@clear-capabilities/agentic-security-scanner 0.140.0 → 0.141.0

package/src/posture/accuracy-scorecard.js

@@ -428,6 +428,63 @@ export function renderScorecardMarkdown(m) {
   }
   L.push('Per-file counts are in `docs/scorecard.json`.');
   L.push('');
+  // PRD F12.6 — the honest scorecard publishes the LIMITS too, not only the
+  // rates. Three claims this project makes are only meaningful with their
+  // caveat attached, and each caveat was invisible before this section:
+  //   proof coverage  — "provable" means provable by a JAVASCRIPT-ONLY harness
+  //   calibration     — the confidence surface is currently UNVERIFIED
+  //   compliance      — most controls are backed by weak or unmeasured detectors
+  // Publishing a rate without its ceiling is how a number comes to mean
+  // whatever the reader assumes.
+  if (m.limits) {
+    L.push('## Stated limits — what these capabilities cannot do');
+    L.push('');
+    if (m.limits.proof) {
+      const pc = m.limits.proof;
+      L.push('### Execution proof coverage, with its ceiling');
+      L.push('');
+      L.push('| Bucket | Share of all findings |');
+      L.push('| --- | --- |');
+      L.push(`| Provable (a proof class exists) | ${pc.provable.n}/${pc.total} |`);
+      L.push(`| Declined on purpose, reason stated | ${pc.indeterminate.n}/${pc.total} |`);
+      L.push(`| No proof class yet (backlog) | ${pc.unclassified.n}/${pc.total} |`);
+      L.push(`| **Out of harness scope (not JavaScript)** | **${pc.outOfScope.n}/${pc.total}** |`);
+      L.push('');
+      L.push(`**The ceiling.** The in-process proof harness only loads JavaScript. Of ${pc.total} findings`);
+      L.push(`measured on the CVE corpus, ${pc.reachable.n} are reachable by it at all. Proof coverage is`);
+      L.push(`**${pc.provable.n}/${pc.total}** of ALL findings and **${pc.provable.n}/${pc.reachable.n}** of the reachable ones.`);
+      L.push('Both are given because they differ by a lot, and a reader shown only one will');
+      L.push('draw the wrong conclusion in whichever direction that one flatters.');
+      L.push('');
+      L.push('Adding more proof classes does not move the ceiling. A Python or Java finding is');
+      L.push('not backlog — it is unreachable by this harness at any effort.');
+      L.push('');
+    }
+    if (m.limits.calibration) {
+      L.push('### Confidence calibration');
+      L.push('');
+      L.push(`**${m.limits.calibration}**`);
+      L.push('');
+      L.push('Every finding carries a confidence number. That number is a claim about how');
+      L.push('often the engine is right, and it is only worth what the evidence behind it is');
+      L.push('worth. `calibration-seed.json` is FITTING data, so measuring against it would');
+      L.push('reproduce the error it was fitted to. The release gate fails on this by default;');
+      L.push('a dated waiver is what currently allows a release, and it expires.');
+      L.push('');
+    }
+    if (m.limits.compliance) {
+      const c = m.limits.compliance;
+      L.push('### Compliance control strength');
+      L.push('');
+      L.push(`Of ${c.total} bundled controls, **${c.partiallyEvidenced} are backed by a detector that is weak or was never`);
+      L.push('measured against an independent corpus**, and are flagged `partiallyEvidenced`.');
+      L.push(`A further **${c.notCodeTestable} are organisational or artifact-existence only** and can never`);
+      L.push('read as evidenced by a scanner. A control appearing in a coverage map is not a');
+      L.push('statement that the control is satisfied.');
+      L.push('');
+    }
+  }
+
   const ind = m.committedInputs.independent;
   if (ind && ind.overall) {
     L.push('## Independent evaluation population — the number that matters');

package/src/posture/aibom.js

@@ -201,7 +201,19 @@ export function buildAIBOM(scan, fileContents = {}, meta = {}) {
   return {
     aibomFormat: 'agentic-security AI-BOM',
     version: '1',
-    cyclonedxCompatible: '1.7-ml-bom',
+    // PRD F5.5 — this document is PROPRIETARY and now says so.
+    //
+    // It previously carried `cyclonedxCompatible: '1.7-ml-bom'`, which was an
+    // unverified claim: nothing validated it, and the document has no
+    // `bomFormat`, no `specVersion` and no CycloneDX `components` array, so it
+    // would not have parsed as CycloneDX at all. A consumer reading that field
+    // and feeding this to a CycloneDX tool would have got an error, not a BOM.
+    //
+    // The honest options F5.5 gives are "validate mechanically, or be labelled
+    // proprietary". Both are taken: the field below states the truth, and
+    // `toCycloneDXMLBOM()` emits a REAL ML-BOM that `validateMLBOM()` checks.
+    proprietary: true,
+    cyclonedxMlBom: 'not this document — call toCycloneDXMLBOM() for a CycloneDX 1.6 ML-BOM view',
     generatedAt: meta.startedAt || new Date().toISOString(),
     models,
     promptTemplates,
@@ -286,3 +298,100 @@ export function aibomToMarkdown(aibom) {
 
   return out.join('\n');
 }
+
+
+// ── CycloneDX ML-BOM (PRD F5.5) ────────────────────────────────────────────
+//
+// A real CycloneDX 1.6 document describing the models this scan found, using the
+// ML-BOM shape: `components[].type: 'machine-learning-model'` carrying a
+// `modelCard`. Emitted separately from the proprietary AI-BOM rather than
+// pretending the proprietary one already conforms.
+//
+// The serial number derives from content under --deterministic, for the same
+// reason toCycloneDX's does: an attestation over a BOM is meaningless if the BOM
+// changes on every run.
+import * as _crypto from 'node:crypto';
+import { isDeterministic as _isDet } from './deterministic.js';
+
+function _mlbomSerial(seed) {
+  if (!_isDet()) return `urn:uuid:${_crypto.randomUUID()}`;
+  const h = _crypto.createHash('sha256').update(String(seed)).digest('hex');
+  return `urn:uuid:${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-${((parseInt(h[16], 16) & 0x3) | 0x8).toString(16)}${h.slice(17, 20)}-${h.slice(20, 32)}`;
+}
+
+export function toCycloneDXMLBOM(aibom, meta = {}) {
+  const models = (aibom && aibom.models) || [];
+  const components = models.map((m) => ({
+    type: 'machine-learning-model',
+    'bom-ref': `model:${m.provider || 'unknown'}/${m.name || 'unknown'}${m.version ? `@${m.version}` : ''}`,
+    name: m.name || 'unknown',
+    ...(m.version ? { version: m.version } : {}),
+    modelCard: {
+      modelParameters: {
+        ...(m.provider ? { approach: { type: 'supervised' } } : {}),
+        ...(m.task ? { task: m.task } : {}),
+      },
+      // `considerations` is where CycloneDX expects known risks to live. Pinning
+      // status is a real supply-chain property of a model reference: an unpinned
+      // model can change under you between runs.
+      considerations: {
+        technicalLimitations: m.pinned
+          ? []
+          : ['model reference is not pinned to a version; the served model can change between runs'],
+      },
+    },
+    properties: [
+      ...(m.provider ? [{ name: 'agentic-security:provider', value: String(m.provider) }] : []),
+      ...(m.file ? [{ name: 'agentic-security:declaredIn', value: String(m.file) }] : []),
+      { name: 'agentic-security:pinned', value: String(!!m.pinned) },
+    ],
+  }));
+
+  return {
+    bomFormat: 'CycloneDX',
+    specVersion: '1.6',
+    serialNumber: _mlbomSerial(JSON.stringify(components.map((c) => c['bom-ref']))),
+    version: 1,
+    metadata: {
+      timestamp: meta.startedAt || (aibom && aibom.generatedAt) || new Date().toISOString(),
+      tools: [{ vendor: 'Clear Capabilities', name: 'agentic-security', version: meta.engineVersion || 'dev' }],
+      component: { type: 'application', name: 'scan-target', version: '1.0.0' },
+    },
+    components,
+  };
+}
+
+/**
+ * Mechanical validation of an ML-BOM.
+ *
+ * STRUCTURAL, not full JSON-Schema validation: fetching the official CycloneDX
+ * schema at scan time would break the no-runtime-network rule, and vendoring it
+ * would add a file that silently rots against upstream. So this checks the
+ * required fields and the ML-BOM-specific shape, and SAYS that is what it does —
+ * a check labelled "validates against CycloneDX" that only tests a few keys
+ * would be the same unverified claim this item exists to remove.
+ */
+export function validateMLBOM(doc) {
+  const errors = [];
+  const req = (cond, msg) => { if (!cond) errors.push(msg); };
+
+  req(doc && typeof doc === 'object', 'not an object');
+  if (!doc || typeof doc !== 'object') return { ok: false, errors, checked: 'structural' };
+
+  req(doc.bomFormat === 'CycloneDX', `bomFormat must be "CycloneDX", got ${JSON.stringify(doc.bomFormat)}`);
+  req(/^1\.[4-9]$/.test(String(doc.specVersion || '')), `specVersion must be 1.4-1.9, got ${JSON.stringify(doc.specVersion)}`);
+  req(Number.isInteger(doc.version) && doc.version >= 1, 'version must be a positive integer');
+  req(/^urn:uuid:[0-9a-f-]{36}$/i.test(String(doc.serialNumber || '')), 'serialNumber must be a urn:uuid');
+  req(doc.metadata && typeof doc.metadata === 'object', 'metadata is required');
+  req(Array.isArray(doc.components), 'components must be an array');
+
+  for (const [i, c] of (Array.isArray(doc.components) ? doc.components : []).entries()) {
+    req(typeof c.name === 'string' && c.name, `components[${i}].name is required`);
+    req(typeof c.type === 'string' && c.type, `components[${i}].type is required`);
+    if (c.type === 'machine-learning-model') {
+      req(c.modelCard && typeof c.modelCard === 'object',
+        `components[${i}] is a machine-learning-model but carries no modelCard — that is the whole ML-BOM extension`);
+    }
+  }
+  return { ok: errors.length === 0, errors, checked: 'structural (required fields + ML-BOM component shape), NOT full JSON-Schema validation' };
+}

package/src/posture/auditor-walkthrough.js

@@ -35,6 +35,11 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 
 import { statePath, stateWritesEnabled } from './state-dir.js';
+import { COMPLIANCE_FAMILY_ALIAS, resolveFamilyKeys } from './family-resolve.js';
+import { strengthOfControl as _strengthOfControl } from './coverage-strength.js';
+
+// Re-exported so existing callers/tests keep importing these from here.
+export { COMPLIANCE_FAMILY_ALIAS, resolveFamilyKeys };
 const BUNDLED_DIR = path.join(path.dirname(new URL(import.meta.url).pathname), 'compliance-frameworks');
 function _readJson(fp) {
   try { return JSON.parse(fs.readFileSync(fp, 'utf8')); } catch { return null; }
@@ -118,15 +123,6 @@ export function loadFramework(scanRoot, id) {
 // `k8s-pod-privileged`; `nist-csf-2.json`/`hipaa-security-rule.json` map to
 // the compliance-side spelling `k8s-pod-security-privileged`, which no
 // detector ever emitted.
-export const COMPLIANCE_FAMILY_ALIAS = {
-  // ASVS spells it `sqli`; every detector emits `sql-injection` (or a
-  // language-prefixed variant, which the suffix rule below does NOT cover
-  // because the prefix is on the wrong end).
-  'sqli': ['sql-injection', 'dart-sql-injection', 'laravel-sql-injection'],
-  'auth-missing': ['broken-access-control', 'fastapi-missing-auth', 'springboot-missing-authz', 'laravel-missing-auth', 'quarkus-missing-authz'],
-  'authz': ['broken-access-control', 'idor', 'springboot-missing-authz', 'quarkus-missing-authz'],
-  'k8s-pod-security-privileged': ['k8s-pod-privileged'],
-};
 
 // CMP-1 audit trail: every `family:` string referenced by the bundled
 // compliance-frameworks/*.json files was cross-checked against real
@@ -223,7 +219,19 @@ export function evaluateFramework(scanRoot, fw, scan) {
 
     if (maps.length === 0) {
       obs.push('No automated mapping — requires manual evidence collection.');
-      results.push({ control: c, status, observations: obs });
+      // PRD F10.2: carry the MEASURED strength of the backing detector, so a
+    // control mapped to a detector that finds 3 of 18 independent advisories
+    // cannot read the same as one backed by a detector that finds nearly
+    // everything. Import is lazy so the evaluator keeps working if the bench
+    // artifacts are absent (they degrade to `unmeasured`, never to a default).
+    let evidence = null;
+    try { evidence = _strengthOfControl(c); } catch { /* strength is additive; never block evaluation */ }
+    results.push({
+      control: c,
+      status,
+      observations: obs,
+      ...(evidence ? { evidence, partiallyEvidenced: evidence.tier === 'weak' || evidence.tier === 'unmeasured' } : {}),
+    });
       continue;
     }
 
@@ -268,7 +276,6 @@ export function evaluateFramework(scanRoot, fw, scan) {
           hasUnverifiableMapping = true;
           continue;
         }
-        const aliasFams = COMPLIANCE_FAMILY_ALIAS[fam] || [];
         // Several detectors emit the family as `<family>-<rule-slug>` — the
         // observed vocabulary holds `prompt-injection-http-user-input-in-llm-`,
         // `xpath-injection-query-built-via-string-c` and similar. This lookup
@@ -281,11 +288,8 @@ export function evaluateFramework(scanRoot, fw, scan) {
         // prefix test would let `nosql-injection` satisfy a `sql-injection`
         // mapping, silently merging two different vulnerability classes. A test
         // pins that boundary in the failing direction.
-        const bases = [fam, ...aliasFams];
-        const candidates = [];
-        for (const [key, list] of families) {
-          if (bases.some(b => key === b || key.startsWith(`${b}-`))) candidates.push(...list);
-        }
+        const candidates = resolveFamilyKeys(fam, families.keys())
+          .flatMap(k => families.get(k) || []);
         const scoped = subfam ? candidates.filter(f => !f.subfamily || f.subfamily === subfam) : candidates;
         const open = scoped.filter(f => !f.intentSuppressed && !f.pastDecision && (f.severity === 'critical' || f.severity === 'high'));
         if (open.length) {
@@ -359,13 +363,48 @@ export function evaluateFramework(scanRoot, fw, scan) {
     // any control that already reads 'partial' because of an inherently
     // unverifiable rule: mapping — that precedent (rule: caps at 'partial',
     // never reaching 'present' OR 'absent') is unchanged.
+    // PRD F10.3: a control NIST/the framework rates as not code-testable must
+    // never read as evidenced by this tool. Two shapes were reaching 'present'
+    // that should not have:
+    //
+    //   codeTestable:'no'      — organisational (policy, training, governance).
+    //                            Nothing a scanner observes can satisfy it.
+    //   codeTestable:'partial' — the only mappings are `module:` artifact
+    //                            EXISTENCE checks. "threat-model.json is
+    //                            present" is not evidence that threat modelling
+    //                            happened; it is evidence a file exists.
+    //
+    // Both are capped at 'partial' via the same unverifiable-mapping path a
+    // `rule:` mapping already uses, and the reason is stated in the
+    // observations so a reader is told WHY rather than left to infer it.
+    if (c.codeTestable === 'no') {
+      obs.push('⚠ this control is organisational, not code-testable — a scanner cannot evidence it (codeTestable: no).');
+      hasUnverifiableMapping = true;
+      anySignal = true;
+    } else if (c.codeTestable === 'partial' && maps.every(m => !m.startsWith('family:'))) {
+      obs.push('⚠ backed only by artifact-existence checks — a present file is weaker evidence than a detector finding nothing (codeTestable: partial).');
+      hasUnverifiableMapping = true;
+    }
+
     if (!anySignal) status = 'manual';
     else if (hasUnverifiableMapping) status = 'partial';
     else if (allCleared) status = 'present';
     else if (!anyCleared) status = 'absent';
     else status = 'partial';
 
-    results.push({ control: c, status, observations: obs });
+    // PRD F10.2: carry the MEASURED strength of the backing detector, so a
+    // control mapped to a detector that finds 3 of 18 independent advisories
+    // cannot read the same as one backed by a detector that finds nearly
+    // everything. Import is lazy so the evaluator keeps working if the bench
+    // artifacts are absent (they degrade to `unmeasured`, never to a default).
+    let evidence = null;
+    try { evidence = _strengthOfControl(c); } catch { /* strength is additive; never block evaluation */ }
+    results.push({
+      control: c,
+      status,
+      observations: obs,
+      ...(evidence ? { evidence, partiallyEvidenced: evidence.tier === 'weak' || evidence.tier === 'unmeasured' } : {}),
+    });
   }
   return results;
 }

package/src/posture/compliance-frameworks/ccpa.json

@@ -4,29 +4,56 @@
   "publisher": "California Legislature",
   "license": "California statute (public)",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5",
+  "scope": "SELECTIVE SUBSET. 4 of the CCPA/CPRA obligations, chosen because a code scanner can produce evidence for them. The statute is far broader; the majority of its duties (notice, consumer request handling, contracts, retention policy) are organisational and are NOT represented here. Absence of a control is not a statement of compliance.",
+  "controlsDigest": "ebc1f708c329ab42",
+  "controlCount": 4,
   "controls": [
     {
       "id": "§1798.100",
       "summary": "Consumer right to know — businesses inform consumers about categories of personal info collected.",
-      "evidence": ["DPIA artifact lists every PII field with file:line provenance."],
-      "mapsTo": ["module:privacy-taint"]
+      "codeTestable": "partial",
+      "evidence": [
+        "DPIA artifact lists every PII field with file:line provenance."
+      ],
+      "mapsTo": [
+        "module:privacy-taint"
+      ]
     },
     {
       "id": "§1798.105",
       "summary": "Right to delete — businesses comply with verified deletion requests.",
-      "evidence": ["No data-exposure findings on PII storage paths."]
+      "codeTestable": "no",
+      "evidence": [
+        "No data-exposure findings on PII storage paths."
+      ]
     },
     {
       "id": "§1798.150",
       "summary": "Civil action for security breach affecting personal information.",
-      "evidence": ["Crypto findings cleared on PII handling code.", "TLS pinning checks pass."],
-      "mapsTo": ["family:crypto-weak-cipher", "family:crypto-tls-version", "family:crypto-tls-no-verify"]
+      "codeTestable": "yes",
+      "evidence": [
+        "Crypto findings cleared on PII handling code.",
+        "TLS pinning checks pass."
+      ],
+      "mapsTo": [
+        "family:crypto-weak-cipher",
+        "family:crypto-tls-version",
+        "family:crypto-tls-no-verify"
+      ]
     },
     {
       "id": "§1798.81.5",
       "summary": "Reasonable security procedures and practices.",
-      "evidence": ["No critical findings on user-data endpoints.", "Auth-missing zero on PII paths."],
-      "mapsTo": ["family:auth-missing", "family:authz", "family:hardcoded-secret"]
+      "codeTestable": "yes",
+      "evidence": [
+        "No critical findings on user-data endpoints.",
+        "Auth-missing zero on PII paths."
+      ],
+      "mapsTo": [
+        "family:auth-missing",
+        "family:authz",
+        "family:hardcoded-secret"
+      ]
     }
   ]
 }

package/src/posture/compliance-frameworks/eu-ai-act.json

@@ -4,48 +4,99 @@
   "publisher": "European Parliament & Council",
   "license": "EU law (Official Journal)",
   "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
+  "scope": "SELECTIVE SUBSET. 7 obligations drawn from the high-risk-system and GPAI articles where a code signal exists. The Act is far broader; conformity assessment, registration, human oversight and post-market monitoring are organisational and are NOT represented here.",
+  "controlsDigest": "16d15998a686a19b",
+  "controlCount": 7,
   "controls": [
     {
       "id": "Art.9",
       "summary": "Risk management system — continuous, iterative risk identification and mitigation.",
-      "evidence": ["Threat model artifact (.agentic-security/threat-model.{json,md}).", "Continuous scan history present."],
-      "mapsTo": ["module:threat-model-auto", "module:scan-history"]
+      "codeTestable": "partial",
+      "evidence": [
+        "Threat model artifact (.agentic-security/threat-model.{json,md}).",
+        "Continuous scan history present."
+      ],
+      "mapsTo": [
+        "module:threat-model-auto",
+        "module:scan-history"
+      ]
     },
     {
       "id": "Art.10",
       "summary": "Data governance — training/validation data is relevant, representative, and bias-checked.",
-      "evidence": ["No training-data-pii findings.", "DPIA artifact for any PII handling."],
-      "mapsTo": ["family:training-data-pii", "family:pii-exposure"]
+      "codeTestable": "yes",
+      "evidence": [
+        "No training-data-pii findings.",
+        "DPIA artifact for any PII handling."
+      ],
+      "mapsTo": [
+        "family:training-data-pii",
+        "family:pii-exposure"
+      ]
     },
     {
       "id": "Art.11",
       "summary": "Technical documentation — system architecture, components, training procedures documented.",
-      "evidence": ["AIBOM artifact at .agentic-security/aibom.json.", "Threat model + DPIA + compliance-evidence present."],
-      "mapsTo": ["module:aibom", "module:threat-model-auto", "module:compliance-policy"]
+      "codeTestable": "partial",
+      "evidence": [
+        "AIBOM artifact at .agentic-security/aibom.json.",
+        "Threat model + DPIA + compliance-evidence present."
+      ],
+      "mapsTo": [
+        "module:aibom",
+        "module:threat-model-auto",
+        "module:compliance-policy"
+      ]
     },
     {
       "id": "Art.12",
       "summary": "Record-keeping — automatic logging of system events for traceability.",
-      "evidence": ["MCP audit log .agentic-security/mcp-audit.log present.", "Scan history retained."],
-      "mapsTo": ["module:mcp-audit", "module:scan-history"]
+      "codeTestable": "partial",
+      "evidence": [
+        "MCP audit log .agentic-security/mcp-audit.log present.",
+        "Scan history retained."
+      ],
+      "mapsTo": [
+        "module:mcp-audit",
+        "module:scan-history"
+      ]
     },
     {
       "id": "Art.13",
       "summary": "Transparency — instructions for use enable users to interpret the system's output correctly.",
-      "evidence": ["why-fired annotation surfaces detection provenance on every finding."],
-      "mapsTo": ["module:why-fired"]
+      "codeTestable": "partial",
+      "evidence": [
+        "why-fired annotation surfaces detection provenance on every finding."
+      ],
+      "mapsTo": [
+        "module:why-fired"
+      ]
     },
     {
       "id": "Art.14",
       "summary": "Human oversight — system permits humans to override / interrupt.",
-      "evidence": ["Fix application requires confirm:true.", "Bodyguard hook can refuse risky edits."],
-      "mapsTo": ["module:pre-edit-bodyguard", "module:apply-fix"]
+      "codeTestable": "partial",
+      "evidence": [
+        "Fix application requires confirm:true.",
+        "Bodyguard hook can refuse risky edits."
+      ],
+      "mapsTo": [
+        "module:pre-edit-bodyguard",
+        "module:apply-fix"
+      ]
     },
     {
       "id": "Art.15",
       "summary": "Accuracy, robustness, cybersecurity — appropriate level of accuracy and resilience.",
-      "evidence": ["Calibration + held-out evaluation present (.agentic-security/calibration-seed.json).", "OWASP Benchmark regression gate."],
-      "mapsTo": ["module:calibration", "module:holdout-eval"]
+      "codeTestable": "partial",
+      "evidence": [
+        "Calibration + held-out evaluation present (.agentic-security/calibration-seed.json).",
+        "OWASP Benchmark regression gate."
+      ],
+      "mapsTo": [
+        "module:calibration",
+        "module:holdout-eval"
+      ]
     }
   ]
 }

package/src/posture/compliance-frameworks/gdpr.json

@@ -4,42 +4,86 @@
   "publisher": "European Parliament & Council",
   "license": "EU law (Official Journal)",
   "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
+  "scope": "SELECTIVE SUBSET. 6 articles where a code scanner can produce evidence (security of processing, data minimisation, DPIA inputs). GDPR has 99 articles; lawful basis, data-subject rights, transfers and records of processing are organisational and are NOT represented here.",
+  "controlsDigest": "749f9dad2b5657cb",
+  "controlCount": 6,
   "controls": [
     {
       "id": "Art.5",
       "summary": "Principles relating to processing of personal data (lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, accountability).",
-      "evidence": ["DPIA artifact at .agentic-security/dpia.md.", "PII fields enumerated by the privacy-taint module."],
-      "mapsTo": ["family:pii-exposure", "module:privacy-taint"]
+      "codeTestable": "yes",
+      "evidence": [
+        "DPIA artifact at .agentic-security/dpia.md.",
+        "PII fields enumerated by the privacy-taint module."
+      ],
+      "mapsTo": [
+        "family:pii-exposure",
+        "module:privacy-taint"
+      ]
     },
     {
       "id": "Art.25",
       "summary": "Data protection by design and by default.",
-      "evidence": ["Threat model produced before code.", "PII annotation runs at scan time, not as an afterthought."],
-      "mapsTo": ["module:threat-model-auto", "module:privacy-taint"]
+      "codeTestable": "partial",
+      "evidence": [
+        "Threat model produced before code.",
+        "PII annotation runs at scan time, not as an afterthought."
+      ],
+      "mapsTo": [
+        "module:threat-model-auto",
+        "module:privacy-taint"
+      ]
     },
     {
       "id": "Art.30",
       "summary": "Records of processing activities — controller maintains a register.",
-      "evidence": ["DPIA + privacy-taint annotations cover each PII field with file:line provenance."],
-      "mapsTo": ["module:privacy-taint"]
+      "codeTestable": "partial",
+      "evidence": [
+        "DPIA + privacy-taint annotations cover each PII field with file:line provenance."
+      ],
+      "mapsTo": [
+        "module:privacy-taint"
+      ]
     },
     {
       "id": "Art.32",
       "summary": "Security of processing — appropriate technical and organizational measures.",
-      "evidence": ["Zero open critical crypto findings.", "Auth-missing findings zero on user-data endpoints.", "TLS pinning checks pass."],
-      "mapsTo": ["family:crypto-weak-cipher", "family:crypto-tls-version", "family:crypto-tls-no-verify", "family:auth-missing"]
+      "codeTestable": "yes",
+      "evidence": [
+        "Zero open critical crypto findings.",
+        "Auth-missing findings zero on user-data endpoints.",
+        "TLS pinning checks pass."
+      ],
+      "mapsTo": [
+        "family:crypto-weak-cipher",
+        "family:crypto-tls-version",
+        "family:crypto-tls-no-verify",
+        "family:auth-missing"
+      ]
     },
     {
       "id": "Art.33",
       "summary": "Notification of personal data breach to the supervisory authority within 72 hours.",
-      "evidence": ["Fix history retained.", "Audit log preserves the breach-window evidence."],
-      "mapsTo": ["module:fix-history", "module:mcp-audit"]
+      "codeTestable": "partial",
+      "evidence": [
+        "Fix history retained.",
+        "Audit log preserves the breach-window evidence."
+      ],
+      "mapsTo": [
+        "module:fix-history",
+        "module:mcp-audit"
+      ]
     },
     {
       "id": "Art.35",
       "summary": "Data protection impact assessment (DPIA) for high-risk processing.",
-      "evidence": ["DPIA artifact present at .agentic-security/dpia.md."],
-      "mapsTo": ["module:privacy-taint:emitDpiaArtifact"]
+      "codeTestable": "partial",
+      "evidence": [
+        "DPIA artifact present at .agentic-security/dpia.md."
+      ],
+      "mapsTo": [
+        "module:privacy-taint:emitDpiaArtifact"
+      ]
     }
   ]
 }