, so these guards are unreachable today, but they match the
+    # defensive Array()-wrapping the sibling consumers (markdown/sarif/terminal) apply.
+    def hashes(value)
+      Array(value).grep(Hash)
+    end
+
+    # Ecosystem-qualified map of each tree package's advisories AND the version it's
+    # pinned at, for the FLAT path (one resolved version per name). A capped dep
+    # resolves in its capper's ecosystem, so match "ecosystem/name" on both sides;
+    # native results carry no :ecosystem (nil on both) and still match. The used
+    # version is kept so "below the fix" ignores fixes that land BELOW it: an OSV
+    # advisory lists a fix per affected range, and a fix for an older line is a
+    # downgrade, not a patch for the version in hand.
+    def flat_advisories(result_object)
+      result_object.each_with_object({}) do |(key, data), map|
+        next unless data[:vulnerability_count].to_i.positive?
+
+        name = data[:name] || key
+        map["#{data[:ecosystem]}/#{name}"] = { vulns: hashes(data[:vulnerabilities]), used_version: data[:version_used] }
+      end
+    end
+
+    # Every RESOLVED copy of each package, keyed "ecosystem/name", for the NESTED
+    # path: npm nests versions and cargo coexists majors, so one name maps to several
+    # copies. The full set (vulnerable AND not) is what the condition-5 soundness
+    # guard needs -- "is there a SAFE copy within the cap" can't be answered from the
+    # vulnerable copies alone.
+    def copy_index(result_object)
+      result_object.each_with_object({}) do |(key, data), map|
+        name = data[:name] || key
+        (map["#{data[:ecosystem]}/#{name}"] ||= []) << { version: data[:version_used], vulns: hashes(data[:vulnerabilities]) }
+      end
+    end
+
+    def mark_flat_constraints(data, advisories)
+      constraints = hashes(data[:constraints])
+      return if constraints.empty?
+
+      eco = data[:ecosystem]
+      constraints.each do |constraint|
+        entry = advisories["#{eco}/#{constraint[:dependency]}"]
+        next if entry.nil?
+
+        vulns = entry[:vulns]
+        next unless VulnerabilityHelper.severity_at_or_above?(vulns, SECURITY_THRESHOLD)
+
+        constraint[:capped_dep_vulnerable] = true
+        mark_below_fix(constraint, vulns, entry[:used_version])
+      end
+    end
+
+    # NESTED below-the-fix (npm/cargo). The pure poison cap is suppressed for these
+    # ecosystems (caret default + nested copies over-claim), so a candidate is
+    # promoted ONLY when it genuinely holds a vulnerable copy below its fix, checked
+    # at PATCH precision. When one is, it takes the same shape the flat path renders,
+    # and :poison is set here (the only npm/cargo poison there is is a below-fix).
+    def promote_nested_below_fix(data, copies)
+      eco = data[:ecosystem]
+      # Consume the candidates: they are an internal work-list, never serialized.
+      promoted = hashes(data.delete(:capped_deps)).filter_map do |candidate|
+        dep_copies = copies["#{eco}/#{candidate[:dependency]}"] || []
+        nested_below_fix(eco, candidate[:dependency], candidate[:requirement], dep_copies)
+      end
+      return if promoted.empty?
+
+      data[:constraints] = promoted
+      data[:poison] = true
+      data[:poison_severity] = :critical
+    end
+
+    # A below-fix finding for one capped dep, or nil. The claim holds only when
+    # EVERY resolved copy the constraint governs is vulnerable to the same HIGH+
+    # advisory (condition 5: no safe in-constraint copy to resolve to), AND no fix
+    # of that advisory satisfies the constraint (the wall, at patch precision). A
+    # patched copy sitting OUTSIDE the constraint elsewhere in the tree is irrelevant
+    # -- it can't lift the copy this capper pins -- so it never enters this view.
+    def nested_below_fix(ecosystem, dependency, requirement, dep_copies)
+      in_constraint = dep_copies.select { |copy| satisfies?(requirement, copy[:version], ecosystem) }
+      return if in_constraint.empty?
+
+      oldest = in_constraint.map { |copy| copy[:version] }.min_by { |version| gem_version(version) }
+      stuck = candidate_advisories(in_constraint).select do |advisory|
+        walls?(requirement, advisory, ecosystem, oldest) && every_copy_affected?(in_constraint, advisory)
+      end
+      return if stuck.empty?
+
+      receipt = stuck.min_by { |advisory| gem_version(nearest_fix(advisory, oldest)) }
+      {
+        dependency: dependency,
+        requirement: requirement,
+        capped_dep_vulnerable: true,
+        capped_below_fix: true,
+        below_fix_advisory: receipt[:id],
+        below_fix_fixed_in: nearest_fix(receipt, oldest),
+      }
+    end
+
+    def satisfies?(requirement, version, ecosystem)
+      SemverSatisfaction.evaluate(requirement: requirement, version: version, ecosystem: ecosystem) == true
+    end
+
+    # HIGH+ advisories with a known fix, deduped by id, across the in-constraint copies.
+    def candidate_advisories(copies)
+      copies.flat_map { |copy| copy[:vulns] }
+        .select { |vuln| BELOW_FIX_LABELS.include?(VulnerabilityHelper.advisory_severity(vuln)) && Array(vuln[:fixed_versions]).any? }
+        .uniq { |vuln| vuln[:id] }
+    end
+
+    # The wall: NO applicable fix satisfies the constraint at patch precision. Every
+    # fix must be a DEFINITE non-match (evaluate == false); an undecidable fix (nil,
+    # unparseable) blocks the claim rather than counting as unreachable, so we never
+    # fabricate a wall from input we couldn't parse.
+    def walls?(requirement, advisory, ecosystem, oldest_affected)
+      fixes = applicable_fixes(advisory, oldest_affected)
+      fixes.any? && fixes.all? { |fix| SemverSatisfaction.evaluate(requirement: requirement, version: fix, ecosystem: ecosystem) == false }
+    end
+
+    # Condition 5: every governed copy is vulnerable to THIS advisory (none is a safe
+    # version you could resolve to within the cap).
+    def every_copy_affected?(copies, advisory)
+      copies.all? { |copy| copy[:vulns].any? { |vuln| vuln[:id] == advisory[:id] } }
+    end
+
+    # The sharper claim on a security-relevant cap: does it hold you BELOW THE FIX?
+    # A HIGH+ advisory with a known fix establishes it only when EVERY fixed version
+    # lands outside the cap (a major it forbids) -- you cannot patch the CVE without
+    # replacing the dormant capper. The receipt names the advisory and its nearest
+    # fix (the lowest fixed version, all of which are outside the cap).
+    def mark_below_fix(constraint, vulns, used_version)
+      stuck = vulns.select do |vuln|
+        fixes = applicable_fixes(vuln, used_version)
+        next false if fixes.empty?
+        next false unless BELOW_FIX_LABELS.include?(VulnerabilityHelper.advisory_severity(vuln))
+
+        fixes.none? { |fix| ConstraintHelper.reachable_within_cap?(constraint, fix) }
+      end
+      return if stuck.empty?
+
+      receipt = stuck.min_by { |vuln| gem_version(nearest_fix(vuln, used_version)) }
+      constraint[:capped_below_fix] = true
+      constraint[:below_fix_advisory] = receipt[:id]
+      constraint[:below_fix_fixed_in] = nearest_fix(receipt, used_version)
+    end
+
+    # An advisory lists a fixed version per affected range; only fixes ABOVE the
+    # version in hand are real remediation. A fix at or below it belongs to an older
+    # release line (a downgrade), so it neither patches this version nor counts as
+    # "reachable within the cap". With no known used version (older data), all fixes
+    # are kept -- the pre-existing behaviour, never fewer findings than before.
+    def applicable_fixes(vuln, used_version)
+      fixes = Array(vuln[:fixed_versions])
+      return fixes if used_version.nil? || !Gem::Version.correct?(used_version.to_s)
+
+      used = gem_version(used_version)
+      fixes.select { |fix| !Gem::Version.correct?(fix.to_s) || gem_version(fix) > used }
+    end
+
+    # The lowest applicable fixed version, for the "fixed in X" receipt. A parseable
+    # version always beats an unparseable one (PyPI epoch `1!2.3.4`, or garbage), so
+    # the receipt never names an odd string when a clean fix is present; only when
+    # EVERY fix is unparseable does it fall back to one of those.
+    def nearest_fix(vuln, used_version)
+      applicable_fixes(vuln, used_version).min_by { |fix| [Gem::Version.correct?(fix.to_s) ? 0 : 1, gem_version(fix)] }
+    end
+
+    # A version key that sorts fix strings without raising; an unparseable version
+    # collapses to 0 (only reached as a tiebreak among all-unparseable fixes, since
+    # nearest_fix prefers parseable ones).
+    def gem_version(version)
+      Gem::Version.new(version.to_s)
+    rescue ArgumentError
+      Gem::Version.new("0")
+    end
+  end
+end

data/lib/still_active/pypi_client.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require_relative "../helpers/http_helper"
+require_relative "version"
+
+module StillActive
+  # The authoritative source for a PyPI release's declared Python constraint,
+  # used by the cross-ecosystem language-runtime ceiling. `requires_python` is
+  # set once per release and enforced by pip as a hard install wall (a real
+  # resolver refuses an incompatible interpreter), so still_active reads it from
+  # PyPI's release-level `info.requires_python` rather than a per-file wheel value
+  # or deps.dev (which does not carry the field). pypi.org is a public source,
+  # queried with no credentials.
+  #
+  # Best-effort like every other network entry point: an unindexed version,
+  # schema drift, or a transport failure degrades to nil (no ceiling), never a
+  # raise that could abort the per-package audit.
+  module PypiClient
+    extend self
+
+    BASE_URI = URI("https://pypi.org/")
+    # Polite identification, matching EcosystemsClient's convention.
+    USER_AGENT = "still_active/#{StillActive::VERSION} (+https://github.com/SeanLF/still_active)"
+
+    # The PEP 440 `requires_python` specifier a release declares (e.g.
+    # ">=3.8,<3.13"), or nil when the version is unreadable or declares none.
+    # PyPI renders an unset constraint as an empty string; normalize it to nil so
+    # callers get a single "no constraint" signal.
+    def requires_python(name:, version:)
+      return if name.nil? || version.nil?
+
+      path = "/pypi/#{encode(name)}/#{encode(version)}/json"
+      body = HttpHelper.get_json(BASE_URI, path, headers: { "User-Agent" => USER_AGENT })
+      return unless body.is_a?(Hash)
+
+      # Guard the nested read: a non-Hash `info` (schema drift) would make
+      # Hash#dig raise TypeError, which -- since this is the LAST enrichment in
+      # EcosystemLens#assess -- would propagate to the per-package rescue and
+      # discard the package's already-computed vuln/poison/staleness findings.
+      # Best-effort must never demote the core audit; degrade to nil.
+      info = body["info"]
+      return unless info.is_a?(Hash)
+
+      value = info["requires_python"]
+      return unless value.is_a?(String) && !value.strip.empty?
+
+      value
+    end
+
+    private
+
+    def encode(segment)
+      URI.encode_www_form_component(segment)
+    end
+  end
+end

data/lib/still_active/sarif/rules.rb

@@ -2,7 +2,7 @@
 
 module StillActive
   module Sarif
-    # Catalog of SARIF rules emitted by still_active. Rule IDs (SA001-SA007)
+    # Catalog of SARIF rules emitted by still_active. Rule IDs (SA001-SA009)
     # are stable across versions; renames or removals are breaking changes.
     #
     # Each rule maps a still_active finding into a SARIF result. Security
@@ -17,14 +17,18 @@ module StillActive
         "#{DOCS_BASE}##{rule_id.downcase}"
       end
 
-      # CVSS 0-10 -> SARIF level. Per GitHub Code Scanning convention,
-      # scores >= 7.0 map to error, 4.0-6.9 to warning, below 4.0 to note.
-      def cvss_to_level(score)
-        return "note" if score.nil?
-        return "error" if score >= 7.0
-        return "warning" if score >= 4.0
-
-        "note"
+      def severity_to_level(label)
+        # Maps a resolved advisory severity label (VulnerabilityHelper.advisory_severity:
+        # a real CVSS score OR the OSV/GHSA label) to a SARIF level. A nil label is a
+        # confirmed-but-unscored advisory (no CVSS score and no OSV label, e.g. a fresh
+        # CVE) -- elevated to warning, not an informational note, so a gate can't read
+        # it as clean. This is the SARIF analogue of the CLI gate's fail-closed.
+        case label
+        when "critical", "high" then "error"
+        when "medium" then "warning"
+        when "low" then "note"
+        else "warning"
+        end
       end
 
       # SARIF security-severity must be a string with one decimal place.
@@ -105,6 +109,26 @@ module StillActive
           security_severity: "8.0",
           tags: ["security", "supply-chain", "external/cwe/cwe-1104"],
         },
+        {
+          id: "SA008",
+          name: "PoisonPill",
+          short: "Dormant gem caps a dependency below its latest major",
+          full: "A dormant (abandoned or archived) gem declares a runtime constraint that caps one of its dependencies below that dependency's current latest major. Because nobody is shipping the gem, the cap will never lift, and it grows more constraining as the capped dependency releases new majors: the tree is held below a ceiling no upstream release will raise.",
+          help_text: "Replace or fork the dormant gem, or vendor a version that relaxes the constraint. For a transitive pill, target the direct dependency that pulls it in.",
+          level: "warning",
+          security_severity: nil, # maintenance/resolvability, not a CVE (as SA002/SA004/SA005)
+          tags: ["maintenance", "supply-chain", "external/cwe/cwe-1104"],
+        },
+        {
+          id: "SA009",
+          name: "RuntimeCeiling",
+          short: "Resolved package version caps its language runtime",
+          full: "A resolved package version's declared runtime constraint (Ruby `ruby_version`, Python `requires_python`) caps the language runtime you can run: either below every still-supported release (stranding you on an end-of-life runtime with no security patches) or below the latest stable (a compatibility ceiling to plan around). The default level is note; an EOL-forcing cap is raised to error per result.",
+          help_text: "If a newer release of the package lifts the cap, upgrade it. Otherwise replace or fork the package, or contribute support for the newer runtime upstream.",
+          level: "note",
+          security_severity: nil, # maintenance/compatibility, not a CVE (as SA002/SA004/SA005/SA008)
+          tags: ["maintenance", "runtime", "external/cwe/cwe-1104"],
+        },
       ].freeze
 
       CATALOG = RAW_RULES.map do |r|

data/lib/still_active/sbom_reader.rb

@@ -0,0 +1,191 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+require "package_url"
+
+module StillActive
+  # Reads a CycloneDX SBOM (e.g. produced by Syft) into a clean, normalized
+  # dependency set -- the breadth input for non-Ruby ecosystems, where the
+  # maintenance lens runs over deps.dev/ecosyste.ms.
+  #
+  # `parse` returns both the assessable dependencies AND the components it could
+  # NOT assess (a real dependency in an unsupported ecosystem, or a library with
+  # no PURL -- typically a git/path/local source). Surfacing those is the point:
+  # silently dropping them would let an audit report "all clear" while ignoring
+  # the deps that are often the riskiest. Genuine non-package noise (GitHub
+  # Actions `pkg:github`, opaque binaries `pkg:generic`, and file/application
+  # components) is excluded, not surfaced.
+  #
+  # `read` keeps the simple "just the dependencies" shape. Never raises -- a
+  # missing/malformed SBOM or a bad PURL degrades to empty/skip.
+  module SbomReader
+    extend self
+
+    Result = Data.define(:dependencies, :unassessable)
+
+    # PURL type -> still_active ecosystem (also the deps.dev `system`, lowercased).
+    ECOSYSTEMS = {
+      "gem" => :rubygems,
+      "npm" => :npm,
+      "pypi" => :pypi,
+      "cargo" => :cargo,
+      "maven" => :maven,
+      "golang" => :go,
+      "nuget" => :nuget,
+    }.freeze
+
+    # PURL types that are not package dependencies: CI actions and opaque
+    # binaries. Excluded from both lists (not "unassessed deps").
+    NOISE_TYPES = ["github", "generic"].freeze
+
+    def read(path) = parse(path).dependencies
+    def read_string(body) = parse_string(body).dependencies
+
+    def parse(path)
+      parse_string(File.read(path))
+    rescue SystemCallError, IOError
+      Result.new(dependencies: [], unassessable: [])
+    end
+
+    def parse_string(body)
+      doc = JSON.parse(body)
+      components = doc.is_a?(Hash) ? doc["components"] : nil
+      return Result.new(dependencies: [], unassessable: []) unless components.is_a?(Array)
+
+      # Only trust the prod/dev split when the generator actually marks it
+      # somewhere (scope, or a dev property). syft-style SBOMs mark nothing, so an
+      # unmarked component is genuinely unknown -- never assume it's production.
+      # Scoped to library components: scope/properties are legal on any component
+      # type (application/file/...), and a dev signal on one of those is unrelated
+      # to whether the dependency library components are marked.
+      marks_dev = components.any? { |c| c.is_a?(Hash) && c["type"] == "library" && dev_signal?(c) }
+
+      deps = []
+      unassessable = []
+      components.each do |component|
+        kind, entry = classify(component)
+        entry[:production] = !dev_signal?(component) if kind == :dependency && marks_dev
+        deps << entry if kind == :dependency
+        unassessable << entry if kind == :unassessable
+      end
+      # uniq collapses a package that a generator lists more than once (e.g. Syft's
+      # per-location entries); `production` is derived from each component's own
+      # signal, so duplicates of the same name+version dedup cleanly unless a
+      # generator marks the copies inconsistently (malformed; not observed).
+      Result.new(dependencies: deps.uniq, unassessable: unassessable.uniq)
+    rescue JSON::ParserError
+      Result.new(dependencies: [], unassessable: [])
+    end
+
+    private
+
+    # Whether a component is marked dev/test-only. CycloneDX `scope` (excluded =
+    # not part of the product, optional = not needed at runtime) is the standard;
+    # tools that don't set scope may instead emit a property (cyclonedx-npm's
+    # `cdx:npm:package:development=true`). Absent both, this is false -- the caller
+    # only trusts a false when the document marks dev somewhere.
+    def dev_signal?(component)
+      scope = component["scope"]
+      return true if scope == "excluded" || scope == "optional"
+
+      Array(component["properties"]).any? do |p|
+        p.is_a?(Hash) && p["value"] == "true" && p["name"].to_s.match?(/(\A|:)dev(elopment)?\z/)
+      end
+    end
+
+    # [:dependency, {...}] | [:unassessable, {...}] | nil (non-package noise).
+    def classify(component)
+      return unless component.is_a?(Hash) && component["type"] == "library"
+
+      name = component["name"]
+      purl = component["purl"]
+      return [:unassessable, { ecosystem: nil, name: name, reason: :no_purl }] unless purl.is_a?(String) && !purl.empty?
+
+      classify_purl(purl, name)
+    end
+
+    # Public registry hosts per ecosystem. A purl `repository_url` qualifier means
+    # a non-default (private/alternative) registry per the purl spec, EXCEPT when a
+    # generator redundantly names the public one -- so we still assess those.
+    PUBLIC_REGISTRY_HOSTS = [
+      "rubygems.org",
+      "registry.npmjs.org",
+      "npmjs.org",
+      "registry.yarnpkg.com",
+      "pypi.org",
+      "files.pythonhosted.org",
+      "crates.io",
+      "static.crates.io",
+      "index.crates.io",
+      "repo1.maven.org",
+      "repo.maven.apache.org",
+      "api.nuget.org",
+      "proxy.golang.org",
+    ].freeze
+
+    def classify_purl(purl, name)
+      parsed = PackageURL.parse(purl)
+      type = parsed.type&.downcase
+      ecosystem = ECOSYSTEMS[type]
+
+      if ecosystem
+        return [:unassessable, { ecosystem: type, name: name, reason: :no_version }] if parsed.version.to_s.empty?
+
+        full_name = build_name(ecosystem, parsed.namespace, parsed.name)
+        repository_url = parsed.qualifiers&.dig("repository_url")
+        # A private/alternative registry: never look the name up on the public
+        # registry (a same-named public package's data is not this one's -- the #43
+        # dependency-confusion guard, cross-ecosystem). We never dial the URL; its
+        # presence alone is the signal. Limit: this can only fire when the SBOM
+        # carries repository_url; a generator that omits it (Syft often can't
+        # determine the source registry) leaves a private package indistinguishable
+        # from a public one, so it is still assessed by name. Best-effort, not a
+        # guarantee that every private package is caught.
+        if repository_url && !public_registry?(repository_url)
+          return [:unassessable, { ecosystem: ecosystem, name: full_name, version: parsed.version, reason: :private_registry, repository_url: repository_url }]
+        end
+
+        [:dependency, { ecosystem: ecosystem, name: full_name, version: parsed.version }]
+      elsif NOISE_TYPES.include?(type)
+        nil # CI actions / opaque binaries: not a package dependency
+      else
+        [:unassessable, { ecosystem: type, name: name, reason: :unsupported_ecosystem }]
+      end
+    rescue ArgumentError
+      # InvalidPackageURL is a subclass of ArgumentError, but PackageURL.parse also
+      # raises a BARE ArgumentError on an empty name-after-namespace (`pkg:npm/@1.0.0`)
+      # or bad percent-encoding, both common in real Syft/Trivy output. Catch both so
+      # one malformed component degrades to unassessable, never a backtrace that drops
+      # every other dependency's verdict (SbomReader's documented "never raises").
+      [:unassessable, { ecosystem: nil, name: name, reason: :malformed_purl }]
+    end
+
+    # Whether a repository_url points at a known public registry. We only read the
+    # host; we never connect to it (a lockfile/SBOM-derived URL is untrusted). An
+    # unparseable or non-public host reads as private, failing safe.
+    def public_registry?(repository_url)
+      host = registry_host(repository_url)
+      !host.nil? && PUBLIC_REGISTRY_HOSTS.include?(host)
+    end
+
+    def registry_host(url)
+      URI.parse(url.include?("//") ? url : "//#{url}").host&.downcase
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    # Reconstruct the lookup name from the PURL's namespace + name: npm
+    # `@scope/name`, maven `group:artifact`, Go module path `github.com/owner/name`;
+    # pypi/cargo/gem/nuget have no namespace and use the bare name.
+    def build_name(ecosystem, namespace, name)
+      return name if namespace.to_s.empty?
+
+      case ecosystem
+      when :npm, :go then "#{namespace}/#{name}"
+      when :maven then "#{namespace}:#{name}"
+      else name
+      end
+    end
+  end
+end

data/lib/still_active/sbom_workflow.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require_relative "ecosystem_lens"
+require_relative "ceiling_reconciler"
+require_relative "poison_security_correlator"
+require_relative "../helpers/python_helper"
+require "async"
+require "async/barrier"
+require "async/semaphore"
+
+module StillActive
+  # The SBOM audit's fan-out, parallel to Workflow but for a cross-ecosystem
+  # SBOM rather than a Bundler lockfile: it runs EcosystemLens over each
+  # dependency concurrently and returns a result hash the same output path can
+  # render. Keyed by "ecosystem/name@version" (not bare name) so nothing collides
+  # and overwrites: not an npm `foo` against a pypi `foo`, and -- the case a merged
+  # monorepo SBOM actually produces -- not two versions of the same package pinned
+  # by different subprojects (a lockfile resolves one version per name, an SBOM
+  # doesn't). Each is a distinct assessable unit with its own version-specific
+  # advisory set, so collapsing them would silently drop one dep's verdict.
+  module SbomWorkflow
+    extend self
+
+    # `assessed` is the "ecosystem/name@version" => gem_data hash; `failures` is
+    # the deps whose lens call raised (a rate-limited/flaky deps.dev, or a bug
+    # hitting every dep). The two are returned separately so run_sbom can surface
+    # the failures instead of dropping them: a raised dep that just vanished would
+    # be absent from the JSON, uncounted, and past the exit gate, letting a
+    # rate-limited run read "all clear" while silently skipping deps.
+    Outcome = Data.define(:assessed, :failures)
+
+    def call(sbom_result, &on_progress)
+      dependencies = sbom_result.dependencies
+      Async do
+        # The Python runtime support window, fetched once for the whole SBOM (the
+        # language-ceiling input for pypi deps). Guarded like the native Ruby path:
+        # a feed failure degrades to "no ceiling checks", never aborts the audit.
+        python_range =
+          begin
+            PythonHelper.supported_python_range
+          rescue StandardError => e
+            $stderr.puts("warning: Python support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
+            nil
+          end
+        barrier = Async::Barrier.new
+        semaphore = Async::Semaphore.new(StillActive.config.parallelism, parent: barrier)
+        result = {}
+        failures = []
+        # Memoizes each capped dep's RESOLVED latest version across the whole SBOM
+        # (keyed by ecosystem+name inside the lens), so a dep pinned by several
+        # dormant packages is fetched once. Unresolved lookups aren't cached (a
+        # transient nil must not suppress a later package's pill), so concurrent
+        # first-misses on the same dep may briefly double-fetch; harmless.
+        constraint_cache = {}
+        total = dependencies.size
+        completed = 0
+        dependencies.each do |dep|
+          semaphore.async do
+            # Carry the SBOM's prod-vs-dev/test verdict onto the assessment so the
+            # output can separate prod risk from test debt. `slice` copies it only
+            # when the SBOM actually marked it (SbomReader leaves the key absent
+            # otherwise): absent stays "unknown", never a false that reads as test-only.
+            result["#{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}"] =
+              EcosystemLens.assess(ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], constraint_cache: constraint_cache, python_range: python_range)
+                .merge(dep.slice(:production))
+          rescue StandardError => e
+            # One dependency's failure must not abort the audit, but it must not
+            # disappear either: record it as an unassessable entry (same shape as
+            # the reader's, with a distinct reason) so it's counted and reported.
+            # production rides along (when known, via slice) so a failed prod dep
+            # stays distinguishable from a failed dev one.
+            failures << { ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], reason: :assessment_error, error: "#{e.class}: #{e.message}" }
+              .merge(dep.slice(:production))
+            $stderr.puts("error assessing #{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}: #{e.class}\n\t#{e.message}")
+          ensure
+            completed += 1
+            on_progress&.call(completed, total)
+          end
+        end
+        barrier.wait
+        # Whole-tree correlation once every package's signals are in: a Python
+        # ceiling's "upgrade to lift it" must not contradict a poison finding that
+        # caps the same package below that upgrade (same guarantee as the native path).
+        CeilingReconciler.reconcile_ceiling_with_poison(result)
+        # Flag poison caps that pin a vulnerable dependency (the moat's strongest
+        # case: an archived package holding you on a known-vulnerable dep).
+        PoisonSecurityCorrelator.correlate(result)
+        # Stable, diffable order regardless of async completion order.
+        Outcome.new(
+          assessed: result.sort_by { |key, _| key }.to_h,
+          failures: failures.sort_by { |failure| "#{failure[:ecosystem]}/#{failure[:name]}@#{failure[:version]}" },
+        )
+      end.wait
+    end
+  end
+end