@clear-capabilities/agentic-security-scanner 0.130.0 → 0.132.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-dd72d7c2dcc4df5e96f24285cf531a6476881867a330000427a6a8edaf71b06e  agentic-security.mjs
+a1f581521eaab4f89f26aa9f06af557e9443dbea7a8411da5ecd904f3b94acd3  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.130.0",
+  "version": "0.132.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, SARIF ingest, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -38,9 +38,8 @@
     "@babel/core": "^8.0.1",
     "@babel/preset-react": "^8.0.1",
     "@babel/preset-typescript": "^8.0.1",
-    "fast-glob": "^3.3.3",
     "java-parser": "^3.0.1",
-    "js-yaml": "^5.2.2",
+    "js-yaml": "^5.2.3",
     "safe-regex": "^2.1.1"
   },
   "optionalDependencies": {
@@ -48,7 +47,7 @@
     "web-tree-sitter": "0.20.8"
   },
   "devDependencies": {
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.2.0",
     "@vercel/ncc": "^0.44.1"
   },
   "overrides": {
@@ -57,12 +56,14 @@
   },
   "scripts": {
     "build": "ncc build bin/agentic-security.js -o dist --minify -e web-tree-sitter -e tree-sitter-wasms && mv dist/index.js dist/agentic-security.mjs && rm -f dist/package.json && chmod +x dist/agentic-security.mjs && node -e \"const fs=require('fs');const p='dist/agentic-security.mjs';const c=fs.readFileSync(p,'utf8');if(!c.startsWith('#!'))fs.writeFileSync(p,'#!/usr/bin/env node\\n'+c);\" && node -e \"const fs=require('fs');const c=require('crypto');const h=c.createHash('sha256').update(fs.readFileSync('dist/agentic-security.mjs')).digest('hex');fs.writeFileSync('dist/agentic-security.mjs.sha256',h+'  agentic-security.mjs\\n');\"",
-    "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs",
-    "test": "npm run test:smoke && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && npm run test:eval && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js",
+    "prepare": "node ../scripts/pre-push-gate.mjs --install-hook",
+    "prepublishOnly": "npm run build && node ../scripts/sync-scanner-changelog.mjs && node ../scripts/release-check.mjs",
+    "test": "npm run test:smoke && npm run test:glob && npm run test:sast && npm run test:posture && npm run test:dataflow && npm run test:mcp && npm run test:report && npm run test:bench-modules && npm run test:lifecycle && npm run test:eval && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js",
     "test:smoke": "node --test test/smoke.test.js",
+    "test:glob": "node --test test/glob-compat.test.js",
     "test:sast": "node --test test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js",
-    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/attestation.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/scan-checkpoint.test.js test/llm-redact.test.js",
-    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js",
+    "test:posture": "node --test test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/attestation.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/scan-checkpoint.test.js test/llm-redact.test.js",
+    "test:dataflow": "node --test test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-go.test.js test/parser-php-rb.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js",
     "test:report": "node --test test/sarif-ingest.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
@@ -95,7 +96,14 @@
     "bench:self-scan:check": "node ../bench/self-scan/check.mjs",
     "bench:self-scan:update-baseline": "node ../bench/self-scan/check.mjs --update-baseline",
     "bench:engine-recall": "node ../bench/engine-recall/measure.mjs",
-    "scorecard": "node ../scripts/scorecard.mjs"
+    "scorecard": "node ../scripts/scorecard.mjs",
+    "corpus:enroll": "node ../scripts/enroll-proven-finding.mjs",
+    "determinism:attest": "node ../scripts/attest-fixture.mjs",
+    "scorecard:check": "node ../scripts/scorecard-check.mjs",
+    "release:check": "node ../scripts/release-check.mjs",
+    "release:check:fast": "node ../scripts/release-check.mjs --fast",
+    "gate:prepush": "node ../scripts/pre-push-gate.mjs",
+    "gate:prepush:install": "node ../scripts/pre-push-gate.mjs --install-hook"
   },
   "author": "Ross Young <ross@clearcapabilities.com>",
   "license": "PolyForm-Internal-Use-1.0.0"

package/src/engine.js

@@ -996,6 +996,14 @@ function performASTAnalysis(fp, code) {
         babelTransformSync(code, {
             filename: fp,
             presets: [presetReact, [presetTypescript, { ignoreExtensions: true }]],
+      // Decorators are SYNTAX we must accept, never transform — without them the
+      // parser rejects the whole file and every finding in it silently disappears.
+      // Measured on one real target: 201 JS files unparseable, all decorator-using
+      // framework code. 'decorators-legacy' covers the framework and TypeScript
+      // parameter forms; 'decoratorAutoAccessors' adds the modern `accessor` field.
+      // The modern 'decorators' variant was rejected: it cannot parse TS parameter
+      // decorators, so it would trade one blind spot for another.
+      parserOpts: { plugins: ['decorators-legacy', 'decoratorAutoAccessors'] },
             plugins: [astTaintTrackerPlugin],
             ast: false, code: false,
             babelrc: false, configFile: false,
@@ -4646,6 +4654,14 @@ function _buildCallGraphAST(fp, code){
     babelTransformSync(code, {
       filename: fp,
       presets: [presetReact, [presetTypescript, { ignoreExtensions: true }]],
+      // Decorators are SYNTAX we must accept, never transform — without them the
+      // parser rejects the whole file and every finding in it silently disappears.
+      // Measured on one real target: 201 JS files unparseable, all decorator-using
+      // framework code. 'decorators-legacy' covers the framework and TypeScript
+      // parameter forms; 'decoratorAutoAccessors' adds the modern `accessor` field.
+      // The modern 'decorators' variant was rejected: it cannot parse TS parameter
+      // decorators, so it would trade one blind spot for another.
+      parserOpts: { plugins: ['decorators-legacy', 'decoratorAutoAccessors'] },
       plugins: [callTrackerPlugin],
       ast: false, code: false,
       babelrc: false, configFile: false,

package/src/ir/parser-js.js

@@ -402,6 +402,14 @@ export function parseJsFile(file, code) {
       // regardless of extension. JSX stays enabled via preset-react, so .js files
       // containing JSX still parse — which .isTSX/.allExtensions guaranteed before.
       presets: [presetReact, [presetTypescript, { ignoreExtensions: true }]],
+      // Decorators are SYNTAX we must accept, never transform — without them the
+      // parser rejects the whole file and every finding in it silently disappears.
+      // Measured on one real target: 201 JS files unparseable, all decorator-using
+      // framework code. 'decorators-legacy' covers the framework and TypeScript
+      // parameter forms; 'decoratorAutoAccessors' adds the modern `accessor` field.
+      // The modern 'decorators' variant was rejected: it cannot parse TS parameter
+      // decorators, so it would trade one blind spot for another.
+      parserOpts: { plugins: ['decorators-legacy', 'decoratorAutoAccessors'] },
       plugins: [plugin],
       ast: false, code: false, babelrc: false, configFile: false,
     });

package/src/mcp/tools.js

@@ -22,8 +22,8 @@ import { verifyLastScan } from '../posture/integrity.js';
 import { analyzeTranscript, formatCacheReport, renderCacheStatusLine } from '../posture/cache-economics.js';
 import { redactString, redactFinding } from './redact.js';
 
-// Lazy-loaded: these transitively pull in npm packages (fast-glob,
-// @babel/core) that aren't available in the plugin-cache install path
+// Lazy-loaded: these transitively pull in npm packages (@babel/core and
+// friends) that aren't available in the plugin-cache install path
 // (no node_modules). Deferring keeps the MCP server bootable everywhere;
 // the import only runs when a tool that needs them is actually called.
 let _runScan;

package/src/posture/CLAUDE.md

@@ -21,12 +21,33 @@ Annotators that run **after** every detector has emitted, plus state stores read
 
 **Fix lifecycle** — `fix-history.js` (apply + backup + recover), `fix-verify.js` (closed-loop re-scan + lint), `fix-plan.js` (oversized-patch fallback), `regression-test-gen.js`, `deterministic-fix.js` (safe context-independent literal-swap patch synthesis — md5/sha1→sha256, TLS verify-off→on — materialized on demand by `mcp/synthesize_fix`; every patch still passes through `apply_fix`'s inline verify before it lands).
 
+**Measured fix loop (R5)** — `fix-metrics.js`. `verifyFix` times each stage
+(`rescan`/`lint`/`tests`/`honesty`) and appends one record per attempt to
+`.agentic-security/fix-metrics.jsonl`; `summarizeFixDurations` turns those into
+the reported distribution, surfaced on `scan.fixMetrics` and as a stderr line
+on human formats. Distinguish it from `time-to-fix.js`, which *estimates*
+engineering hours from family and patch shape before anything runs — this
+module reports only what was observed.
+
+Three bucketing rules are load-bearing and each has a test that fails if
+relaxed: **failed attempts never enter the validated distribution** (a failed
+verification short-circuits, so blending them makes a worse pipeline look
+faster); **"tests skipped" is bucketed apart from "tests passed"**
+(`validatedWithoutTests`, since a project with no detectable suite reaches
+`ok:true` on a weaker and much cheaper check); and **per-stage timings come
+from validated runs only** (a failed run truncates every stage after the
+failure point). Buckets partition the attempts, so the counts always sum.
+Percentiles are nearest-rank — every figure reported is a duration some run
+actually took — and are flagged `reliable:false` below n=10 rather than hidden
+or quoted as settled. Recording goes through `isSafeStateDir`, so it declines
+rather than creating a stray state dir outside a project.
+
 **Agentic verification** — `verifier.js`, `verifier-target.js`, `verifier-ephemeral.js`, `harness-discovery.js`, `adversary-agent.js`, `defender-agent.js`, `auditor-agent.js`, `three-agent-pipeline.js`.
 
 **Methodology additions (`docs/AGENTIC_METHODOLOGY_PRD.md`)** — default-on annotators/artifacts that layer the agentic-hunter methodology on the deterministic engine:
 - `falsification.js` — default falsification pass. For each taint-style finding, tries to DISPROVE it (locate a context-matched control on the path, reusing `dataflow/sanitizer-proof.js`'s shape rules read-only); a blocked finding is demoted + `quarantined`, never removed and never severity-touched (recall-preserving, like `proof-gate`). Wired after `annotateProofGate`. Opt out: `AGENTIC_SECURITY_NO_FALSIFICATION=1`. Optional LLM tier over survivors when an endpoint is configured.
 - `entrypoint-inventory.js` — attack-surface completeness ledger. Enumerates every entry point (HTTP/queue/cron/CLI/env/upload/webhook) with a disposition each; on `scan.entrypointInventory`.
-- `root-cause-sweep.js` — from confirmed findings, finds sibling instances detectors missed with total-count accounting (`found === candidates + mitigated`); on `scan.rootCauseSweep`.
+- `root-cause-sweep.js` — from confirmed findings, finds sibling instances detectors missed with total-count accounting (`found === candidates + mitigated`); on `scan.rootCauseSweep`. Searches the corpus **once per distinct sink pattern**, not once per finding — findings deriving the same pattern share one walk and one set of (read-only) match records. The counts are always exact; the materialised `instances` list is a bounded sample (`INSTANCE_SAMPLE_LIMIT`, 100) and says so via `instancesTruncated`. Both properties are load-bearing on large corpora: the per-finding walk was O(findings × corpus-bytes) and the instance records were O(findings × matches), which together exhausted a 6 GB heap on a 40k-file suite. If you touch this module, keep the own-site exclusion **per pattern group** — resolving it globally makes a group subtract an exclusion it never matched and drives counts negative.
 - `model-routing.js` — capability-based CWE/severity→model policy; stamps `finding.dispatchModel` (strongest for crypto/auth/critical, mid for injection, cheapest for low-sev hardening) for cost-sensitive subagent dispatch.
 - `fix-honesty-gate.js` — deterministic honesty gates on fix output: a residual-risk hand-wave guard, a cited-file:line requirement for any FP/safe verdict, and FULL/MITIGATION/WORKAROUND completeness tiers. Consumed by `fix-verify.js` when the caller supplies fix metadata; the closed-loop test leg (`fix-verify-loop.js`) is wired into `mcp/apply_fix` behind `AGENTIC_SECURITY_FIX_RUN_TESTS=1`.
 
@@ -102,19 +123,75 @@ timeout/crash detection, never as the proof signal itself.
 
 **The backend is recorded in every evidence object** (`proofEvidence.backend`,
 e.g. `'userspace'`) because not all confinement backends carry the same
-guarantee. The kernel-namespace backend is unverified on this host and, even
-where available, only confines network — it does **not** confine writes.
-Treat `execution-proven` evidence from a non-`userspace` backend as weaker
-than the same tier from `userspace` until that backend's write confinement
-is independently verified. `attachProofTier()` also enforces the demotion
+guarantee. Two backends now carry a verified-by-execution escape contract:
+`userspace` (verified on the macOS development host) and `namespace`, which
+implements write confinement as well as network isolation (read-only rebind of
+the mount tree, read-write rebind of the sandbox root, capability drop before
+exec) and whose escape suite has now **RUN and passed on a Linux host in CI** —
+see `sandbox/CLAUDE.md` for the host and the eight cases. `execution-proven`
+evidence from either of those backends stands on an executed escape contract.
+The `disabled` backend never produces evidence at all: it refuses to run,
+which is why the tier stays static rather than becoming `proof-failed`.
+Keep reading `proofEvidence.backend` anyway — it is what makes a tier
+re-auditable when a backend's contract changes, and a backend added later
+starts out unverified by default. `attachProofTier()` also enforces the demotion
 guard: `ran:false` can never yield `execution-proven` or `proof-failed`,
 regardless of what tier was requested — it falls back to the finding's
 static standing (`proofTierOf`).
 
+**`ran` means the PoC executed, not that `runConfined` returned.** A sandbox
+that could not start (`status:'error'` — confinement binary missing, namespaces
+denied) and a refusal (`status:'disabled'`) both leave the PoC unexecuted, so
+`execution-proof.js` records `ran:false` and a reason naming the sandbox
+failure, leaving the finding at its static tier. Calling that `proof-failed`
+would report a broken sandbox as a failed exploit attempt — a claim about the
+*finding* derived from evidence that only concerns the *host*.
+
 `proofTier`/`proofEvidence` are copied through `report/index.js`'s
 `normalizeFindings()` only when the annotator actually attached them —
 never synthesised at the report layer.
 
+## Corpus auto-enrolment (R2's differentiator)
+
+`corpus-enroll.js` + `corpus-match.js` turn an execution-proven finding into a
+permanent CVE-replay corpus entry, so every exploit the pipeline proves once is
+defended by the baseline gate forever.
+
+**`corpus-match.js` is shared with the gate on purpose.** `bench/cve-replay/runner.mjs`
+imports `matcherFor`/`preHit`/`postHit` from it. If enrolment verified a
+candidate with a different matcher than the gate scores with, it would commit
+entries that fail CI. The pre/post asymmetry (pre matches `vuln` OR `family`
+and regex-tests `cwe`; post is strict on `vuln` and exact on `cwe`) is
+reproduced verbatim from the runner — `bench/cve-replay/CONTRIBUTING.md` records
+it as known imprecision, and changing it would re-verdict the whole committed
+baseline, which is a corpus migration rather than a refactor.
+
+**Nothing is written that has not been scored.** `enrollProvenFinding` builds
+the entry in a temp dir, scans `pre/` and `post/`, and moves it into the corpus
+only on `pre:TP post:TN`. There is no force flag, and `scoreCandidate` is
+deliberately unexported so no caller can score by one route and write by
+another — that unscored-write path is the v0.106.0 mistake this module would
+otherwise automate. Refusals also cover: a tier that disagrees with its own
+`proofEvidence`, `ran !== true`, an `execution-proven` tier with nothing
+observed, a missing `post/` (never synthesised by deleting the vulnerable
+line — it would pass for the wrong reason), a `post/` identical to `pre/`, a
+path escaping the entry dir, a `pre/` not containing the finding's file, and a
+duplicate id. The manifest's `vuln_match` is regex-escaped so an unrelated
+detector cannot satisfy the entry.
+
+**New entries land in `capability/`, never `regression/`.** `regression/` is
+the CI-gated tier and graduation into it is a human decision with a stated
+policy; an automated writer must not decide what blocks everyone's build.
+
+**Operator entry point:** `scripts/enroll-proven-finding.mjs <project>`
+(`--dry-run` scores without writing). It proves findings itself — the scan
+pipeline does **not** attach a `poc` to findings or promote proof tiers, so
+`last-scan.json` never contains an `execution-proven` finding on its own. PoCs
+come from the PoC-generator. Enrolment additionally needs fixed content
+(`finding.fix.patch`) for `post/`; a proven finding with no fix is reported as
+skipped, not dropped. After enrolling, refresh the baseline
+(`npm run bench:cve-replay:update-baseline`) and commit it.
+
 ## Scan checkpointing / resume (R8)
 
 `scan-checkpoint.js` lets an interrupted scan resume instead of restarting, which

package/src/posture/attestation.js

@@ -60,10 +60,13 @@ const PROVES =
   '(same rule id, severity, file, line, cwe, vuln, and multiplicity) produced by the same ' +
   'engine version, ruleset version, and bundle — regardless of emission order.';
 const DOES_NOT_PROVE =
-  'It does not prove cross-machine reproducibility: no run on a second machine, OS, or Node ' +
-  'version is compared here, and some detectors are environment-sensitive. A signature, when ' +
-  'present, is a symmetric per-install HMAC — tamper-evidence for this install, not ' +
-  'third-party non-repudiation.';
+  'It does not prove cross-machine reproducibility: this attestation is one run on one machine, ' +
+  'nothing here compares a second machine, OS, or Node version, and some detectors are ' +
+  'environment-sensitive. That property is tested separately by the determinism-attest / ' +
+  'determinism-compare CI jobs, which run the same commit on two operating systems and fail ' +
+  'unless the digests match — evidence about the ENGINE, not about this attestation. ' +
+  'A signature, when present, is a symmetric per-install HMAC — tamper-evidence for this ' +
+  'install, not third-party non-repudiation.';
 
 function _str(v) { return v === undefined || v === null ? '' : String(v); }
 

package/src/posture/corpus-enroll.js

@@ -0,0 +1,303 @@
+// R2's differentiator — auto-enrol an execution-proven finding as a permanent
+// CVE-replay corpus entry.
+//
+// The compounding asset: a finding that was PROVEN by execution becomes a
+// regression test that the baseline gate defends forever. Every exploit the
+// pipeline proves once, it can never silently stop detecting.
+//
+// THE CENTRAL RULE: nothing is written to the corpus that has not been scored.
+// The v0.106.0 failure — fixtures committed without verifying they actually
+// score, which then broke the gate for everyone — is the exact mistake this
+// module must not automate. So enrolment builds the entry in a TEMPORARY
+// directory, scans `pre/` and `post/` with the same matcher the gate uses
+// (`corpus-match.js`), and moves it into the corpus only on `pre:TP post:TN`.
+// A candidate that does not score is discarded and the reason returned. There
+// is no force flag and no "probably fine" path.
+//
+// WHY A FIX IS MANDATORY. An entry needs a `post/` that scores TN, and the
+// only honest source of one is a real fix. Enrolment therefore refuses a
+// finding with no fixed content rather than synthesising a `post/` by deleting
+// the vulnerable line — that would produce an entry that passes for a reason
+// unrelated to the vulnerability, which is worse than no entry.
+//
+// WHY `capability/` AND NOT `regression/`. `regression/` is the CI-gated tier
+// and graduation into it is a human decision with a stated policy (five
+// consecutive passing snapshots — see bench/cve-replay/CONTRIBUTING.md). An
+// automated writer promoting straight into the gated tier would let a machine
+// decide what blocks everyone's build. New entries land in `capability/`,
+// already passing, and graduate on the existing policy.
+//
+// NOTHING THROWS (posture convention): every path returns
+// `{ok:false, refused:true, reason}` instead.
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { preHit, postHit, matcherFor } from './corpus-match.js';
+
+const DEFAULT_TIER = 'capability';
+
+// Entry ids must be safe to use as a directory name and stable across runs.
+const ID_SAFE = /^[A-Za-z0-9._-]+$/;
+
+function refuse(reason) { return { ok: false, refused: true, reason }; }
+
+// A finding is enrollable only if the pipeline actually RAN its exploit. This
+// re-checks the evidence rather than trusting `proofTier` alone: the tier is a
+// string on an object that may have crossed a process boundary, and the
+// consequence of trusting a forged one is a permanent corpus entry.
+export function isEnrollable(finding) {
+  if (!finding || typeof finding !== 'object') return refuse('no finding supplied');
+  if (finding.proofTier !== 'execution-proven') {
+    return refuse(
+      `only execution-proven findings may enrol; this one is '${finding.proofTier || 'untiered'}'. `
+      + 'A statically-reasoned finding has not earned a permanent regression entry.',
+    );
+  }
+  const ev = finding.proofEvidence;
+  if (!ev || ev.ran !== true) {
+    return refuse('proofEvidence does not record a run (ran !== true) — the tier is not backed by evidence');
+  }
+  if (ev.tier !== 'execution-proven') {
+    return refuse(`proofEvidence.tier ('${ev.tier}') disagrees with proofTier — refusing rather than picking one`);
+  }
+  if (!ev.observed) {
+    return refuse('proofEvidence records no observed effect — an execution-proven tier with nothing observed is not evidence');
+  }
+  return { ok: true };
+}
+
+function _slug(s, fallback) {
+  const out = String(s || '').trim().replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '');
+  return out || fallback;
+}
+
+/**
+ * The entry id. Derived from the finding so re-enrolling the same finding is
+ * idempotent (it will be refused as a duplicate) rather than accumulating
+ * near-identical entries.
+ */
+export function entryIdFor(finding) {
+  const fam = _slug(finding?.family || finding?.cwe, 'finding');
+  const sid = _slug(finding?.stableId || finding?.id, 'unknown');
+  return `proven-${fam}-${sid}`.slice(0, 120);
+}
+
+/**
+ * Build the manifest + file map for a candidate entry, without writing it.
+ *
+ * @param {object} finding      an execution-proven finding
+ * @param {object} opts
+ * @param {object} opts.preFiles   rel→content, the VULNERABLE tree
+ * @param {object} opts.postFiles  rel→content, the FIXED tree
+ */
+export function buildCandidate(finding, { preFiles, postFiles, addedAt } = {}) {
+  const gate = isEnrollable(finding);
+  if (!gate.ok) return gate;
+
+  if (!finding.cwe) return refuse('finding has no cwe — the manifest matcher would be meaningless');
+  if (!finding.vuln) return refuse('finding has no vuln — nothing to match on');
+  if (!finding.file) return refuse('finding has no file — cannot name the expected file');
+
+  const pre = preFiles && typeof preFiles === 'object' ? preFiles : null;
+  const post = postFiles && typeof postFiles === 'object' ? postFiles : null;
+  if (!pre || !Object.keys(pre).length) return refuse('no pre/ content supplied — nothing to prove the detector fires on');
+  if (!post || !Object.keys(post).length) {
+    return refuse(
+      'no post/ content supplied. An entry with no fixed tree cannot score post:TN, and '
+      + 'synthesising one by deleting the vulnerable code would pass for the wrong reason.',
+    );
+  }
+
+  // A `post` identical to `pre` cannot be a fix. Catching it here turns a
+  // guaranteed post:FP into a clear refusal.
+  const same = Object.keys(pre).length === Object.keys(post).length
+    && Object.entries(pre).every(([k, v]) => post[k] === v);
+  if (same) return refuse('post/ is byte-identical to pre/ — no fix was applied, so the entry cannot score post:TN');
+
+  for (const [label, files] of [['pre', pre], ['post', post]]) {
+    for (const [rel, content] of Object.entries(files)) {
+      if (typeof content !== 'string') return refuse(`${label}/${rel} content is not a string`);
+      if (path.isAbsolute(rel) || rel.split(/[\\/]/).includes('..')) {
+        return refuse(`${label}/${rel} escapes the entry directory`);
+      }
+    }
+  }
+
+  const id = entryIdFor(finding);
+  if (!ID_SAFE.test(id)) return refuse(`derived entry id '${id}' is not a safe directory name`);
+
+  const expectedFile = path.basename(String(finding.file));
+  if (!Object.keys(pre).some(rel => path.basename(rel) === expectedFile)) {
+    return refuse(`the finding's file '${expectedFile}' is not among the pre/ files — the entry would not test the finding`);
+  }
+
+  const manifest = {
+    cve: id,
+    cwe: finding.cwe,
+    family: finding.family || 'unknown',
+    language: finding.language || _languageOf(expectedFile),
+    summary: `execution-proven ${finding.family || finding.cwe}: ${String(finding.vuln).slice(0, 120)}`,
+    expected: {
+      file: expectedFile,
+      // Match on the exact vuln string this finding carried. A broader regex
+      // would let an unrelated detector satisfy the entry.
+      vuln_match: _escapeRegex(String(finding.vuln)),
+    },
+    source: 'execution-proven',
+    added_at: addedAt || new Date().toISOString().slice(0, 10),
+    provenance: {
+      stableId: finding.stableId || null,
+      proofBackend: finding.proofEvidence?.backend || null,
+      observed: finding.proofEvidence?.observed || null,
+      provenAt: finding.proofEvidence?.at || null,
+    },
+  };
+
+  return { ok: true, id, manifest, preFiles: pre, postFiles: post };
+}
+
+function _escapeRegex(s) { return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'); }
+
+function _languageOf(file) {
+  const ext = path.extname(file).toLowerCase();
+  return {
+    '.js': 'javascript', '.mjs': 'javascript', '.cjs': 'javascript',
+    '.ts': 'typescript', '.tsx': 'typescript', '.jsx': 'javascript',
+    '.py': 'python', '.java': 'java', '.go': 'go', '.rb': 'ruby',
+    '.php': 'php', '.cs': 'csharp', '.rs': 'rust',
+  }[ext] || 'unknown';
+}
+
+function _writeTree(dir, files) {
+  for (const [rel, content] of Object.entries(files)) {
+    const abs = path.join(dir, rel);
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, content, 'utf8');
+  }
+}
+
+/**
+ * Materialise a candidate into a staging directory and SCORE it, using the
+ * same matcher the corpus gate uses.
+ *
+ * @param {function} runScan  injected so this module stays free of an engine
+ *   import cycle and so tests can drive it without a full scan.
+ * @returns {{ok:boolean, status:string, preHit:boolean, postHit:boolean, reason?:string}}
+ */
+async function scoreCandidate(candidate, runScan, { stagingDir } = {}) {
+  const dir = stagingDir || fs.mkdtempSync(path.join(os.tmpdir(), 'corpus-cand-'));
+  try {
+    const preDir = path.join(dir, 'pre');
+    const postDir = path.join(dir, 'post');
+    fs.mkdirSync(preDir, { recursive: true });
+    fs.mkdirSync(postDir, { recursive: true });
+    _writeTree(preDir, candidate.preFiles);
+    _writeTree(postDir, candidate.postFiles);
+    fs.writeFileSync(path.join(dir, 'manifest.json'), JSON.stringify(candidate.manifest, null, 2) + '\n', 'utf8');
+
+    const matcher = matcherFor(candidate.manifest);
+    let pre, post;
+    try {
+      ({ scan: pre } = await runScan(preDir));
+    } catch (e) {
+      return { ok: false, status: 'scan-error', preHit: false, postHit: false, reason: `pre/ scan failed: ${e.message}` };
+    }
+    try {
+      ({ scan: post } = await runScan(postDir));
+    } catch (e) {
+      return { ok: false, status: 'scan-error', preHit: false, postHit: false, reason: `post/ scan failed: ${e.message}` };
+    }
+
+    const hitPre = preHit(pre, candidate.manifest, matcher);
+    const hitPost = postHit(post, candidate.manifest, matcher);
+    const status = `pre:${hitPre ? 'TP' : 'FN'} post:${hitPost ? 'FP' : 'TN'}`;
+
+    if (!hitPre) {
+      return {
+        ok: false, status, preHit: hitPre, postHit: hitPost, dir,
+        reason: 'the detector does not fire on pre/ — the entry would be committed already failing. '
+              + 'A PoC proved this finding at runtime but the minimised fixture does not reproduce it statically.',
+      };
+    }
+    if (hitPost) {
+      return {
+        ok: false, status, preHit: hitPre, postHit: hitPost, dir,
+        reason: 'the detector still fires on post/ — the fix does not clear the finding, so the entry cannot score TN.',
+      };
+    }
+    return { ok: true, status, preHit: hitPre, postHit: hitPost, dir };
+  } catch (e) {
+    return { ok: false, status: 'error', preHit: false, postHit: false, reason: e.message };
+  }
+}
+
+/**
+ * The full path: gate → build → score → commit.
+ *
+ * Writes into `<corpusRoot>/<tier>/<id>/` ONLY when the candidate scored
+ * `pre:TP post:TN`. Anything else leaves the corpus untouched.
+ */
+export async function enrollProvenFinding(finding, {
+  corpusRoot, preFiles, postFiles, runScan, tier = DEFAULT_TIER, addedAt, dryRun = false,
+} = {}) {
+  if (!corpusRoot) return refuse('no corpusRoot supplied');
+  if (typeof runScan !== 'function') return refuse('no runScan supplied — an entry may not be committed unscored');
+
+  const candidate = buildCandidate(finding, { preFiles, postFiles, addedAt });
+  if (!candidate.ok) return candidate;
+
+  const dest = path.join(corpusRoot, tier, candidate.id);
+  if (fs.existsSync(dest)) {
+    return refuse(`entry '${candidate.id}' already exists in ${tier}/ — refusing to overwrite a corpus entry`);
+  }
+
+  const staging = fs.mkdtempSync(path.join(os.tmpdir(), 'corpus-cand-'));
+  try {
+    const scored = await scoreCandidate(candidate, runScan, { stagingDir: staging });
+    if (!scored.ok) {
+      return {
+        ok: false, refused: true, id: candidate.id, status: scored.status,
+        reason: `not enrolled (${scored.status}): ${scored.reason}`,
+      };
+    }
+    if (dryRun) {
+      return { ok: true, dryRun: true, id: candidate.id, status: scored.status, dir: null, manifest: candidate.manifest };
+    }
+
+    // Scan state accumulated inside the staged trees must not be committed —
+    // it would be scanned as part of the fixture on the next run.
+    _stripState(staging);
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.renameSync(staging, dest);
+    return {
+      ok: true,
+      id: candidate.id,
+      tier,
+      status: scored.status,
+      dir: dest,
+      manifest: candidate.manifest,
+      // Said explicitly because a caller that stops here leaves the repo in a
+      // state where the gate reports a nudge rather than a pass.
+      followUp: 'run `npm run bench:cve-replay:update-baseline` and commit the regenerated corpus-baseline.json',
+    };
+  } catch (e) {
+    return refuse(`enrolment failed: ${e.message}`);
+  } finally {
+    // If the rename happened, staging no longer exists and this is a no-op.
+    try { fs.rmSync(staging, { recursive: true, force: true }); } catch { /* best effort */ }
+  }
+}
+
+function _stripState(dir) {
+  for (const sub of ['pre', 'post']) {
+    const s = path.join(dir, sub, '.agentic-security');
+    try { fs.rmSync(s, { recursive: true, force: true }); } catch { /* best effort */ }
+  }
+}
+
+// `scoreCandidate` is deliberately NOT exported: an external caller could
+// score a candidate and then write it by some other route, which is exactly
+// the unscored-write path this module exists to make unavailable. Enrolment
+// scores and writes as one operation or not at all.
+export const _internals = { DEFAULT_TIER, scoreCandidate, _languageOf, _escapeRegex, _stripState };

package/src/posture/corpus-match.js

@@ -0,0 +1,52 @@
+// How a CVE-replay corpus entry is scored against a scan result.
+//
+// Extracted from `bench/cve-replay/runner.mjs` so the corpus GATE and corpus
+// ENROLLMENT (`corpus-enroll.js`) cannot drift apart. That drift is not
+// hypothetical: enrollment only writes an entry it has verified scores
+// `pre:TP post:TN`, and if it verified that with a different matcher than the
+// gate uses, it would cheerfully commit entries that fail CI. One
+// implementation, two callers.
+//
+// THE PRE/POST ASYMMETRY IS DELIBERATE AND PRESERVED VERBATIM. The `pre`
+// matcher accepts a hit on `vuln` OR `family` and regex-tests `cwe`; the
+// `post` matcher is strict on `vuln` and requires an exact `cwe`. This means
+// an entry faces a looser bar to score a TP than an FP, which
+// `bench/cve-replay/CONTRIBUTING.md` records as known imprecision to resolve
+// before the corpus grows toward 500. It is reproduced here rather than
+// quietly fixed: changing it would silently re-verdict entries across the
+// whole committed baseline, which is a corpus migration, not a refactor.
+//
+// The scanner emits into several arrays — `findings` (SAST), `secrets`,
+// `supplyChain` (SCA) and `logicVulns` (business-logic + behavioural) — and a
+// CVE can land in any of them, so all four are consulted.
+
+const CHANNELS = ['findings', 'secrets', 'supplyChain', 'logicVulns'];
+
+/** The regex an entry's manifest scores with. */
+export function matcherFor(manifest) {
+  return new RegExp(manifest?.expected?.vuln_match || manifest?.family || manifest?.cwe || '(?!)', 'i');
+}
+
+function _any(scan, predicate) {
+  for (const channel of CHANNELS) {
+    const arr = scan?.[channel];
+    if (Array.isArray(arr) && arr.some(predicate)) return true;
+  }
+  return false;
+}
+
+/** Did the vulnerable (`pre/`) tree produce a matching finding? */
+export function preHit(scan, manifest, matcher = matcherFor(manifest)) {
+  return _any(scan, f =>
+    (matcher.test(f.vuln || '') || matcher.test(f.family || '')) &&
+    (manifest?.cwe ? f.cwe === manifest.cwe || matcher.test(f.cwe || '') : true));
+}
+
+/** Did the fixed (`post/`) tree still produce a matching finding? */
+export function postHit(scan, manifest, matcher = matcherFor(manifest)) {
+  return _any(scan, f =>
+    matcher.test(f.vuln || '') &&
+    (manifest?.cwe ? f.cwe === manifest.cwe : true));
+}
+
+export const _internals = { CHANNELS };