@clear-capabilities/agentic-security-scanner 0.136.2 → 0.136.9

package/CHANGELOG.md

@@ -9,6 +9,242 @@
 > make the history less accurate, not more.
 
 
+## 0.136.9 — the real bug: the single-file bundle was never actually self-contained
+
+0.136.8's diagnostic logging answered the question immediately:
+
+```
+Error [ERR_MODULE_NOT_FOUND]: Cannot find module
+'.../scanner/dist/449.index.js' imported from
+'.../scanner/dist/agentic-security.mjs'
+```
+
+`dist/agentic-security.mjs` is documented and committed as a self-contained
+single-file bundle — `.gitignore`'s own comment says the reusable
+`scan.yml` workflow fetches *only that one file* from
+raw.githubusercontent.com so downstream users need no install step. That
+was never quite true. `bin/agentic-security.js` lazily loads each
+subcommand's implementation with `await import('../src/...')` — about 58
+call sites, deliberately, so running `agentic-security scan` doesn't pay
+the cost of loading every posture/discovery/compliance module `agentic-security
+compliance` or `agentic-security hunt` would need. `ncc` code-splits every
+one of those into its own `dist/NNN.index.js` chunk rather than inlining
+it, and the chunk is loaded at runtime via a path relative to the bundle's
+own location on disk — but `.gitignore` only ever allowlisted the main
+`.mjs`, its sha256 sidecar, and the compliance-frameworks data. All 38
+chunk files were silently gitignored. `.claude/settings.local.json`-style
+invisible: they exist on any machine that has ever run `npm run build`
+locally (which is every contributor's, permanently, from the first
+`npm install`), so nobody — human or gate — had a checkout that lacked
+them until this release's hosted CI runs did.
+
+This is the third occurrence of the identical bug class in this file's own
+history — `.gitignore` already carries a comment about the same thing
+happening to `compliance-frameworks/` data before ("the shipped CLI
+silently listed ZERO frameworks and exited 0"). Same shape both times: a
+single tracked entry point quietly depends on sibling files nobody
+allowlisted.
+
+Fixed by allowlisting `scanner/dist/*.index.js` and committing all 38
+current chunks (744 KB), and by adding a permanent regression guard
+(`test/dist-chunks-tracked.test.js`, wired into `test:lifecycle`) that
+diffs `dist/*.index.js` on disk against `git ls-files dist` and fails
+loud, by name, the moment a future build produces a chunk nobody
+allowlisted — rather than waiting for a lazy code path to hit it in
+production. Verified RED against the pre-fix git state (all 38 chunks
+correctly reported untracked) and GREEN after staging them.
+
+## 0.136.8 — instrumenting a real, still-unexplained hosted-CI-only failure
+
+0.136.7's hosted release run got past every other check and failed on
+exactly one: `test/mttr.test.js`'s CLI-wiring test, which asserts a real
+`agentic-security scan` reports an `mttr` field in `last-scan.json`. That
+field comes from a deliberately best-effort code path in `cmdScan`
+(`bin/agentic-security.js`) wrapped in a bare `catch { /* MTTR is
+best-effort — never block a scan write */ }` — correct as a product
+decision (a scan must never fail because a secondary metric couldn't be
+computed), but it means whatever throws inside that block has never been
+visible to anyone, including this investigation.
+
+This is now confirmed NOT the shared-runner flakiness 0.136.5/0.136.6
+blamed it as: reran the identical failed job against the identical commit
+(`gh run rerun --failed`, no code change) and got the exact same failure,
+same file, same line, same message, a fourth consecutive time. Extensive
+local reproduction attempts — simulating `CI=true`/`GITHUB_ACTIONS=true`,
+running the full 1328-test `test:posture` scope concurrently to match CI's
+exact invocation shape, invoking the real bundled CLI directly under the
+same env vars — all passed cleanly. Whatever this is, it is deterministic
+on GitHub's hosted runner and has not reproduced anywhere else tried so far.
+
+Rather than keep guessing, the silent catch now logs the actual error to
+stderr whenever `CI`/`GITHUB_ACTIONS` is set (or `AGENTIC_SECURITY_MTTR_DEBUG=1`
+locally), and the test's own assertion message now includes the scan
+subprocess's stderr. Scan behavior is unchanged — this is instrumentation
+only, shipped specifically to get a real answer out of the next hosted run
+instead of another guess.
+
+## 0.136.7 — the doc-drift checker was resolving paths outside the repo
+
+0.136.6's hosted release run failed on a check this same audit added a few
+releases ago: `check-doc-drift.mjs`'s own regression test, "the real
+repository currently has zero mechanically-checkable drift," flagged root
+CLAUDE.md's documented (and correctly gitignored) `.claude/settings.local.json`
+reference as a dangling path.
+
+The actual defect was in `resolveCandidate`'s search bases, not in the
+reference: for a CLAUDE.md near the repo root, one of the fallback bases is
+"two directories up from the CLAUDE.md's own directory" — meant for nested
+CLAUDE.md files reaching back toward the repo root, but for the ROOT
+CLAUDE.md itself that lands OUTSIDE the checkout entirely, in whatever
+happens to be the parent of wherever the repo was cloned. On the
+maintainer's laptop that's their home directory, which happens to contain
+an unrelated, machine-global `~/.claude/settings.local.json` from ordinary
+Claude Code usage — so the checker "resolved" the reference against a file
+that has nothing to do with this project, passed locally, and failed on a
+clean CI checkout where no such coincidence exists. `resolveCandidate` now
+rejects any candidate base or resolved path outside the repo root, and
+`settings.local.json` — genuinely optional, gitignored, user-created — joins
+the checker's existing known-example-basename allowlist as a second,
+independent fix.
+
+Reproduced without touching CI: moved the local override file aside,
+confirmed the existing regression test still passed (proving the checker was
+resolving against something else entirely), traced it to the home-directory
+escape, fixed both the escape and the allowlist gap, verified clean with the
+file present and absent, then restored it.
+
+## 0.136.6 — correction: the "flaky" dataflow tests were a real, deterministic gap
+
+0.136.5's entry below called a cluster of `test:dataflow` failures on the
+hosted runner resource-contention flakiness, because a second, simultaneous
+workflow run of the identical commit showed a completely different failure
+and neither reproduced locally. That diagnosis was wrong, and the actual
+cause is more interesting: 13 test files pass `runScan(dir, { deep: true })`
+to exercise the interprocedural taint engine directly, but never opt into
+`AGENTIC_SECURITY_DEEP_IN_CI` — and `engine.js` deliberately auto-disables
+deep mode under any detected CI environment unless that second flag is also
+set, precisely so a pathological file can't hang a CI pipeline. Every one of
+those 13 files has therefore been silently CI-broken (never actually
+exercising the deep engine there, only recording the "skipped in CI"
+placeholder finding) since the day it was written — invisible until this
+release's tag push put 62 accumulated commits through hosted CI for the
+first time. Reproduced deterministically with `CI=true node --test
+<file>.test.js` locally (no CI service required), fixed by threading
+`deepInCi: true` alongside `deep: true` at all 21 call sites across those 13
+files, and confirmed both directions: `npm test` is clean with `CI` unset
+and with `CI=true` set.
+
+The earlier flakiness diagnosis wasn't entirely wrong — the *other* workflow
+run's single MTTR-wiring failure genuinely didn't reproduce on a third run
+and remains unexplained — but it was wrong about *this* failure cluster,
+which was 100% reproducible once isolated with the right environment
+variable rather than blamed on shared-runner load.
+
+## 0.136.5 — the release workflow gets its own missing dependency
+
+0.136.4 was tagged and its release workflow ran — for the first time ever,
+since the 60-odd commits it carried had accumulated across many local
+sessions without a single hosted-CI push. The gate caught a real gap in
+itself: `nist-catalog-freshness` (a check this same release adds, see below)
+shells out to `scripts/nist-compliance/build-catalog.py`, which needs
+`openpyxl` to read the source workbook. That's present on the maintainer's
+machine via a system Python install, but nothing installs it on the hosted
+runner — so the check could never have passed there. `release.yml` now
+installs it explicitly before the gate runs.
+
+The same CI run also showed roughly a dozen dataflow tests fail — a
+completely different set than the *other* workflow (`ci.yml`) failed on the
+same commit at the same time (one flaky MTTR-wiring test, no overlap with the
+dataflow set). Neither set reproduces locally, isolated or otherwise. That
+non-overlap is the signature of resource-contention flakiness on a shared
+runner, not a deterministic regression, so it isn't chased further here — but
+it's worth knowing about if a future release gate flakes on `npm test` again.
+
+Per the project's own precedent (see 0.136.1 below): a tag that failed to
+publish stays where it is rather than being moved. 0.136.4 is that tag. This
+ships as 0.136.5 instead, otherwise identical.
+
+## 0.136.4 — dominance-correct implicit-flow taint, and wiring three dead-reachable tools
+
+A capability-PRD follow-up audit found several places where a real, tested
+mechanism existed in the code but nothing in the product could actually reach
+it. This release closes those gaps rather than documenting them further.
+
+**`implicit-flow.js` now uses real dominance, not a depth counter.** The
+branch-scoping check for implicit taint (does a constant-argument sink sit
+*inside* a tainted branch, or after it closes?) was a path-dependent DFS
+depth-counter, which cannot distinguish a join point from a nested branch and
+both over- and under-attributes depending on CFG shape. It's replaced with a
+proper dominance check (`ssa.js`'s `computeDominators`, already used for φ-node
+placement, now exported and reused here) plus a predecessor-count "sole
+parent" test — needed because an else-less `if`'s CFG lowering links the
+condition directly to the join node, which a naive dominance check alone would
+still misread as a branch root. `dataflow/engine.js`'s implicit-flow post-pass
+is split into two correctly-scoped passes: a sink-call-must-be-inside-the-
+branch check for constant-argument leaks, and an ungated check for
+already-tainted-variable-as-argument leaks, which don't need the sink itself
+to be branch-local.
+
+**Three previously-dead mechanisms are now reachable.** `verify_fix`'s PoC-
+recheck leg always reported `not-requested` — the caller never had the PoC to
+pass it, so it's now looked up server-side from the finding's own
+`last-scan.json` entry. `fix-honesty-gate.js`'s deterministic honesty checks
+(vague-assurance residual prose, unbacked false-positive verdicts) were fully
+built and consulted by the verifier, but `fixMeta` was never in `apply_fix` or
+`verify_fix`'s MCP schema, so no caller could ever supply one; a dishonest
+`fixMeta` now blocks the write itself, not just the report. `verifyRunAttestation`
+had no CLI caller at all — `verify-attestation` now auto-detects a
+run-attestation shape and re-scans the target to check it reproduces the
+attested digest, backed by two new release-gate checks
+(`attestation-self-check`, `nist-catalog-freshness`).
+
+**Stale docs, fixed instead of flagged.** `docs/compliance/{nist-ai-600-1,
+owasp-asvs}-coverage.md` carried static control tables that drifted from the
+live evaluator; both now point at the `/compliance` walkthrough/report instead
+of duplicating data that can go stale. The ASVS doc also had a genuine
+version mismatch (4.0.3 vs. the 5.0 catalog actually in use). A new
+`scripts/check-doc-drift.mjs` catches this class of staleness mechanically —
+it resolves every backtick-quoted path/export reference in a CLAUDE.md file
+against the real filesystem — after this audit found several by hand.
+
+**CVE-replay corpus:** four new capability entries (IaC open-ingress, LLM
+system-prompt injection, MCP untrusted-install, API missing-auth/BFLA),
+closing four of six previously-flagged zero-coverage categories; each verified
+`pre:TP post:TN` against the real runner before joining the baseline. SBOM and
+SCA-reachability are documented in `bench/cve-replay/CONTRIBUTING.md` as
+structurally unable to fit this corpus's binary presence/absence schema —
+they're covered by their own test suites instead.
+
+CMP-1's family-alias table also closed three more gaps
+(`k8s-pod-security-privileged`, `mcp-audit.js`'s `agent-tool-exec` backfill,
+dependency-confusion family tagging).
+
+**No functional change from 0.136.2.** This version exists for one reason, and
+it is worth stating plainly rather than dressing up: 0.136.2 reached npm from a
+maintainer's laptop, not from CI, so it carries **no provenance attestation** —
+nothing ties that tarball to this repository or this commit beyond trust in the
+publisher.
+
+npm will not accept a re-publish of an existing version, so obtaining provenance
+requires a new one. 0.136.3 is that, and nothing else.
+
+The release path itself was already proven end to end on 0.136.2: the gate passed
+on a clean runner, npm signed a provenance statement and recorded it in the
+Sigstore transparency log, and only the final registry upload was rejected —
+because the token in CI was not authorized to publish. With a valid automation
+token that last step completes, and the attestation that was already being
+generated actually lands.
+
+Verify it yourself once published:
+
+```
+npm view @clear-capabilities/agentic-security-scanner@0.136.3 --json | jq .dist.attestations
+```
+
+`null` means it went out unattested again. `dist.signatures` is NOT the same
+thing — the registry signs every package it serves; provenance is the separate
+Sigstore statement binding the artifact to its source.
+
 ## 0.136.2 — authenticate the gate on the path that actually runs it
 
 0.136.1 removed the self-deadlock and the release workflow got further: every

package/bin/agentic-security.js

@@ -14,7 +14,6 @@ import { toCycloneDX, toSPDX } from '../src/posture/sbom.js';
 import { toPBOM } from '../src/sast/pipeline.js';
 import { buildAIBOM, aibomToMarkdown } from '../src/posture/aibom.js';
 import { recordScan, formatStreakLine, formatGradeDelta } from '../src/posture/streak.js';
-import { ingestAndMerge } from '../src/sca/sarif-ingest.js';
 import { loadProfile, saveProfile, detectProfile, renderAttributionLine, ATTRIBUTION, ATTRIBUTION_URL } from '../src/posture/profile.js';
 import { applySuppressions, addSoftAcceptance, expiredSoftAcceptances } from '../src/posture/suppressions.js';
 import { applyOverrides, validateOverrides, suppressionReport, renderSuppressionSummary } from '../src/posture/rule-overrides.js';
@@ -28,7 +27,6 @@ import { syncTickets } from '../src/integrations/tickets.js';
 import { decide as decideNextAction, explain as explainDecision } from '../src/posture/router.js';
 import * as triage from '../src/posture/triage.js';
 import { buildSlackDigest, buildDiscordDigest, postWebhook, buildJiraIssue, buildPrComment, buildSiemEvent, loadIntegrationConfig } from '../src/integrations/index.js';
-import { globFiles } from '../src/util/glob.js';
 
 import { stateDir, statePath } from '../src/posture/state-dir.js';
 // last-scan.json integrity helpers — implementation in posture/integrity.js
@@ -111,7 +109,6 @@ Options:
   --show-threat-model          Append the auto-derived STRIDE threat model summary
   --show-drift                 Append calibration-drift alarms (overconfidence detection)
   --sca-reachable-only         Only SCA findings where the vulnerable function is reachable
-  --ingest-sarif <glob>        Merge external SARIF into this scan
   --scorecard                  Enrich components with OSSF Scorecard scores
   --no-network                 Skip OSV/registry queries (offline mode)
   --pr [ref]                   Diff-aware: scan only files changed since ref (auto-detects PR base)
@@ -297,7 +294,7 @@ function _bundleSha() {
   return 'unavailable';
 }
 
-async function writeMachineOutput(targetAbs, scan, meta, profile) {
+async function writeMachineOutput(targetAbs, scan, meta, profile, args) {
   const stateDirPath = stateDir(targetAbs);
   const { isSafeStateDir: _isSafe, stateWritesEnabled: _writesOn } = await import('../src/posture/state-dir.js');
   // Read-only scan (NON_MUTATING_SCAN_PRD S1). These writes bypass
@@ -311,7 +308,7 @@ async function writeMachineOutput(targetAbs, scan, meta, profile) {
   // Always JSON (used by /security-fix and /security-report).
   await fsp.writeFile(path.join(stateDirPath, 'findings.json'),
     JSON.stringify(toJSON(scan, meta), null, 2));
-  if (profile.profile === 'pro' || profile.machineOutput) {
+  if (profile.profile === 'pro' || profile.machineOutput || (args && args.flags['machine-output'])) {
     await fsp.writeFile(path.join(stateDirPath, 'findings.sarif'),
       JSON.stringify(toSARIF(scan, meta), null, 2));
     await fsp.writeFile(path.join(stateDirPath, 'findings.csv'), toCSV(scan));
@@ -440,9 +437,16 @@ async function cmdScan(args) {
 
   const only = args.flags.only;
   if (only) {
+    // Four channels exist (scanner/CLAUDE.md): findings (SAST), secrets,
+    // supplyChain (SCA), logicVulns (business-logic). --only sast keeps
+    // logicVulns (business-logic is source analysis, part of the SAST
+    // pillar); --only sca/secrets must also clear it — it's neither SCA
+    // nor secrets, and normalizeFindings()/exitCodeFor() both fold it in,
+    // so leaving it meant a business-logic finding leaked into a
+    // single-pillar scan's output AND its exit code.
     if (only === 'sast') { scan.secrets = []; scan.supplyChain = []; }
-    if (only === 'sca')  { scan.findings = []; scan.secrets = []; }
-    if (only === 'secrets') { scan.findings = []; scan.supplyChain = []; }
+    if (only === 'sca')  { scan.findings = []; scan.secrets = []; scan.logicVulns = []; }
+    if (only === 'secrets') { scan.findings = []; scan.supplyChain = []; scan.logicVulns = []; }
   }
 
   // --set-baseline: save current findings as baseline for future --since-baseline filtering
@@ -494,18 +498,6 @@ async function cmdScan(args) {
   // 0.9.0 Feat-18: --scorecard flag enables OSSF Scorecard enrichment
   if (args.flags['scorecard']) process.env.AGENTIC_SECURITY_SCORECARD = '1';
 
-  // 0.7.0 Feat-7: --ingest-sarif <path-or-glob> merges SARIF from external tools (Semgrep,
-  // gitleaks, Bandit, Trivy, Checkov, etc.) into this scan's findings, deduping by
-  // fingerprint and tracking provenance via sources[].
-  if (args.flags['ingest-sarif']) {
-    const glob = args.flags['ingest-sarif'];
-    const paths = await globFiles(glob);
-    if (paths.length) {
-      const r = ingestAndMerge(scan, paths);
-      if (process.stderr.isTTY) process.stderr.write(`[ingest] merged ${r.merged} / added ${r.added} findings from ${paths.length} SARIF file(s)\n`);
-    }
-  }
-
   // 0.6.0 Feat-1: --sca-reachable-only filters to only SCA findings where the vulnerable
   // function was confirmed reachable from a route handler.
   if (args.flags['sca-reachable-only']) {
@@ -566,6 +558,31 @@ async function cmdScan(args) {
     try { await enrichWithEPSS(scan); } catch {}
   }
 
+  // Re-run risk-dollars now that both signals it needs are actually
+  // available: EPSS (just enriched above — engine.js's own call ran before
+  // this, so every finding's epssScore was still unset) and relevanceTier
+  // (posture/relevance.js runs last inside runScan/engine.js, so it's
+  // populated on `scan.findings` by the time we get here, but wasn't yet
+  // when engine.js's own annotateRiskDollars call ran mid-pipeline).
+  try {
+    const { annotateRiskDollars } = await import('../src/posture/risk-dollars.js');
+    annotateRiskDollars(targetAbs, scan.findings || []);
+  } catch {}
+
+  // Re-run composite risk for the same reason as annotateRiskDollars above:
+  // engine.js's mid-pipeline annotateCompositeRisk calls ran before
+  // enrichWithEPSS (just above) had a chance to set f.exploitedNow, so
+  // every finding's 'exploited-now-floor:75' boost was computed against a
+  // field that was always undefined at the time — an actively-exploited
+  // CVE (EPSS percentile >= 0.95) never got its compositeRisk score raised.
+  // annotateCompositeRisk is pure/idempotent (only sets compositeRisk*
+  // fields, reads everything else), so re-running it here is safe.
+  try {
+    const { annotateCompositeRisk } = await import('../src/posture/composite-risk.js');
+    annotateCompositeRisk(scan.findings || []);
+    annotateCompositeRisk(scan.supplyChain || []);
+  } catch {}
+
   // Blast-radius narrative — purely local, always safe to run.
   if (!args.flags['no-blast-radius']) {
     try { enrichWithBlastRadius(scan, targetAbs); } catch {}
@@ -622,7 +639,7 @@ async function cmdScan(args) {
   } catch { /* attestation is metadata; never fail a scan over it */ }
 
   // R2: Always emit machine-readable artifacts to .agentic-security/.
-  await writeMachineOutput(targetAbs, scan, meta, profile);
+  await writeMachineOutput(targetAbs, scan, meta, profile, args);
 
   const includeSuppressed = !!args.flags['include-suppressed'];
   let body;
@@ -664,32 +681,70 @@ async function cmdScan(args) {
   // Persist last scan for /security-fix and /security-report
   const { isSafeStateDir: _isSafeStateDir, stateWritesEnabled: _writesOnScan } = await import('../src/posture/state-dir.js');
   const stateDirPath = stateDir(path.resolve(target));
+  // S7 (Stage-0 audit): declared here, not with `const` inside the `if`
+  // below — it used to be block-scoped there while recordScan() further
+  // down referenced it unconditionally, throwing a ReferenceError on every
+  // single scan (silently swallowed by that call's empty catch{}). streak.json
+  // — grades, streak days, achievements — never actually persisted through
+  // the real CLI as a result, reproduced live before this fix.
+  let persistedScan = null;
   if (_writesOnScan() && _isSafeStateDir(stateDirPath)) {
     await fsp.mkdir(stateDirPath, { recursive: true });
-    const persistedScan = toJSON(scan, meta);
+    persistedScan = toJSON(scan, meta);
     // #10 — MTTR: stamp firstSeenAt/lastSeenAt/ageDays from the PREVIOUS scan so
     // every finding carries an age, SLA breaches can be surfaced, and the fix
     // loop can report time-to-clean. Best-effort; skipped under --deterministic
     // so deterministic state stays byte-identical run-to-run.
     if (!args.flags.deterministic) {
       try {
-        const { stampFindingTimestamps, buildBaselineMap, renderSlaSummary } = await import('../src/posture/mttr.js');
+        const { stampFindingTimestamps, buildBaselineMap, renderSlaSummary, fingerprintFinding, computeMTTR } = await import('../src/posture/mttr.js');
         let baselineMap = new Map();
+        let prevAll = [];
         try {
           const prev = JSON.parse(await fsp.readFile(path.join(stateDirPath, 'last-scan.json'), 'utf8'));
           baselineMap = buildBaselineMap(prev);
+          // The previous scan's own findings already carry firstSeenAt/lastSeenAt
+          // from ITS baseline lookup — exactly the shape computeMTTR needs for
+          // whichever of them are no longer present now (i.e. were fixed).
+          prevAll = [
+            ...(prev?.findings || []), ...(prev?.secrets || []),
+            ...(prev?.supplyChain || []).filter(s => s.type === 'vulnerable_dep'),
+          ];
         } catch { /* first run — empty baseline, everything is firstSeen now */ }
         const now = Date.now();
         stampFindingTimestamps(persistedScan.findings || [], baselineMap, now);
         stampFindingTimestamps(persistedScan.secrets || [], baselineMap, now);
         stampFindingTimestamps((persistedScan.supplyChain || []).filter(s => s.type === 'vulnerable_dep'), baselineMap, now);
+        // #10 — MTTR: which of the previous scan's findings are no longer
+        // present now (fixed), and how long each took. computeMTTR itself was
+        // fully built and tested but had never had a real caller — the module's
+        // own comment calls it "true MTTR," distinct from the open-backlog
+        // median-age proxy renderSlaSummary already surfaces below.
+        const currentFps = new Set([
+          ...(persistedScan.findings || []), ...(persistedScan.secrets || []),
+          ...(persistedScan.supplyChain || []).filter(s => s.type === 'vulnerable_dep'),
+        ].map(fingerprintFinding));
+        const removed = prevAll.filter(f => !currentFps.has(fingerprintFinding(f)));
+        persistedScan.mttr = computeMTTR(removed);
         // Surface the SLA-breach line on human-readable formats (not JSON/CI pipes).
         const isJson = format === 'json' || format === 'sarif' || format === 'cyclonedx' || format === 'sbom' || format === 'spdx' || format === 'vex' || format === 'openvex' || format === 'pbom' || format === 'aibom';
         if (!isJson) {
           const sla = renderSlaSummary(persistedScan.findings || []);
           if (sla) process.stderr.write(`⏰ agentic-security: ${sla}\n`);
+          if (persistedScan.mttr.count > 0) {
+            process.stderr.write(`✅ agentic-security: ${persistedScan.mttr.count} finding(s) fixed since last scan, median ${Math.round(persistedScan.mttr.medianDays)}d to remediate\n`);
+          }
         }
-      } catch { /* MTTR is best-effort — never block a scan write */ }
+      } catch (e) {
+        // MTTR is best-effort — never block a scan write. But a silent catch
+        // here previously hid a real, deterministic CI-only failure (the
+        // mttr field went missing on every hosted-CI run, never locally, and
+        // nothing explained why) for long enough that it shipped several
+        // releases undiagnosed. Surface it — never fail the scan on it.
+        if (process.env.AGENTIC_SECURITY_MTTR_DEBUG === '1' || process.env.CI || process.env.GITHUB_ACTIONS) {
+          process.stderr.write(`agentic-security: MTTR computation failed (best-effort, scan unaffected): ${(e && e.stack) || e}\n`);
+        }
+      }
 
       // R5 — report the observed time-to-validated-fix distribution from the
       // fix attempts recorded by `verifyFix`. This is measurement, not
@@ -735,10 +790,17 @@ async function cmdScan(args) {
 
   // 0.14.0 — update streak / achievements after every full scan. Suppress
   // streak side effects when the user only wants raw JSON output (CI piping).
+  // Gated on `persistedScan !== null` (i.e. the same _writesOnScan() &&
+  // _isSafeStateDir() condition above) — recordScan()'s own isSafeStateDir
+  // check alone does not know about --no-state / AGENTIC_SECURITY_NO_STATE,
+  // so without this a "read-only, mutates nothing" scan would still write
+  // streak.json. This was accidentally masked before the persistedScan
+  // scoping fix (recordScan was never reached at all, for the wrong reason);
+  // fixing that reachability bug required adding this guard explicitly.
   try {
-    const streak = recordScan(stateDirPath, persistedScan);
+    const streak = persistedScan !== null ? recordScan(stateDirPath, persistedScan) : null;
     // Print celebration / streak line to stderr so it doesn't pollute --format json
-    if (process.stderr.isTTY && format !== 'json' && format !== 'sarif') {
+    if (streak && process.stderr.isTTY && format !== 'json' && format !== 'sarif') {
       const delta = formatGradeDelta(streak);
       const line = formatStreakLine(streak);
       if (delta) process.stderr.write('\n' + delta + '\n');
@@ -814,20 +876,48 @@ async function cmdCi(args) {
   const packNames = packArg ? (Array.isArray(packArg) ? packArg : String(packArg).split(',')) : [];
   if (packNames.length) Object.assign(scan, applyPacks(scan, packNames));
 
-  // Persist the three CI artifacts.
+  // R4 — same run attestation cmdScan attaches, computed here too so
+  // findings.json (the actual CI evidence artifact) carries the same
+  // tamper-evidence digest 'agentic-security scan' does, rather than
+  // always shipping attestation: null. Runs after every filter above, so
+  // it attests what actually ships. Metadata only — never fails the scan.
+  try {
+    const { computeRunAttestation } = await import('../src/posture/attestation.js');
+    const { keyProvenance } = await import('../src/posture/integrity.js');
+    const { effectiveVersion } = await import('../src/posture/ruleset-version.js');
+    scan.attestation = computeRunAttestation({
+      findings: normalizeFindings(scan),
+      engineVersion: PKG_VERSION,
+      rulesetVersion: effectiveVersion(targetAbs).version,
+      bundleSha: _bundleSha(),
+      root: targetAbs,
+      sign: true,
+    });
+    if (scan.attestation) scan.attestation.keyProvenance = keyProvenance();
+  } catch { /* attestation is metadata; never fail a scan over it */ }
+
+  // Persist the three CI artifacts — but a refusal to write must NEVER skip
+  // the --fail-on evaluation below. S1 (Stage-0 audit, 2026): this used to be
+  // a bare `return;` inside the write-guard, so `cmdCi` returned `undefined`
+  // and `process.exit(await cmdCi(args))` became `process.exit(undefined)`,
+  // which Node treats as exit 0 — a CI pipeline reading only $? would see a
+  // passing build whose findings were never evaluated against --fail-on at
+  // all. The write and the gate are orthogonal: "we couldn't persist
+  // artifacts" is not evidence about "the scan is clean."
   const stateDirPath = stateDir(targetAbs);
   const { isSafeStateDir: _isSafeCi, stateWritesEnabled: _writesOnCi } = await import('../src/posture/state-dir.js');
-  if (!_writesOnCi() || !_isSafeCi(stateDirPath)) {
+  const _canWriteCi = _writesOnCi() && _isSafeCi(stateDirPath);
+  if (!_canWriteCi) {
     if (process.env.AGENTIC_SECURITY_DEBUG === '1') process.stderr.write(`[agentic-security] refusing to write CI artifacts at ${stateDirPath} — no project marker\n`);
-    return;
+  } else {
+    await fsp.mkdir(stateDirPath, { recursive: true });
+    await fsp.writeFile(path.join(stateDirPath, 'findings.json'),
+      JSON.stringify(toJSON(scan, meta), null, 2));
+    await fsp.writeFile(path.join(stateDirPath, 'findings.sarif'),
+      JSON.stringify(toSARIF(scan, meta), null, 2));
+    await fsp.writeFile(path.join(stateDirPath, 'findings.junit.xml'),
+      toJUnit(scan, meta));
   }
-  await fsp.mkdir(stateDirPath, { recursive: true });
-  await fsp.writeFile(path.join(stateDirPath, 'findings.json'),
-    JSON.stringify(toJSON(scan, meta), null, 2));
-  await fsp.writeFile(path.join(stateDirPath, 'findings.sarif'),
-    JSON.stringify(toSARIF(scan, meta), null, 2));
-  await fsp.writeFile(path.join(stateDirPath, 'findings.junit.xml'),
-    toJUnit(scan, meta));
 
   const scanCode = exitCodeFor(scan);
   const findings = normalizeFindings(scan);
@@ -835,7 +925,9 @@ async function cmdCi(args) {
   for (const f of findings) sev[f.severity] = (sev[f.severity] || 0) + 1;
   process.stderr.write(
     `[ci] ${findings.length} findings — ${sev.critical} critical · ${sev.high} high · ${sev.medium} medium · ${sev.low} low\n` +
-    `[ci] artifacts: .agentic-security/findings.{json,sarif,junit.xml}\n` +
+    (_canWriteCi
+      ? `[ci] artifacts: .agentic-security/findings.{json,sarif,junit.xml}\n`
+      : `[ci] artifacts: NOT written (state writes refused — set AGENTIC_SECURITY_DEBUG=1 for the reason)\n`) +
     `[ci] fail-on=${failOn}  scan-exit=${scanCode}\n`
   );
   // FR-SDLC-9: when --policy <file.rego> is supplied, evaluate against the
@@ -1758,16 +1850,73 @@ async function cmdAttest(args) {
   return 0;
 }
 
+// R4/D2 correctness follow-up: attestation.js ships TWO independent
+// verifiers — verifyEvidenceBundle (per-finding, Ed25519, self-contained —
+// only needs a public key) and verifyRunAttestation (whole-run, per-install
+// HMAC, NOT self-contained — needs the caller to also supply the finding
+// set to re-derive against). This CLI command only ever called the first;
+// the second had zero production callers anywhere in the repo (confirmed by
+// grep — only test/attestation.test.js called it). Auto-detect which
+// artifact was handed in and dispatch to the matching verifier instead of
+// silently misinterpreting a run-attestation as a (structurally different)
+// evidence bundle.
+function _asRunAttestation(obj) {
+  if (obj && typeof obj.digest === 'string' && obj.canonicalisation) return obj;
+  if (obj && obj.attestation && typeof obj.attestation.digest === 'string') return obj.attestation;
+  return null;
+}
+
+// Verifies a run attestation the ONLY way it can be verified: by re-deriving
+// the digest from a fresh scan and comparing. Unlike an evidence bundle
+// (self-contained, just needs a public key), a run attestation is a claim
+// about a FINDING SET, not a standalone signed blob — "does scanning this
+// codebase right now reproduce the exact digest an earlier run attested"
+// is the actual, meaningful question this command answers.
+async function cmdVerifyRunAttestation(attestation, args) {
+  const projectPath = path.resolve(args.flags.against || '.');
+  if (!fs.existsSync(projectPath)) {
+    console.error(`--against path does not exist: ${projectPath}`);
+    return 2;
+  }
+  console.log(`Re-scanning ${projectPath} to check it reproduces the attested digest...`);
+  const { runScan } = await import('../src/runScan.js');
+  const { normalizeFindings } = await import('../src/report/index.js');
+  const { effectiveVersion } = await import('../src/posture/ruleset-version.js');
+  const { verifyRunAttestation } = await import('../src/posture/attestation.js');
+  const { scan } = await runScan(projectPath);
+  const r = verifyRunAttestation(attestation, {
+    findings: normalizeFindings(scan),
+    engineVersion: PKG_VERSION,
+    rulesetVersion: effectiveVersion(projectPath).version,
+    bundleSha: _bundleSha(),
+    root: projectPath,
+  });
+  if (!r.ok) {
+    console.error(`✗ INVALID — ${r.reason}`);
+    return 1;
+  }
+  console.log('✓ VALID — a fresh scan of this project reproduces the attested digest exactly.');
+  console.log('');
+  console.log(`  digest:          ${attestation.digest}`);
+  console.log(`  findingCount:    ${attestation.findingCount}`);
+  console.log(`  proves:          ${attestation.proves}`);
+  console.log(`  does NOT prove:  ${attestation.doesNotProve}`);
+  return 0;
+}
+
 async function cmdVerifyAttestation(args) {
   const { verifyEvidenceBundle, keyPaths } = await import('../src/posture/evidence-bundle.js');
   // `args._[0]` is the command name itself — the same convention cmdScan uses.
   const file = args.flags.bundle || args._[1];
-  if (!file) { console.error('Usage: agentic-security verify-attestation <bundle.json> [--public-key <path>]'); return 2; }
+  if (!file) { console.error('Usage: agentic-security verify-attestation <bundle.json|last-scan.json> [--public-key <path>] [--against <project-path>]'); return 2; }
 
   let bundle;
   try { bundle = JSON.parse(fs.readFileSync(path.resolve(file), 'utf8')); }
   catch (e) { console.error(`Could not read bundle: ${e.message}`); return 2; }
 
+  const runAttestation = _asRunAttestation(bundle);
+  if (runAttestation) return cmdVerifyRunAttestation(runAttestation, args);
+
   const keyFile = args.flags['public-key'] || keyPaths().publicKey;
   let publicKeyPem = null;
   try { publicKeyPem = fs.readFileSync(path.resolve(keyFile), 'utf8'); }

package/dist/113.index.js

@@ -78,7 +78,7 @@ function recordFixAttempt(scanRoot, record) {
   try {
     const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
     if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
-    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return;
+    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return false;
   node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
     // One writeSync of one newline-terminated line: a concurrent reader sees
     // whole records or nothing, and a torn tail is dropped on read.
@@ -266,7 +266,16 @@ function _detectRunner(scanRoot) {
     } catch { return null; }
   })();
   if (pkg && pkg.scripts && pkg.scripts.test && !/no test specified/.test(String(pkg.scripts.test))) {
-    return { runner: 'npm', cmd: 'npm', args: ['test', '--silent', '--', '--passWithNoTests'] };
+    // --passWithNoTests is Jest-specific CLI syntax — appending it
+    // unconditionally broke every non-Jest npm test script (mocha, vitest,
+    // ava, tap, or a plain node script) with an "unrecognized option" exit,
+    // failing verification for a reason that has nothing to do with
+    // whether the patch actually broke anything. Only add it when Jest is
+    // actually the configured runner.
+    const usesJest = /\bjest\b/.test(String(pkg.scripts.test))
+      || Boolean(pkg.devDependencies?.jest) || Boolean(pkg.dependencies?.jest);
+    const args = usesJest ? ['test', '--silent', '--', '--passWithNoTests'] : ['test', '--silent'];
+    return { runner: 'npm', cmd: 'npm', args };
   }
   if (has('pytest.ini') || has('pyproject.toml') || has('setup.cfg')) {
     return { runner: 'pytest', cmd: 'pytest', args: ['-q', '--no-header', '-x'] };
@@ -406,8 +415,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 499 modules
-var engine = __webpack_require__(2912);
+// EXTERNAL MODULE: ./src/engine.js + 196 modules
+var engine = __webpack_require__(2739);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(2912);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(2739);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan: