@clear-capabilities/agentic-security-scanner 0.134.0 → 0.136.9

package/src/mcp/redact.js

@@ -27,6 +27,32 @@ const PATTERNS = [
   [/rk_(?:live|test)_[A-Za-z0-9]{20,}/g, 'stripe-restricted-key'],
   [/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g, 'sendgrid-key'],
   [/AIza[0-9A-Za-z_-]{35}/g, 'google-api-key'],
+  // Stage 4 correctness audit (coverage breadth, AI security): this list
+  // only covered a small subset of what the scanner's OWN credential
+  // detector (engine.js's CREDENTIAL_PATTERNS, 40+ provider shapes) finds
+  // — a Shopify/Telegram/Twilio/Discord-webhook/Square/Google-OAuth/JDBC
+  // secret detected and reported by a scan reached explain_finding's
+  // output completely unredacted, because none of those shapes were in
+  // THIS separate, narrower list. Reusing the same regex bodies as
+  // engine.js's CREDENTIAL_PATTERNS for the shapes verified to leak
+  // (rather than importing engine.js itself, which would pull its entire
+  // multi-thousand-line module graph into the MCP server's dependency
+  // surface for a handful of consts).
+  [/ya29\.[0-9A-Za-z_-]{20,}/g, 'google-oauth-token'],
+  [/shp(?:at|ss|ca|pa)_[a-fA-F0-9]{32}/g, 'shopify-token'],
+  [/(?<![0-9])[0-9]{8,10}:AA[0-9A-Za-z_-]{33}(?![A-Za-z0-9_])/g, 'telegram-bot-token'],
+  [/twilio.{0,20}SK[0-9a-fA-F]{32}/gi, 'twilio-api-key'],
+  [/sq0atp-[0-9A-Za-z_-]{22}/g, 'square-access-token'],
+  [/sq0csp-[0-9A-Za-z_-]{43}/g, 'square-oauth-secret'],
+  [/access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}/g, 'paypal-braintree-token'],
+  [/https:\/\/(?:discordapp|discord)\.com\/api\/webhooks\/[0-9]+\/[A-Za-z0-9_-]+/g, 'discord-webhook'],
+  [/https:\/\/hooks\.slack\.com\/services\/T[a-zA-Z0-9_]{8}\/B[a-zA-Z0-9_]{8,12}\/[a-zA-Z0-9_]{24}/g, 'slack-webhook'],
+  [/https:\/\/outlook\.office\.com\/webhook\/[A-Za-z0-9\-@]+\/IncomingWebhook\/[A-Za-z0-9-]+\/[A-Za-z0-9-]+/g, 'teams-webhook'],
+  [/https:\/\/(?:www\.)?hooks\.zapier\.com\/hooks\/catch\/[A-Za-z0-9]+\/[A-Za-z0-9]+\//g, 'zapier-webhook'],
+  // JDBC connection string carrying a password: only redact when password
+  // evidence is actually on the line (matches engine.js's own ctx gate),
+  // so a credential-free JDBC URL in docs isn't needlessly mangled.
+  [/jdbc:[a-z:]+:\/\/[A-Za-z0-9.\-_:;=/@?,&]*(?:@|password=|passwd=|pwd=)[A-Za-z0-9.\-_:;=/@?,&]*/gi, 'jdbc-connection-string'],
   // JWT — three dot-separated b64url segments starting with eyJ
   [/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, 'jwt'],
   // PEM-encoded private keys

package/src/mcp/tools.js

@@ -21,6 +21,7 @@ import { synthesizeDeterministicPatch } from '../posture/deterministic-fix.js';
 import { verifyLastScan } from '../posture/integrity.js';
 import { analyzeTranscript, formatCacheReport, renderCacheStatusLine } from '../posture/cache-economics.js';
 import { redactString, redactFinding } from './redact.js';
+import { _remediationOf } from '../report/index.js';
 
 // Lazy-loaded: these transitively pull in npm packages (@babel/core and
 // friends) that aren't available in the plugin-cache install path
@@ -152,12 +153,17 @@ function _validateScratchpadPath(relPath) {
   return { ok: true, agent, session, fileParts };
 }
 
+// Routes through the same lstat+realpath confinement every other write/
+// path-taking tool uses (OWASP MCP05) — a lexical prefix/charset check
+// alone doesn't stop a pre-planted symlink at any path component from
+// relocating the write/read outside the session root. Throws on escape;
+// callers must catch (see append_scratchpad / read_scratchpad).
 function _scratchpadAbs(sessionRoot, relPath) {
-  return path.resolve(sessionRoot, relPath.replace(/\\/g, '/'));
+  return _confine(sessionRoot, relPath.replace(/\\/g, '/'), 'scratchpad path');
 }
 
 function _scratchpadTotalBytes(sessionRoot) {
-  const base = path.join(sessionRoot, '.agentic-security', 'agent-scratchpad');
+  const base = statePath(sessionRoot, 'agent-scratchpad');
   if (!fs.existsSync(base)) return 0;
   let total = 0;
   const walk = (dir) => {
@@ -222,8 +228,8 @@ function _confine(sessionRoot, candidate, label) {
 }
 
 function _readLastScanVerified(sessionRoot, { allowUnsigned = false } = {}) {
-  const stateDir = path.join(sessionRoot, '.agentic-security');
-  const scanFile = path.join(stateDir, 'last-scan.json');
+  const stateDirPath = stateDir(sessionRoot);
+  const scanFile = path.join(stateDirPath, 'last-scan.json');
   const sigFile = scanFile + '.sig';
   if (!fs.existsSync(scanFile)) return { scan: null, status: 'missing' };
   const body = fs.readFileSync(scanFile, 'utf8');
@@ -337,12 +343,22 @@ export const scan_diff = {
     const wantSet = new Set(Object.keys(fileContents));
     const sevRank = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
     const min = sevRank[severity] ?? 0;
-    const findings = (result.scan.findings || [])
+    // Stage 6 correctness audit: this only ever read result.scan.findings
+    // (the SAST channel) — scan.secrets and scan.logicVulns are separate
+    // arrays on the raw runScan() result (report/index.js's normalizeFindings
+    // is what merges all four channels, and that merge hasn't run yet here).
+    // A file containing a bare hardcoded credential reported findingCount: 0
+    // through a tool whose own description promises "Use BEFORE writing a
+    // Write/Edit to disk so the agent can self-correct". Also reused
+    // _remediationOf so a fix-string detector (the majority of engine.js's
+    // own, ~127 call sites) doesn't silently report an empty `description`
+    // the way reading only `.remediation` did.
+    const findings = [...(result.scan.findings || []), ...(result.scan.secrets || []), ...(result.scan.logicVulns || [])]
       .filter(f => wantSet.has(String(f.file || '').replace(/\\/g, '/')) && (sevRank[f.severity] ?? 0) >= min)
       .map(f => redactFinding({
         id: f.id, severity: f.severity, file: f.file, line: f.line,
         title: f.title || f.vuln, cwe: f.cwe,
-        description: f.description, remediation: f.remediation,
+        description: f.description, remediation: _remediationOf(f),
       }));
     // Harness-anatomy #1: offload when the result exceeds OFFLOAD_THRESHOLD.
     // The agent gets a head+tail preview plus a path it can page through;
@@ -505,10 +521,40 @@ export const apply_fix = {
         additionalProperties: { type: 'string', maxLength: 500_000 },
         minProperties: 1, maxProperties: 8,
       },
+      // Stage 6 correctness audit: same gap and same fix as verify_fix — the
+      // honesty gate is reachable but was never wired to any real caller.
+      // Here it's stronger than advisory: the inline re-verify below already
+      // gates the WRITE on `verdict.ok`, and verifyFixCore's own `ok`
+      // formula already folds in `honesty.ok` when fixMeta is supplied — so
+      // passing it through here makes a dishonest fixMeta (hand-wave
+      // residual, uncited false-positive verdict) block the write itself,
+      // not just report a verdict.
+      fixMeta: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          residual: { type: 'string', maxLength: 2000 },
+          verdict: { type: 'string', maxLength: 64 },
+          evidence: { type: 'array', items: { type: 'string', maxLength: 500 }, maxItems: 20 },
+          signals: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+              sinkSignatureChanged: { type: 'boolean' },
+              allCallersRouted: { type: 'boolean' },
+              testDiscriminates: { type: 'boolean' },
+              rateLimitOnly: { type: 'boolean' },
+              docsOnly: { type: 'boolean' },
+              logOnlyNoReject: { type: 'boolean' },
+              partialSanitization: { type: 'boolean' },
+            },
+          },
+        },
+      },
     },
     required: ['finding_id', 'confirm'],
   },
-  async handler({ finding_id, confirm, dry_run = false, patch = null }, ctx) {
+  async handler({ finding_id, confirm, dry_run = false, patch = null, fixMeta = null }, ctx) {
     if (confirm !== true) {
       return { _meta: META, applied: false, reason: 'apply_fix requires confirm: true.' };
     }
@@ -564,6 +610,7 @@ export const apply_fix = {
             scanRoot: ctx.sessionRoot,
             originalFindingStableId: f.stableId,
             files: _files,
+            fixMeta,
           });
         }
       } catch (e) {
@@ -573,7 +620,7 @@ export const apply_fix = {
         return {
           _meta: META, applied: false,
           reason: `patch rejected by verifier: ${verdict.summary || verdict.rescan?.reason || 'did not verify'}`,
-          verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok } },
+          verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok }, honesty: verdict.honesty || null },
         };
       }
       if (dry_run) {
@@ -585,7 +632,7 @@ export const apply_fix = {
           const originalContent = fs.existsSync(v.abs) ? await fsp.readFile(v.abs, 'utf8') : '';
           const entry = await applyFixHistory({
             scanRoot: ctx.sessionRoot, file: rel, originalContent, newContent: v.content,
-            findingId: f.id, stableId: f.stableId, ruleId: f.rule || null, vuln: f.vuln || f.title || null,
+            findingId: f.id, stableId: f.stableId, ruleId: f.ruleId || f.cwe || f.family || null, vuln: f.vuln || f.title || null,
           });
           written.push({ file: rel, historyId: entry.id, backupPath: entry.backupPath });
         }
@@ -643,7 +690,7 @@ export const apply_fix = {
         newContent: f.fix.replacement,
         findingId: f.id,
         stableId: f.stableId || null,   // premortem 4R-8
-        ruleId: f.rule || null,
+        ruleId: f.ruleId || f.cwe || f.family || null,
         vuln: f.vuln || f.title || null,
       });
     } catch (e) {
@@ -680,7 +727,7 @@ export const apply_fix = {
 // proceed with apply_fix.
 export const verify_fix = {
   name: 'verify_fix',
-  description: 'Verify a proposed patch before applying. Re-scans the patched files in memory and runs the project linter. Returns { ok, rescan, lint, summary }. No filesystem writes.',
+  description: 'Verify a proposed patch before applying. Re-scans the patched files in memory, runs the project linter, runs the project test suite, checks fix honesty (FULL/MITIGATION/WORKAROUND) when fixMeta is supplied, and re-runs the PoC when one exists. Returns { ok, rescan, lint, tests, honesty, poc, summary }. Does not write to the target project’s own files, but DOES append one record per attempt to .agentic-security/fix-metrics.jsonl for the measured fix-loop.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -692,10 +739,41 @@ export const verify_fix = {
         minProperties: 1,
         maxProperties: 8,
       },
+      // Stage 6 correctness audit: posture/fix-honesty-gate.js's deterministic
+      // honesty checks (vague-assurance residual prose, unbacked false-
+      // positive verdicts, tier/residual consistency) were fully built and
+      // fix-verify.js already consulted them when given a `fixMeta` — but
+      // this schema never had a `fixMeta` property, so no call through the
+      // MCP surface could ever supply one. The gate can only run against
+      // claims the AGENT self-reports (residual risk, verdict, evidence,
+      // completeness signals) — nothing here is server-computable — so
+      // fixing this meant exposing the property, not inventing a lookup.
+      fixMeta: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          residual: { type: 'string', maxLength: 2000 },
+          verdict: { type: 'string', maxLength: 64 },
+          evidence: { type: 'array', items: { type: 'string', maxLength: 500 }, maxItems: 20 },
+          signals: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+              sinkSignatureChanged: { type: 'boolean' },
+              allCallersRouted: { type: 'boolean' },
+              testDiscriminates: { type: 'boolean' },
+              rateLimitOnly: { type: 'boolean' },
+              docsOnly: { type: 'boolean' },
+              logOnlyNoReject: { type: 'boolean' },
+              partialSanitization: { type: 'boolean' },
+            },
+          },
+        },
+      },
     },
     required: ['stable_id', 'files'],
   },
-  async handler({ stable_id, files }, ctx) {
+  async handler({ stable_id, files, fixMeta }, ctx) {
     // Confine every file path before passing to the verifier.
     const confined = {};
     for (const [relPath, content] of Object.entries(files || {})) {
@@ -707,17 +785,48 @@ export const verify_fix = {
       confined[relPath] = String(content);
     }
     try {
+      // The PoC-re-check leg (verifyFixCore's `pocLeg`) needs a `poc` param
+      // to do anything — until now nothing supplied one, so it always
+      // reported {status:'not-requested'} through this surface (see
+      // posture/CLAUDE.md's disclosure). Rather than widening inputSchema
+      // to make the CALLER pass PoC data back, look it up server-side: the
+      // scan pipeline already attaches an HTTP-shaped f.poc to matching
+      // findings by default (engine.js's annotatePocs), and last-scan.json
+      // already carries it under the same stableId this handler receives.
+      // Best-effort: a missing/unsigned/tampered scan just means no PoC is
+      // available to re-check, not a verify_fix failure — the rescan/lint/
+      // tests legs below are independent of this and still apply.
+      let poc = null;
+      try {
+        const { scan: lastScan } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: true });
+        const orig = lastScan && (lastScan.findings || []).find(f => f.stableId === stable_id);
+        if (orig && orig.poc && orig.poc.code) poc = { ...orig.poc, finding: orig };
+      } catch { /* best-effort lookup; poc stays null */ }
+
       const verifyFixCore = await getVerifyFixCore();
       const r = await verifyFixCore({
         scanRoot: ctx.sessionRoot,
         originalFindingStableId: stable_id,
         files: confined,
+        poc,
+        fixMeta,
       });
       return {
         _meta: META,
         ok: r.ok,
         rescan: { ok: r.rescan.ok, reason: r.rescan.reason, introduced: r.rescan.introduced || [] },
         lint: { runner: r.lint.runner, ok: r.lint.ok, skipped: r.lint.skipped || false, output: redactString(r.lint.output || '').slice(0, 1500) },
+        // verifyFix computes five legs, not two — tests/honesty/poc were
+        // being silently dropped here, leaving an agent with no structured
+        // way to see WHY verification failed when the failure was in one
+        // of those three (only the free-text summary carried it).
+        // test-runner.js's runProjectTests never returns raw stdout/stderr,
+        // so no redaction is needed there; honesty.violations are static,
+        // code-generated strings; poc.reason is redacted defensively since
+        // it can echo proof-harness detail derived from scanned source.
+        tests: r.tests,
+        honesty: r.honesty,
+        poc: r.poc ? { ...r.poc, reason: r.poc.reason ? redactString(r.poc.reason) : r.poc.reason } : r.poc,
         summary: r.summary,
       };
     } catch (e) {
@@ -801,7 +910,13 @@ export const synthesize_fix = {
       regression_test: f.regression_test || null,
       remediation: typeof fix.description === 'string' ? fix.description : (typeof fix === 'string' ? fix : null),
       patchBounds: { touchedFiles, locDelta, oversized },
-      recommendsFixPlan: oversized && !hasReplacement && !autofix,
+      // oversized can only be true when hasReplacement is true (locDelta is
+      // only computed in that branch, and touchedFiles never varies) — a
+      // `!hasReplacement` conjunct here was a structural contradiction that
+      // made this permanently false. The correct signal: the stored
+      // replacement itself is too big to trust auto-applying, and there's
+      // no safer deterministic alternative.
+      recommendsFixPlan: oversized && !autofix,
     };
   },
 };
@@ -933,7 +1048,9 @@ export const append_scratchpad = {
   async handler({ path: relPath, content }, ctx) {
     const v = _validateScratchpadPath(relPath);
     if (!v.ok) return { _meta: META, ok: false, reason: v.reason };
-    const abs = _scratchpadAbs(ctx.sessionRoot, relPath);
+    let abs;
+    try { abs = _scratchpadAbs(ctx.sessionRoot, relPath); }
+    catch (e) { return { _meta: META, ok: false, reason: `path-escape refused: ${e.message}` }; }
     const total = _scratchpadTotalBytes(ctx.sessionRoot);
     if (total + content.length > SCRATCHPAD_MAX_TOTAL_BYTES) {
       return {
@@ -979,7 +1096,9 @@ export const read_scratchpad = {
   async handler({ path: relPath, offset, limit }, ctx) {
     const v = _validateScratchpadPath(relPath);
     if (!v.ok) return { _meta: META, ok: false, reason: v.reason };
-    const abs = _scratchpadAbs(ctx.sessionRoot, relPath);
+    let abs;
+    try { abs = _scratchpadAbs(ctx.sessionRoot, relPath); }
+    catch (e) { return { _meta: META, ok: false, reason: `path-escape refused: ${e.message}` }; }
     if (!fs.existsSync(abs)) return { _meta: META, ok: false, reason: 'not-found' };
     let stat;
     try { stat = fs.statSync(abs); } catch (e) { return { _meta: META, ok: false, reason: `stat-failed: ${e.message}` }; }
@@ -1013,6 +1132,7 @@ export const read_scratchpad = {
 import { appendAgentsMemory as _appendAgentsMemory, readAgentsMemory as _readAgentsMemory } from '../posture/agents-memory.js';
 import { lookupCve as _lookupCve } from '../posture/cve-lookup.js';
 
+import { stateDir, statePath } from '../posture/state-dir.js';
 export const append_agents_memory = {
   name: 'append_agents_memory',
   description: 'Append a short narrative entry to AGENTS.md — agent-authored continual-learning notes. Use at session end to record "what worked / what didn\'t / what I\'d try differently next time" so the next agent can pick up the lesson. Bounded: 2 KB per entry, 20 KB total before rotation to AGENTS.md.archive. Use sparingly — narrative, not structured data.',
@@ -1074,7 +1194,20 @@ export const query_triage_memory = {
   },
   async handler({ query }, ctx) {
     const { queryMemory } = await import('../posture/triage-memory.js');
-    const results = queryMemory(ctx.sessionRoot, query || '');
+    const raw = queryMemory(ctx.sessionRoot, query || '');
+    // Stage 6 correctness audit: this returned queryMemory's output
+    // verbatim, with no redaction pass — every other tool that echoes
+    // scanned-source-derived text redacts it (mcp/CLAUDE.md's "Adding a new
+    // tool" step 3). Round-trip through redactString the same way
+    // redactFinding already does for its own opaque `.trace` field: results
+    // here mix shapes (a triage decision's free-text `reason`, a finding's
+    // `vuln`/`family`/file path), so scrubbing the whole serialized
+    // structure catches secret-shaped substrings regardless of which field
+    // they landed in, rather than hardcoding a field allowlist that could
+    // miss one.
+    let results;
+    try { results = JSON.parse(redactString(JSON.stringify(raw))); }
+    catch { results = raw; }
     return {
       _meta: META,
       count: results.length,
@@ -1102,7 +1235,16 @@ export const query_findings_memory = {
   },
   async handler({ query }, ctx) {
     const { queryFindingsMemory } = await import('../posture/findings-memory.js');
-    return { _meta: META, ...queryFindingsMemory(ctx.sessionRoot, query || '') };
+    const raw = queryFindingsMemory(ctx.sessionRoot, query || '');
+    // Stage 6 correctness audit — same redaction gap and same fix as
+    // query_triage_memory just above: this mixes four differently-shaped
+    // result kinds (finding / triage / history / AGENTS.md text), so a
+    // whole-structure redactString round-trip is applied rather than a
+    // per-field allowlist that could miss one of the four shapes.
+    let body;
+    try { body = JSON.parse(redactString(JSON.stringify(raw))); }
+    catch { body = raw; }
+    return { _meta: META, ...body };
   },
 };
 

package/src/posture/CLAUDE.md

@@ -19,7 +19,7 @@ Annotators that run **after** every detector has emitted, plus state stores read
 
 **Production-posture ingest** — `auth-posture-import.js`, `network-policy-import.js`, `telemetry-ingest.js`, `waf-ingest.js`, `feature-flags.js`. These read customer-side YAML and convert to mitigation flags consumed by `mitigation-composite.js`.
 
-**Fix lifecycle** — `fix-history.js` (apply + backup + recover), `fix-verify.js` (closed-loop re-scan + lint), `fix-plan.js` (oversized-patch fallback), `regression-test-gen.js`, `deterministic-fix.js` (safe context-independent literal-swap patch synthesis — md5/sha1→sha256, TLS verify-off→on — materialized on demand by `mcp/synthesize_fix`; every patch still passes through `apply_fix`'s inline verify before it lands).
+**Fix lifecycle** — `fix-history.js` (apply + backup + recover), `fix-verify.js` (**five legs, not "re-scan + lint"**: rescan + lint + the project test suite + the fix-honesty gate + a PoC re-check, and it appends one record per attempt to `.agentic-security/fix-metrics.jsonl` — see `mcp/CLAUDE.md`'s `verify_fix` row, which had the same stale "no writes" claim), `fix-plan.js` (oversized-patch fallback — **not currently wired to anything**, see the dead-module allowlist), `regression-test-gen.js`, `deterministic-fix.js` (safe context-independent literal-swap patch synthesis — md5/sha1→sha256, TLS verify-off→on — materialized on demand by `mcp/synthesize_fix`; every patch still passes through `apply_fix`'s inline verify before it lands).
 
 **Measured fix loop (R5)** — `fix-metrics.js`. `verifyFix` times each stage
 (`rescan`/`lint`/`tests`/`honesty`) and appends one record per attempt to
@@ -44,12 +44,13 @@ rather than creating a stray state dir outside a project.
 
 **Agentic verification** — `verifier.js`, `verifier-target.js`, `verifier-ephemeral.js`, `harness-discovery.js`, `adversary-agent.js`, `defender-agent.js`, `auditor-agent.js`, `three-agent-pipeline.js`.
 
-**Methodology additions (`docs/AGENTIC_METHODOLOGY_PRD.md`)** — default-on annotators/artifacts that layer the agentic-hunter methodology on the deterministic engine:
+**Methodology additions (Agentic Methodology PRD, removed post-implementation)** — default-on annotators/artifacts that layer the agentic-hunter methodology on the deterministic engine:
 - `falsification.js` — default falsification pass. For each taint-style finding, tries to DISPROVE it (locate a context-matched control on the path, reusing `dataflow/sanitizer-proof.js`'s shape rules read-only); a blocked finding is demoted + `quarantined`, never removed and never severity-touched (recall-preserving, like `proof-gate`). Wired after `annotateProofGate`. Opt out: `AGENTIC_SECURITY_NO_FALSIFICATION=1`. Optional LLM tier over survivors when an endpoint is configured.
 - `entrypoint-inventory.js` — attack-surface completeness ledger. Enumerates every entry point (HTTP/queue/cron/CLI/env/upload/webhook) with a disposition each; on `scan.entrypointInventory`.
 - `root-cause-sweep.js` — from confirmed findings, finds sibling instances detectors missed with total-count accounting (`found === candidates + mitigated`); on `scan.rootCauseSweep`. Searches the corpus **once per distinct sink pattern**, not once per finding — findings deriving the same pattern share one walk and one set of (read-only) match records. The counts are always exact; the materialised `instances` list is a bounded sample (`INSTANCE_SAMPLE_LIMIT`, 100) and says so via `instancesTruncated`. Both properties are load-bearing on large corpora: the per-finding walk was O(findings × corpus-bytes) and the instance records were O(findings × matches), which together exhausted a 6 GB heap on a 40k-file suite. If you touch this module, keep the own-site exclusion **per pattern group** — resolving it globally makes a group subtract an exclusion it never matched and drives counts negative.
 - `model-routing.js` — capability-based CWE/severity→model policy; stamps `finding.dispatchModel` (strongest for crypto/auth/critical, mid for injection, cheapest for low-sev hardening) for cost-sensitive subagent dispatch.
-- `fix-honesty-gate.js` — deterministic honesty gates on fix output: a residual-risk hand-wave guard, a cited-file:line requirement for any FP/safe verdict, and FULL/MITIGATION/WORKAROUND completeness tiers. Consumed by `fix-verify.js` when the caller supplies fix metadata; the closed-loop test leg (`fix-verify-loop.js`) is wired into `mcp/apply_fix` behind `AGENTIC_SECURITY_FIX_RUN_TESTS=1`.
+- `fix-honesty-gate.js` — deterministic honesty gates on fix output: a residual-risk hand-wave guard, a cited-file:line requirement for any FP/safe verdict, and FULL/MITIGATION/WORKAROUND completeness tiers. `fix-verify.js` accepts a `fixMeta` param and consults this gate when it is present (`if (fixMeta && typeof fixMeta === 'object')`). Both `mcp/apply_fix` and `mcp/verify_fix` now expose an optional `fixMeta: {residual, verdict, evidence, signals}` input property and pass it straight through — `fixMeta` is inherently agent-self-reported (only the caller claiming a fix worked knows its own residual-risk reasoning), so the fix was exposing the property, not computing anything server-side. On `apply_fix`'s patch path this is stronger than advisory: `verifyFixCore`'s own `ok` formula already folds in `honesty.ok`, and the inline re-verify already gates the write on `ok` — so a hand-wave residual or an uncited false-positive verdict in `fixMeta` blocks the write itself. The closed-loop test leg (`fix-verify-loop.js`) is separately wired into `mcp/apply_fix` behind `AGENTIC_SECURITY_FIX_RUN_TESTS=1` and does not (yet) thread `fixMeta` through — that path still bypasses the honesty gate.
+- **The PoC-re-check leg is now genuinely reachable, without a schema change.** `verifyFixCore` accepts a `poc` param and, when given one with `poc.code` set, re-runs the proof harness against the patched files (`fix-verify.js`, the `pocLeg` block). `mcp/tools.js`'s `verify_fix` `inputSchema` still has no `poc` property — instead of widening it to make the caller resupply PoC data it never had, the handler looks up the original finding server-side from `last-scan.json` via `stable_id` (best-effort, `allowUnsigned: true` — a missing/tampered scan just means no PoC is available, not a `verify_fix` failure) and passes its `f.poc` straight through. Since `annotatePocs` attaches an HTTP-shaped `f.poc` by default on every scan (see the "Operator entry point" section below), any finding with a matching CWE template gets its PoC re-checked automatically on every `verify_fix` call — no agent-side plumbing required. `tests`/`honesty`/`poc` are all forwarded in the response (previously silently dropped).
 
 **Relevance scoping (R6 + R9)** — `relevance.js`. Turns the two existing *inventories* into *inputs*: `entrypoint-inventory.js` supplies the attack surface, `threat-model.js` supplies assets/boundaries/STRIDE, and `annotateRelevance(findings, ctx)` scores each finding by how reachable and how threat-modelled it is. Sets `entrypointReachable: true|false|null`, `relevance` (0..1), `relevanceTier: 'direct'|'indirect'|'unreachable'|'unknown'`, `relevanceFactors[]`, and re-ranks `exploitability` (ordinal priority, ×1.15 direct / ×0.6 unreachable, floored at 0.05, tier label recomputed on the same thresholds `annotateExploitability` uses). Reachability is a forward BFS over a literal-specifier import graph (JS/TS relative + Python dotted + Java FQCN) starting at every entry-point file.
 
@@ -76,11 +77,38 @@ Canonicalisation is an **allowlist, not a denylist** — each finding reduces to
 
 Wired in `bin/agentic-security.js` after every filter and after `makeDeterministic`, over `normalizeFindings(scan)` — i.e. it attests the set that actually ships — and surfaced as `attestation` in `toJSON`. `bundleSha` is read from the sidecar next to the *running* bundle and is `'unavailable'` when running from source, rather than reporting a dist hash that may not correspond to this run.
 
+**`verifyRunAttestation` now has two real callers.** `agentic-security verify-attestation <file>` auto-detects whether the given JSON is an evidence bundle (`.finding`+`.signature`, verified via `evidence-bundle.js`'s Ed25519 path, unchanged) or a run attestation (`.digest`+`.canonicalisation`, either bare or embedded under a full `last-scan.json`'s `.attestation` field) and dispatches accordingly. A run attestation isn't self-contained the way a bundle is — verifying it means re-scanning the project (`--against <path>`, default `.`) and confirming the fresh scan reproduces the attested digest, which is the actual, meaningful claim this artifact makes ("does this codebase, scanned now, match what was attested earlier"). Separately, `scripts/release-check.mjs`'s `attestation-self-check` gate round-trips a synthetic finding set through compute→verify (and a mutated copy through verify, which must fail) on every release, catching a broken canonicalisation or signing path before it ships — independent of whether any project ever calls `verify-attestation` on a real artifact.
+
 **Integrity + signing** — `integrity.js` (per-install HMAC for `last-scan.json`), `rule-pack-signing.js`. The HMAC key lives at `$XDG_CONFIG_HOME/agentic-security/scan-key`; override via `$AGENTIC_SECURITY_HMAC_KEY`. Premortem-derived; do not regress to hostname-derived.
 
 **Rule lifecycle** — `custom-rules.js` (YAML pattern DSL), `rule-overrides.js` (`disable:` gated on signature), `rule-packs.js`, `rule-synthesis.js` (proposes suppressions from triage feedback), `ruleset-version.js`.
 
-**Posture artifacts** — `sbom.js`, `aibom.js`, `api-inventory.js`, `threat-model.js`, `trust-boundary-diagram.js`, `stack-playbook.js`, `deploy-platform.js`, `license-policy.js`, `material-change.js`, `mttr.js`, `streak.js`, `scorecard.js`, `security-trend.js`.
+**NIST Privacy Framework 1.1 (`privacy-framework.js`)** — assessment + remediation
+over the bundled `compliance-frameworks/nist-privacy-1-1.json` (all 104 controls).
+Sits on top of `auditor-walkthrough.js`'s evaluator and adds the half a narrative
+cannot give you: a gap becomes a FINDING (`family: privacy-compliance`,
+`CWE-359`) carrying an actionable remediation, so it flows through triage and
+`/fix`.
+
+Four buckets, and the bucket is always stated: `gap` (mapped signal failing —
+the ONLY bucket that emits a finding), `engine-gap` (NIST rates it code-testable
+but this engine has no signal — disclosed by name, never a pass), `manual` (NIST
+rates it not code-testable), `satisfied`. NIST's own `codeTestable` rating is
+carried per control and is what separates "nobody checked" from "we checked and
+it is fine" — 48 of 104 are governance controls no scanner can assess, and
+reporting those as passed is the failure mode the module exists to prevent.
+
+Two guards are load-bearing. **Findings are opt-in**
+(`AGENTIC_SECURITY_PRIVACY_FRAMEWORK=1`); the assessment always lands on
+`scan.privacyFramework` and at `.agentic-security/privacy-framework.{json,md}`,
+but appending to `scan.findings` by default would change every severity count
+and gate verdict downstream. And the **vacuous-satisfaction guard**: a
+`family:`-mapped control clears when no findings of that family are open, which
+is also true of a scan that read zero files — so when nothing was examined every
+mapped control degrades to `engine-gap` instead of reporting as satisfied. That
+one was caught by the module's own test, not in review.
+
+**Posture artifacts** — `sbom.js`, `aibom.js`, `api-inventory.js`, `threat-model.js`, `trust-boundary-diagram.js`, `stack-playbook.js`, `deploy-platform.js`, `license-policy.js`, `material-change.js`, `mttr.js`, `streak.js`, `accuracy-scorecard.js` (see "Published accuracy scorecard (R3)" above — this line previously named a bare "scorecard" module that never existed under that filename), `security-trend.js`.
 
 **Why this fired** — `why-fired.js`. Runs LAST so it reflects every annotation. Customer-facing provenance.
 
@@ -209,10 +237,19 @@ the CI-gated tier and graduation into it is a human decision with a stated
 policy; an automated writer must not decide what blocks everyone's build.
 
 **Operator entry point:** `scripts/enroll-proven-finding.mjs <project>`
-(`--dry-run` scores without writing). It proves findings itself — the scan
-pipeline does **not** attach a `poc` to findings or promote proof tiers, so
-`last-scan.json` never contains an `execution-proven` finding on its own. PoCs
-come from the PoC-generator. Enrolment additionally needs fixed content
+(`--dry-run` scores without writing). It proves findings itself — **but the
+scan pipeline DOES attach an HTTP-shaped `f.poc` by default** (`annotatePocs`,
+`engine.js`, unconditional — not behind a flag; findings with no matching CWE
+template get `f.poc: null`). What the scan pipeline does NOT do by default is
+the *sandbox execution proof* that promotes a finding to the
+`execution-proven` tier: that pass is genuinely opt-in
+(`AGENTIC_SECURITY_PROVE=1`), so `last-scan.json` never contains an
+`execution-proven` finding from an ordinary scan on its own — this file
+previously conflated "attaches a poc" with "promotes to execution-proven,"
+which are two different passes with two different default states. Enrolment
+still proves findings itself via its own sandboxed run, independent of
+whichever tier `last-scan.json` shipped with. Enrolment additionally needs
+fixed content
 (`finding.fix.patch`) for `post/`; a proven finding with no fix is reported as
 skipped, not dropped. After enrolling, refresh the baseline
 (`npm run bench:cve-replay:update-baseline`) and commit it.

package/src/posture/accuracy-scorecard.js

@@ -121,7 +121,14 @@ export function buildScorecard(inputs) {
       notGeneralRecall: true,
       notGeneralFalsePositiveRate: true,
       f1Emitted: false,
-      f1OmissionReason: 'no labelled real-world population is available to measure precision over, so any F1 would combine denominators that do not describe the same population',
+      // Was: "no labelled real-world population is available". That stopped
+      // being true when bench/independent/ was built, and a stale justification
+      // is worse than none — it argues against a measurement that now exists.
+      // No F1 is emitted FOR THE CURATED CORPUS, and the reason is narrower:
+      // its `post/` fixtures are authored here to be silent, so its precision
+      // denominator describes fixture design rather than engine behaviour.
+      // F1 over the independent population IS reported, in its own section.
+      f1OmissionReason: 'the curated corpus authors both its vulnerable and its fixed fixtures, so an F1 over it would measure fixture design, not accuracy; F1 over the labelled third-party population is reported separately from bench/independent/RESULT.json',
     },
     corpus: {
       measuredThisRun: true,
@@ -138,6 +145,17 @@ export function buildScorecard(inputs) {
       corpusBaseline: committed.corpusBaseline
         ? { source: 'bench/cve-replay/corpus-baseline.json', generatedAt: committed.corpusBaseline.generatedAt, total: committed.corpusBaseline.total, passing: committed.corpusBaseline.passing }
         : null,
+      independent: committed.independent
+        ? {
+          source: 'bench/independent/RESULT.json',
+          measuredAt: committed.independent.measuredAt || null,
+          engineVersion: committed.independent.engineVersion || null,
+          population: committed.independent.population || null,
+          overall: committed.independent.overall || null,
+          wide: committed.independent.wide || null,
+          byLanguage: committed.independent.byLanguage || null,
+        }
+        : null,
       proofCorpus: proof
         ? {
           source: 'bench/proof-corpus/results/summary.json',
@@ -307,6 +325,54 @@ export function renderScorecardMarkdown(m) {
   }
   L.push('Per-file counts are in `docs/scorecard.json`.');
   L.push('');
+  const ind = m.committedInputs.independent;
+  if (ind && ind.overall) {
+    L.push('## Independent evaluation population — the number that matters');
+    L.push('');
+    L.push('Everything above is a **regression net**: its fixtures and its labels are both');
+    L.push('written here, which is why its detection rate sits at the ceiling by');
+    L.push('construction. `bench/independent/` is the other instrument — real upstream code');
+    L.push('at the commit where a vulnerability really existed, with the CWE assigned by a');
+    L.push('public advisory database rather than by this project.');
+    L.push('');
+    // population.unscored is an array of {id, reason} (bench/independent/runner.mjs) —
+    // render its count, not the array itself (Array#toString would stringify to
+    // "[object Object],[object Object]" or blank for an empty array, both silently
+    // wrong on the line this section calls "the number that matters"). Tolerates a
+    // bare number too, for any already-committed artifact predating this fix.
+    const unscoredList = ind.population?.unscored;
+    const unscoredCount = Array.isArray(unscoredList) ? unscoredList.length
+      : (typeof unscoredList === 'number' ? unscoredList : 0);
+    L.push(`**Measured ${ind.measuredAt} on engine ${ind.engineVersion}, ` +
+      `n=${ind.population?.scoredEntries}, ${unscoredCount} unscored** ` +
+      '(*committed artifact*, `' + ind.source + '` — read, not re-run: scoring takes ~32 minutes).');
+    L.push('');
+    L.push('| | Advisory-local (**the claim**) | Wide (diagnostic) |');
+    L.push('| --- | --- | --- |');
+    L.push(`| Precision | **${formatRate(ind.overall.precision?.n, ind.overall.precision?.d)}** | ${formatRate(ind.wide?.precision?.n, ind.wide?.precision?.d)} |`);
+    L.push(`| Recall | **${formatRate(ind.overall.recall?.n, ind.overall.recall?.d)}** | ${formatRate(ind.wide?.recall?.n, ind.wide?.recall?.d)} |`);
+    L.push(`| F1 | **${ind.overall.f1 === null || ind.overall.f1 === undefined ? 'n/a' : ind.overall.f1.toFixed(3)}** | ${ind.wide?.f1 === null || ind.wide?.f1 === undefined ? 'n/a' : ind.wide.f1.toFixed(3)} |`);
+    L.push('');
+    if (ind.byLanguage) {
+      L.push('| Language | n | Recall | Precision |');
+      L.push('| --- | --- | --- | --- |');
+      for (const [k, v] of Object.entries(ind.byLanguage)) {
+        L.push(`| ${k} | ${v.entries} | ${formatRate(v.recall?.n, v.recall?.d)} | ${formatRate(v.precision?.n, v.precision?.d)} |`);
+      }
+      L.push('');
+    }
+    L.push('**Quote the advisory-local column.** "Wide" scores the same scans without');
+    L.push('restricting findings to the files the advisory\'s fix commit touched — it asks');
+    L.push('only whether the CWE appeared *anywhere* in the package. Over scopes holding up');
+    L.push('to 1740 findings that is close to asking whether the codebase contains the bug');
+    L.push('class at all, a question with a much easier yes. It is kept because it is the');
+    L.push('only way to tell whether a change moved the engine or moved the benchmark.');
+    L.push('');
+    L.push('Against ~100% on the curated corpus above. **That gap is the most useful number');
+    L.push('in this document**, and publishing it is the point of the exercise. The figure');
+    L.push('went DOWN when the benchmark was corrected, and is published that way.');
+    L.push('');
+  }
   L.push('## Committed artifacts referenced (not re-run by this command)');
   L.push('');
   const cb = m.committedInputs.corpusBaseline;

package/src/posture/agents-memory.js

@@ -29,6 +29,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 
+import { statePath, stateWritesEnabled } from './state-dir.js';
 const MEMORY_FILE = '.agentic-security/AGENTS.md';
 const ARCHIVE_FILE = '.agentic-security/AGENTS.md.archive';
 const MAX_BYTES = 20 * 1024;
@@ -36,8 +37,8 @@ const MAX_ENTRY_BYTES = 2 * 1024;
 const ARCHIVE_MAX_BYTES = 200 * 1024;
 const HEADER = '# AGENTS.md\n\nAgent-authored continual-learning notes. Each entry: timestamp + agent name + one short paragraph. New entries appended at the bottom; oldest entries rotate to AGENTS.md.archive when this file exceeds 20 KB.\n\n';
 
-function _resolve(scanRoot) { return path.join(scanRoot, MEMORY_FILE); }
-function _archivePath(scanRoot) { return path.join(scanRoot, ARCHIVE_FILE); }
+function _resolve(scanRoot) { return statePath(scanRoot, 'AGENTS.md'); }
+function _archivePath(scanRoot) { return statePath(scanRoot, 'AGENTS.md.archive'); }
 
 export function readAgentsMemory(scanRoot) {
   const fp = _resolve(scanRoot);
@@ -65,7 +66,8 @@ export function appendAgentsMemory(scanRoot, { agent, body }) {
   const entry = `\n## ${ts}  agent: ${agent}\n\n${snippet}\n`;
   try {
     const fp = _resolve(scanRoot);
-    fs.mkdirSync(path.dirname(fp), { recursive: true });
+    if (!stateWritesEnabled()) return;
+  fs.mkdirSync(path.dirname(fp), { recursive: true });
     if (!fs.existsSync(fp)) fs.writeFileSync(fp, HEADER);
     fs.appendFileSync(fp, entry);
     _maybeRotate(scanRoot);

package/src/posture/aibom.js

@@ -156,12 +156,16 @@ function _extractPromptFile(fp, content) {
   };
 }
 
+// A package's role isn't mutually exclusive in reality — `openai` and
+// `@anthropic-ai/sdk` are both a general inference framework AND an
+// embedding-provider SDK. Returns every matching class, not just the first.
 function _classifyFramework(c) {
   const name = (c.name || '').toLowerCase();
-  if (FRAMEWORK_PACKAGES.has(name) || FRAMEWORK_PACKAGES.has(c.name)) return 'inference-framework';
-  if (VECTOR_STORE_PACKAGES.has(name) || VECTOR_STORE_PACKAGES.has(c.name)) return 'vector-store';
-  if (EMBEDDING_PACKAGES.has(name) || EMBEDDING_PACKAGES.has(c.name)) return 'embedding-provider';
-  return null;
+  const classes = [];
+  if (FRAMEWORK_PACKAGES.has(name) || FRAMEWORK_PACKAGES.has(c.name)) classes.push('inference-framework');
+  if (VECTOR_STORE_PACKAGES.has(name) || VECTOR_STORE_PACKAGES.has(c.name)) classes.push('vector-store');
+  if (EMBEDDING_PACKAGES.has(name) || EMBEDDING_PACKAGES.has(c.name)) classes.push('embedding-provider');
+  return classes;
 }
 
 // Public: build the AI-BOM from already-scanned data.
@@ -189,10 +193,10 @@ export function buildAIBOM(scan, fileContents = {}, meta = {}) {
   const vectorStores = [];
   const embeddings = [];
   for (const c of (scan.components || [])) {
-    const cls = _classifyFramework(c);
-    if (cls === 'inference-framework') frameworks.push({ ecosystem: c.ecosystem, name: c.name, version: c.version, license: c.license || null });
-    else if (cls === 'vector-store') vectorStores.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
-    else if (cls === 'embedding-provider') embeddings.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
+    const classes = _classifyFramework(c);
+    if (classes.includes('inference-framework')) frameworks.push({ ecosystem: c.ecosystem, name: c.name, version: c.version, license: c.license || null });
+    if (classes.includes('vector-store')) vectorStores.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
+    if (classes.includes('embedding-provider')) embeddings.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
   }
   return {
     aibomFormat: 'agentic-security AI-BOM',