@clear-capabilities/agentic-security-scanner 0.136.2 → 0.136.9

package/src/posture/aibom.js

@@ -156,12 +156,16 @@ function _extractPromptFile(fp, content) {
   };
 }
 
+// A package's role isn't mutually exclusive in reality — `openai` and
+// `@anthropic-ai/sdk` are both a general inference framework AND an
+// embedding-provider SDK. Returns every matching class, not just the first.
 function _classifyFramework(c) {
   const name = (c.name || '').toLowerCase();
-  if (FRAMEWORK_PACKAGES.has(name) || FRAMEWORK_PACKAGES.has(c.name)) return 'inference-framework';
-  if (VECTOR_STORE_PACKAGES.has(name) || VECTOR_STORE_PACKAGES.has(c.name)) return 'vector-store';
-  if (EMBEDDING_PACKAGES.has(name) || EMBEDDING_PACKAGES.has(c.name)) return 'embedding-provider';
-  return null;
+  const classes = [];
+  if (FRAMEWORK_PACKAGES.has(name) || FRAMEWORK_PACKAGES.has(c.name)) classes.push('inference-framework');
+  if (VECTOR_STORE_PACKAGES.has(name) || VECTOR_STORE_PACKAGES.has(c.name)) classes.push('vector-store');
+  if (EMBEDDING_PACKAGES.has(name) || EMBEDDING_PACKAGES.has(c.name)) classes.push('embedding-provider');
+  return classes;
 }
 
 // Public: build the AI-BOM from already-scanned data.
@@ -189,10 +193,10 @@ export function buildAIBOM(scan, fileContents = {}, meta = {}) {
   const vectorStores = [];
   const embeddings = [];
   for (const c of (scan.components || [])) {
-    const cls = _classifyFramework(c);
-    if (cls === 'inference-framework') frameworks.push({ ecosystem: c.ecosystem, name: c.name, version: c.version, license: c.license || null });
-    else if (cls === 'vector-store') vectorStores.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
-    else if (cls === 'embedding-provider') embeddings.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
+    const classes = _classifyFramework(c);
+    if (classes.includes('inference-framework')) frameworks.push({ ecosystem: c.ecosystem, name: c.name, version: c.version, license: c.license || null });
+    if (classes.includes('vector-store')) vectorStores.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
+    if (classes.includes('embedding-provider')) embeddings.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
   }
   return {
     aibomFormat: 'agentic-security AI-BOM',

package/src/posture/auditor-walkthrough.js

@@ -98,11 +98,69 @@ export function loadFramework(scanRoot, id) {
  *   'absent'    — no signal / open critical findings on every mapsTo family
  *   'manual'    — control has no mapsTo (requires manual attestation)
  */
+// Stage 6 correctness audit: several compliance frameworks map controls to
+// `family:auth-missing` / `family:authz`, but no detector in this codebase
+// ever emits those literal family strings — the real missing-auth/authz
+// detectors use `broken-access-control` (generic), `fastapi-missing-auth`,
+// `springboot-missing-authz`, `laravel-missing-auth`, `quarkus-missing-authz`
+// (framework-specific). Without this alias, a control mapped to
+// auth-missing/authz read "present" (vacuously — the family bucket was
+// always empty) even with a critical, unauthenticated route open. Listed
+// under both compliance-side names since `broken-access-control` covers
+// both "nobody checked" (missing auth) and "checked wrong" (broken authz)
+// and it is strictly safer to over-count a real finding against both than
+// to keep silently excluding it from either.
+// CMP-1 (Stage 6 follow-up): grown incrementally by cross-referencing every
+// `family:` string the bundled compliance-frameworks/*.json files reference
+// against what src/sast + src/posture actually emit (a small, closed
+// problem — only the strings a control actually maps to, not a universal
+// vocabulary registry). k8s-admission.js's real rule id is
+// `k8s-pod-privileged`; `nist-csf-2.json`/`hipaa-security-rule.json` map to
+// the compliance-side spelling `k8s-pod-security-privileged`, which no
+// detector ever emitted.
+const COMPLIANCE_FAMILY_ALIAS = {
+  'auth-missing': ['broken-access-control', 'fastapi-missing-auth', 'springboot-missing-authz', 'laravel-missing-auth', 'quarkus-missing-authz'],
+  'authz': ['broken-access-control', 'idor', 'springboot-missing-authz', 'quarkus-missing-authz'],
+  'k8s-pod-security-privileged': ['k8s-pod-privileged'],
+};
+
+// CMP-1 audit trail: every `family:` string referenced by the bundled
+// compliance-frameworks/*.json files was cross-checked against real
+// detector output; entries above are the confirmed naming mismatches with a
+// real detector to alias, and `mcp-audit.js`/`sca/dep-confusion.js` were
+// fixed at the SOURCE (they now set `family` explicitly) rather than
+// aliased, since the finding constructors themselves were the root cause.
+// Four references have no matching detector at all — not a naming
+// mismatch, a genuine coverage gap that would need a new rule, out of
+// scope for an alias table: `crypto-tls-version` (crypto-protocol.js checks
+// verify-disabled, not minimum-TLS-version — the file's own header comment
+// even names the never-implemented `crypto-tls-min-version` rule id),
+// `nosql-injection` (referenced by cross-lang-meta.js's chain-detection
+// list, but no dedicated NoSQL-injection detector exists), `pii-exposure`
+// and `data-exposure` (both referenced only by consumers — threat-model-
+// auto.js's classifier and a Juliet-benchmark answer-key label
+// respectively — with no producer). Every control mapped to one of these
+// four reads `manual`/`engine-gap` rather than a false `present`, which is
+// the safe failure mode this whole mechanism exists to guarantee.
 export function evaluateFramework(scanRoot, fw, scan) {
+  // CMP-2: last-scan.json (what this is actually handed in production) carries
+  // findings across four separate channels — SAST (`findings`), secrets,
+  // business-logic, and SCA (`supplyChain`) — because report/index.js's
+  // normalizeFindings keeps them apart too. Reading only `scan.findings` made
+  // every secrets/logic/SCA finding invisible to every framework's family:
+  // mappings, e.g. a critical hardcoded secret never counted against a
+  // control mapped to family:hardcoded-secret. Each channel's family default
+  // mirrors normalizeFindings' own fallback for that channel so the two stay
+  // in agreement about what family an untagged finding belongs to.
   const findings = (scan && Array.isArray(scan.findings)) ? scan.findings : [];
+  const secrets = ((scan && Array.isArray(scan.secrets)) ? scan.secrets : [])
+    .map(s => ({ ...s, family: s.family || 'hardcoded-secret' }));
+  const logicVulns = (scan && Array.isArray(scan.logicVulns)) ? scan.logicVulns : [];
+  const supplyChain = ((scan && Array.isArray(scan.supplyChain)) ? scan.supplyChain : [])
+    .map(sc => ({ ...sc, family: sc.family || 'vulnerable-dep' }));
   const components = (scan && Array.isArray(scan.components)) ? scan.components : [];
   const families = new Map();
-  for (const f of findings) {
+  for (const f of [...findings, ...secrets, ...logicVulns, ...supplyChain]) {
     const k = f.family || 'unknown';
     if (!families.has(k)) families.set(k, []);
     families.get(k).push(f);
@@ -122,15 +180,43 @@ export function evaluateFramework(scanRoot, fw, scan) {
 
     let allCleared = true;
     let anySignal = false;
+    // Tracks whether ANY family:/module: mapping in this control actually
+    // passed (distinct from allCleared, which asks whether EVERY one did).
+    // Feeds the 'absent' vs 'partial' distinction below: a control where
+    // nothing at all checks out is a materially different auditor story
+    // ("no evidence") than one that's mostly clean with one open gap
+    // ("evidence with a gap") — both used to render as the same 'partial'.
+    let anyCleared = false;
+    // CMP-2: a rule: mapping's own observation says "verify manually" — it
+    // is deliberately not code-checked. It used to set anySignal=true and
+    // leave allCleared untouched, so a control whose ONLY mapping was rule:
+    // resolved to 'present' (fully evidenced), the same status as a control
+    // with real, checked evidence. Any rule: mapping present caps the
+    // control at 'partial' — never 'present' — regardless of what the
+    // family:/module: mappings in the same control found.
+    let hasUnverifiableMapping = false;
     for (const m of maps) {
       if (m.startsWith('family:')) {
-        const fam = m.slice('family:'.length).split(':')[0];
-        const open = (families.get(fam) || []).filter(f => !f.intentSuppressed && !f.pastDecision && (f.severity === 'critical' || f.severity === 'high'));
+        // `family:X` and the subfamily-qualified `family:X:Y` (used by
+        // owasp-llm-top-10 for LLM02/LLM06/LLM07) both used to collapse to
+        // just `X` here — the `:Y` qualifier was parsed and then silently
+        // dropped, so any finding of family X counted against every control
+        // mapped to X regardless of which subfamily the control actually
+        // named (four LLM controls flagged off one credential-in-prompt
+        // finding). Detectors that emit a subfamily always set it, so
+        // filtering is safe; findings with no subfamily set still count
+        // (recall-preserving default — same precedent as relevance.js).
+        const [fam, subfam] = m.slice('family:'.length).split(':');
+        const aliasFams = COMPLIANCE_FAMILY_ALIAS[fam] || [];
+        const candidates = [fam, ...aliasFams].flatMap(k => families.get(k) || []);
+        const scoped = subfam ? candidates.filter(f => !f.subfamily || f.subfamily === subfam) : candidates;
+        const open = scoped.filter(f => !f.intentSuppressed && !f.pastDecision && (f.severity === 'critical' || f.severity === 'high'));
         if (open.length) {
           allCleared = false;
           obs.push(`${open.length} open ${fam} finding(s) at high/critical.`);
         } else {
           obs.push(`✓ ${fam}: no open critical/high findings.`);
+          anyCleared = true;
         }
         anySignal = true;
       } else if (m.startsWith('module:')) {
@@ -174,6 +260,7 @@ export function evaluateFramework(scanRoot, fw, scan) {
         if (resolved && fs.existsSync(resolved)) {
           obs.push(`✓ ${mod}: ${label} present.`);
           anySignal = true;
+          anyCleared = true;
         } else {
           obs.push(`✗ ${mod}: expected ${label} not present.`);
           allCleared = false;
@@ -182,11 +269,23 @@ export function evaluateFramework(scanRoot, fw, scan) {
         // Could check whether a custom rule fires zero — leave a hint for now.
         obs.push(`(rule mapping) ${m} — verify manually that the bodyguard rule is enabled.`);
         anySignal = true;
+        hasUnverifiableMapping = true;
       }
     }
 
+    // 'absent' was documented (see the docstring above) as a fourth,
+    // distinct status — a control where NOTHING passed at all — but the
+    // assignment below never produced it; every non-present, non-manual
+    // control rendered as 'partial' regardless of whether it was "mostly
+    // clean with one gap" or "completely unevidenced". Only introduced for
+    // the fully-automated case (no rule: mapping) to avoid reclassifying
+    // any control that already reads 'partial' because of an inherently
+    // unverifiable rule: mapping — that precedent (rule: caps at 'partial',
+    // never reaching 'present' OR 'absent') is unchanged.
     if (!anySignal) status = 'manual';
+    else if (hasUnverifiableMapping) status = 'partial';
     else if (allCleared) status = 'present';
+    else if (!anyCleared) status = 'absent';
     else status = 'partial';
 
     results.push({ control: c, status, observations: obs });

package/src/posture/autopilot.js

@@ -110,7 +110,14 @@ export async function runAutopilot({
   for (const f of inScope) {
     const key = f.stableId || `${f.file}:${f.line}:${f.vuln}`;
     const prior = resume ? state.findings[key] : null;
-    if (prior?.outcome) { results.push(prior); continue; }
+    // A cached VERIFIED_FIXED whose patch was gated (not written) on a prior
+    // apply:false run is not a terminal outcome once the caller asks for
+    // apply:true — replaying it verbatim would silently never call
+    // applyFix on the exact two-step workflow (preview, then --apply) this
+    // gate exists to support. Everything else cached IS terminal and is
+    // replayed as before.
+    const gatedOnlyByApply = prior?.outcome === 'VERIFIED_FIXED' && prior.applied !== true && apply === true;
+    if (prior?.outcome && !gatedOnlyByApply) { results.push(prior); continue; }
 
     const rec = { key, file: f.file, line: f.line, vuln: f.vuln, severity: f.severity };
 

package/src/posture/calibration-drift.js

@@ -57,12 +57,18 @@ export function computeDrift(scanRoot, opts = {}) {
   const fb = loadTriageFeedback(scanRoot);
   if (!fb.length) return { alarms: [], note: 'no-feedback-data' };
 
-  // Group by family. Each entry should carry: family, verdict ('tp'|'fp'|'wai'),
-  // reportedConfidence (0..1), ts.
+  // Group by family. Each entry should carry: family, verdict ('tp'|'fp'|'wontfix'),
+  // reportedConfidence (0..1), at.
+  // Field names/verdict values here previously didn't match the real
+  // producer (commands/triage.md's Step 2): it writes `at`, not `ts`, and
+  // never wrote `reportedConfidence` at all (fixed there alongside this —
+  // Stage 2 measurement-completeness audit) or a `'wai'` verdict (it only
+  // ever writes 'tp'|'fp'|'wontfix'), so this alarm could never fire against
+  // real triage data regardless of how badly calibration had drifted.
   const byFamily = new Map();
   for (const e of fb) {
-    if (!e || !e.family || !inWindow(e.ts, window)) continue;
-    if (!['tp', 'fp', 'wai'].includes(e.verdict)) continue;
+    if (!e || !e.family || !inWindow(e.at, window)) continue;
+    if (!['tp', 'fp', 'wontfix'].includes(e.verdict)) continue;
     if (typeof e.reportedConfidence !== 'number') continue;
     if (!byFamily.has(e.family)) byFamily.set(e.family, []);
     byFamily.get(e.family).push(e);
@@ -75,7 +81,7 @@ export function computeDrift(scanRoot, opts = {}) {
     const reportedAcc = entries.reduce((acc, e) => acc + e.reportedConfidence, 0) / entries.length;
     const divergence = Math.abs(reportedAcc - realizedAcc);
     if (divergence < threshold) continue;
-    const firstTs = entries.map(e => e.ts).filter(Boolean).sort()[0];
+    const firstTs = entries.map(e => e.at).filter(Boolean).sort()[0];
     alarms.push({
       alarm: true,
       since: firstTs,

package/src/posture/calibration.js

@@ -121,15 +121,37 @@ export function loadCalibrationHistory(scanRoot) {
   };
   if (seed) merge(seed);
   if (customer) merge(customer);
-  // Merge triage-derived TP/FP counts (auto-feedback loop)
+  // Merge triage-derived TP/FP counts (auto-feedback loop).
+  //
+  // EA-01: only a state a human actually chose is a real signal. triage.js's
+  // syncWithScan sets every new finding to 'open' with no human involved, and
+  // auto-closes any finding the scanner stops seeing to 'fixed' with
+  // `automatic:true` on the transition — neither reflects a judgment that the
+  // finding was real. Counting them as TP made the "true positive" column
+  // entirely machine-generated while the FP column required an explicit human
+  // false-positive mark, so calibrated confidence trended toward 1.0 for any
+  // family with enough scan volume regardless of actual accuracy. Only a
+  // manual 'fixed' transition (confirmed real, now resolved) counts as TP;
+  // only 'false-positive' counts as FP. 'open', 'in-progress', 'wont-fix',
+  // and an automatically-reached 'fixed' contribute to neither bucket.
   try {
     const triage = _readJsonMaybe(statePath(scanRoot, 'triage.json'));
     if (triage && triage.findings) {
+      const lastFixedIsAutomatic = new Map();
+      for (const t of triage.transitions || []) {
+        if (t && t.to === 'fixed') lastFixedIsAutomatic.set(t.id, t.automatic === true);
+      }
       const triageFams = {};
       for (const f of Object.values(triage.findings)) {
         const fam = f.family || 'unknown';
         if (!triageFams[fam]) triageFams[fam] = { tp: 0, fp: 0 };
-        if (f.state === 'fixed' || f.state === 'open' || f.state === 'in-progress') triageFams[fam].tp++;
+        // Require POSITIVE proof of a manual transition (=== false), not
+        // merely the absence of proof of an automatic one (!== true) — the
+        // latter fails OPEN: a finding with no transition record at all
+        // (lastFixedIsAutomatic.get returns undefined) counted as a manual
+        // TP by default, exactly the machine-generated-signal failure mode
+        // this whole block's comment states it exists to prevent.
+        if (f.state === 'fixed' && lastFixedIsAutomatic.get(f.id) === false) triageFams[fam].tp++;
         else if (f.state === 'false-positive') triageFams[fam].fp++;
       }
       merge({ families: triageFams });

package/src/posture/compliance-frameworks/nist-privacy-1-1.json

@@ -781,7 +781,7 @@
       "summary": "Software is maintained, replaced, and removed commensurate with risk.",
       "codeTestable": "partial",
       "mapsTo": [
-        "family:vulnerable-dependency",
+        "family:vulnerable-dep",
         "family:dependency-drift"
       ]
     },
@@ -800,7 +800,7 @@
       "codeTestable": "yes",
       "mapsTo": [
         "family:dependency-confusion",
-        "family:vulnerable-dependency"
+        "family:vulnerable-dep"
       ]
     },
     {

package/src/posture/compliance-frameworks/owasp-asvs-5.json

@@ -66,7 +66,7 @@
       "category": "Malicious Code",
       "summary": "Verify the application does not include known-malicious or compromised dependencies.",
       "evidence": [".agentic-security/sbom-history snapshots clean.", "No dependency-confusion or dependency-drift findings."],
-      "mapsTo": ["family:vulnerable-dependency", "family:dependency-confusion", "family:dependency-drift"]
+      "mapsTo": ["family:vulnerable-dep", "family:dependency-confusion", "family:dependency-drift"]
     },
     {
       "id": "V14.1",

package/src/posture/compliance-policy.js

@@ -41,6 +41,7 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as yaml from '../util/yaml.js';
 import { statePath, safeWriteState } from './state-dir.js';
+import { SCANNER_VERSION } from './version.js';
 
 const POLICY_FILE = 'compliance.policy.yml';
 
@@ -128,7 +129,29 @@ function _runCheck(check, ctx) {
  * Run all controls in the policy and emit a verification report.
  */
 export function verifyPolicy(policy, ctx) {
+  // CMP-5: loadPolicy() reports a parse failure as { _error }, which has no
+  // `.controls` — the same shape as "no policy file at all". Distinguishing
+  // them matters: a customer who typo'd their YAML deserves a loud error,
+  // not a report that silently treats their (unparsed) policy as having no
+  // controls to check.
+  if (policy && policy._error) return { controls: [], status: 'error', error: policy._error };
   if (!policy || !policy.controls) return { controls: [], status: 'no-policy' };
+  // CMP-5: a finding-family check must see every channel a real scan
+  // produces (findings=SAST, secrets, logicVulns, supplyChain=SCA) — the
+  // caller (engine.js) hands last-scan.json's own channel split through
+  // ctx, so a control checking family:hardcoded-secret or
+  // family:vulnerable-dep isn't blind to 3 of the engine's 4 finding types.
+  // Family defaults mirror report/index.js's normalizeFindings so the two
+  // modules can't drift apart on what family an untagged finding belongs to.
+  ctx = {
+    ...ctx,
+    findings: [
+      ...(ctx.findings || []),
+      ...(ctx.secrets || []).map(s => ({ ...s, family: s.family || 'hardcoded-secret' })),
+      ...(ctx.logicVulns || []),
+      ...(ctx.supplyChain || []).map(sc => ({ ...sc, family: sc.family || 'vulnerable-dep' })),
+    ],
+  };
   const results = [];
   for (const control of policy.controls) {
     if (control.not_applicable) {
@@ -166,6 +189,13 @@ export function emitEvidenceJsonLd(report, scanRoot) {
     framework: report.framework,
     version: report.version,
     generatedAt: new Date().toISOString(),
+    // CMP-5: this artifact is fed to GRC tooling (Vanta/Drata/SecureFrame) and
+    // auditors largely unread by a human — the same reason
+    // auditor-walkthrough.js's narrative carries this disclaimer verbatim.
+    // Without it here, a machine-consumed "ComplianceEvidence" document reads
+    // as an attestation, not a scanner's automated observation.
+    disclaimer: 'This artifact organizes automated scanner evidence into a structured report. It does not certify compliance. A licensed assessor (CPA / auditor / DPO) is responsible for the final attestation.',
+    provenance: { engineVersion: SCANNER_VERSION },
     summary: report.summary,
     controls: report.controls.map(c => ({
       '@type': 'Control',
@@ -192,7 +222,9 @@ export function emitEvidenceMarkdown(report, scanRoot) {
   const lines = [];
   lines.push(`# Compliance evidence — ${report.framework}`);
   lines.push('');
-  lines.push(`Generated by agentic-security on ${new Date().toISOString().slice(0,10)}.`);
+  lines.push(`Generated by agentic-security (engine ${SCANNER_VERSION}) on ${new Date().toISOString().slice(0,10)}.`);
+  lines.push('');
+  lines.push('> This document organizes automated scanner evidence into a structured report. It does not certify compliance. A licensed assessor (CPA / auditor / DPO) is responsible for the final attestation.');
   lines.push('');
   lines.push(`Compliant: **${report.summary.compliant}** / Non-compliant: **${report.summary.nonCompliant}** / Not applicable: **${report.summary.notApplicable}** of ${report.summary.total} controls.`);
   lines.push('');

package/src/posture/confidence.js

@@ -47,19 +47,53 @@ export function annotateConfidence(findings) {
       if (f.routeRooted) conf = Math.min(1, conf + 0.05);
       if (f.guards && f.guards.length) conf *= 0.80;
       if (f.reachable === false) conf *= 0.55;
+      // f.unvalidated is set later in the pipeline (llm-validator/index.js,
+      // invoked well after this first confidence pass), so it's never true
+      // here on a finding's first computation — see applyUnvalidatedPenalty
+      // below, the real enforcement point, run after validation. Kept here
+      // too so a caller that builds a synthetic finding with
+      // unvalidated:true pre-set still gets it applied in one pass.
       if (f.unvalidated) conf *= 0.85;   // LLM validator unavailable
-      if (f.llmOnly) conf *= 0.70;       // LLM-only finding, no Layer-2 path
+      // f.llmOnly: currently unreachable — no producer anywhere in this
+      // codebase ever sets it (grepped). Documented as a no-op rather than
+      // silently deleted, since the intent ("LLM-only finding, no Layer-2
+      // path") is a real, plausible signal that just isn't wired yet.
+      if (f.llmOnly) conf *= 0.70;
     }
     conf = Math.max(0, Math.min(1, conf));
     f.confidence = Math.round(conf * 1000) / 1000;
-    // Premortem 3R-15: derive tier from the 2-decimal display value so a
-    // finding reported as "0.75" never lands in two tiers depending on the
-    // viewer's rounding. Add a +0.005 epsilon to anchor cutoffs to the
-    // displayed rounded value (3-decimal raw 0.745 → 2-decimal 0.75 → high).
-    const display = Math.round(f.confidence * 100) / 100;
-    if (display >= 0.75) f.confidenceTier = 'high';
-    else if (display >= 0.50) f.confidenceTier = 'medium';
-    else if (display >= 0.25) f.confidenceTier = 'low';
-    else f.confidenceTier = 'very-low';
+    f.confidenceTier = _tierFor(f.confidence);
+  }
+}
+
+// Premortem 3R-15: derive tier from the 2-decimal display value so a
+// finding reported as "0.75" never lands in two tiers depending on the
+// viewer's rounding (3-decimal raw 0.745 → 2-decimal 0.75 → high).
+function _tierFor(confidence) {
+  const display = Math.round(confidence * 100) / 100;
+  if (display >= 0.75) return 'high';
+  if (display >= 0.50) return 'medium';
+  if (display >= 0.25) return 'low';
+  return 'very-low';
+}
+
+// Retroactively applies the unvalidated penalty to findings whose
+// confidence was already computed by annotateConfidence BEFORE
+// f.unvalidated could be known — annotateConfidence only computes from
+// scratch when f.confidence is still null (so hand-tuned detector
+// confidences survive untouched), and f.unvalidated is set by
+// llm-validator/index.js, which runs well after the pipeline's first
+// annotateConfidence pass. Call this once, immediately after LLM
+// validation runs (or is skipped). Idempotent: a finding is only
+// adjusted once, tracked via f._unvalidatedPenaltyApplied.
+export function applyUnvalidatedPenalty(findings) {
+  if (!Array.isArray(findings)) return;
+  for (const f of findings) {
+    if (!f || typeof f !== 'object') continue;
+    if (f._unvalidatedPenaltyApplied) continue;
+    f._unvalidatedPenaltyApplied = true;
+    if (!f.unvalidated || typeof f.confidence !== 'number') continue;
+    f.confidence = Math.round(Math.max(0, Math.min(1, f.confidence * 0.85)) * 1000) / 1000;
+    f.confidenceTier = _tierFor(f.confidence);
   }
 }

package/src/posture/corpus-enroll.js

@@ -296,8 +296,12 @@ function _stripState(dir) {
   }
 }
 
-// `scoreCandidate` is deliberately NOT exported: an external caller could
-// score a candidate and then write it by some other route, which is exactly
-// the unscored-write path this module exists to make unavailable. Enrolment
-// scores and writes as one operation or not at all.
-export const _internals = { DEFAULT_TIER, scoreCandidate, _languageOf, _escapeRegex, _stripState };
+// `scoreCandidate` is deliberately NOT exported — not even via _internals,
+// the test-only-helpers convention used elsewhere in this codebase: an
+// external caller could score a candidate and then write it by some other
+// route, which is exactly the unscored-write path this module exists to
+// make unavailable. Enrolment scores and writes as one operation or not at
+// all. Keep it out of this object even though every other _internals
+// export in this codebase is a harmless pure helper — this one specific
+// function is the security boundary, not test plumbing.
+export const _internals = { DEFAULT_TIER, _languageOf, _escapeRegex, _stripState };

package/src/posture/corpus-match.js

@@ -54,6 +54,25 @@ function _matches(f, manifest, matcher) {
     (manifest?.cwe ? f.cwe === manifest.cwe || matcher.test(f.cwe || '') : true);
 }
 
+/**
+ * Every finding, across every channel, that scores this entry.
+ *
+ * Third caller of the ONE predicate (gate, enrollment, and now the per-layer
+ * recall instrument in `bench/layer-recall/`). That instrument needs to know
+ * WHICH findings matched so it can attribute them to the analysis layer that
+ * produced them; re-deriving the predicate there is precisely the drift this
+ * module was extracted to prevent, so it reuses `_matches` instead.
+ */
+export function matchingFindings(scan, manifest, matcher = matcherFor(manifest)) {
+  const out = [];
+  for (const channel of CHANNELS) {
+    const arr = scan?.[channel];
+    if (!Array.isArray(arr)) continue;
+    for (const f of arr) if (_matches(f, manifest, matcher)) out.push(f);
+  }
+  return out;
+}
+
 /** Did the vulnerable (`pre/`) tree produce a matching finding? */
 export function preHit(scan, manifest, matcher = matcherFor(manifest)) {
   return _any(scan, f => _matches(f, manifest, matcher));

package/src/posture/csharp-analysis.js

@@ -101,6 +101,49 @@ function isSanitizedExpr(text) {
   return false;
 }
 
+// For each SANITIZER_PATTERNS match in `text`, find the nearest `(...)` call
+// span after the match and return its [start, end) bounds. Used to tell
+// "the sanitizer call actually wraps the tainted value" (HtmlEncode(x)) apart
+// from "the sanitizer pattern matched something unrelated elsewhere in a
+// compound expression" (comment + (IsNullOrEmpty(flag) ? ... : ...)) — a
+// common .NET idiom that combines a tainted value with an unrelated validity
+// check in the same expression.
+function _sanitizerCallSpans(text) {
+  const spans = [];
+  for (const re of SANITIZER_PATTERNS) {
+    const g = new RegExp(re.source, re.flags.includes('g') ? re.flags : re.flags + 'g');
+    let m;
+    while ((m = g.exec(text))) {
+      const openIdx = text.indexOf('(', g.lastIndex - 1);
+      if (openIdx !== -1 && openIdx - g.lastIndex < 3) {
+        let depth = 1, j = openIdx + 1;
+        while (j < text.length && depth > 0) {
+          if (text[j] === '(') depth++;
+          else if (text[j] === ')') depth--;
+          j++;
+        }
+        spans.push([openIdx, j]);
+      }
+      if (g.lastIndex === m.index) g.lastIndex++; // avoid infinite loop on zero-width matches
+    }
+  }
+  return spans;
+}
+
+// Is `ref` tainted-and-NOT-neutralized by an enclosing sanitizer call in
+// `text`? True when every occurrence of `ref` as a whole word sits outside
+// every sanitizer call span (i.e. no sanitizer actually wraps it).
+function _refEscapesSanitizers(text, ref, spans) {
+  if (!spans.length) return true;
+  const re = new RegExp(`\\b${ref.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`, 'g');
+  let m, sawAny = false;
+  while ((m = re.exec(text))) {
+    sawAny = true;
+    if (!spans.some(([s, e]) => m.index >= s && m.index < e)) return true;
+  }
+  return !sawAny;
+}
+
 // Walk a single method's body and compute per-variable type + taint.
 // Returns { typeMap, taintMap, sourceLines } where sourceLines records the
 // declaration line at which each variable first became tainted.
@@ -296,12 +339,22 @@ export function receiverIsType(method, flow, receiver, typePattern) {
 // for short expressions but unsafe for arbitrary string-containing text.
 export function expressionIsTainted(flow, text, idents = null) {
   if (!text && !idents) return false;
+  // Check known-tainted variable references that ESCAPE every sanitizer
+  // call span first — a whole-expression sanitizer-pattern match (below)
+  // must not clear a tainted variable the sanitizer doesn't actually wrap.
+  // `HtmlEncode(x)` genuinely neutralizes `x` (inside the call's parens);
+  // `comment + (string.IsNullOrEmpty(flag) ? ... : ...)` does not neutralize
+  // `comment` just because an unrelated sanitizer pattern matched `flag`
+  // elsewhere in the same compound expression.
+  const refs = idents || (text ? text.match(/\b[A-Za-z_]\w*\b/g) || [] : []);
+  const spans = text ? _sanitizerCallSpans(text) : [];
+  for (const r of refs) {
+    if (flow.taintMap.get(r) && (!text || _refEscapesSanitizers(text, r, spans))) return true;
+  }
   if (text) {
     if (isSourceExpr(text) && !isSanitizedExpr(text)) return true;
     if (isSanitizedExpr(text)) return false;
   }
-  const refs = idents || (text ? text.match(/\b[A-Za-z_]\w*\b/g) || [] : []);
-  for (const r of refs) if (flow.taintMap.get(r)) return true;
   return false;
 }
 
@@ -311,9 +364,15 @@ export function expressionIsTainted(flow, text, idents = null) {
 // not treated as code identifiers.
 export function argIsTainted(flow, arg) {
   if (!arg) return false;
+  // Same span-aware fix as expressionIsTainted: a tainted identifier that
+  // escapes every sanitizer call span wins over a whole-argument
+  // sanitizer-pattern match.
+  const spans = arg.text ? _sanitizerCallSpans(arg.text) : [];
+  for (const id of arg.idents || []) {
+    if (flow.taintMap.get(id) && (!arg.text || _refEscapesSanitizers(arg.text, id, spans))) return true;
+  }
   if (arg.text && isSanitizedExpr(arg.text)) return false;
   if (arg.text && isSourceExpr(arg.text)) return true;
-  for (const id of arg.idents || []) if (flow.taintMap.get(id)) return true;
   return false;
 }
 

package/src/posture/deploy-platform.js

@@ -4,7 +4,10 @@
 // returns platform-specific security findings: missing headers, public previews,
 // no health checks, unsafe infra settings.
 //
-// Platforms: Vercel, Railway, Fly.io, Render, Netlify, AWS Amplify, Cloudflare
+// Platforms: Vercel, Railway, Fly.io, Netlify, Cloudflare.
+// NOT implemented despite being previously listed here: Render, AWS Amplify
+// (found via Stage-0 doc audit, 2026 — grepped for any render/amplify config
+// path or platform key in this file; zero hits for either).
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';

package/src/posture/drift.js

@@ -8,7 +8,13 @@
 
 function _routeKey(r) { return `${r.method || 'ANY'} ${r.path || '(file)'} @ ${r.file}:${r.line}`; }
 function _depKey(c)   { return `${c.ecosystem}:${c.name}@${c.version}`; }
-function _findingKey(f) { return `${f.kind}:${f.file}:${f.line}:${(f.vuln||'').slice(0,80)}`; }
+// Prefer stableId (posture/stable-id.js) — it omits the exact source line by
+// design, so an unrelated edit that shifts a still-unfixed finding's line
+// number doesn't register as one "removed" + one "added" finding, inflating
+// drift tier and falsely flagging a PR as introducing/fixing something it
+// didn't touch. Falls back to the line-sensitive key only for finding shapes
+// that never got a stableId annotated.
+function _findingKey(f) { return f.stableId || `${f.kind}:${f.file}:${f.line}:${(f.vuln||'').slice(0,80)}`; }
 
 function _toMap(arr, keyFn) {
   const m = new Map();

package/src/posture/epss.js

@@ -6,10 +6,19 @@
 // from those attackers are actively weaponizing.
 //
 // Decoration shape (added to each SCA finding with a CVE):
-//   epss: 0.92345
+//   epssScore: 0.92345   (this comment previously said `epss:`; the code has
+//                         always written `epssScore` — the comment was wrong,
+//                         not the code)
 //   epssPercentile: 0.987
 //   exploitedNow: true   ← percentile >= 0.95
 //
+// ⚠ engine.js ALSO sets f.epssScore/f.epssPercentile directly (around line
+// 6451), independently of this module's fetchEPSS/decorate path — two
+// implementations of the same decoration. This module's own `fetchEPSS` has
+// no in-tree caller (allowlisted in no-dead-modules.test.js as future-public
+// API); the live path is the one in engine.js. Worth consolidating, not
+// resolved here.
+//
 // Source: https://api.first.org/data/v1/epss?cve=CVE-...,CVE-...
 // Cached on disk: ~/.claude/agentic-security/epss-cache/<sha256>.json
 // 24-hour TTL. Falls back gracefully when offline.
@@ -93,6 +102,9 @@ function cvesIn(finding) {
   const found = new Set();
   if (typeof finding.cve === 'string') found.add(finding.cve.toUpperCase());
   if (Array.isArray(finding.cves)) for (const c of finding.cves) found.add(String(c).toUpperCase());
+  // The actual field name every SCA finding in this codebase uses (src/sca/
+  // CLAUDE.md's documented shape; carried through by normalizeFindings).
+  if (Array.isArray(finding.cveAliases)) for (const c of finding.cveAliases) found.add(String(c).toUpperCase());
   if (Array.isArray(finding.vulnerabilities)) {
     for (const v of finding.vulnerabilities) {
       if (typeof v.id === 'string' && v.id.startsWith('CVE-')) found.add(v.id.toUpperCase());