@aqaf/cli 1.1.0 → 1.1.1

package/vendor/aqaf/cli.py

@@ -11,6 +11,7 @@ from pathlib import Path
 from collections import Counter, defaultdict
 from . import __version__
 from .registry import Registry, ProfileError, read_doc
+from .evidence import parent_context, rust_test_count, has_warning_call
 
 def _metadata():
     """Bundled source index; gracefully return empty if a developer copy is incomplete."""
@@ -61,16 +62,10 @@ class Finding:
         self.evidence=evidence; self.risk=risk; self.recommendation=recommendation; self.confidence=confidence
     def to_dict(self): return self.__dict__
 
-def iter_files(root: Path):
-    for dirpath, dirnames, filenames in os.walk(root):
-        dirnames[:] = sorted(d for d in dirnames if d not in SKIP_DIRS and not d.startswith('.cache'))
-        for f in sorted(filenames):
-            p=Path(dirpath)/f
-            if p.is_symlink(): continue
-            try:
-                if p.stat().st_size > 1_500_000: continue
-            except OSError: continue
-            yield p
+def iter_files(root: Path, respect_gitignore=True, policy='typed'):
+    from .scope import Scope
+    yield from Scope(root,respect_gitignore=respect_gitignore,policy=policy).build().files
+
 
 def rel(p, root):
     try: return str(p.relative_to(root))
@@ -80,8 +75,18 @@ def read_text(p):
     try: return p.read_text(encoding='utf-8', errors='ignore')
     except Exception: return ''
 
-def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", capabilities=()):
-    files=list(iter_files(root))
+def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", capabilities=(), review_signals=False, respect_gitignore=True, scope_policy='typed', scope_config=None,
+         inventory_all=False, component=None, review_options=None, session=None, review_knowledge=False):
+    from .scope import Scope
+    scope=session or Scope(root,respect_gitignore,scope_policy,scope_config,inventory_all).build()
+    root=scope.root
+    files=scope.files
+    if component:
+        selected=next((n for n in scope.nodes if n['id']==component or n['root']==component),None)
+        if selected is None:raise ValueError('Unknown component/root: '+component)
+        root=scope.root if selected['root']=='.' else scope.root/selected['root']
+        files=[r['path'] for r in scope.records if r['owner']==selected['id']]
+    read=scope.text
     code=[p for p in files if p.suffix.lower() in CODE_EXTS]
     # Exclude AQAF's own scanner when it has been copied into a target repo; otherwise it can bias product detection.
     app_code=[p for p in code if p.name.lower() != 'aqaf.py']
@@ -89,14 +94,14 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
     exts=Counter(p.suffix.lower() for p in files)
     names={p.name.lower() for p in files}
     path_text='\n'.join(rel(p,root).lower() for p in files)
-    sample_text='\n'.join(read_text(p)[:2000].lower() for p in detection_code[:250])
+    sample_text='\n'.join(read(p)[:2000].lower() for p in detection_code[:250])
 
     findings=[]
     signals=[]
 
     # Data-only registry makes product types additive without changing the scanner core.
     reg = registry or Registry()
-    detected_product, evidence_signals, detection_confidence, candidates = reg.detect(files,root,detection_code,pack)
+    detected_product, evidence_signals, detection_confidence, candidates = reg.detect(files,root,detection_code,pack,reader=scope.text)
     product = detected_product
     if profile != 'auto':
         chosen=reg.get_profile(profile)
@@ -117,8 +122,11 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
         if not re.fullmatch(r'[a-z][a-z0-9_]{1,63}',c):
             raise ValueError(f'Invalid capability: {c}')
 
+    context = parent_context(root)
+
     # docs/ADRs
     has_arch_docs = any('adr' in rel(p,root).lower() or 'architecture' in rel(p,root).lower() for p in files if p.suffix.lower() in {'.md','.adoc','.rst'})
+    has_arch_docs = has_arch_docs or bool(context['architecture_files'])
     if not has_arch_docs:
         findings.append(Finding('AQ-DOC-001','medium','No architecture decision records or architecture docs found',
             'No files with ADR/architecture naming were found.',
@@ -127,14 +135,18 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
 
     # tests
     test_files=[p for p in files if re.search(r'(^|/|\\)(tests?|__tests__)(/|\\)', str(p).lower()) or re.search(r'(test_|_test\.|\.spec\.|\.test\.)', p.name.lower())]
-    if len(test_files)==0:
+    inline_rust_tests = sum(rust_test_count(read(p)) for p in code if p.suffix.lower() == '.rs' and p not in test_files)
+    test_evidence = len(test_files) + inline_rust_tests
+    # One actual inline test is meaningful for a tiny crate; keep the size-based warning.
+    minimum_tests = max(1 if inline_rust_tests else 3, len(code)//50)
+    if test_evidence==0:
         findings.append(Finding('AQ-TST-001','high','No tests detected',
             'No conventional test files or test directories were found.',
             'Architecture refactoring becomes risky because behavior is not protected.',
             'Add characterization tests around critical workflows before structural refactoring.', 'high'))
-    elif len(test_files) < max(3, len(code)//50):
+    elif test_evidence < minimum_tests:
         findings.append(Finding('AQ-TST-001','medium','Low visible test density',
-            f'{len(test_files)} test-like files for {len(code)} code files.',
+            f'{len(test_files)} test-like files' + (f' and {inline_rust_tests} inline Rust tests' if inline_rust_tests else '') + f' for {len(code)} code files.',
             'Important behavior may be unprotected during AI-generated changes.',
             'Add tests for the modules affected by upcoming architecture work.', 'medium'))
 
@@ -149,7 +161,7 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
     # secrets/config
     secret_hits=[]
     for p in code[:1000]:
-        txt=read_text(p)
+        txt=read(p)
         for pat in SECRET_PATTERNS:
             if pat.search(txt):
                 secret_hits.append(rel(p,root)); break
@@ -161,7 +173,7 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
 
     # module boundaries
     module_dirs = [d for d in ['modules','features','domains','domain','application','infrastructure','adapters','services','src'] if (root/d).exists()]
-    if len(code)>30 and not any((root/d).exists() for d in ['modules','features','domain','domains','application']):
+    if len(code)>30 and not any((root/d).exists() for d in ['modules','features','domain','domains','application']) and (component or len(scope.nodes)==1):
         findings.append(Finding('AQ-MOD-001','high','Growing codebase lacks obvious domain/feature module boundaries',
             f'{len(code)} code files found, but no conventional modules/features/domain/application boundary directories.',
             'Feature additions may spread logic across unrelated files, increasing change blast radius.',
@@ -172,7 +184,7 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
     for p in code:
         rp=rel(p,root).lower()
         if any(seg in ('/' + rp.replace('\\','/')) for seg in ['/domain/','/core/']):
-            txt=read_text(p).lower()
+            txt=read(p).lower()
             volatile=['sqlalchemy','django','flask','requests','boto3','firebase','androidx','wordpress','wp_','openai','ollama','stripe']
             if any(v in txt for v in volatile):
                 dep_hits.append(rel(p,root))
@@ -186,9 +198,9 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
     operational_terms=['requests.','fetch(','axios','subprocess','open(','write_text','read_text','sqlite','psycopg','mysql','smtplib','shutil','ffmpeg','yt-dlp']
     operational_files=[]; logging_files=0
     for p in code:
-        txt=read_text(p).lower()
+        txt=read(p).lower()
         if any(t in txt for t in operational_terms): operational_files.append(p)
-        if any(t in txt for t in ['logging.','logger.','console.error','log.error','print(']): logging_files+=1
+        if any(t in txt for t in ['logging.','logger.','console.error','log.error','print(']) or has_warning_call(txt, python=p.suffix.lower()=='.py'): logging_files+=1
     if operational_files and logging_files < max(1, len(operational_files)//5):
         findings.append(Finding('AQ-OBS-001','medium','Operational code has little visible logging',
             f'{len(operational_files)} files appear to touch IO/network/processes; logging appears in {logging_files} files.',
@@ -199,6 +211,7 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
     if product in {'saas_or_web_app','ai_pipeline','api_backend'}:
         has_db=any(x in sample_text for x in ['sqlite','postgres','mysql','sqlalchemy','prisma','typeorm','sequelize','mongoose'])
         has_migrations=any('migration' in rel(p,root).lower() or 'alembic' in rel(p,root).lower() or 'prisma/migrations' in rel(p,root).lower() for p in files)
+        has_migrations = has_migrations or bool(context['migration_files'])
         if has_db and not has_migrations:
             findings.append(Finding('AQ-DATA-001','high','Database usage detected without obvious migration strategy',
                 'Database-related terms were found, but no migration directory/tooling was detected.',
@@ -243,7 +256,7 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
         io_terms=['urlsession', 'filemanager', 'sqlite', 'coredata', 'userdefaults', 'keychain', 'openai', 'ollama', 'firebase', 'alamofire', 'stripe']
         ui_io=[]
         for p in swift_files:
-            txt=read_text(p).lower()
+            txt=read(p).lower()
             rp=rel(p,root).lower()
             if any(u in txt for u in ui_terms) and any(i in txt for i in io_terms):
                 ui_io.append(rel(p,root))
@@ -266,7 +279,7 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
         main=root/'src'/'main.rs'
         lib=root/'src'/'lib.rs'
         if main.exists():
-            mt=read_text(main)
+            mt=read(main)
             main_lines=len([ln for ln in mt.splitlines() if ln.strip() and not ln.strip().startswith('//')])
             if main_lines>180 or (not lib.exists() and len(rust_files)>3):
                 findings.append(Finding('AQ-RUST-001','high','Rust binary entrypoint may contain too much core logic',
@@ -275,7 +288,7 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
                     'Move core workflows into src/lib.rs/modules or workspace crates; keep main.rs thin.', 'medium'))
         unsafe_hits=[]
         for p in rust_files:
-            txt=read_text(p)
+            txt=read(p)
             if 'unsafe ' in txt or 'unsafe{' in txt.replace(' ',''):
                 # crude safety comment check near unsafe
                 if 'SAFETY:' not in txt and 'Safety:' not in txt:
@@ -298,7 +311,7 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
     if product == 'browser_extension':
         for manifest in (p for p in files if p.name.lower()=='manifest.json'):
             try:
-                m=json.loads(read_text(manifest))
+                m=json.loads(read(manifest))
                 if not isinstance(m,dict) or 'manifest_version' not in m: continue
                 perms=m.get('host_permissions',[])+m.get('permissions',[])
                 if not isinstance(perms,list): continue
@@ -312,7 +325,7 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
     if product == 'google_apps_script':
         for p in code:
             if p.suffix.lower() not in {'.js','.gs'}: continue
-            content=read_text(p)
+            content=read(p)
             # Only nearby text around a trigger signature is inspected; avoids pretending to parse the JS AST.
             for match in re.finditer(r'function\s+(onEdit|onOpen|doGet|doPost)\s*\(',content):
                 neighborhood=content[match.start():match.start()+900]
@@ -326,7 +339,7 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
         for p in files:
             if p.parent==root and p.name=='package.json':
                 try:
-                    data=json.loads(read_text(p))
+                    data=json.loads(read(p))
                     if not any(data.get(k) for k in ('exports','main','bin')):
                         findings.append(Finding('AQ-NPM-001','medium','No explicit library export or executable entrypoint detected',
                             'package.json has none of exports, main, bin.',
@@ -349,6 +362,7 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
         'detected_product_type': detected_product,
         'limitations': ['Static structure and regex heuristics only', 'Does not execute target repository code', 'No measured runtime behavior, threat modeling, or performance tests', 'File absence is not proof a capability is absent', 'Index is not independently calibrated or certified'],
         'root':str(root),
+        'context_evidence': context,
         'product_type':product,
         'selected_pack':pack,
         'product_profile_status':chosen['status'],
@@ -375,6 +389,40 @@ def scan(root: Path, profile: str = "auto", registry=None, pack: str = "auto", c
         {'id': sid, 'title': registry[sid]['title'], 'url': registry[sid]['url'], 'type': registry[sid]['type']}
         for sid in sorted(source_ids) if sid in registry
     ]
+    # Child classifications and context are descriptive, not averaged scores.
+    for node in scope.nodes:
+        owned=[r['path'] for r in scope.records if r['owner']==node['id']]
+        child_root=scope.root if node['root']=='.' else scope.root/node['root']
+        child_code=[p for p in owned if p.suffix.lower() in CODE_EXTS]
+        child_profile,child_signals,confidence,_=reg.detect(owned,child_root,child_code,pack,reader=scope.text)
+        if node.get('profile_override'):
+            reg.get_profile(node['profile_override']);child_profile=node['profile_override'];confidence='user-selected'
+        node['classification']={'product_type':child_profile,'confidence':confidence,'signals':child_signals}
+        own_tests=[p for p in owned if re.search(r'(^|/)(tests?|__tests__)/|(?:test_|_test\.|\.test\.|\.spec\.)',p.relative_to(child_root).as_posix())]
+        own_docs=[p.relative_to(scope.root).as_posix() for p in owned if p.suffix.lower() in {'.md','.rst','.adoc'} and re.search(r'(?i)architecture|(?:^|/)adr(?:/|$)',p.relative_to(scope.root).as_posix())]
+        parent_ids=set();parent=node.get('parent')
+        while parent:
+            parent_ids.add(parent);parent=next((n.get('parent') for n in scope.nodes if n['id']==parent),None)
+        inherited_docs=[r['relative'] for r in scope.records if r['owner'] in parent_ids and r['path'].suffix.lower() in {'.md','.rst','.adoc'} and re.search(r'(?i)architecture|(?:^|/)adr(?:/|$)',r['relative'])]
+        inherited_ci=[r['relative'] for r in scope.records if r['owner'] in parent_ids and '.github/workflows/' in r['relative']]
+        node['assessment']={'code_files':len(child_code),'test_like_files':len(own_tests),'architecture_files':own_docs,'inherited_architecture':inherited_docs,'inherited_ci':inherited_ci,
+                            'status':'selected_source_only' if child_code else 'no_collected_core_code',
+                            'runtime_tests_executed':False,'score':None}
+    result['projects']=scope.graph
+    result['extensions_full']=dict(sorted(exts.items()))
+    scope_metadata=scope.report()
+    if review_signals:
+        from .review import review_files
+        result['review'] = review_files(files, root, scope=scope, **(review_options or {}))
+    result['scope']=scope_metadata
+    result['scope']['analysis_root']=str(root)
+    result['scope']['selected_component']=component
+    result['score_scope']='selected_container_source_not_an_average_of_children'
+    result['assessment_state']='source_collected' if code else 'no_collected_core_code'
+    result['limitations'].append('Scored absence hints describe the selected scope; unsupported or excluded source is not verified.')
+    if review_knowledge:
+        from .knowledge import review_agenda
+        result['review_knowledge']=review_agenda(scope,product,paths=files)
     return result
 
 def md_report(r):
@@ -391,9 +439,28 @@ def md_report(r):
     lines.append(f"**Recommended target:** {r['recommended_target_architecture']}")
     lines.append(f"**Files scanned:** {r['files_scanned']} total, {r['code_files']} code files")
     lines.append('')
+    context = r.get('context_evidence', {})
+    if context.get('root'):
+        lines.append('## Parent context (metadata only)')
+        lines.append('Conventional source-slice parent: ' + context['root'])
+        for key in ('architecture_files', 'migration_files'):
+            for path in context.get(key, []): lines.append('- ' + path)
+        lines.append('Presence is not proof of adequacy; parent source code was not scanned.')
+        lines.append('')
+    if 'scope' in r:
+        scope=r['scope']
+        lines.extend(['## Scope and project coverage','',
+          'Policy: '+scope['policy']+'; respect .gitignore: '+str(scope['respect_gitignore']),
+          'Assessment state: '+r.get('assessment_state','unknown')+'; index applies only to selected source.',
+          'Discovered roots: '+str(len(r.get('projects',{}).get('nodes',[]))),
+          'Pruned subtrees are not a full physical census unless explicitly inventoried.',
+          'Scope outcomes: '+json.dumps(scope['counts'],sort_keys=True),''])
+        for node in r.get('projects',{}).get('nodes',[]):
+            lines.append('- '+node['id']+' / '+node['root']+' / '+node['relationship']+' / '+str(node['files_collected'])+' owned-candidate files')
+        lines.append('')
     lines.append('## Extension summary')
     lines.append('')
-    for ext,count in r['extensions'].items(): lines.append(f'- `{ext or "[no extension]"}`: {count}')
+    for ext,count in r.get('extensions_full',r['extensions']).items(): lines.append(f'- `{ext or "[no extension]"}`: {count}')
     lines.append('')
     lines.append('## Findings')
     lines.append('')
@@ -422,6 +489,30 @@ def md_report(r):
         for src in r['source_registry']:
             lines.append(f"- {src['id']}: {src['title']} — {src['url']}")
         lines.append('')
+    if 'review_knowledge' in r:
+        from .knowledge import markdown_agenda
+        lines.extend(markdown_agenda(r['review_knowledge']))
+    if 'review' in r:
+        review = r['review']
+        lines.append('## Experimental unscored review')
+        lines.append('Static observations and unreviewed candidates; no confirmed defects, score impact or baseline gates.')
+        for signal in review['signals']:
+            location = signal['locations'][0]
+            lines.append(f"- {signal['check_id']} / {signal['kind']} — {location['path']}:{location['line']}:{location['column']}: {signal['observed_fact']}")
+            for control in signal['observed_controls']: lines.append('  - Observed control: ' + control)
+            for unknown in signal['unknowns']: lines.append('  - Unknown: ' + unknown)
+            lines.append('  - Next characterization: ' + signal['next_test'])
+        coverage=review['scope']
+        lines.append('Review files: '+str(coverage.get('files_eligible','unknown'))+' eligible, '+str(coverage['files_attempted'])+' attempted, '+str(coverage.get('files_assessed','unknown'))+' assessed with partial language support.')
+        if coverage.get('zero_attempt_reason'):lines.append('Zero-attempt reason: '+coverage['zero_attempt_reason'])
+        lines.extend(['','| Component | Language | Eligible | Attempted | Assessed |','|---|---|---:|---:|---:|'])
+        for group in coverage.get('groups',[]):lines.append('| '+group['owner']+' | '+group['language']+' | '+str(group['eligible'])+' | '+str(group['attempted'])+' | '+str(group['assessed'])+' |')
+        lines.append('')
+        lines.append('Review scope outcomes: ' + json.dumps(review['scope']['outcomes'], sort_keys=True))
+        for limit in review['limitations']: lines.append('- ' + limit)
+        lines.append('Review sources contextualize concerns, not detector accuracy or endorsement:')
+        for source in review['source_registry']: lines.append(f"- {source['id']}: {source['title']} — {source['url']}")
+        lines.append('')
     lines.append('## Limitations')
     for limit in r['limitations']:
         lines.append('- ' + limit)
@@ -497,13 +588,16 @@ def sarif_report(r):
             'ruleId': f['rule_id'], 'level': {'high':'error','medium':'warning','low':'note'}.get(f['severity'],'note'),
             'message': {'text': f['title'] + '. Evidence: ' + f['evidence'] + '. Recommendation: ' + f['recommendation']},
             'partialFingerprints': {'primaryLocationLineHash': f['fingerprint']},
-            'properties': {'confidence': f['confidence'], 'baselineStatus': f['status'], 'assessmentType': 'heuristic'},
+            'properties': {'confidence': f['confidence'], 'baselineStatus': f.get('status','uncompared'), 'assessmentType': 'heuristic'},
         })
     return {'version':'2.1.0', '$schema':'https://json.schemastore.org/sarif-2.1.0.json', 'runs':[{
         'tool':{'driver':{'name':'AQAF', 'version':__version__,
           'rules':[{'id': k, 'name':k, 'shortDescription':{'text':v[1]}} for k,v in RULE_META.items()]}},
         'results':results,
-        'properties':{'disclaimer':'Heuristic architecture hints, not security findings or a validated score.'}
+        'properties':{'disclaimer':'Heuristic architecture hints, not security findings or a validated score.',
+                      **({'review_knowledge':r['review_knowledge']} if 'review_knowledge' in r else {}),
+                      **({'aqafReview':r['review']} if 'review' in r else {}),
+                      **({'aqafScope':r['scope'],'aqafProjects':r['projects']} if 'scope' in r else {})}
     }]}
 
 
@@ -539,17 +633,32 @@ def registry_command(argv):
 
 def main(argv=None):
     argv=list(sys.argv[1:] if argv is None else argv)
+    from . import project_commands
+    if project_commands.matches(argv):return project_commands.main(argv)
     if argv and argv[0] in ('profiles','packs'): return registry_command(argv)
     ap=argparse.ArgumentParser(description='AQAF local architecture scanner (heuristic, non-certifying)')
     ap.add_argument('repo', nargs='?', default='.', help='Repository path')
     ap.add_argument('--version', action='version', version='AQAF '+ __version__)
-    ap.add_argument('--format', choices=['md','json','sarif'], default='md')
+    ap.add_argument('--format', choices=['md','json','sarif','all'], default='md')
     ap.add_argument('--output','-o', default='-')
     ap.add_argument('--profile', default='auto', help='Registry profile ID; see `aqaf profiles list`')
     ap.add_argument('--pack', default='auto', help='Limit auto-detection to a pack; see `aqaf packs list`')
     ap.add_argument('--profile-dir', action='append', default=[], help='Additional data-only JSON profile directory')
     ap.add_argument('--pack-dir', action='append', default=[], help='Additional data-only JSON pack directory')
     ap.add_argument('--capability', action='append', default=[], help='Declared contextual capability (repeatable)')
+    ap.add_argument('--gitignore', action=argparse.BooleanOptionalAction, default=True, help='Respect root/nested .gitignore by default; --no-gitignore explicitly opts out')
+    ap.add_argument('--scope-policy', choices=['typed','legacy'], default='typed', help='Type-aware ownership/exclusions or historical directory rules')
+    ap.add_argument('--scope-config', help='Operator-selected bounded JSON scope configuration')
+    ap.add_argument('--inventory-all', action='store_true', help='Also count metadata in pruned subtrees; never analyze their bodies')
+    ap.add_argument('--component', help='Analyze only one discovered component ID or root-relative path')
+    ap.add_argument('--review-max-files', type=int, default=1000, help='Maximum experimental file attempts per scan')
+    ap.add_argument('--review-max-bytes', type=int, default=20000000, help='Maximum experimental source bytes per scan')
+    ap.add_argument('--review-file-bytes', type=int, default=256000, help='Maximum experimental bytes per file')
+    ap.add_argument('--review-cursor-in', help='Validate bounded full-content continuation state from an earlier page')
+    ap.add_argument('--review-cursor-out', help='Write new immutable continuation state outside the source')
+    ap.add_argument('--review-offset', type=int, default=0, help='Deterministic selection offset; separately reported partial coverage')
+    ap.add_argument('--review-knowledge',action='store_true',help='Optional book-informed human review agenda; unknown/unscored, no target execution')
+    ap.add_argument('--review-signals', action='store_true', help='Opt-in bounded multi-language review observations; experimental and unscored')
     ap.add_argument('--baseline', help='Earlier AQAF JSON report for new/existing comparison')
     ap.add_argument('--config', help='Path to local .aqaf.json suppression config; defaults to <repo>/.aqaf.json')
     ap.add_argument('--fail-on', choices=['off','new-high','new-medium'], default='off', help='Optional CI gate for findings; requires a baseline')
@@ -562,11 +671,40 @@ def main(argv=None):
     try:
         registry=Registry(args.profile_dir,args.pack_dir)
         if args.pack!='auto': registry.get_pack(args.pack)
-        r=add_fingerprints(scan(repo,args.profile,registry,args.pack,args.capability))
+        from .scope import config_document
+        if args.review_max_files<1 or args.review_max_bytes<1 or args.review_file_bytes<1 or args.review_offset<0:raise ValueError('Review budgets must be positive; offset must be nonnegative')
+        if args.review_file_bytes>1500000 or args.review_max_files>100000 or args.review_max_bytes>256000000:raise ValueError('Review budget exceeds bounded maximum')
+        session=None
+        if args.review_cursor_in or args.review_cursor_out:
+            if not args.review_signals:raise ValueError('Continuation requires --review-signals')
+            if args.component:raise ValueError('Use a scoped root/configuration for continuation; --component continuation is not supported')
+            from .scope import Scope
+            from .cursor import identity,load
+            session=Scope(repo,args.gitignore,args.scope_policy,config_document(args.scope_config),args.inventory_all).build()
+            cursor_options={'max_files':args.review_max_files,'max_total_bytes':args.review_max_bytes,'max_file_bytes':args.review_file_bytes}
+            cursor_identity=identity(session,cursor_options)
+            if args.review_cursor_in:
+                if args.review_offset:raise ValueError('Choose a cursor or an explicit offset')
+                args.review_offset=load(args.review_cursor_in,cursor_identity)
+        r=add_fingerprints(scan(repo,args.profile,registry,args.pack,args.capability,review_signals=args.review_signals,
+            respect_gitignore=args.gitignore,scope_policy=args.scope_policy,scope_config=config_document(args.scope_config),
+            inventory_all=args.inventory_all,component=args.component,session=session,review_knowledge=args.review_knowledge,
+            review_options={'max_files':args.review_max_files,'max_total_bytes':args.review_max_bytes,'max_file_bytes':args.review_file_bytes,'offset':args.review_offset}))
+        if args.review_cursor_out:
+            from .cursor import write
+            # Include byte/size failures in the page; never silently merge older pages.
+            write(args.review_cursor_out,session,cursor_identity,min(r['review']['scope']['files_eligible'],args.review_offset+r['review']['scope']['files_attempted']))
         r=apply_suppressions(r,Path(args.config).resolve() if args.config else repo/'.aqaf.json')
         r=add_baseline_diff(r,Path(args.baseline) if args.baseline else None)
     except (ValueError, ProfileError) as exc:
         ap.error(str(exc))
+    if args.format=='all':
+        if args.output=='-':ap.error('--format all requires --output DIRECTORY')
+        from .artifacts import write_bundle
+        try:write_bundle(r,Path(args.output))
+        except (ValueError,OSError) as exc:ap.error(str(exc))
+        print('Wrote report.json, report.md and report.sarif to '+args.output)
+        return 2 if args.fail_on!='off' and any(f['status']=='new' and f['severity'] in ({'high'} if args.fail_on=='new-high' else {'high','medium'}) for f in r['findings']) else 0
     out=json.dumps(r,indent=2) if args.format=='json' else json.dumps(sarif_report(r),indent=2) if args.format=='sarif' else md_report(r)
     if args.output=='-': print(out)
     else:

package/vendor/aqaf/cursor.py

@@ -0,0 +1,56 @@
+"""Bounded data-only continuation identity. Never merge different assessments."""
+import hashlib,json,os,tempfile
+from pathlib import Path
+from . import __version__
+
+MAX_STATE_BYTES=16384
+MAX_IDENTITY_BYTES=256000000
+MAX_IDENTITY_FILE=1500000
+
+
+def runtime_identity():
+    root=Path(__file__).parent;digest=hashlib.sha256()
+    for path in sorted(root.rglob('*')):
+        if path.is_file() and path.suffix in {'.py','.json'} and '__pycache__' not in path.parts:
+            digest.update(path.relative_to(root).as_posix().encode()+b'\0'+path.read_bytes())
+    return digest.hexdigest()
+
+
+def identity(scope,options):
+    """Full selected-body hashes under explicit bounds; oversized identity fails closed."""
+    digest=hashlib.sha256();total=0
+    metadata={'root':str(scope.root),'runtime':runtime_identity(),'version':__version__,'policy':scope.policy,
+              'gitignore':scope.respect_gitignore,'ignore_sources':scope.ignore_sources,'config':scope.config,
+              'options':{k:v for k,v in options.items() if k!='offset'}}
+    digest.update(json.dumps(metadata,sort_keys=True).encode())
+    for record in sorted(scope.records,key=lambda r:r['relative']):
+        size=record['size'];total+=size
+        if size>MAX_IDENTITY_FILE or total>MAX_IDENTITY_BYTES:raise ValueError('Continuation identity exceeds safe full-content bounds; use a smaller component/scope or a fresh independent scan')
+        raw=scope.raw(record['path'],MAX_IDENTITY_FILE+1)
+        if len(raw)!=size:raise ValueError('Continuation identity input changed or is unreadable')
+        digest.update(record['relative'].encode()+b'\0'+hashlib.sha256(raw).digest())
+    return digest.hexdigest()
+
+
+def load(path,expected):
+    path=Path(path)
+    if path.is_symlink() or not path.is_file() or path.stat().st_size>MAX_STATE_BYTES:raise ValueError('Invalid bounded continuation state')
+    try:data=json.loads(path.read_text())
+    except (ValueError,OSError,RecursionError) as error:raise ValueError('Invalid continuation JSON') from error
+    if not isinstance(data,dict) or data.get('schema_version')!=1 or data.get('identity')!=expected:raise ValueError('Stale continuation: source, root, runtime, scope or budgets changed; start a new scan')
+    offset=data.get('next_offset')
+    if type(offset) is not int or not 0<=offset<=500000:raise ValueError('Invalid continuation offset')
+    return offset
+
+
+def write(path,scope,identity_value,next_offset):
+    path=Path(path).absolute()
+    resolved=path.resolve()
+    if resolved==scope.root or scope.root in resolved.parents:raise ValueError('Continuation state must be outside the assessed source')
+    if path.exists() or path.is_symlink():raise ValueError('Continuation state already exists; choose a new output file')
+    path.parent.mkdir(parents=True,exist_ok=True)
+    fd,temporary=tempfile.mkstemp(prefix='.aqaf-cursor-',dir=path.parent)
+    try:
+        with os.fdopen(fd,'w') as f:json.dump({'schema_version':1,'identity':identity_value,'next_offset':next_offset,'scope':'Independent partial page; previous evidence is not merged or marked complete.'},f,indent=2)
+        os.link(temporary,path)  # Atomic create without replacing historical state.
+    finally:Path(temporary).unlink(missing_ok=True)