@clear-capabilities/agentic-security-scanner 0.139.1 → 0.141.0

package/src/posture/accuracy-scorecard.js

@@ -428,6 +428,63 @@ export function renderScorecardMarkdown(m) {
   }
   L.push('Per-file counts are in `docs/scorecard.json`.');
   L.push('');
+  // PRD F12.6 — the honest scorecard publishes the LIMITS too, not only the
+  // rates. Three claims this project makes are only meaningful with their
+  // caveat attached, and each caveat was invisible before this section:
+  //   proof coverage  — "provable" means provable by a JAVASCRIPT-ONLY harness
+  //   calibration     — the confidence surface is currently UNVERIFIED
+  //   compliance      — most controls are backed by weak or unmeasured detectors
+  // Publishing a rate without its ceiling is how a number comes to mean
+  // whatever the reader assumes.
+  if (m.limits) {
+    L.push('## Stated limits — what these capabilities cannot do');
+    L.push('');
+    if (m.limits.proof) {
+      const pc = m.limits.proof;
+      L.push('### Execution proof coverage, with its ceiling');
+      L.push('');
+      L.push('| Bucket | Share of all findings |');
+      L.push('| --- | --- |');
+      L.push(`| Provable (a proof class exists) | ${pc.provable.n}/${pc.total} |`);
+      L.push(`| Declined on purpose, reason stated | ${pc.indeterminate.n}/${pc.total} |`);
+      L.push(`| No proof class yet (backlog) | ${pc.unclassified.n}/${pc.total} |`);
+      L.push(`| **Out of harness scope (not JavaScript)** | **${pc.outOfScope.n}/${pc.total}** |`);
+      L.push('');
+      L.push(`**The ceiling.** The in-process proof harness only loads JavaScript. Of ${pc.total} findings`);
+      L.push(`measured on the CVE corpus, ${pc.reachable.n} are reachable by it at all. Proof coverage is`);
+      L.push(`**${pc.provable.n}/${pc.total}** of ALL findings and **${pc.provable.n}/${pc.reachable.n}** of the reachable ones.`);
+      L.push('Both are given because they differ by a lot, and a reader shown only one will');
+      L.push('draw the wrong conclusion in whichever direction that one flatters.');
+      L.push('');
+      L.push('Adding more proof classes does not move the ceiling. A Python or Java finding is');
+      L.push('not backlog — it is unreachable by this harness at any effort.');
+      L.push('');
+    }
+    if (m.limits.calibration) {
+      L.push('### Confidence calibration');
+      L.push('');
+      L.push(`**${m.limits.calibration}**`);
+      L.push('');
+      L.push('Every finding carries a confidence number. That number is a claim about how');
+      L.push('often the engine is right, and it is only worth what the evidence behind it is');
+      L.push('worth. `calibration-seed.json` is FITTING data, so measuring against it would');
+      L.push('reproduce the error it was fitted to. The release gate fails on this by default;');
+      L.push('a dated waiver is what currently allows a release, and it expires.');
+      L.push('');
+    }
+    if (m.limits.compliance) {
+      const c = m.limits.compliance;
+      L.push('### Compliance control strength');
+      L.push('');
+      L.push(`Of ${c.total} bundled controls, **${c.partiallyEvidenced} are backed by a detector that is weak or was never`);
+      L.push('measured against an independent corpus**, and are flagged `partiallyEvidenced`.');
+      L.push(`A further **${c.notCodeTestable} are organisational or artifact-existence only** and can never`);
+      L.push('read as evidenced by a scanner. A control appearing in a coverage map is not a');
+      L.push('statement that the control is satisfied.');
+      L.push('');
+    }
+  }
+
   const ind = m.committedInputs.independent;
   if (ind && ind.overall) {
     L.push('## Independent evaluation population — the number that matters');

package/src/posture/aibom.js

@@ -201,7 +201,19 @@ export function buildAIBOM(scan, fileContents = {}, meta = {}) {
   return {
     aibomFormat: 'agentic-security AI-BOM',
     version: '1',
-    cyclonedxCompatible: '1.7-ml-bom',
+    // PRD F5.5 — this document is PROPRIETARY and now says so.
+    //
+    // It previously carried `cyclonedxCompatible: '1.7-ml-bom'`, which was an
+    // unverified claim: nothing validated it, and the document has no
+    // `bomFormat`, no `specVersion` and no CycloneDX `components` array, so it
+    // would not have parsed as CycloneDX at all. A consumer reading that field
+    // and feeding this to a CycloneDX tool would have got an error, not a BOM.
+    //
+    // The honest options F5.5 gives are "validate mechanically, or be labelled
+    // proprietary". Both are taken: the field below states the truth, and
+    // `toCycloneDXMLBOM()` emits a REAL ML-BOM that `validateMLBOM()` checks.
+    proprietary: true,
+    cyclonedxMlBom: 'not this document — call toCycloneDXMLBOM() for a CycloneDX 1.6 ML-BOM view',
     generatedAt: meta.startedAt || new Date().toISOString(),
     models,
     promptTemplates,
@@ -286,3 +298,100 @@ export function aibomToMarkdown(aibom) {
 
   return out.join('\n');
 }
+
+
+// ── CycloneDX ML-BOM (PRD F5.5) ────────────────────────────────────────────
+//
+// A real CycloneDX 1.6 document describing the models this scan found, using the
+// ML-BOM shape: `components[].type: 'machine-learning-model'` carrying a
+// `modelCard`. Emitted separately from the proprietary AI-BOM rather than
+// pretending the proprietary one already conforms.
+//
+// The serial number derives from content under --deterministic, for the same
+// reason toCycloneDX's does: an attestation over a BOM is meaningless if the BOM
+// changes on every run.
+import * as _crypto from 'node:crypto';
+import { isDeterministic as _isDet } from './deterministic.js';
+
+function _mlbomSerial(seed) {
+  if (!_isDet()) return `urn:uuid:${_crypto.randomUUID()}`;
+  const h = _crypto.createHash('sha256').update(String(seed)).digest('hex');
+  return `urn:uuid:${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-${((parseInt(h[16], 16) & 0x3) | 0x8).toString(16)}${h.slice(17, 20)}-${h.slice(20, 32)}`;
+}
+
+export function toCycloneDXMLBOM(aibom, meta = {}) {
+  const models = (aibom && aibom.models) || [];
+  const components = models.map((m) => ({
+    type: 'machine-learning-model',
+    'bom-ref': `model:${m.provider || 'unknown'}/${m.name || 'unknown'}${m.version ? `@${m.version}` : ''}`,
+    name: m.name || 'unknown',
+    ...(m.version ? { version: m.version } : {}),
+    modelCard: {
+      modelParameters: {
+        ...(m.provider ? { approach: { type: 'supervised' } } : {}),
+        ...(m.task ? { task: m.task } : {}),
+      },
+      // `considerations` is where CycloneDX expects known risks to live. Pinning
+      // status is a real supply-chain property of a model reference: an unpinned
+      // model can change under you between runs.
+      considerations: {
+        technicalLimitations: m.pinned
+          ? []
+          : ['model reference is not pinned to a version; the served model can change between runs'],
+      },
+    },
+    properties: [
+      ...(m.provider ? [{ name: 'agentic-security:provider', value: String(m.provider) }] : []),
+      ...(m.file ? [{ name: 'agentic-security:declaredIn', value: String(m.file) }] : []),
+      { name: 'agentic-security:pinned', value: String(!!m.pinned) },
+    ],
+  }));
+
+  return {
+    bomFormat: 'CycloneDX',
+    specVersion: '1.6',
+    serialNumber: _mlbomSerial(JSON.stringify(components.map((c) => c['bom-ref']))),
+    version: 1,
+    metadata: {
+      timestamp: meta.startedAt || (aibom && aibom.generatedAt) || new Date().toISOString(),
+      tools: [{ vendor: 'Clear Capabilities', name: 'agentic-security', version: meta.engineVersion || 'dev' }],
+      component: { type: 'application', name: 'scan-target', version: '1.0.0' },
+    },
+    components,
+  };
+}
+
+/**
+ * Mechanical validation of an ML-BOM.
+ *
+ * STRUCTURAL, not full JSON-Schema validation: fetching the official CycloneDX
+ * schema at scan time would break the no-runtime-network rule, and vendoring it
+ * would add a file that silently rots against upstream. So this checks the
+ * required fields and the ML-BOM-specific shape, and SAYS that is what it does —
+ * a check labelled "validates against CycloneDX" that only tests a few keys
+ * would be the same unverified claim this item exists to remove.
+ */
+export function validateMLBOM(doc) {
+  const errors = [];
+  const req = (cond, msg) => { if (!cond) errors.push(msg); };
+
+  req(doc && typeof doc === 'object', 'not an object');
+  if (!doc || typeof doc !== 'object') return { ok: false, errors, checked: 'structural' };
+
+  req(doc.bomFormat === 'CycloneDX', `bomFormat must be "CycloneDX", got ${JSON.stringify(doc.bomFormat)}`);
+  req(/^1\.[4-9]$/.test(String(doc.specVersion || '')), `specVersion must be 1.4-1.9, got ${JSON.stringify(doc.specVersion)}`);
+  req(Number.isInteger(doc.version) && doc.version >= 1, 'version must be a positive integer');
+  req(/^urn:uuid:[0-9a-f-]{36}$/i.test(String(doc.serialNumber || '')), 'serialNumber must be a urn:uuid');
+  req(doc.metadata && typeof doc.metadata === 'object', 'metadata is required');
+  req(Array.isArray(doc.components), 'components must be an array');
+
+  for (const [i, c] of (Array.isArray(doc.components) ? doc.components : []).entries()) {
+    req(typeof c.name === 'string' && c.name, `components[${i}].name is required`);
+    req(typeof c.type === 'string' && c.type, `components[${i}].type is required`);
+    if (c.type === 'machine-learning-model') {
+      req(c.modelCard && typeof c.modelCard === 'object',
+        `components[${i}] is a machine-learning-model but carries no modelCard — that is the whole ML-BOM extension`);
+    }
+  }
+  return { ok: errors.length === 0, errors, checked: 'structural (required fields + ML-BOM component shape), NOT full JSON-Schema validation' };
+}

package/src/posture/auditor-walkthrough.js

@@ -35,6 +35,11 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import { statePath, stateWritesEnabled } from './state-dir.js';
+import { COMPLIANCE_FAMILY_ALIAS, resolveFamilyKeys } from './family-resolve.js';
+import { strengthOfControl as _strengthOfControl } from './coverage-strength.js';
+
+// Re-exported so existing callers/tests keep importing these from here.
+export { COMPLIANCE_FAMILY_ALIAS, resolveFamilyKeys };
 const BUNDLED_DIR = path.join(path.dirname(new URL(import.meta.url).pathname), 'compliance-frameworks');
 function _readJson(fp) {
   try { return JSON.parse(fs.readFileSync(fp, 'utf8')); } catch { return null; }
@@ -118,11 +123,6 @@ export function loadFramework(scanRoot, id) {
 // `k8s-pod-privileged`; `nist-csf-2.json`/`hipaa-security-rule.json` map to
 // the compliance-side spelling `k8s-pod-security-privileged`, which no
 // detector ever emitted.
-const COMPLIANCE_FAMILY_ALIAS = {
-  'auth-missing': ['broken-access-control', 'fastapi-missing-auth', 'springboot-missing-authz', 'laravel-missing-auth', 'quarkus-missing-authz'],
-  'authz': ['broken-access-control', 'idor', 'springboot-missing-authz', 'quarkus-missing-authz'],
-  'k8s-pod-security-privileged': ['k8s-pod-privileged'],
-};
 
 // CMP-1 audit trail: every `family:` string referenced by the bundled
 // compliance-frameworks/*.json files was cross-checked against real
@@ -130,18 +130,63 @@ const COMPLIANCE_FAMILY_ALIAS = {
 // real detector to alias, and `mcp-audit.js`/`sca/dep-confusion.js` were
 // fixed at the SOURCE (they now set `family` explicitly) rather than
 // aliased, since the finding constructors themselves were the root cause.
-// Four references have no matching detector at all — not a naming
-// mismatch, a genuine coverage gap that would need a new rule, out of
-// scope for an alias table: `crypto-tls-version` (crypto-protocol.js checks
-// verify-disabled, not minimum-TLS-version — the file's own header comment
-// even names the never-implemented `crypto-tls-min-version` rule id),
-// `nosql-injection` (referenced by cross-lang-meta.js's chain-detection
-// list, but no dedicated NoSQL-injection detector exists), `pii-exposure`
-// and `data-exposure` (both referenced only by consumers — threat-model-
-// auto.js's classifier and a Juliet-benchmark answer-key label
-// respectively — with no producer). Every control mapped to one of these
-// four reads `manual`/`engine-gap` rather than a false `present`, which is
-// the safe failure mode this whole mechanism exists to guarantee.
+//
+// CORRECTION (measured, not read): this comment used to claim four families
+// had no producer at all — `crypto-tls-version`, `nosql-injection`,
+// `pii-exposure` and `data-exposure` — and that every control mapped to one
+// of them therefore read `manual`/`engine-gap` rather than a false `present`.
+// BOTH halves were wrong. Nothing implemented the engine-gap treatment (see
+// COMPLIANCE_FAMILY_GAPS below), and all four families DO have producers:
+// a sweep of 331 real scan roots (bench/family-producers/OBSERVED.json)
+// observed crypto-tls-version, nosql-injection and data-exposure twice each,
+// and `pii-exposure` is emitted by dataflow/privacy-taint.js:129.
+//
+// The lesson is recorded because it cost a wrong commit: a family is not a
+// gap because a grep or a source comment says so. Several detectors pass
+// `family` POSITIONALLY (`_shape(file, line, ruleId, vuln, fam, …)` in
+// cloud-iam.js, crypto-protocol.js, k8s-admission.js, ml-supply-chain.js),
+// so no textual search enumerates the real vocabulary. Only running the
+// engine does.
+
+// ...which the prose above ASSERTED but nothing enforced. A `family:` mapping
+// with no detector behind it produces an empty bucket, and an empty bucket was
+// reported as `✓ no open critical/high findings` — identical to a genuine pass.
+// So the four known-unevidenceable families read as fully evidenced controls,
+// which is precisely the outcome the comment says is avoided.
+//
+// Declaring them here makes the claim load-bearing: the evaluator consults this
+// map (see the `family:` branch below) and caps such a control at `partial`
+// with an explicit disclosure, and `test/compliance-mapping-liveness.test.js`
+// fails if an entry loses its reason, duplicates an alias, or stops being
+// referenced by any framework.
+//
+// Membership is deliberately conservative — these four come from the CMP-1
+// audit recorded above, each confirmed to be referenced only by CONSUMER
+// tables (attack-taxonomy, risk-dollars, threat-model classifiers) with no
+// producing detector. A family is NOT added here merely because a static grep
+// or a fixture sweep failed to observe it: several detectors pass `family`
+// positionally (`_shape(file, line, ruleId, vuln, fam, …)` in cloud-iam.js,
+// crypto-protocol.js, k8s-admission.js, ml-supply-chain.js), so neither source
+// enumerates the real vocabulary on its own. Wrongly declaring a live family a
+// gap would suppress a control that does work.
+export const COMPLIANCE_FAMILY_GAPS = {
+  // Deliberately EMPTY. Every family currently mapped by a bundled framework
+  // has a producer, verified against bench/family-producers/OBSERVED.json.
+  //
+  // The mechanism below is retained because the hazard is real and structural:
+  // the evaluator resolves `family:X` against a Map keyed by finding.family, so
+  // a mapping nothing produces yields an empty bucket, and an empty bucket used
+  // to render as `✓ no open critical/high findings` — a pass nothing checked.
+  // An entry here caps such a control at `partial` with an explicit disclosure
+  // instead.
+  //
+  // Adding an entry requires EVIDENCE that no detector emits the family — a
+  // sweep that does not observe it is a lower bound, not proof (SCA families
+  // need network access, and some rules need shapes no corpus entry has).
+  // Wrongly declaring a live family a gap silently suppresses a control that
+  // works, which is the mirror image of the bug this prevents.
+};
+
 export function evaluateFramework(scanRoot, fw, scan) {
   // CMP-2: last-scan.json (what this is actually handed in production) carries
   // findings across four separate channels — SAST (`findings`), secrets,
@@ -174,7 +219,19 @@ export function evaluateFramework(scanRoot, fw, scan) {
 
     if (maps.length === 0) {
       obs.push('No automated mapping — requires manual evidence collection.');
-      results.push({ control: c, status, observations: obs });
+      // PRD F10.2: carry the MEASURED strength of the backing detector, so a
+    // control mapped to a detector that finds 3 of 18 independent advisories
+    // cannot read the same as one backed by a detector that finds nearly
+    // everything. Import is lazy so the evaluator keeps working if the bench
+    // artifacts are absent (they degrade to `unmeasured`, never to a default).
+    let evidence = null;
+    try { evidence = _strengthOfControl(c); } catch { /* strength is additive; never block evaluation */ }
+    results.push({
+      control: c,
+      status,
+      observations: obs,
+      ...(evidence ? { evidence, partiallyEvidenced: evidence.tier === 'weak' || evidence.tier === 'unmeasured' } : {}),
+    });
       continue;
     }
 
@@ -207,8 +264,32 @@ export function evaluateFramework(scanRoot, fw, scan) {
         // filtering is safe; findings with no subfamily set still count
         // (recall-preserving default — same precedent as relevance.js).
         const [fam, subfam] = m.slice('family:'.length).split(':');
-        const aliasFams = COMPLIANCE_FAMILY_ALIAS[fam] || [];
-        const candidates = [fam, ...aliasFams].flatMap(k => families.get(k) || []);
+        // No detector produces this family, so its bucket is empty on EVERY
+        // scan. Reporting that as "no open findings" is a pass nothing checked
+        // — disclose it and cap the control at 'partial' (the same treatment a
+        // `rule:` mapping gets, and for the same reason: unverifiable is not
+        // evidence). Deliberately does NOT clear allCleared — the control is
+        // unknown, not failing.
+        if (COMPLIANCE_FAMILY_GAPS[fam]) {
+          obs.push(`⚠ ${fam}: no detector can evidence this control (engine-gap) — ${COMPLIANCE_FAMILY_GAPS[fam]}`);
+          anySignal = true;
+          hasUnverifiableMapping = true;
+          continue;
+        }
+        // Several detectors emit the family as `<family>-<rule-slug>` — the
+        // observed vocabulary holds `prompt-injection-http-user-input-in-llm-`,
+        // `xpath-injection-query-built-via-string-c` and similar. This lookup
+        // used to be an exact Map key read, so `family:prompt-injection`
+        // matched none of them and the control read as evidenced whatever the
+        // scan found. That silenced LLM01 (Prompt Injection — the FIRST control
+        // of the OWASP LLM Top 10), ASVS V5.1 and NIST AI 600-1 MG-3.2-005.
+        //
+        // The `-` separator is load-bearing, not cosmetic: a bare substring or
+        // prefix test would let `nosql-injection` satisfy a `sql-injection`
+        // mapping, silently merging two different vulnerability classes. A test
+        // pins that boundary in the failing direction.
+        const candidates = resolveFamilyKeys(fam, families.keys())
+          .flatMap(k => families.get(k) || []);
         const scoped = subfam ? candidates.filter(f => !f.subfamily || f.subfamily === subfam) : candidates;
         const open = scoped.filter(f => !f.intentSuppressed && !f.pastDecision && (f.severity === 'critical' || f.severity === 'high'));
         if (open.length) {
@@ -282,13 +363,48 @@ export function evaluateFramework(scanRoot, fw, scan) {
     // any control that already reads 'partial' because of an inherently
     // unverifiable rule: mapping — that precedent (rule: caps at 'partial',
     // never reaching 'present' OR 'absent') is unchanged.
+    // PRD F10.3: a control NIST/the framework rates as not code-testable must
+    // never read as evidenced by this tool. Two shapes were reaching 'present'
+    // that should not have:
+    //
+    //   codeTestable:'no'      — organisational (policy, training, governance).
+    //                            Nothing a scanner observes can satisfy it.
+    //   codeTestable:'partial' — the only mappings are `module:` artifact
+    //                            EXISTENCE checks. "threat-model.json is
+    //                            present" is not evidence that threat modelling
+    //                            happened; it is evidence a file exists.
+    //
+    // Both are capped at 'partial' via the same unverifiable-mapping path a
+    // `rule:` mapping already uses, and the reason is stated in the
+    // observations so a reader is told WHY rather than left to infer it.
+    if (c.codeTestable === 'no') {
+      obs.push('⚠ this control is organisational, not code-testable — a scanner cannot evidence it (codeTestable: no).');
+      hasUnverifiableMapping = true;
+      anySignal = true;
+    } else if (c.codeTestable === 'partial' && maps.every(m => !m.startsWith('family:'))) {
+      obs.push('⚠ backed only by artifact-existence checks — a present file is weaker evidence than a detector finding nothing (codeTestable: partial).');
+      hasUnverifiableMapping = true;
+    }
+
     if (!anySignal) status = 'manual';
     else if (hasUnverifiableMapping) status = 'partial';
     else if (allCleared) status = 'present';
     else if (!anyCleared) status = 'absent';
     else status = 'partial';
 
-    results.push({ control: c, status, observations: obs });
+    // PRD F10.2: carry the MEASURED strength of the backing detector, so a
+    // control mapped to a detector that finds 3 of 18 independent advisories
+    // cannot read the same as one backed by a detector that finds nearly
+    // everything. Import is lazy so the evaluator keeps working if the bench
+    // artifacts are absent (they degrade to `unmeasured`, never to a default).
+    let evidence = null;
+    try { evidence = _strengthOfControl(c); } catch { /* strength is additive; never block evaluation */ }
+    results.push({
+      control: c,
+      status,
+      observations: obs,
+      ...(evidence ? { evidence, partiallyEvidenced: evidence.tier === 'weak' || evidence.tier === 'unmeasured' } : {}),
+    });
   }
   return results;
 }

package/src/posture/compliance-frameworks/ccpa.json

@@ -4,29 +4,56 @@
   "publisher": "California Legislature",
   "license": "California statute (public)",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5",
+  "scope": "SELECTIVE SUBSET. 4 of the CCPA/CPRA obligations, chosen because a code scanner can produce evidence for them. The statute is far broader; the majority of its duties (notice, consumer request handling, contracts, retention policy) are organisational and are NOT represented here. Absence of a control is not a statement of compliance.",
+  "controlsDigest": "ebc1f708c329ab42",
+  "controlCount": 4,
   "controls": [
     {
       "id": "§1798.100",
       "summary": "Consumer right to know — businesses inform consumers about categories of personal info collected.",
-      "evidence": ["DPIA artifact lists every PII field with file:line provenance."],
-      "mapsTo": ["module:privacy-taint"]
+      "codeTestable": "partial",
+      "evidence": [
+        "DPIA artifact lists every PII field with file:line provenance."
+      ],
+      "mapsTo": [
+        "module:privacy-taint"
+      ]
     },
     {
       "id": "§1798.105",
       "summary": "Right to delete — businesses comply with verified deletion requests.",
-      "evidence": ["No data-exposure findings on PII storage paths."]
+      "codeTestable": "no",
+      "evidence": [
+        "No data-exposure findings on PII storage paths."
+      ]
     },
     {
       "id": "§1798.150",
       "summary": "Civil action for security breach affecting personal information.",
-      "evidence": ["Crypto findings cleared on PII handling code.", "TLS pinning checks pass."],
-      "mapsTo": ["family:crypto-weak-cipher", "family:crypto-tls-version", "family:crypto-tls-no-verify"]
+      "codeTestable": "yes",
+      "evidence": [
+        "Crypto findings cleared on PII handling code.",
+        "TLS pinning checks pass."
+      ],
+      "mapsTo": [
+        "family:crypto-weak-cipher",
+        "family:crypto-tls-version",
+        "family:crypto-tls-no-verify"
+      ]
     },
     {
       "id": "§1798.81.5",
       "summary": "Reasonable security procedures and practices.",
-      "evidence": ["No critical findings on user-data endpoints.", "Auth-missing zero on PII paths."],
-      "mapsTo": ["family:auth-missing", "family:authz", "family:hardcoded-secret"]
+      "codeTestable": "yes",
+      "evidence": [
+        "No critical findings on user-data endpoints.",
+        "Auth-missing zero on PII paths."
+      ],
+      "mapsTo": [
+        "family:auth-missing",
+        "family:authz",
+        "family:hardcoded-secret"
+      ]
     }
   ]
 }

package/src/posture/compliance-frameworks/eu-ai-act.json

@@ -4,48 +4,99 @@
   "publisher": "European Parliament & Council",
   "license": "EU law (Official Journal)",
   "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
+  "scope": "SELECTIVE SUBSET. 7 obligations drawn from the high-risk-system and GPAI articles where a code signal exists. The Act is far broader; conformity assessment, registration, human oversight and post-market monitoring are organisational and are NOT represented here.",
+  "controlsDigest": "16d15998a686a19b",
+  "controlCount": 7,
   "controls": [
     {
       "id": "Art.9",
       "summary": "Risk management system — continuous, iterative risk identification and mitigation.",
-      "evidence": ["Threat model artifact (.agentic-security/threat-model.{json,md}).", "Continuous scan history present."],
-      "mapsTo": ["module:threat-model-auto", "module:scan-history"]
+      "codeTestable": "partial",
+      "evidence": [
+        "Threat model artifact (.agentic-security/threat-model.{json,md}).",
+        "Continuous scan history present."
+      ],
+      "mapsTo": [
+        "module:threat-model-auto",
+        "module:scan-history"
+      ]
     },
     {
       "id": "Art.10",
       "summary": "Data governance — training/validation data is relevant, representative, and bias-checked.",
-      "evidence": ["No training-data-pii findings.", "DPIA artifact for any PII handling."],
-      "mapsTo": ["family:training-data-pii", "family:pii-exposure"]
+      "codeTestable": "yes",
+      "evidence": [
+        "No training-data-pii findings.",
+        "DPIA artifact for any PII handling."
+      ],
+      "mapsTo": [
+        "family:training-data-pii",
+        "family:pii-exposure"
+      ]
     },
     {
       "id": "Art.11",
       "summary": "Technical documentation — system architecture, components, training procedures documented.",
-      "evidence": ["AIBOM artifact at .agentic-security/aibom.json.", "Threat model + DPIA + compliance-evidence present."],
-      "mapsTo": ["module:aibom", "module:threat-model-auto", "module:compliance-policy"]
+      "codeTestable": "partial",
+      "evidence": [
+        "AIBOM artifact at .agentic-security/aibom.json.",
+        "Threat model + DPIA + compliance-evidence present."
+      ],
+      "mapsTo": [
+        "module:aibom",
+        "module:threat-model-auto",
+        "module:compliance-policy"
+      ]
     },
     {
       "id": "Art.12",
       "summary": "Record-keeping — automatic logging of system events for traceability.",
-      "evidence": ["MCP audit log .agentic-security/mcp-audit.log present.", "Scan history retained."],
-      "mapsTo": ["module:mcp-audit", "module:scan-history"]
+      "codeTestable": "partial",
+      "evidence": [
+        "MCP audit log .agentic-security/mcp-audit.log present.",
+        "Scan history retained."
+      ],
+      "mapsTo": [
+        "module:mcp-audit",
+        "module:scan-history"
+      ]
     },
     {
       "id": "Art.13",
       "summary": "Transparency — instructions for use enable users to interpret the system's output correctly.",
-      "evidence": ["why-fired annotation surfaces detection provenance on every finding."],
-      "mapsTo": ["module:why-fired"]
+      "codeTestable": "partial",
+      "evidence": [
+        "why-fired annotation surfaces detection provenance on every finding."
+      ],
+      "mapsTo": [
+        "module:why-fired"
+      ]
     },
     {
       "id": "Art.14",
       "summary": "Human oversight — system permits humans to override / interrupt.",
-      "evidence": ["Fix application requires confirm:true.", "Bodyguard hook can refuse risky edits."],
-      "mapsTo": ["module:pre-edit-bodyguard", "module:apply-fix"]
+      "codeTestable": "partial",
+      "evidence": [
+        "Fix application requires confirm:true.",
+        "Bodyguard hook can refuse risky edits."
+      ],
+      "mapsTo": [
+        "module:pre-edit-bodyguard",
+        "module:apply-fix"
+      ]
     },
     {
       "id": "Art.15",
       "summary": "Accuracy, robustness, cybersecurity — appropriate level of accuracy and resilience.",
-      "evidence": ["Calibration + held-out evaluation present (.agentic-security/calibration-seed.json).", "OWASP Benchmark regression gate."],
-      "mapsTo": ["module:calibration", "module:holdout-eval"]
+      "codeTestable": "partial",
+      "evidence": [
+        "Calibration + held-out evaluation present (.agentic-security/calibration-seed.json).",
+        "OWASP Benchmark regression gate."
+      ],
+      "mapsTo": [
+        "module:calibration",
+        "module:holdout-eval"
+      ]
     }
   ]
 }