@clear-capabilities/agentic-security-scanner 0.127.0 → 0.130.0

package/src/ir/parser-cs.js

@@ -26,6 +26,7 @@
 // parser-py-cst.js) once we have a dotnet capability probe.
 
 import * as crypto from 'node:crypto';
+import { callSitesFromCfg } from './call-sites.js';
 
 const METHOD_RE = new RegExp(
   '(?:^|[\\s;{}])(?:public|private|protected|internal|static|virtual|override|async|sealed|abstract|new|readonly|partial)' +
@@ -249,10 +250,12 @@ export function parseCSharpFile(file, code) {
     }
     nodes[prev].succ.push('exit');
     nodes.exit.pred.push(prev);
+    const cfg = { entry: 'entry', exit: 'exit', nodes };
     functions.push({
       qid: _qid(file, name, startLine, extracted.body),
       name, line: startLine, params, file,
-      cfg: { entry: 'entry', exit: 'exit', nodes },
+      cfg,
+      calls: callSitesFromCfg(cfg),
     });
     METHOD_RE.lastIndex = extracted.end + 1;
   }

package/src/ir/parser-go.js

@@ -21,6 +21,7 @@
 //   - struct field assignments (x.Field = val) beyond simple dotted targets
 
 import * as crypto from 'node:crypto';
+import { callSitesFromCfg } from './call-sites.js';
 
 const FUNC_RE = new RegExp(
   '(?:^|[\\n;{}])\\s*func\\s+' +
@@ -400,10 +401,12 @@ export function parseGoFile(file, code) {
     const exit = _addNode(nodes, { kind: 'exit', line: startLine });
     const tail = _buildCfg(extracted.body, nodes, entry, startLine + 1);
     _link(nodes, tail, exit);
+    const cfg = { entry, exit, nodes };
     functions.push({
       qid: _qid(file, name, startLine, extracted.body),
       name, line: startLine, params, file,
-      cfg: { entry, exit, nodes },
+      cfg,
+      calls: callSitesFromCfg(cfg),
     });
     FUNC_RE.lastIndex = extracted.end + 1;
   }

package/src/ir/parser-js.js

@@ -397,7 +397,11 @@ export function parseJsFile(file, code) {
   try {
     babelTransformSync(code, {
       filename: file,
-      presets: [presetReact, [presetTypescript, { isTSX: true, allExtensions: true }]],
+      // Babel 8 removed preset-typescript's .isTSX/.allExtensions. ignoreExtensions
+      // is the documented replacement: parse every file with the same TS grammar
+      // regardless of extension. JSX stays enabled via preset-react, so .js files
+      // containing JSX still parse — which .isTSX/.allExtensions guaranteed before.
+      presets: [presetReact, [presetTypescript, { ignoreExtensions: true }]],
       plugins: [plugin],
       ast: false, code: false, babelrc: false, configFile: false,
     });

package/src/ir/parser-kt.js

@@ -21,6 +21,7 @@
 // gradle helper) is the upgrade path.
 
 import * as crypto from 'node:crypto';
+import { callSitesFromCfg } from './call-sites.js';
 
 const FUN_RE = new RegExp(
   '(?:^|[\\s;{}])(?:public|private|internal|protected|inline|suspend|tailrec|operator|infix|open|abstract|override|final|external)?' +
@@ -247,10 +248,12 @@ export function parseKotlinFile(file, code) {
     }
     nodes[prev].succ.push('exit');
     nodes.exit.pred.push(prev);
+    const cfg = { entry: 'entry', exit: 'exit', nodes };
     functions.push({
       qid: _qid(file, name, startLine, extracted.body),
       name, line: startLine, params, file,
-      cfg: { entry: 'entry', exit: 'exit', nodes },
+      cfg,
+      calls: callSitesFromCfg(cfg),
     });
     FUN_RE.lastIndex = extracted.end + 1;
   }

package/src/ir/parser-php.js

@@ -18,9 +18,10 @@
 //   - control flow (if/for/while/switch) — body is straight-line
 
 import * as crypto from 'node:crypto';
+import { callSitesFromCfg } from './call-sites.js';
 
 const FUNC_RE = new RegExp(
-  '(?:^|[\\n;{}])\\s*' +
+  '(?:^|[\\n;{}]|<\\?php|<\\?)\\s*' +
   '(?:(?:public|private|protected|static|abstract|final)\\s+)*' +
   'function\\s+' +
   '([A-Za-z_]\\w*)' +                  // function name (g1)
@@ -319,12 +320,18 @@ export function parsePhpFile(file, code) {
     const exit = _addNode(nodes, { kind: 'exit', line: startLine });
     const tail = _buildCfg(extracted.body, nodes, entry, startLine + 1);
     _linkNodes(nodes, tail, exit);
+    const cfg = { entry, exit, nodes };
     functions.push({
       qid: _qid(file, name, startLine, extracted.body),
       name, line: startLine, params, file,
-      cfg: { entry, exit, nodes },
+      cfg,
+      calls: callSitesFromCfg(cfg),
     });
-    FUNC_RE.lastIndex = extracted.end + 1;
+    // Don't skip past the closing brace: for `<?php function h(){...} function m(){...}`
+    // that brace is the only boundary character available to anchor the next
+    // function's match (there's no newline/semicolon between them), and advancing
+    // past it here would make the following function declaration unmatchable.
+    FUNC_RE.lastIndex = extracted.end;
   }
   return functions.length ? { file, functions, topLevel: null } : null;
 }

package/src/ir/parser-py-cst.js

@@ -32,6 +32,7 @@ import * as cp from 'node:child_process';
 import * as path from 'node:path';
 import * as fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import { callSitesFromCfg } from './call-sites.js';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const HELPER_PATH = path.join(HERE, 'parser-py.helper.py');
@@ -41,15 +42,39 @@ const HELPER_PATH = path.join(HERE, 'parser-py.helper.py');
 //   { ok: false, reason: '...' }                                   on failure
 let _capability = null;
 
+// Degradation record (BLOCKER 1 — corpus-gate flakiness).
+//
+// A CST→regex fallback is invisible to callers but silently removes Python
+// interprocedural analysis for that run (`parser-py.js` emits no `fn.calls`
+// — see ./CLAUDE.md). That turned a loaded machine into a phantom detection
+// regression in the CVE-replay gate. Callers that care (the corpus runner)
+// reset this before a scan and check it after, so a degraded parser is
+// reported as an ENVIRONMENT error rather than scored as a false negative.
+let _degradation = null;
+export function noteParserDegradation(reason) { if (!_degradation) _degradation = reason; }
+export function pythonParserDegradation() { return _degradation; }
+export function resetPythonParserDegradation() { _degradation = null; }
+
+// Probe timeout. 1500 ms was too tight: on a machine still busy from a prior
+// test run, `python3 --version` genuinely took >1.5 s, the probe failed, and
+// because the result is cached process-wide EVERY later scan in that process
+// silently used the regex parser. Timeouts are also no longer cached (see
+// below), so a transient spike can't poison the whole process.
+const PROBE_TIMEOUT_MS = Number(process.env.AGENTIC_SECURITY_PY_PROBE_TIMEOUT_MS || 5000);
+
 export function probePythonAvailable() {
   if (_capability) return _capability;
+  let sawTimeout = false;
   // Try the canonical names in order. macOS / most Linux have python3;
   // some Linuxes only have python. We don't accept python2 (no f-strings).
   for (const bin of ['python3', 'python']) {
     let r;
     try {
-      r = cp.spawnSync(bin, ['--version'], { encoding: 'utf8', timeout: 1500 });
+      r = cp.spawnSync(bin, ['--version'], { encoding: 'utf8', timeout: PROBE_TIMEOUT_MS });
     } catch { continue; }
+    // spawnSync sets .error (ETIMEDOUT) and a null status when the timeout
+    // fires. That is a load symptom, not "python is missing" — don't cache it.
+    if (r.error && (r.error.code === 'ETIMEDOUT' || r.signal)) { sawTimeout = true; continue; }
     if (r.status !== 0) continue;
     // Output format: "Python 3.12.2" (or 2.x — reject those).
     const m = /Python\s+(\d+)\.(\d+)\.(\d+)/.exec(r.stdout || r.stderr || '');
@@ -60,6 +85,10 @@ export function probePythonAvailable() {
     _capability = { ok: true, python: bin, version: `${m[1]}.${m[2]}.${m[3]}` };
     return _capability;
   }
+  if (sawTimeout) {
+    // Uncached: the next call re-probes once the machine is less busy.
+    return { ok: false, reason: 'probe-timeout', transient: true };
+  }
   _capability = { ok: false, reason: 'no-python3-on-path' };
   return _capability;
 }
@@ -87,8 +116,8 @@ export function parsePythonFile(file, raw) {
 export function parsePythonFilesBatch(entries) {
   if (!Array.isArray(entries) || entries.length === 0) return [];
   const cap = probePythonAvailable();
-  if (!cap.ok) return null;
-  if (!fs.existsSync(HELPER_PATH)) return null;
+  if (!cap.ok) { noteParserDegradation(`python-unavailable:${cap.reason}`); return null; }
+  if (!fs.existsSync(HELPER_PATH)) { noteParserDegradation('helper-script-missing'); return null; }
   const filtered = entries.filter(e =>
     e && typeof e.file === 'string' && /\.py$/i.test(e.file) &&
     typeof e.content === 'string' && e.content.length <= 1_000_000
@@ -96,29 +125,34 @@ export function parsePythonFilesBatch(entries) {
   if (filtered.length === 0) return [];
   let payload;
   try { payload = JSON.stringify(filtered); }
-  catch { return null; }
+  catch { noteParserDegradation('payload-serialize-failed'); return null; }
   let r;
   try {
     r = cp.spawnSync(cap.python, [HELPER_PATH], {
       input: payload,
       encoding: 'utf8',
-      // 10 s for a whole batch. The helper itself processes files in a
-      // simple linear loop; on a 100-file repo a single-digit-second
-      // budget is plenty. If a customer hits the timeout, the regex
-      // parser fallback catches them.
-      timeout: 10_000,
+      // 30 s for a whole batch. The helper processes files in a simple
+      // linear loop; single-digit seconds is plenty on a 100-file repo, but
+      // the budget has to survive a machine that is busy with something else
+      // (this was one half of the corpus-gate flakiness — a loaded box blew
+      // the old 10 s budget and silently dropped to the regex parser).
+      // Tunable for constrained runners.
+      timeout: Number(process.env.AGENTIC_SECURITY_PY_BATCH_TIMEOUT_MS || 30_000),
       maxBuffer: 64 * 1024 * 1024,
     });
   } catch (e) {
     if (process.env.AGENTIC_SECURITY_PY_PARSER_DEBUG === '1') {
       process.stderr.write(`parser-py-cst: spawn failed — ${e.message}\n`);
     }
+    noteParserDegradation(`helper-spawn-failed:${e.message}`);
     return null;
   }
   if (r.status !== 0 || !r.stdout) {
     if (process.env.AGENTIC_SECURITY_PY_PARSER_DEBUG === '1') {
       process.stderr.write(`parser-py-cst: helper exit=${r.status} stderr=${r.stderr || ''}\n`);
     }
+    noteParserDegradation(r.error && (r.error.code === 'ETIMEDOUT' || r.signal)
+      ? 'helper-batch-timeout' : `helper-exit-${r.status}`);
     return null;
   }
   let out;
@@ -127,9 +161,27 @@ export function parsePythonFilesBatch(entries) {
     if (process.env.AGENTIC_SECURITY_PY_PARSER_DEBUG === '1') {
       process.stderr.write(`parser-py-cst: helper output not JSON — ${e.message}\n`);
     }
+    noteParserDegradation('helper-output-not-json');
     return null;
   }
-  return out;
+  return _annotateCalls(out);
+}
+
+// Populate `fn.calls` (post-parse, from the CFG) on every function of every
+// file entry the helper returned. Done here rather than in the helper
+// itself. Uses the shared `callSitesFromCfg` (./call-sites.js) — this used
+// to be a second, drifted copy of that walker; folded into the shared module
+// (which gained `elements`/`props` traversal to match) once the two were
+// verified to produce identical output for Python.
+function _annotateCalls(entries) {
+  if (!Array.isArray(entries)) return entries;
+  for (const entry of entries) {
+    if (!entry || !Array.isArray(entry.functions)) continue;
+    for (const fn of entry.functions) {
+      if (fn && fn.cfg) fn.calls = callSitesFromCfg(fn.cfg);
+    }
+  }
+  return entries;
 }
 
 // Reset the cache — for tests.

package/src/ir/tree-sitter-loader.js

@@ -1,7 +1,19 @@
 // Tree-sitter parser loader (roadmap #8) — OPTIONAL, runtime-lazy, degrades.
 //
 // web-tree-sitter + tree-sitter-wasms are OPTIONAL dependencies (pinned to an
-// ABI-matched pair: web-tree-sitter 0.20.8 ↔ tree-sitter-wasms 0.1.13). They
+// ABI-matched pair: web-tree-sitter 0.20.8 ↔ tree-sitter-wasms 0.1.13).
+//
+// DO NOT bump web-tree-sitter on its own. Verified 2026-07-27 against 0.26.11:
+// every grammar in tree-sitter-wasms 0.1.13 fails to instantiate (empty Error
+// from Language.load), because the prebuilt grammars target the older grammar
+// ABI. 0.1.13 is the newest tree-sitter-wasms published, so there is no matched
+// pair to upgrade TO — bumping the runtime silently drops all tree-sitter
+// language support (rust, solidity, go, swift, cpp, c) rather than failing loudly.
+// Revisit only when tree-sitter-wasms publishes grammars built for the newer ABI.
+//
+// 0.25+ also moved Language off the Parser class to a top-level named export, so
+// that migration needs _ensureRuntime/getParserFor updated together with the pin.
+// They
 // are NOT bundled into dist (the build marks them `--external`), so the
 // committed bundle stays self-contained and small; this loader requires them
 // lazily at runtime and returns null when they're absent. That keeps the

package/src/llm-validator/index.js

@@ -45,6 +45,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { statePath, ensureStateDir, safeWriteState } from '../posture/state-dir.js';
+import { redactSecrets } from './redact.js';
 
 // Bump on every prompt change so the cache invalidates. Exported as a
 // stable public symbol (premortem 4R-15) so the validator-cache GC subcommand
@@ -195,12 +196,18 @@ function renderPrompt(finding, fileContents, challenge, nonce) {
     : `${finding.file}:${finding.line} [single-point detection, no cross-file path]`;
   // Defensive: strip the delimiter literally from the untrusted excerpt so
   // an attacker can't close it early by embedding our token.
-  const sterileContext = String(context || '')
+  let sterileContext = String(context || '')
     .replace(/BEGIN-UNTRUSTED-CODE-EXCERPT-[a-f0-9]+/gi, '[stripped-delimiter]')
     .replace(/END-UNTRUSTED-CODE-EXCERPT-[a-f0-9]+/gi, '[stripped-delimiter]');
-  const sterileSnippet = String(finding.snippet || '')
+  let sterileSnippet = String(finding.snippet || '')
     .replace(/[\r\n]+/g, ' ')
     .slice(0, 400);
+  // R10 — redact likely live credentials (API keys, tokens, private keys,
+  // connection-string passwords, ...) out of BOTH excerpts before anything
+  // leaves the machine. This is the last choke point before the prompt is
+  // assembled — everything downstream sees only redacted text.
+  sterileContext = redactSecrets(sterileContext).text;
+  sterileSnippet = redactSecrets(sterileSnippet).text;
   return PROMPT_TEMPLATE
     .replace(/\{\{nonce\}\}/g, nonce)
     .replace(/\{\{challenge\}\}/g, challenge)

package/src/llm-validator/redact.js

@@ -0,0 +1,157 @@
+// R10 — secret redaction for the Layer-3 LLM validator prompt.
+//
+// The validator sends real source-code excerpts to a model API. Those
+// excerpts can contain live credentials that were hardcoded in the scanned
+// project (API keys, tokens, private keys, connection-string passwords).
+// This module strips likely secret VALUES while preserving the surrounding
+// code STRUCTURE (variable name, operator, quotes, call shape) so the
+// validator can still reason about the finding.
+//
+// Design tension (this is the point of the module): redact too little and a
+// live key leaves the machine; redact too aggressively and the validator
+// loses the context it needs to judge a finding. We resolve it by only
+// touching values that match a specific credential shape — never whole
+// lines, never identifiers, never ordinary string literals — and by biasing
+// every heuristic toward leaving normal code alone (see the exclusions on
+// the entropy pass below).
+//
+// Pure function, no I/O, no logging of the redacted material itself (only a
+// count is returned) — callers must not print the input/output around this
+// call in a way that defeats the point.
+
+const REDACTED_PLACEHOLDER = '[REDACTED-SECRET]';
+
+// Case-insensitive names that, when assigned a quoted string, are treated as
+// carrying a credential. Exact identifiers only (word-boundary matched) —
+// e.g. `password_field` does NOT match `password` because `_` is a word
+// character and blocks the trailing \b.
+const SECRET_KEY_NAMES = [
+  'apiKey',
+  'api_key',
+  'secret',
+  'token',
+  'password',
+  'passwd',
+  'client_secret',
+  'access_key',
+  'private_key',
+  'authorization',
+];
+
+const KEY_VALUE_RE = new RegExp(
+  '(\\b(?:' + SECRET_KEY_NAMES.join('|') + ')\\b)(\\s*[:=]\\s*)([\'"`])([^\'"`]+)\\3',
+  'gi'
+);
+
+// `Authorization: Bearer <blob>` — the blob only, scheme word survives.
+const BEARER_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]+/gi;
+
+// PEM private-key blocks, any key type (`RSA PRIVATE KEY`, `EC PRIVATE KEY`,
+// `PRIVATE KEY`, …). BEGIN/END markers are preserved so the excerpt still
+// reads as "a private key was here"; the body is collapsed to one placeholder.
+const PEM_RE = /-----BEGIN\s+[A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END\s+[A-Z0-9 ]*PRIVATE KEY-----/gi;
+
+// `scheme://user:PASSWORD@host` — only the password segment is replaced;
+// scheme, user, and host/path survive.
+const CONN_STRING_RE = /(:\/\/[^:/\s'"@]+:)([^@/\s'"]+)(@)/g;
+
+// Quoted string literals (single/double/backtick), escape-aware, so the
+// entropy pass below can inspect literal contents without being fooled by
+// an escaped quote inside the literal.
+const QUOTED_STRING_RE = /'(?:\\.|[^'\\])*'|"(?:\\.|[^"\\])*"|`(?:\\.|[^`\\])*`/g;
+
+// Minimum length before a bare string literal is even considered for the
+// entropy pass. Conservative on purpose — short strings are indistinguishable
+// from ordinary code tokens.
+const ENTROPY_MIN_LENGTH = 24;
+const ENTROPY_MIN_BITS_PER_CHAR = 4.0;
+// base64url-ish charset only. Anything outside this (colons, slashes,
+// semicolons, spaces, commas — e.g. a `data:...;base64,...` URI or a
+// sentence) is left alone by construction, not by a special-cased exclusion.
+const ENTROPY_CHARSET_RE = /^[A-Za-z0-9+/_=-]+$/;
+// Pure-hex strings (git SHAs, color codes, hash digests) are common in
+// ordinary code and have materially lower entropy-per-symbol than a random
+// base64 secret at the same bit strength; treat them as non-secret.
+const HEX_ONLY_RE = /^[0-9a-fA-F]+$/;
+
+function shannonEntropy(str) {
+  const freq = new Map();
+  for (const ch of str) freq.set(ch, (freq.get(ch) || 0) + 1);
+  const len = str.length;
+  let entropy = 0;
+  for (const count of freq.values()) {
+    const p = count / len;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+
+function looksLikeHighEntropySecret(inner) {
+  if (inner === REDACTED_PLACEHOLDER) return false; // already redacted upstream
+  if (inner.length < ENTROPY_MIN_LENGTH) return false;
+  if (!ENTROPY_CHARSET_RE.test(inner)) return false;
+  if (HEX_ONLY_RE.test(inner)) return false; // e.g. git SHA — leave alone
+  return shannonEntropy(inner) >= ENTROPY_MIN_BITS_PER_CHAR;
+}
+
+// redactSecrets(text) -> { text, redactions }
+//
+// Runs a fixed sequence of passes, most-specific first (PEM blocks and
+// connection strings have unambiguous shapes; the entropy pass is the most
+// general and runs last so it never fights with a more specific rule over
+// the same span). Order does not affect whether a real secret is caught —
+// only how many passes independently flag it — so a slight redaction-count
+// overlap on an already-redacted span is harmless (the value is still gone
+// exactly once; see KEY_VALUE_RE + BEARER_RE interaction for the one case
+// where both can fire on the same literal).
+export function redactSecrets(text) {
+  if (typeof text !== 'string' || text.length === 0) {
+    return { text: typeof text === 'string' ? text : '', redactions: 0 };
+  }
+
+  let redactions = 0;
+  let out = text;
+
+  // 1. PEM private-key blocks.
+  out = out.replace(PEM_RE, (m) => {
+    redactions++;
+    const begin = (m.match(/^-----BEGIN\s+[A-Z0-9 ]*PRIVATE KEY-----/i) || [])[0] || '-----BEGIN PRIVATE KEY-----';
+    const end = (m.match(/-----END\s+[A-Z0-9 ]*PRIVATE KEY-----$/i) || [])[0] || '-----END PRIVATE KEY-----';
+    return `${begin}\n${REDACTED_PLACEHOLDER}\n${end}`;
+  });
+
+  // 2. Connection-string passwords.
+  out = out.replace(CONN_STRING_RE, (_m, pre, _pass, at) => {
+    redactions++;
+    return `${pre}${REDACTED_PLACEHOLDER}${at}`;
+  });
+
+  // 3. Bearer tokens.
+  out = out.replace(BEARER_RE, () => {
+    redactions++;
+    return `Bearer ${REDACTED_PLACEHOLDER}`;
+  });
+
+  // 4. `secretName = "value"` / `secretName: "value"` assignments.
+  //
+  // Special case: `authorization: "Bearer <blob>"` — keep the `Bearer `
+  // scheme word (already handled generically by BEARER_RE above; this just
+  // keeps this pass from re-swallowing it when it runs on the same span).
+  out = out.replace(KEY_VALUE_RE, (_m, keyName, opWs, quote, value) => {
+    redactions++;
+    const bearer = /^(Bearer\s+)(.+)$/i.exec(value);
+    if (bearer) return `${keyName}${opWs}${quote}${bearer[1]}${REDACTED_PLACEHOLDER}${quote}`;
+    return `${keyName}${opWs}${quote}${REDACTED_PLACEHOLDER}${quote}`;
+  });
+
+  // 5. Long high-entropy string literals not caught by a more specific rule.
+  out = out.replace(QUOTED_STRING_RE, (m) => {
+    const q = m[0];
+    const inner = m.slice(1, -1);
+    if (!looksLikeHighEntropySecret(inner)) return m;
+    redactions++;
+    return `${q}${REDACTED_PLACEHOLDER}${q}`;
+  });
+
+  return { text: out, redactions };
+}

package/src/mcp/tools.js

@@ -549,12 +549,23 @@ export const apply_fix = {
       // Inline re-verify — the load-bearing gate. Must pass to write.
       let verdict;
       try {
-        const verifyFixCore = await getVerifyFixCore();
-        verdict = await verifyFixCore({
-          scanRoot: ctx.sessionRoot,
-          originalFindingStableId: f.stableId,
-          files: Object.fromEntries(Object.entries(confinedAbs).map(([rel, v]) => [rel, v.content])),
-        });
+        const _files = Object.fromEntries(Object.entries(confinedAbs).map(([rel, v]) => [rel, v.content]));
+        if (process.env.AGENTIC_SECURITY_FIX_RUN_TESTS === '1') {
+          // Addition #7 — connect the closed-loop verifier: add the project test
+          // suite as a fourth verification leg (scan + lint + tests). Opt-in
+          // because many repos have no runner and we must not fail-closed by
+          // default. Normalized to the scan+lint verdict shape used below.
+          const { verifyFixWithTests } = await import('../posture/fix-verify-loop.js');
+          const t = await verifyFixWithTests({ scanRoot: ctx.sessionRoot, originalFindingStableId: f.stableId, files: _files });
+          verdict = { ok: t.ok, summary: t.summary, rescan: t.legs?.scan?.detail, lint: t.legs?.lint?.detail, tests: t.legs?.tests, testVerdict: t.verdict };
+        } else {
+          const verifyFixCore = await getVerifyFixCore();
+          verdict = await verifyFixCore({
+            scanRoot: ctx.sessionRoot,
+            originalFindingStableId: f.stableId,
+            files: _files,
+          });
+        }
       } catch (e) {
         return { _meta: META, applied: false, reason: `patch verification failed: ${e.message}` };
       }

package/src/posture/CLAUDE.md

@@ -9,6 +9,8 @@ Annotators that run **after** every detector has emitted, plus state stores read
 
 **Calibration + held-out evaluation** — `calibration.js`, `calibration-drift.js`, `validator-metrics.js`, `holdout-eval.js`. The seed corpus lives at `calibration-seed.json`; held-out labels are taken via `loadLabeledJsonl`. Brier and ECE both live in `holdout-eval.js`; never reintroduce a "fit-on-the-table" version.
 
+**Published accuracy scorecard (R3)** — `accuracy-scorecard.js`. Pure aggregation + markdown/JSON rendering for `docs/SCORECARD.md`; the impure driver that performs the corpus and self-scan runs is `scripts/scorecard.mjs` (`npm run scorecard`). Every rate is carried as `{n, d}` and rendered through `formatRate()` so a percentage can never appear without its denominator; entries a run could not score are excluded from every denominator *and* disclosed by name. No F1 is emitted — see the module header for why, and don't add one without a labelled real-world population to measure precision over.
+
 **Cross-language taint** — `cross-lang-{openapi,grpc,graphql,orm,queues,meta}.js`. Each parses a contract artifact (`openapi.json`, `*.proto`, `*.graphql`, queue config) and emits a chain finding when the same data crosses a language boundary into another module's finding.
 
 **Risk amplification** — `epss.js`, `kev` (in `version.js`), `blast-radius.js`, `crown-jewels.js`, `exploitability.js`, `bounty-prediction.js`, `risk-in-dollars` (lives in `scripts/`, not here).
@@ -21,6 +23,38 @@ Annotators that run **after** every detector has emitted, plus state stores read
 
 **Agentic verification** — `verifier.js`, `verifier-target.js`, `verifier-ephemeral.js`, `harness-discovery.js`, `adversary-agent.js`, `defender-agent.js`, `auditor-agent.js`, `three-agent-pipeline.js`.
 
+**Methodology additions (`docs/AGENTIC_METHODOLOGY_PRD.md`)** — default-on annotators/artifacts that layer the agentic-hunter methodology on the deterministic engine:
+- `falsification.js` — default falsification pass. For each taint-style finding, tries to DISPROVE it (locate a context-matched control on the path, reusing `dataflow/sanitizer-proof.js`'s shape rules read-only); a blocked finding is demoted + `quarantined`, never removed and never severity-touched (recall-preserving, like `proof-gate`). Wired after `annotateProofGate`. Opt out: `AGENTIC_SECURITY_NO_FALSIFICATION=1`. Optional LLM tier over survivors when an endpoint is configured.
+- `entrypoint-inventory.js` — attack-surface completeness ledger. Enumerates every entry point (HTTP/queue/cron/CLI/env/upload/webhook) with a disposition each; on `scan.entrypointInventory`.
+- `root-cause-sweep.js` — from confirmed findings, finds sibling instances detectors missed with total-count accounting (`found === candidates + mitigated`); on `scan.rootCauseSweep`.
+- `model-routing.js` — capability-based CWE/severity→model policy; stamps `finding.dispatchModel` (strongest for crypto/auth/critical, mid for injection, cheapest for low-sev hardening) for cost-sensitive subagent dispatch.
+- `fix-honesty-gate.js` — deterministic honesty gates on fix output: a residual-risk hand-wave guard, a cited-file:line requirement for any FP/safe verdict, and FULL/MITIGATION/WORKAROUND completeness tiers. Consumed by `fix-verify.js` when the caller supplies fix metadata; the closed-loop test leg (`fix-verify-loop.js`) is wired into `mcp/apply_fix` behind `AGENTIC_SECURITY_FIX_RUN_TESTS=1`.
+
+**Relevance scoping (R6 + R9)** — `relevance.js`. Turns the two existing *inventories* into *inputs*: `entrypoint-inventory.js` supplies the attack surface, `threat-model.js` supplies assets/boundaries/STRIDE, and `annotateRelevance(findings, ctx)` scores each finding by how reachable and how threat-modelled it is. Sets `entrypointReachable: true|false|null`, `relevance` (0..1), `relevanceTier: 'direct'|'indirect'|'unreachable'|'unknown'`, `relevanceFactors[]`, and re-ranks `exploitability` (ordinal priority, ×1.15 direct / ×0.6 unreachable, floored at 0.05, tier label recomputed on the same thresholds `annotateExploitability` uses). Reachability is a forward BFS over a literal-specifier import graph (JS/TS relative + Python dotted + Java FQCN) starting at every entry-point file.
+
+Its contract is **recall-preserving, same precedent as `falsification.js` / `dataflow/proof-gate.js`**: it never removes a finding, never touches `severity`, and never asserts `unreachable` without positive evidence — a negative verdict additionally requires the intra-repo import graph to be hole-free *along the reachable set* (an unresolved relative import or a non-literal `require(x)` in a reachable file hides a possible edge, so every would-be `unreachable` degrades to `unknown`). `null`/`'unknown'` is a first-class state and is **not** the same as `false`. Wired in `engine.js` after the entry-point inventory is built and after every finding has been appended (multi-sink and cross-language chains included) so nothing escapes annotation; this is the one annotator that deliberately runs after `why-fired`.
+
+**Enforced verification separation (R7)** — `verification-separation.js`. The falsification pass could already try to *disprove* a finding; what it could not do was prove the checker was not the producer. This module supplies that structural guarantee:
+
+- `recordProducer(finding, producerId)` stamps provenance **write-once** — a later party cannot re-stamp itself as producer to manufacture separation.
+- `assertSeparation(finding, verifierId)` refuses when verifier === producer, and **fails closed** when no producer was recorded (unestablishable separation is not separation).
+- `recordVerdict(finding, {verifierId, lens, verdict, reason})` runs that check itself, so there is no path to a recorded verdict that skips it. `lens` is the perspective (`'control-flow'`, `'reachability'`, `'data-shape'`, `'llm-review'`); `verdict ∈ 'upheld'|'refuted'|'undecided'`. One verifier gets one vote per lens — a re-vote replaces rather than stuffs.
+- `consensusOf(finding) -> {verdict, upheld, refuted, undecided, lenses[]}` — majority, `'undecided'` on a tie or on no verdicts.
+
+Producer ids are namespaced `detector:<parser>`, verifier ids `verifier:<name>`, so the two spaces cannot collide. **Nothing throws** (posture convention): every entry point returns `{ok:false, refused:true, reason}`.
+
+Contract is **recall-preserving, same precedent as `falsification.js` / `proof-gate.js`**: a `refuted` verdict never removes a finding and never touches `severity`. It is a triage signal, not a deletion.
+
+Wired in `falsification.js`: the detector is stamped as producer, the falsification pass records under `VERIFIER_FALSIFICATION` on the `control-flow` lens, and the optional LLM tier records separately under `VERIFIER_LLM_REVIEW` on the `llm-review` lens — which is what makes a contested finding legible *as contested* (upheld vs refuted → consensus `undecided`) instead of resolved by whoever spoke last. Result lands on `finding.verification = {producer, verdicts[], consensus}`.
+
+**Run attestation (R4)** — `attestation.js`. Turns determinism from an implementation property into something a third party can check. `computeRunAttestation({findings, engineVersion, rulesetVersion, bundleSha, root, sign})` returns `{digest, algorithm, findingCount, engineVersion, rulesetVersion, bundleSha, canonicalisation, proves, doesNotProve, signature?}`; `verifyRunAttestation(attestation, {findings, …})` re-derives and returns `{ok, reason}`.
+
+Canonicalisation is an **allowlist, not a denylist** — each finding reduces to `id ⇥ severity ⇥ file ⇥ line ⇥ cwe ⇥ vuln`, rows sorted, multiplicity preserved. That is what makes the digest independent of emission order, run ids, timestamps, durations, separator style, and the absolute prefix (when `root` is given), while a changed severity/file/line/rule id/cwe or a finding appearing or disappearing all change it. A new volatile field cannot leak in without being added to the allowlist deliberately. `parser` and `family` are deliberately **excluded**: `parser` records which analysis engine fired, which is environment-sensitive (the Python AST path vs. its regex fallback), so including it would report an environment difference as a findings difference.
+
+**What it proves / does not prove** — the attestation carries both statements inline, and both are asserted by a test so they cannot be quietly dropped. It proves two finding sets with the same digest under the same canonicalisation are the same findings from the same engine/ruleset/bundle. It does **not** prove cross-machine reproducibility — no second machine was compared, and this repo makes no such claim. Signing reuses `integrity.js`'s per-install HMAC key handling verbatim (`signLastScan`); no second key mechanism was introduced. `verifyLastScan` is *not* reused because it verifies against a sibling `.sig` file whereas an attestation carries its signature inline, so verification re-signs and compares in constant time. Being symmetric, the signature is tamper-evidence for the operator, not third-party non-repudiation.
+
+Wired in `bin/agentic-security.js` after every filter and after `makeDeterministic`, over `normalizeFindings(scan)` — i.e. it attests the set that actually ships — and surfaced as `attestation` in `toJSON`. `bundleSha` is read from the sidecar next to the *running* bundle and is `'unavailable'` when running from source, rather than reporting a dist hash that may not correspond to this run.
+
 **Integrity + signing** — `integrity.js` (per-install HMAC for `last-scan.json`), `rule-pack-signing.js`. The HMAC key lives at `$XDG_CONFIG_HOME/agentic-security/scan-key`; override via `$AGENTIC_SECURITY_HMAC_KEY`. Premortem-derived; do not regress to hostname-derived.
 
 **Rule lifecycle** — `custom-rules.js` (YAML pattern DSL), `rule-overrides.js` (`disable:` gated on signature), `rule-packs.js`, `rule-synthesis.js` (proposes suppressions from triage feedback), `ruleset-version.js`.
@@ -37,6 +71,94 @@ Annotators that run **after** every detector has emitted, plus state stores read
 - **No throwing.** Every annotation in `engine.js` is wrapped `try { … } catch (_) {}`. Your annotator must degrade gracefully — set `null` on the field and continue.
 - **Dead-module test.** `npm run test:lifecycle` fails the build if you export a public symbol from a posture module that no other source file imports. Wire it in `engine.js` (or allowlist it with a written reason in `test/no-dead-modules.test.js`).
 
+## Execution-proof tiers (R2)
+
+`proof-tier.js` + `execution-proof.js` add a fourth axis to a finding's
+credibility, orthogonal to `confidence`/`exploitability`: whether the bug was
+*run*, not just reasoned about.
+
+**The four tiers** (`PROOF_TIERS`, most-proven first):
+
+- `execution-proven` — a generated PoC ran inside the sandbox and the sandbox
+  observed the predicted effect (a marker file the PoC's payload should have
+  written showed up). The strongest claim the pipeline can make.
+- `proof-failed` — a PoC ran and the marker did **not** appear. This is a
+  **triage signal, not a false-positive verdict**. Absence of proof is not
+  proof of absence: the PoC may be wrong, the param key may be misinferred,
+  or the vulnerable path may need state the single-shot PoC didn't set up.
+  Never auto-close or downgrade severity off `proof-failed` alone.
+- `taint-proven` — the analyser's static reasoning (`IR-TAINT`/`MULTI-SINK`)
+  found it; nothing executed. This is `proofTierOf()`'s default when no
+  execution evidence has been attached.
+- `unproven` — no analyser backing recorded at all (e.g. `REGEX` parser).
+
+**Why a marker file, not an exit code.** The sandbox cannot reliably
+distinguish "the payload was denied by confinement" from "the payload ran
+and happened to exit 0" — both look like a clean exit from the parent
+process's point of view. A marker file the PoC only writes *if its exploit
+path actually executes* turns that ambiguity into a directly observable
+fact: the file exists, or it doesn't. Exit code alone is used only for
+timeout/crash detection, never as the proof signal itself.
+
+**The backend is recorded in every evidence object** (`proofEvidence.backend`,
+e.g. `'userspace'`) because not all confinement backends carry the same
+guarantee. The kernel-namespace backend is unverified on this host and, even
+where available, only confines network — it does **not** confine writes.
+Treat `execution-proven` evidence from a non-`userspace` backend as weaker
+than the same tier from `userspace` until that backend's write confinement
+is independently verified. `attachProofTier()` also enforces the demotion
+guard: `ran:false` can never yield `execution-proven` or `proof-failed`,
+regardless of what tier was requested — it falls back to the finding's
+static standing (`proofTierOf`).
+
+`proofTier`/`proofEvidence` are copied through `report/index.js`'s
+`normalizeFindings()` only when the annotator actually attached them —
+never synthesised at the report layer.
+
+## Scan checkpointing / resume (R8)
+
+`scan-checkpoint.js` lets an interrupted scan resume instead of restarting, which
+is what caps usable repository size today. **Opt-in only**: `AGENTIC_SECURITY_RESUME=1`
+(or `runScan(root, {resume:true})`). Default behaviour is byte-for-byte unchanged
+and nothing is written.
+
+**What is checkpointed.** Only the per-file loop in `engine.js#runFullScan` — the
+one place per-file work happens. Each completed file's *entire* contribution is
+persisted (routes, findings, taint sources/sinks/sanitizers, logic vulns, secrets,
+at-rest/in-transit ciphers, the suppression-log delta, and the per-file taint
+result the cross-file pass reads), not just its findings. Everything after the
+loop — cross-file taint, gadget detection, the whole annotation pipeline — re-runs
+from scratch, so nothing that depends on the global picture can be stale by
+construction. On replay, `pfr[p]`'s arrays are rebuilt as slices of the aggregate
+arrays, so object identity between the two matches an uninterrupted run exactly.
+
+**The property.** A resumed scan must produce the same finding set as an
+uninterrupted one; a checkpoint that silently drops findings turns a slow scan
+into a quietly incomplete one, which is worse than no checkpoint. `test/scan-checkpoint.test.js`
+asserts this end-to-end: a child process is hard-exited (`process.exit`, no
+unwinding) partway through a real scan, the resumed scan is compared against a
+genuinely uninterrupted one, and the fixture is asserted to exercise every
+channel inside the replayed prefix so a dropped channel cannot go unnoticed.
+
+**Invalidation is deliberately blunt.** The run key covers engine version,
+ruleset version, bundle SHA, a content hash of every scanned and dependency file
+(which subsumes mtime), and every `AGENTIC_SECURITY_*` env switch. If any of it
+moved, the checkpoint is discarded and the scan starts clean. Redoing work is
+slow; resuming stale work is a correctness bug.
+
+**Crash safety: append-and-fsync.** JSONL — one header line pinning the run key,
+then one record per file carrying a SHA-256 of its own payload, each written with
+a single `writeSync` and `fsyncSync`'d before the next file is analysed. Recovery
+reads forward while records verify and truncates at the last byte that did, so a
+torn or tampered tail is dropped rather than resumed into. Nothing is rewritten
+in place. Values JSON cannot round-trip (Date/RegExp/Map/function/…) are refused
+rather than recorded lossily — that file just gets rescanned. On clean completion
+the checkpoint is removed, so the next run cannot resume consumed state.
+
+State lives at `<scanRoot>/.agentic-security/scan-checkpoint.jsonl`; like every
+other module here, nothing throws — a failure to open, read or append degrades to
+"no checkpoint", i.e. a normal full scan.
+
 ## Gotchas
 
 - The seed `calibration-seed.json` is small (n < 30 for several families). Don't treat it as a held-out set — that's `holdout-eval.js`'s job, against an externally-supplied JSONL.