@clear-capabilities/agentic-security-scanner 0.139.1 → 0.140.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-6644269053578a17693b6dbb13795c1195ddf4faf6816063d8fb5e33c78bdbae  agentic-security.mjs
+800f9251808cc9e453cd1604b2375ad445aa4a00382ebe049294ac758622d258  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.139.1",
+  "version": "0.140.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -64,7 +64,7 @@
     "test:smoke": "node --test test/smoke.test.js test/demo-app.test.js",
     "test:glob": "node --test test/glob-compat.test.js",
     "test:sast": "node --test test/sibling-guard.test.js test/comment-blindness.test.js test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/zip-slip-containment-guard.test.js test/redos-anchoring.test.js test/path-guard-validator-call.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/guard-window-identifier-correlation.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js test/juliet-path-filter-gate.test.js test/java-bench-shape-opt-in.test.js test/reachability-missing-callgraph-data.test.js test/rate-limit.test.js test/auth-signals.test.js test/convention-deviation.test.js test/resource-exhaustion.test.js test/resource-exhaustion-realworld.test.js test/redirect-toctou.test.js test/redirect-toctou-realworld.test.js test/codegen-sink.test.js test/ownership-authz.test.js test/ownership-authz-realworld.test.js test/t21-precision-audit.test.js",
-    "test:posture": "node --test test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js",
+    "test:posture": "node --test test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js",
     "test:dataflow": "node --test test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js",
     "test:report": "node --test test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js",

package/src/engine.js

@@ -35,6 +35,7 @@ import { scanLlmTradingAgent } from './sast/llm-trading-agent.js';
 import { scanMobileManifest } from './sast/mobile-manifest.js';
 import { scanQuarkusHardening } from './sast/quarkus-hardening.js';
 import { scanFastapiHardening } from './sast/fastapi-hardening.js';
+import { isDeterministic } from './posture/deterministic.js';
 import { scanAuthZ } from './sast/authz.js';
 import { scanApiBrokenAuthz } from './sast/api-authz.js';
 import { scanTerraform } from './sast/iac-terraform.js';
@@ -8019,6 +8020,23 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   try { _GLOBAL_JAVA_TAINTED_METHODS = _buildGlobalJavaTaintedMethodIndex(fileContents); }
   catch { _GLOBAL_JAVA_TAINTED_METHODS = new Set(); }
   const _perFileTimeoutMs = parseInt(process.env.AGENTIC_SECURITY_PER_FILE_TIMEOUT_MS || '10000', 10);
+// Per-file wall-clock timings are the slowest-first performance view, and they
+// leaked straight into --deterministic output: the `ms` values differ run to
+// run, and because the list is SORTED BY those values the ORDER differs too.
+// Zeroing the numbers alone would not have been enough — the sort key would
+// have become constant and the resulting order arbitrary. Under deterministic
+// mode the timings are therefore reported as 0 and ordered by filename, so the
+// field keeps its shape (consumers still see the same 20 entries) without
+// carrying anything a clock decided.
+function _deterministicFileTimings(timings) {
+  if (!isDeterministic()) return timings.sort((a, b) => b.ms - a.ms).slice(0, 20);
+  return timings
+    .slice()
+    .sort((a, b) => String(a.file).localeCompare(String(b.file)))
+    .slice(0, 20)
+    .map(t => ({ ...t, ms: 0 }));
+}
+
   const _fileTimings = [];
   let _filesSkipped = 0, _filesTimedOut = 0, _filesDenseSkipped = 0;
   const files=Object.keys(fileContents).filter(f=>(shouldScan(f) || isKubernetesManifest(f, fileContents[f])) && !_isPathIgnored(f));const fc={},pfr={};const aR=[],aF=[],aSrc=[],aSink=[],aSan=[],aLogic=[],aSupply=[],aSecrets=[],aCiphersRest=[],aCiphersTransit=[];
@@ -9516,7 +9534,7 @@ async function runFullScan({fileContents={}, depFileContents={}, scanRoot=null,
   // seen when only N-of-those-candidates were actually analyzed.
   // checkpoint.total intentionally keeps files.length — that field means the
   // full candidate set for resume bookkeeping, a different, correct meaning.
-  const _scanMeta={filesScanned:Object.keys(fc).length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_fileTimings.sort((a,b)=>b.ms-a.ms).slice(0,20),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
+  const _scanMeta={filesScanned:Object.keys(fc).length,filesSkipped:_filesSkipped,filesDenseSkipped:_filesDenseSkipped,filesTimedOut:_filesTimedOut,analysisTier:_analysisTier,unmodeledSinkCandidates:_unmodeledSinks,fileTimings:_deterministicFileTimings(_fileTimings),findingsBySeverity:{critical:finalFindings.filter(f=>f.severity==='critical').length,high:finalFindings.filter(f=>f.severity==='high').length,medium:finalFindings.filter(f=>f.severity==='medium').length,low:finalFindings.filter(f=>f.severity==='low').length,info:finalFindings.filter(f=>f.severity==='info').length},checkpoint:{enabled:!!(_ckpt&&_ckpt.enabled),resumed:_ckptResumed,total:files.length}};
   // R8: the scan completed, so the checkpoint has been fully consumed — remove
   // it. Anything that threw before this point leaves it in place to resume from.
   try { closeCheckpoint(_ckpt, { complete: true }); } catch (_) {}

package/src/posture/auditor-walkthrough.js

@@ -118,7 +118,11 @@ export function loadFramework(scanRoot, id) {
 // `k8s-pod-privileged`; `nist-csf-2.json`/`hipaa-security-rule.json` map to
 // the compliance-side spelling `k8s-pod-security-privileged`, which no
 // detector ever emitted.
-const COMPLIANCE_FAMILY_ALIAS = {
+export const COMPLIANCE_FAMILY_ALIAS = {
+  // ASVS spells it `sqli`; every detector emits `sql-injection` (or a
+  // language-prefixed variant, which the suffix rule below does NOT cover
+  // because the prefix is on the wrong end).
+  'sqli': ['sql-injection', 'dart-sql-injection', 'laravel-sql-injection'],
   'auth-missing': ['broken-access-control', 'fastapi-missing-auth', 'springboot-missing-authz', 'laravel-missing-auth', 'quarkus-missing-authz'],
   'authz': ['broken-access-control', 'idor', 'springboot-missing-authz', 'quarkus-missing-authz'],
   'k8s-pod-security-privileged': ['k8s-pod-privileged'],
@@ -130,18 +134,63 @@ const COMPLIANCE_FAMILY_ALIAS = {
 // real detector to alias, and `mcp-audit.js`/`sca/dep-confusion.js` were
 // fixed at the SOURCE (they now set `family` explicitly) rather than
 // aliased, since the finding constructors themselves were the root cause.
-// Four references have no matching detector at all — not a naming
-// mismatch, a genuine coverage gap that would need a new rule, out of
-// scope for an alias table: `crypto-tls-version` (crypto-protocol.js checks
-// verify-disabled, not minimum-TLS-version — the file's own header comment
-// even names the never-implemented `crypto-tls-min-version` rule id),
-// `nosql-injection` (referenced by cross-lang-meta.js's chain-detection
-// list, but no dedicated NoSQL-injection detector exists), `pii-exposure`
-// and `data-exposure` (both referenced only by consumers — threat-model-
-// auto.js's classifier and a Juliet-benchmark answer-key label
-// respectively — with no producer). Every control mapped to one of these
-// four reads `manual`/`engine-gap` rather than a false `present`, which is
-// the safe failure mode this whole mechanism exists to guarantee.
+//
+// CORRECTION (measured, not read): this comment used to claim four families
+// had no producer at all — `crypto-tls-version`, `nosql-injection`,
+// `pii-exposure` and `data-exposure` — and that every control mapped to one
+// of them therefore read `manual`/`engine-gap` rather than a false `present`.
+// BOTH halves were wrong. Nothing implemented the engine-gap treatment (see
+// COMPLIANCE_FAMILY_GAPS below), and all four families DO have producers:
+// a sweep of 331 real scan roots (bench/family-producers/OBSERVED.json)
+// observed crypto-tls-version, nosql-injection and data-exposure twice each,
+// and `pii-exposure` is emitted by dataflow/privacy-taint.js:129.
+//
+// The lesson is recorded because it cost a wrong commit: a family is not a
+// gap because a grep or a source comment says so. Several detectors pass
+// `family` POSITIONALLY (`_shape(file, line, ruleId, vuln, fam, …)` in
+// cloud-iam.js, crypto-protocol.js, k8s-admission.js, ml-supply-chain.js),
+// so no textual search enumerates the real vocabulary. Only running the
+// engine does.
+
+// ...which the prose above ASSERTED but nothing enforced. A `family:` mapping
+// with no detector behind it produces an empty bucket, and an empty bucket was
+// reported as `✓ no open critical/high findings` — identical to a genuine pass.
+// So the four known-unevidenceable families read as fully evidenced controls,
+// which is precisely the outcome the comment says is avoided.
+//
+// Declaring them here makes the claim load-bearing: the evaluator consults this
+// map (see the `family:` branch below) and caps such a control at `partial`
+// with an explicit disclosure, and `test/compliance-mapping-liveness.test.js`
+// fails if an entry loses its reason, duplicates an alias, or stops being
+// referenced by any framework.
+//
+// Membership is deliberately conservative — these four come from the CMP-1
+// audit recorded above, each confirmed to be referenced only by CONSUMER
+// tables (attack-taxonomy, risk-dollars, threat-model classifiers) with no
+// producing detector. A family is NOT added here merely because a static grep
+// or a fixture sweep failed to observe it: several detectors pass `family`
+// positionally (`_shape(file, line, ruleId, vuln, fam, …)` in cloud-iam.js,
+// crypto-protocol.js, k8s-admission.js, ml-supply-chain.js), so neither source
+// enumerates the real vocabulary on its own. Wrongly declaring a live family a
+// gap would suppress a control that does work.
+export const COMPLIANCE_FAMILY_GAPS = {
+  // Deliberately EMPTY. Every family currently mapped by a bundled framework
+  // has a producer, verified against bench/family-producers/OBSERVED.json.
+  //
+  // The mechanism below is retained because the hazard is real and structural:
+  // the evaluator resolves `family:X` against a Map keyed by finding.family, so
+  // a mapping nothing produces yields an empty bucket, and an empty bucket used
+  // to render as `✓ no open critical/high findings` — a pass nothing checked.
+  // An entry here caps such a control at `partial` with an explicit disclosure
+  // instead.
+  //
+  // Adding an entry requires EVIDENCE that no detector emits the family — a
+  // sweep that does not observe it is a lower bound, not proof (SCA families
+  // need network access, and some rules need shapes no corpus entry has).
+  // Wrongly declaring a live family a gap silently suppresses a control that
+  // works, which is the mirror image of the bug this prevents.
+};
+
 export function evaluateFramework(scanRoot, fw, scan) {
   // CMP-2: last-scan.json (what this is actually handed in production) carries
   // findings across four separate channels — SAST (`findings`), secrets,
@@ -207,8 +256,36 @@ export function evaluateFramework(scanRoot, fw, scan) {
         // filtering is safe; findings with no subfamily set still count
         // (recall-preserving default — same precedent as relevance.js).
         const [fam, subfam] = m.slice('family:'.length).split(':');
+        // No detector produces this family, so its bucket is empty on EVERY
+        // scan. Reporting that as "no open findings" is a pass nothing checked
+        // — disclose it and cap the control at 'partial' (the same treatment a
+        // `rule:` mapping gets, and for the same reason: unverifiable is not
+        // evidence). Deliberately does NOT clear allCleared — the control is
+        // unknown, not failing.
+        if (COMPLIANCE_FAMILY_GAPS[fam]) {
+          obs.push(`⚠ ${fam}: no detector can evidence this control (engine-gap) — ${COMPLIANCE_FAMILY_GAPS[fam]}`);
+          anySignal = true;
+          hasUnverifiableMapping = true;
+          continue;
+        }
         const aliasFams = COMPLIANCE_FAMILY_ALIAS[fam] || [];
-        const candidates = [fam, ...aliasFams].flatMap(k => families.get(k) || []);
+        // Several detectors emit the family as `<family>-<rule-slug>` — the
+        // observed vocabulary holds `prompt-injection-http-user-input-in-llm-`,
+        // `xpath-injection-query-built-via-string-c` and similar. This lookup
+        // used to be an exact Map key read, so `family:prompt-injection`
+        // matched none of them and the control read as evidenced whatever the
+        // scan found. That silenced LLM01 (Prompt Injection — the FIRST control
+        // of the OWASP LLM Top 10), ASVS V5.1 and NIST AI 600-1 MG-3.2-005.
+        //
+        // The `-` separator is load-bearing, not cosmetic: a bare substring or
+        // prefix test would let `nosql-injection` satisfy a `sql-injection`
+        // mapping, silently merging two different vulnerability classes. A test
+        // pins that boundary in the failing direction.
+        const bases = [fam, ...aliasFams];
+        const candidates = [];
+        for (const [key, list] of families) {
+          if (bases.some(b => key === b || key.startsWith(`${b}-`))) candidates.push(...list);
+        }
         const scoped = subfam ? candidates.filter(f => !f.subfamily || f.subfamily === subfam) : candidates;
         const open = scoped.filter(f => !f.intentSuppressed && !f.pastDecision && (f.severity === 'critical' || f.severity === 'high'));
         if (open.length) {

package/src/posture/concurrency-checker.js

@@ -106,6 +106,13 @@ function grabBody(text, openBraceIdx) {
   return null;
 }
 
+// Lock names come from a `\w+` capture so they cannot currently carry regex
+// metacharacters, but the guards below interpolate them into a pattern — escape
+// so that stays true if a capture ever widens.
+function escapeRe(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 function findMissedUnlocks(fn, lang) {
   const out = [];
   const p = PATTERNS[lang];
@@ -128,10 +135,32 @@ function findMissedUnlocks(fn, lang) {
       // Lock+unlock both present, but check that the function has a defer/
       // try-finally guarantee. Go: `defer`; Java/Py: try/finally; otherwise
       // early-return-before-unlock is a risk.
+      //
+      // The guard must accept a QUALIFIED receiver (`defer s.mu.Unlock()`,
+      // `with self.lock:`), not just a bare one. A mutex is usually a struct
+      // field or an instance attribute, so the qualified form is the common
+      // shape in real code — and the acquire patterns already matched it
+      // (`\b(\w+)\.Lock\(\)` captures `mu` from `s.mu.Lock()`). While the two
+      // halves disagreed, correct idiomatic code was the most likely to be
+      // reported: on a 12-entry Go sample this was the bulk of the module's
+      // output.
+      //
+      // It is also matched PER LOCK NAME rather than body-wide. A function
+      // holding two mutexes must not have its second lock cleared just because
+      // the first one is deferred.
+      // The receiver prefix is `[\w$.]*` — a single character class — rather
+      // than the more obvious `(?:[\w$]+\.)*`, which nests a quantifier inside
+      // a quantifier and is exactly the catastrophic-backtracking shape this
+      // project's own CWE-1333 detector flags (it caught this line in the
+      // self-scan). `\b` before the lock name is what keeps the flat form
+      // precise: without it, `[\w$.]*` would happily match `s.not` and let
+      // `defer s.notmu.Unlock()` guard a lock named `mu`.
+      const q = escapeRe(name);
       const guarded =
-        (lang === 'go' && /defer\s+\w+\.Unlock\(\)/.test(fn.body)) ||
+        (lang === 'go' && new RegExp(`defer\\s+[\\w$.]*\\b${q}\\.Unlock\\(\\)`).test(fn.body)) ||
         (lang === 'java' && /try\s*\{[\s\S]*finally\s*\{[\s\S]*\.unlock\(\)/m.test(fn.body)) ||
-        (lang === 'py' && (/with\s+\w+:/.test(fn.body) || /try\s*:[\s\S]*finally\s*:[\s\S]*\.release\(\)/m.test(fn.body)));
+        (lang === 'py' && (new RegExp(`with\\s+[^:\\n]*\\b${q}\\b[^:\\n]*:`).test(fn.body)
+          || /try\s*:[\s\S]*finally\s*:[\s\S]*\.release\(\)/m.test(fn.body)));
       if (!guarded && /\breturn\b/.test(fn.body)) {
         out.push({
           kind: 'unguarded-lock',
@@ -229,6 +258,12 @@ export function scanConcurrency(fileContents) {
             ? `Concurrency: ${fn.name}() acquires ${bug.lock} but no matching unlock`
             : `Concurrency: ${fn.name}() can return without releasing ${bug.lock}`,
           severity: 'medium',
+          // CWE-667 Improper Locking. The findings schema in CLAUDE.md requires a
+          // cwe on every finding, and these carried none — so they arrived in
+          // every CWE-keyed report as null and could never match an advisory
+          // label. Found while auditing the wrong-CWE bucket: 57% of findings
+          // on a Go/Ruby sample had no cwe at all.
+          cwe: 'CWE-667',
           family: 'concurrency-bug',
           confidence: 0.5,
           remediation: bug.remediation || 'Release the lock on every exit path (defer / try-finally / context manager).',
@@ -241,6 +276,7 @@ export function scanConcurrency(fileContents) {
           line: bug.startLine,
           vuln: `Concurrency: fire-and-forget async call in ${fn.name}() — result not awaited`,
           severity: 'low',
+          cwe: 'CWE-703', // Improper Check or Handling of Exceptional Conditions
           family: 'concurrency-bug',
           confidence: 0.4,
           remediation: 'Await the promise / call .get() on the future / use asyncio.gather.',
@@ -255,6 +291,7 @@ export function scanConcurrency(fileContents) {
         line: bug.startLineA,
         vuln: `Concurrency: potential deadlock — ${bug.order}`,
         severity: 'high',
+        cwe: 'CWE-833', // Deadlock
         family: 'concurrency-bug',
         confidence: 0.4,
         remediation: 'Acquire locks in a consistent global order across all call sites.',

package/src/posture/integrity.js

@@ -39,6 +39,46 @@ function _keyPath() { return path.join(_keyDir(), 'scan-key'); }
 let _keySource = null;
 export function keyProvenance() { return _keySource || 'unresolved'; }
 
+// `writeFileSync(fp, …, {flag:'wx'})` is exclusive-CREATE, not atomic
+// create-with-content: it creates the file and THEN writes it. A concurrent
+// process that opens the path in that window reads an empty or partial file,
+// fails the hex check, and falls through to an ephemeral key — whose signatures
+// verify nowhere, forever, indistinguishable from real tampering. That is the
+// same failure the `wx` flag was added to prevent, just through a narrower
+// window, and CI caught it: 1 of 8 concurrently-generated signatures failed to
+// verify under the install key.
+//
+// Writing the full content to a temp file and hard-LINKING it into place closes
+// the window. link(2) is atomic and fails with EEXIST rather than clobbering, so
+// the destination path only ever appears with complete content, and the
+// first-writer-wins guarantee is preserved. Some filesystems (and Windows in
+// places) refuse hard links, so an unsupported link degrades to the previous
+// exclusive-create behaviour rather than failing the scan.
+function _publishKeyAtomically(fp, contents) {
+  const dir = _keyDir();
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const tmp = path.join(dir, `scan-key.${process.pid}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+  try {
+    fs.writeFileSync(tmp, contents, { mode: 0o600 });
+    try {
+      fs.linkSync(tmp, fp);
+      return 'created';
+    } catch (e) {
+      if (e.code === 'EEXIST') return 'exists';
+      // Hard links unsupported here — fall back, accepting the narrower race.
+      try {
+        fs.writeFileSync(fp, contents, { mode: 0o600, flag: 'wx' });
+        return 'created';
+      } catch (e2) {
+        if (e2.code === 'EEXIST') return 'exists';
+        throw e2;
+      }
+    }
+  } finally {
+    try { fs.unlinkSync(tmp); } catch { /* best effort */ }
+  }
+}
+
 function _readOrGenerateKey() {
   const fromEnv = process.env.AGENTIC_SECURITY_HMAC_KEY;
   if (fromEnv && /^[0-9a-fA-F]{32,}$/.test(fromEnv.trim())) {
@@ -62,19 +102,30 @@ function _readOrGenerateKey() {
   // forever after, indistinguishable from real tampering.
   const buf = crypto.randomBytes(32);
   try {
-    fs.mkdirSync(_keyDir(), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(fp, buf.toString('hex') + '\n', { mode: 0o600, flag: 'wx' });
-    _keySource = 'per-install-new';
-    return buf;
+    const outcome = _publishKeyAtomically(fp, buf.toString('hex') + '\n');
+    if (outcome === 'created') { _keySource = 'per-install-new'; return buf; }
+    // Another process published first — fall through to the EEXIST path and
+    // adopt ITS key, exactly as before.
+    const e = new Error('key already published'); e.code = 'EEXIST'; throw e;
   } catch (e) {
     if (e.code === 'EEXIST') {
       // Another process won the race and persisted its key first — use
       // THAT key instead of the one we generated, or we'd return a key
       // that matches nothing on disk.
-      try {
-        const hex = fs.readFileSync(fp, 'utf8').trim();
-        if (/^[0-9a-fA-F]{32,}$/.test(hex)) { _keySource = 'per-install'; return Buffer.from(hex, 'hex'); }
-      } catch { /* fall through to ephemeral */ }
+      // Bounded retry, defence-in-depth. With the atomic link publish above the
+      // winner's key is complete the instant the path exists, so one read is
+      // enough. It is NOT enough when the link fell back to exclusive-create
+      // (filesystems without hard links), or when an older version of this file
+      // left a torn key behind — there the content can still be arriving. A few
+      // short retries cost nothing and the alternative is an ephemeral key whose
+      // signatures never verify again.
+      for (let attempt = 0; attempt < 5; attempt++) {
+        try {
+          const hex = fs.readFileSync(fp, 'utf8').trim();
+          if (/^[0-9a-fA-F]{32,}$/.test(hex)) { _keySource = 'per-install'; return Buffer.from(hex, 'hex'); }
+        } catch { /* not readable yet */ }
+        try { Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 2); } catch { /* no sleep available */ }
+      }
     }
     // Could not persist (or the winner's key was unreadable/malformed) —
     // this key lives for this process only, so nothing signed with it will

package/src/posture/poc-generator.js

@@ -23,8 +23,24 @@
 //   - Per-language template variants beyond the primary host language.
 // Those land in P1.2.
 
+import * as crypto from 'node:crypto';
 import { CWE_TO_FAMILY, FAMILY_TO_PRIMARY_CWE } from './poc-cwe-map.js';
 
+// The XSS marker was `Math.random()`, evaluated at GENERATION time, so the
+// same finding produced a different PoC on every scan and `--deterministic`
+// could not make the JSON report byte-identical. (The XXE sentinel further
+// down also calls Math.random(), but that call is literal text inside the
+// EMITTED PoC — it runs when the PoC runs, so the artifact is already stable.
+// Leave it alone.)
+//
+// Derived from the finding instead: still distinct per finding, which is what
+// the marker is for — a token that will not collide with content already in
+// the response — but now reproducible.
+function _stableToken(f, n = 6) {
+  const seed = String((f && (f.stableId || f.id)) || `${f && f.file}:${f && f.line}`);
+  return crypto.createHash('sha256').update(seed).digest('hex').slice(0, n);
+}
+
 // ─── Template selectors ─────────────────────────────────────────────────────
 //
 // Each entry: { cwe, family, vulnContains, lang, render(finding, ctx) → code }
@@ -64,7 +80,7 @@ const TEMPLATES = [
     kind: 'http-payload',
     render: (f, ctx) => _httpPocNode(ctx, {
       header: 'Demonstrates reflected XSS by checking the script payload appears unencoded.',
-      payload: `"><script>__POC_XSS_${Math.random().toString(36).slice(2, 8)}</script>`,
+      payload: `"><script>__POC_XSS_${_stableToken(f)}</script>`,
       expect: 'response body contains the literal <script> payload (proves no HTML encoding)',
     }),
   },

package/src/posture/sbom.js

@@ -7,6 +7,7 @@
 // SPDX 2.3 schema reference:  https://spdx.github.io/spdx-spec/v2.3/
 
 import * as crypto from 'node:crypto';
+import { isDeterministic } from './deterministic.js';
 
 function _purl(c) {
   if (c.purl) return c.purl;
@@ -21,10 +22,39 @@ function _bomRef(c) {
   return `${c.ecosystem || 'pkg'}:${c.name}@${c.version}`;
 }
 
+// CycloneDX `serialNumber` and SPDX `documentNamespace` are both required to
+// identify a document, and both were minted with crypto.randomUUID() — so two
+// scans of identical input produced different bytes, and `--deterministic` did
+// not actually make an SBOM reproducible. An attestation over an SBOM is only
+// meaningful if the SBOM can be regenerated and compared.
+//
+// Under --deterministic the identifier is derived from the document's own
+// content instead of randomness. That preserves what the identifier is FOR:
+// different content still yields a different id, while identical content
+// yields an identical one — the standard reproducible-build treatment. Outside
+// deterministic mode the random UUID is unchanged, so ordinary scans keep
+// per-run-unique document ids.
+function _stableUuidFrom(seed) {
+  const h = crypto.createHash('sha256').update(String(seed)).digest('hex');
+  // Shape the digest as a v4-looking UUID: the version/variant nibbles are set
+  // so consumers that validate the format still accept it.
+  return [
+    h.slice(0, 8),
+    h.slice(8, 12),
+    `4${h.slice(13, 16)}`,
+    `${((parseInt(h[16], 16) & 0x3) | 0x8).toString(16)}${h.slice(17, 20)}`,
+    h.slice(20, 32),
+  ].join('-');
+}
+
+function _documentUuid(seed) {
+  return isDeterministic() ? _stableUuidFrom(seed) : crypto.randomUUID();
+}
+
 export function toCycloneDX(scan, meta = {}) {
   const components = scan.components || [];
   const supplyChain = (scan.supplyChain || []).filter(s => s.type === 'vulnerable_dep');
-  const serialNumber = `urn:uuid:${crypto.randomUUID()}`;
+  const serialNumber = `urn:uuid:${_documentUuid(JSON.stringify(components.map(_bomRef)))}`;
 
   const cdxComponents = components.map(c => ({
     type: 'library',
@@ -36,8 +66,12 @@ export function toCycloneDX(scan, meta = {}) {
     ...(c.scope ? { scope: c.scope === 'dev' ? 'optional' : 'required' } : {}),
   }));
 
-  const vulnerabilities = supplyChain.map(s => ({
-    'bom-ref': `${_bomRef({ ecosystem: s.ecosystem, name: s.name, version: s.version })}#${s.osvId || s.advisory || crypto.randomUUID()}`,
+  const vulnerabilities = supplyChain.map((s, i) => ({
+    // The last-resort id was crypto.randomUUID(), which reintroduced
+    // per-run drift for any advisory carrying neither an osvId nor an
+    // advisory string. Index within the (already deterministically sorted)
+    // supplyChain array identifies it just as well and is reproducible.
+    'bom-ref': `${_bomRef({ ecosystem: s.ecosystem, name: s.name, version: s.version })}#${s.osvId || s.advisory || `unidentified-${i}`}`,
     id: s.osvId || (s.cveAliases || [])[0] || s.advisory,
     source: { name: 'OSV.dev', url: `https://osv.dev/vulnerability/${s.osvId || ''}` },
     references: (s.cveAliases || []).map(cve => ({ id: cve, source: { name: 'NVD' } })),
@@ -72,7 +106,7 @@ export function toCycloneDX(scan, meta = {}) {
 export function toSPDX(scan, meta = {}) {
   const components = scan.components || [];
   const supplyChain = (scan.supplyChain || []).filter(s => s.type === 'vulnerable_dep');
-  const docNamespace = `https://agentic-security.local/spdx/${crypto.randomUUID()}`;
+  const docNamespace = `https://agentic-security.local/spdx/${_documentUuid(JSON.stringify(components.map(_bomRef)))}`;
   const ts = meta.startedAt || new Date().toISOString();
 
   const packages = components.map((c, i) => ({