@clear-capabilities/agentic-security-scanner 0.139.1 → 0.141.0

package/src/posture/compliance-frameworks/owasp-llm-top-10.json

@@ -4,66 +4,135 @@
   "publisher": "OWASP Foundation",
   "license": "Creative Commons Attribution-ShareAlike 4.0",
   "url": "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
+  "scope": "FULL TOP-10. All ten categories are present. Each category is a broad class rather than a single testable requirement, so a mapping indicates a detector exists for part of the class, not that the class is fully covered.",
+  "controlsDigest": "0a0351a9536790e4",
+  "controlCount": 10,
   "controls": [
     {
       "id": "LLM01",
       "summary": "Prompt Injection — controls preventing injected instructions from overriding the system prompt.",
-      "evidence": ["Zero open findings in family prompt-injection / llm-app-security.", "Prompt-template integrity check passing."],
-      "mapsTo": ["family:prompt-injection", "family:llm-app-security", "family:prompt-integrity"]
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings in family prompt-injection / llm-app-security.",
+        "Prompt-template integrity check passing."
+      ],
+      "mapsTo": [
+        "family:prompt-injection",
+        "family:llm-app-security",
+        "family:prompt-integrity"
+      ]
     },
     {
       "id": "LLM02",
       "summary": "Insecure Output Handling — LLM output is not directly piped to dangerous sinks (eval/shell/SQL/HTML).",
-      "evidence": ["Zero open findings in subfamily llm-output-untrusted-sink."],
-      "mapsTo": ["family:llm-app-security:llm-output-untrusted-sink"]
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open findings in subfamily llm-output-untrusted-sink."
+      ],
+      "mapsTo": [
+        "family:llm-app-security:llm-output-untrusted-sink"
+      ]
     },
     {
       "id": "LLM03",
       "summary": "Training Data Poisoning — provenance and integrity controls on training/fine-tuning data.",
-      "evidence": ["No streaming-dataset-url findings.", "datasets.load_dataset uses pinned revisions."],
-      "mapsTo": ["family:streaming-dataset-url", "family:hf-datasets-rce"]
+      "codeTestable": "yes",
+      "evidence": [
+        "No streaming-dataset-url findings.",
+        "datasets.load_dataset uses pinned revisions."
+      ],
+      "mapsTo": [
+        "family:streaming-dataset-url",
+        "family:hf-datasets-rce"
+      ]
     },
     {
       "id": "LLM04",
       "summary": "Model Denial of Service — rate-limit / token-cap controls.",
-      "evidence": ["LLM API calls in source carry an explicit max_tokens cap (bodyguard rule no-max-tokens)."],
-      "mapsTo": ["rule:no-max-tokens"]
+      "codeTestable": "no",
+      "evidence": [
+        "LLM API calls in source carry an explicit max_tokens cap (bodyguard rule no-max-tokens)."
+      ],
+      "mapsTo": [
+        "rule:no-max-tokens"
+      ]
     },
     {
       "id": "LLM05",
       "summary": "Supply Chain — model & dataset supply-chain integrity.",
-      "evidence": ["No mlflow-untrusted-uri / model-format / hf-endpoint-override findings.", "Sigstore provenance verification configured if opt-in."],
-      "mapsTo": ["family:mlflow-untrusted-uri", "family:model-format", "family:hf-endpoint-override"]
+      "codeTestable": "yes",
+      "evidence": [
+        "No mlflow-untrusted-uri / model-format / hf-endpoint-override findings.",
+        "Sigstore provenance verification configured if opt-in."
+      ],
+      "mapsTo": [
+        "family:mlflow-untrusted-uri",
+        "family:model-format",
+        "family:hf-endpoint-override"
+      ]
     },
     {
       "id": "LLM06",
       "summary": "Sensitive Information Disclosure — output filters prevent leakage.",
-      "evidence": ["Zero findings in subfamily llm-credential-in-prompt.", "Redact module covers prompt + response."],
-      "mapsTo": ["family:llm-app-security:llm-credential-in-prompt"]
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero findings in subfamily llm-credential-in-prompt.",
+        "Redact module covers prompt + response."
+      ],
+      "mapsTo": [
+        "family:llm-app-security:llm-credential-in-prompt"
+      ]
     },
     {
       "id": "LLM07",
       "summary": "Insecure Plugin / Tool Design — tools the LLM can invoke are narrowly scoped.",
-      "evidence": ["Zero llm-app-security:llm-tool-exec findings.", "Agent tool definitions reviewed for excessive agency."],
-      "mapsTo": ["family:agent-tool-exec", "family:llm-app-security:llm-tool-exec"]
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero llm-app-security:llm-tool-exec findings.",
+        "Agent tool definitions reviewed for excessive agency."
+      ],
+      "mapsTo": [
+        "family:agent-tool-exec",
+        "family:llm-app-security:llm-tool-exec"
+      ]
     },
     {
       "id": "LLM08",
       "summary": "Excessive Agency — agent autonomy is bounded by explicit guards.",
-      "evidence": ["MCP server config limits write-tools to confirm:true + reserved-write-path refusal.", "Apply-fix path requires HMAC-verified scan."],
-      "mapsTo": ["module:mcp-tools", "module:apply-fix"]
+      "codeTestable": "partial",
+      "evidence": [
+        "MCP server config limits write-tools to confirm:true + reserved-write-path refusal.",
+        "Apply-fix path requires HMAC-verified scan."
+      ],
+      "mapsTo": [
+        "module:mcp-tools",
+        "module:apply-fix"
+      ]
     },
     {
       "id": "LLM09",
       "summary": "Overreliance — human review checkpoints exist.",
-      "evidence": ["security-fixer agent has Stop-on-verify-fail loop.", "PreToolUse bodyguard exists."],
-      "mapsTo": ["module:security-fixer", "module:pre-edit-bodyguard"]
+      "codeTestable": "partial",
+      "evidence": [
+        "security-fixer agent has Stop-on-verify-fail loop.",
+        "PreToolUse bodyguard exists."
+      ],
+      "mapsTo": [
+        "module:security-fixer",
+        "module:pre-edit-bodyguard"
+      ]
     },
     {
       "id": "LLM10",
       "summary": "Model Theft — model access controls.",
-      "evidence": ["No private-key-in-frontend or rpc-key-inline findings in client code."],
-      "mapsTo": ["family:private-key-in-frontend", "family:rpc-key-inline"]
+      "codeTestable": "yes",
+      "evidence": [
+        "No private-key-in-frontend or rpc-key-inline findings in client code."
+      ],
+      "mapsTo": [
+        "family:private-key-in-frontend",
+        "family:rpc-key-inline"
+      ]
     }
   ]
 }

package/src/posture/concurrency-checker.js

@@ -106,6 +106,13 @@ function grabBody(text, openBraceIdx) {
   return null;
 }
 
+// Lock names come from a `\w+` capture so they cannot currently carry regex
+// metacharacters, but the guards below interpolate them into a pattern — escape
+// so that stays true if a capture ever widens.
+function escapeRe(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
 function findMissedUnlocks(fn, lang) {
   const out = [];
   const p = PATTERNS[lang];
@@ -128,10 +135,32 @@ function findMissedUnlocks(fn, lang) {
       // Lock+unlock both present, but check that the function has a defer/
       // try-finally guarantee. Go: `defer`; Java/Py: try/finally; otherwise
       // early-return-before-unlock is a risk.
+      //
+      // The guard must accept a QUALIFIED receiver (`defer s.mu.Unlock()`,
+      // `with self.lock:`), not just a bare one. A mutex is usually a struct
+      // field or an instance attribute, so the qualified form is the common
+      // shape in real code — and the acquire patterns already matched it
+      // (`\b(\w+)\.Lock\(\)` captures `mu` from `s.mu.Lock()`). While the two
+      // halves disagreed, correct idiomatic code was the most likely to be
+      // reported: on a 12-entry Go sample this was the bulk of the module's
+      // output.
+      //
+      // It is also matched PER LOCK NAME rather than body-wide. A function
+      // holding two mutexes must not have its second lock cleared just because
+      // the first one is deferred.
+      // The receiver prefix is `[\w$.]*` — a single character class — rather
+      // than the more obvious `(?:[\w$]+\.)*`, which nests a quantifier inside
+      // a quantifier and is exactly the catastrophic-backtracking shape this
+      // project's own CWE-1333 detector flags (it caught this line in the
+      // self-scan). `\b` before the lock name is what keeps the flat form
+      // precise: without it, `[\w$.]*` would happily match `s.not` and let
+      // `defer s.notmu.Unlock()` guard a lock named `mu`.
+      const q = escapeRe(name);
       const guarded =
-        (lang === 'go' && /defer\s+\w+\.Unlock\(\)/.test(fn.body)) ||
+        (lang === 'go' && new RegExp(`defer\\s+[\\w$.]*\\b${q}\\.Unlock\\(\\)`).test(fn.body)) ||
         (lang === 'java' && /try\s*\{[\s\S]*finally\s*\{[\s\S]*\.unlock\(\)/m.test(fn.body)) ||
-        (lang === 'py' && (/with\s+\w+:/.test(fn.body) || /try\s*:[\s\S]*finally\s*:[\s\S]*\.release\(\)/m.test(fn.body)));
+        (lang === 'py' && (new RegExp(`with\\s+[^:\\n]*\\b${q}\\b[^:\\n]*:`).test(fn.body)
+          || /try\s*:[\s\S]*finally\s*:[\s\S]*\.release\(\)/m.test(fn.body)));
       if (!guarded && /\breturn\b/.test(fn.body)) {
         out.push({
           kind: 'unguarded-lock',
@@ -229,7 +258,13 @@ export function scanConcurrency(fileContents) {
             ? `Concurrency: ${fn.name}() acquires ${bug.lock} but no matching unlock`
             : `Concurrency: ${fn.name}() can return without releasing ${bug.lock}`,
           severity: 'medium',
-          family: 'concurrency-bug',
+          // CWE-667 Improper Locking. The findings schema in CLAUDE.md requires a
+          // cwe on every finding, and these carried none — so they arrived in
+          // every CWE-keyed report as null and could never match an advisory
+          // label. Found while auditing the wrong-CWE bucket: 57% of findings
+          // on a Go/Ruby sample had no cwe at all.
+          cwe: 'CWE-667',
+          family: 'concurrency-bug', parser: 'CONCURRENCY',
           confidence: 0.5,
           remediation: bug.remediation || 'Release the lock on every exit path (defer / try-finally / context manager).',
         });
@@ -241,7 +276,8 @@ export function scanConcurrency(fileContents) {
           line: bug.startLine,
           vuln: `Concurrency: fire-and-forget async call in ${fn.name}() — result not awaited`,
           severity: 'low',
-          family: 'concurrency-bug',
+          cwe: 'CWE-703', // Improper Check or Handling of Exceptional Conditions
+          family: 'concurrency-bug', parser: 'CONCURRENCY',
           confidence: 0.4,
           remediation: 'Await the promise / call .get() on the future / use asyncio.gather.',
         });
@@ -255,7 +291,8 @@ export function scanConcurrency(fileContents) {
         line: bug.startLineA,
         vuln: `Concurrency: potential deadlock — ${bug.order}`,
         severity: 'high',
-        family: 'concurrency-bug',
+        cwe: 'CWE-833', // Deadlock
+        family: 'concurrency-bug', parser: 'CONCURRENCY',
         confidence: 0.4,
         remediation: 'Acquire locks in a consistent global order across all call sites.',
       });

package/src/posture/coverage-strength.js

@@ -0,0 +1,182 @@
+// Measured evidence strength for a compliance control (PRD F10.2).
+//
+// THE PROBLEM THIS EXISTS FOR
+// ---------------------------
+// A control mapped to a detector with 5% recall is COVERED in the coverage map
+// and UNCOVERED in reality. The map said "family:sql-injection → checked" and
+// stopped there, so a reader could not tell a control backed by a detector that
+// finds nearly everything from one backed by a detector that finds almost
+// nothing. The PRD calls closing that its highest-integrity change, and this is
+// the closing.
+//
+// THE JOIN
+// --------
+//   control → mapped family
+//           → producing detector        (posture/family-registry.js)
+//           → the CWEs that family carries   (bench/family-producers/OBSERVED.json)
+//           → measured recall for those CWEs (bench/family-producers/RECALL.json)
+//
+// The recall numbers come from bench/independent: advisories mined from public
+// sources, NOT authored here. That matters more than the numbers themselves —
+// a control cannot look well-evidenced because the engine graded its own
+// homework.
+//
+// WHAT "UNMEASURED" MEANS, AND WHY IT IS NOT "FINE"
+// ------------------------------------------------
+// A CWE the independent corpus never exercised has NO recall figure. That is
+// unmeasured, and unmeasured is reported as unmeasured — never silently treated
+// as passing, and never given a default number. Roughly half the observed
+// families are in that state today. Saying so is the honest output; inventing a
+// figure for them would be the failure this module exists to prevent.
+//
+// Every rate is carried as {n, d} and rendered through the caller's formatter,
+// following posture/accuracy-scorecard.js: a percentage must never appear
+// without its denominator, because "50% recall" over two samples is noise.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { producersOf } from './family-registry.js';
+import { resolveFamilyKeys } from './family-resolve.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const BENCH = path.join(HERE, '..', '..', '..', 'bench', 'family-producers');
+
+// Thresholds. Deliberately coarse — the underlying denominators are small, and a
+// finer scale would imply a precision the measurement does not have.
+const WEAK_BELOW = 0.25;
+const PARTIAL_BELOW = 0.60;
+
+// Below this many scored entries a rate is reported but flagged as indicative,
+// mirroring accuracy-scorecard.js's `reliable:false` treatment.
+const RELIABLE_MIN_D = 5;
+
+let _cache = null;
+
+function _load() {
+  if (_cache) return _cache;
+  const read = (f, fallback) => {
+    try { return JSON.parse(fs.readFileSync(path.join(BENCH, f), 'utf8')); }
+    catch { return fallback; }
+  };
+  // A missing artifact must degrade to "unmeasured", never to a default rate —
+  // same reasoning as the unmeasured tier itself.
+  const observed = read('OBSERVED.json', { families: {} });
+  const recall = read('RECALL.json', { byCwe: {} });
+  _cache = { families: observed.families || {}, byCwe: recall.byCwe || {}, population: recall.population || null };
+  return _cache;
+}
+
+/** Reset the memo. Tests only. */
+export function _resetCache() { _cache = null; }
+
+/**
+ * The CWEs a family mapping was observed to carry, most frequent first.
+ *
+ * Resolves the mapping the SAME way the evaluator does — exact, alias, or
+ * `<base>-<rule-slug>` suffix — via the shared resolver. Looking `family` up as
+ * a literal key reported "unmeasured" for every aliased mapping: ASVS V5.1 maps
+ * to `family:sqli`, nothing emits `sqli`, and the real family `sql-injection` IS
+ * measured. That would be a false "no evidence" verdict on a control that has
+ * evidence.
+ */
+export function cwesFor(family) {
+  const { families } = _load();
+  const keys = resolveFamilyKeys(family, Object.keys(families));
+  const counts = new Map();
+  for (const k of keys) {
+    for (const [cwe, n] of Object.entries((families[k] || {}).cwes || {})) {
+      counts.set(cwe, (counts.get(cwe) || 0) + n);
+    }
+  }
+  return [...counts.entries()].sort((a, b) => b[1] - a[1]).map(([c]) => c);
+}
+
+/**
+ * Measured strength of the detector(s) behind `family`.
+ *
+ * Returns { tier, recall:{n,d}|null, cwes, measuredCwes, reliable, producers, reason }.
+ * `tier` ∈ 'measured' | 'partial' | 'weak' | 'unmeasured'.
+ */
+export function strengthOf(family) {
+  const { byCwe } = _load();
+  const cwes = cwesFor(family);
+  const producers = producersOf(family);
+
+  // Aggregate across every CWE this family carries that the independent corpus
+  // actually exercised. Summing {n,d} weights by how much evidence each CWE has,
+  // which is what we want — averaging the percentages would let a 1-of-1 CWE
+  // outvote a 40-of-100 one.
+  let n = 0, d = 0;
+  const measuredCwes = [];
+  for (const c of cwes) {
+    const m = byCwe[c];
+    if (!m || !m.recall || !m.recall.d) continue;
+    n += m.recall.n; d += m.recall.d;
+    measuredCwes.push(c);
+  }
+
+  if (!d) {
+    return {
+      tier: 'unmeasured',
+      recall: null,
+      cwes, measuredCwes: [], reliable: false, producers,
+      reason: cwes.length
+        ? 'no CWE this family carries was exercised by the independent corpus'
+        : 'no CWE observed for this family — nothing to measure against',
+    };
+  }
+
+  const rate = n / d;
+  const tier = rate < WEAK_BELOW ? 'weak' : rate < PARTIAL_BELOW ? 'partial' : 'measured';
+  return {
+    tier,
+    recall: { n, d },
+    cwes, measuredCwes,
+    reliable: d >= RELIABLE_MIN_D,
+    producers,
+    reason: `measured over ${d} independent advisor${d === 1 ? 'y' : 'ies'}`,
+  };
+}
+
+/**
+ * Strength for a control, taken across every family it maps to.
+ *
+ * The WEAKEST backing family wins. A control is only as evidenced as its
+ * flimsiest leg: claiming the average would let a strong mapping hide a
+ * mapping that finds nothing.
+ */
+export function strengthOfControl(control) {
+  const families = (control && Array.isArray(control.mapsTo) ? control.mapsTo : [])
+    .filter(m => typeof m === 'string' && m.startsWith('family:'))
+    .map(m => m.slice('family:'.length).split(':')[0]);
+
+  if (!families.length) return { tier: 'unmeasured', families: [], legs: [], reason: 'control has no family: mapping' };
+
+  const legs = families.map(f => ({ family: f, ...strengthOf(f) }));
+  const ORDER = { unmeasured: 0, weak: 1, partial: 2, measured: 3 };
+  const weakest = legs.reduce((a, b) => (ORDER[b.tier] < ORDER[a.tier] ? b : a));
+  return {
+    tier: weakest.tier,
+    families, legs,
+    reason: `weakest backing family "${weakest.family}": ${weakest.reason}`,
+  };
+}
+
+/**
+ * True when a control should NOT be presented as cleanly evidenced, because the
+ * detector behind it is weak or was never measured. This is the flag the
+ * coverage map carries.
+ */
+export function isPartiallyEvidenced(control) {
+  const s = strengthOfControl(control);
+  return s.tier === 'weak' || s.tier === 'unmeasured';
+}
+
+/** Human-readable, denominator-carrying label for a report. */
+export function formatStrength(s) {
+  if (!s || s.tier === 'unmeasured') return 'unmeasured (no independent evidence)';
+  const { n, d } = s.recall || (s.legs && s.legs.length ? s.legs[0].recall : null) || {};
+  if (n == null) return `${s.tier} (no rate)`;
+  const pct = Math.round((n / d) * 100);
+  return `${s.tier} — recall ${n}/${d} (${pct}%)${s.reliable === false ? ', indicative only' : ''}`;
+}

package/src/posture/epss.js

@@ -38,12 +38,28 @@ function cachePath(cveListKey) {
   return path.join(CACHE_DIR, h + '.json');
 }
 
+// PRD F3.4 — record how old the EPSS data actually is.
+//
+// EPSS scores decay in relevance: a probability computed months ago describes a
+// threat landscape that has moved. Unlike KEV, a stale EPSS score can err in
+// EITHER direction, so the age is reported rather than the value suppressed.
+let _epssMeta = { source: 'not-loaded', ageDays: null, stale: null };
+const EPSS_STALE_AFTER_MS = 7 * 24 * 60 * 60 * 1000;
+export function epssCacheMeta() { return { ..._epssMeta }; }
+
 function readCache(key) {
   const fp = cachePath(key);
   if (!fs.existsSync(fp)) return null;
   try {
     const stat = fs.statSync(fp);
-    if (Date.now() - stat.mtimeMs > TTL_MS) return null;
+    const age = Date.now() - stat.mtimeMs;
+    if (age > TTL_MS) return null;
+    _epssMeta = {
+      source: 'cache',
+      ageDays: Math.floor(age / 86400000),
+      stale: age > EPSS_STALE_AFTER_MS,
+      meaning: 'EPSS is a decaying probability; an old score describes a threat landscape that has moved.',
+    };
     return JSON.parse(fs.readFileSync(fp, 'utf8'));
   } catch { return null; }
 }

package/src/posture/family-registry.js

@@ -0,0 +1,103 @@
+// Producer registry (PRD F10.2) — which detector emits which finding family.
+//
+// WHY THIS EXISTS
+// ---------------
+// Compliance controls map to families (`family:sql-injection`). Answering "is
+// this control backed by a real detector, and how good is that detector?"
+// requires knowing the family vocabulary. Nothing could answer that:
+//
+//   - A textual search cannot. Detectors set `family` positionally
+//     (`_shape(file, line, ruleId, vuln, fam, …)`) or from a rule table
+//     (`family: rule.family`), so grepping `family:` misses them entirely. A
+//     search-derived list was used once to declare four families "unevidenceable";
+//     all four had producers, and 15 working controls were suppressed as a result.
+//   - A corpus sweep cannot. It reports only what some fixture triggered — a
+//     LOWER BOUND. `k8s-pod-security-privileged` was absent from a 116-root sweep
+//     and present in a 331-root one; nothing about the engine changed.
+//
+// So the detector declares, in the file that emits: `export const EMITS = [...]`.
+// Colocation is the point — the rule and its declaration are edited together, and
+// the gate below catches the case where they are not.
+//
+// SCOPE, STATED HONESTLY
+// ----------------------
+// Registration is per-module and incremental. 287 detector modules exist; the
+// ones listed here are registered so far, chosen because they set `family`
+// positionally (invisible to every other method) and back compliance mappings.
+//
+// A module that is registered is held to COMPLETENESS: a scan producing a family
+// it did not declare fails the gate. A module that is not registered is not
+// silently passing — it is absent, and `test/family-registry.test.js` reports the
+// undeclared remainder as a ratchet that must not grow. That is the difference
+// between a gate that expands over time and one that gets switched off in week
+// two for failing on day one.
+import { EMITS as CLOUD_IAM } from '../sast/cloud-iam.js';
+import { EMITS as CRYPTO_PROTOCOL } from '../sast/crypto-protocol.js';
+import { EMITS as DAPP_FRONTEND } from '../sast/dapp-frontend.js';
+import { EMITS as K8S_ADMISSION } from '../sast/k8s-admission.js';
+import { EMITS as ML_SUPPLY_CHAIN } from '../sast/ml-supply-chain.js';
+import { EMITS as WEB3_ADVANCED } from '../sast/web3-advanced.js';
+
+// module path -> declared families. Path is the identity a human greps for.
+export const REGISTERED = Object.freeze({
+  'sast/cloud-iam.js': CLOUD_IAM,
+  'sast/crypto-protocol.js': CRYPTO_PROTOCOL,
+  'sast/dapp-frontend.js': DAPP_FRONTEND,
+  'sast/k8s-admission.js': K8S_ADMISSION,
+  'sast/ml-supply-chain.js': ML_SUPPLY_CHAIN,
+  'sast/web3-advanced.js': WEB3_ADVANCED,
+});
+
+// The `parser` field each registered module stamps on its findings. This is how a
+// finding is attributed back to its module at runtime.
+//
+// NOT every parser identifies a module: `REGEX` alone covers 80 distinct
+// families, and `STRUCTURAL` covers 23. Those are shared labels, so a module
+// using one cannot be registered for completeness until it stamps something
+// specific. Only module-specific parsers appear here, and the gate checks
+// attribution only for these.
+export const PARSER_OF = Object.freeze({
+  'sast/cloud-iam.js': 'CLOUD-IAM',
+  'sast/crypto-protocol.js': 'CRYPTO-PROTO',
+  'sast/dapp-frontend.js': 'DAPP-FRONTEND',
+  'sast/k8s-admission.js': 'K8S-ADM',
+  'sast/ml-supply-chain.js': 'ML-SUPPLY',
+  'sast/web3-advanced.js': 'WEB3-ADV',
+});
+
+/** Every family any registered module declares. */
+export function declaredFamilies() {
+  const out = new Set();
+  for (const list of Object.values(REGISTERED)) for (const f of list) out.add(f);
+  return out;
+}
+
+/** Module paths declaring `family`, or [] if none does. */
+export function producersOf(family) {
+  return Object.entries(REGISTERED)
+    .filter(([, list]) => list.includes(family))
+    .map(([mod]) => mod);
+}
+
+/** The module registered for `parser`, or null when the parser is not module-specific. */
+export function moduleForParser(parser) {
+  const hit = Object.entries(PARSER_OF).find(([, p]) => p === parser);
+  return hit ? hit[0] : null;
+}
+
+/**
+ * Families a registered module emitted but never declared — the drift this whole
+ * mechanism exists to catch. `findings` is any array carrying {family, parser}.
+ */
+export function undeclaredFrom(findings) {
+  const out = new Map(); // module -> Set(family)
+  for (const f of findings || []) {
+    if (!f || !f.family || !f.parser) continue;
+    const mod = moduleForParser(f.parser);
+    if (!mod) continue;                       // parser is not module-specific
+    if (REGISTERED[mod].includes(f.family)) continue;
+    if (!out.has(mod)) out.set(mod, new Set());
+    out.get(mod).add(f.family);
+  }
+  return out;
+}

package/src/posture/family-resolve.js

@@ -0,0 +1,47 @@
+// Shared family-name resolution for compliance mappings.
+//
+// Extracted into its own module to break an import CYCLE: the evaluator
+// (auditor-walkthrough.js) needs the resolver to count findings, and
+// coverage-strength.js needs the SAME resolver to measure detector strength. When
+// the resolver lived in the evaluator and the evaluator imported strength back,
+// ESM handed one side an undefined binding and a defensive try/catch turned that
+// into a silently missing `evidence` field — a wrong answer wearing the costume
+// of a working one.
+//
+// One definition, no cycle, both callers import from here.
+
+export const COMPLIANCE_FAMILY_ALIAS = {
+  // ASVS spells it `sqli`; every detector emits `sql-injection` (or a
+  // language-prefixed variant, which the suffix rule below does NOT cover
+  // because the prefix is on the wrong end).
+  'sqli': ['sql-injection', 'dart-sql-injection', 'laravel-sql-injection'],
+  'auth-missing': ['broken-access-control', 'fastapi-missing-auth', 'springboot-missing-authz', 'laravel-missing-auth', 'quarkus-missing-authz'],
+  'authz': ['broken-access-control', 'idor', 'springboot-missing-authz', 'quarkus-missing-authz'],
+  'k8s-pod-security-privileged': ['k8s-pod-privileged'],
+};
+
+/**
+ * The emitted families a `family:X` mapping resolves to, given the families a
+ * scan actually produced.
+ *
+ * Exported because TWO callers must agree: this file's evaluator (does the
+ * control have open findings?) and posture/coverage-strength.js (how good is the
+ * detector behind it?). When only the evaluator knew the rule, the strength
+ * module reported "unmeasured" for every aliased or suffixed mapping — a false
+ * "no evidence" verdict on controls that are in fact measured, which is the
+ * mirror image of the vacuous-pass bug this file already fixes. One rule, one
+ * definition.
+ *
+ * Resolution is exact match, alias, or `<base>-<rule-slug>` suffix. The `-`
+ * separator is load-bearing: without it `nosql-injection` would satisfy a
+ * `sql-injection` mapping.
+ */
+export function resolveFamilyKeys(fam, availableKeys) {
+  const bases = [fam, ...(COMPLIANCE_FAMILY_ALIAS[fam] || [])];
+  const out = [];
+  for (const key of availableKeys) {
+    if (bases.some(b => key === b || key.startsWith(`${b}-`))) out.push(key);
+  }
+  return out;
+}
+