@clear-capabilities/agentic-security-scanner 0.143.0 → 0.145.0

package/src/posture/fix-verify.js

@@ -38,7 +38,15 @@ export async function verifyPatch({
   const fileContents = { ...files };
   let scan;
   try {
-    scan = await runFullScan({ fileContents, depFileContents, scanRoot }, () => {});
+    // `provenance:false` is REQUIRED here, not an optimisation. This scan is
+    // deliberately scoped to just the patched file(s), so its finding set is a
+    // tiny subset of the project's. updateLifecycle marks every open stableId
+    // NOT in the set it is handed as `remediated` — so a single fix
+    // verification (every /fix, apply_fix, and autopilot iteration runs one)
+    // would mass-mark the rest of the project as remediated, then
+    // `reintroduced` on the next real scan. The patched content is also not
+    // committed, so there is no history to resolve provenance against anyway.
+    scan = await runFullScan({ fileContents, depFileContents, scanRoot, provenance: false }, () => {});
   } catch (e) {
     return { ok: false, reason: 'rescan-failed', error: e.message };
   }
@@ -187,12 +195,6 @@ export async function verifyFix({
   // and on the result so a caller cannot mistake it for a verified patch.
   const _testedPrePatch = !tests.skipped && _candidateDiffersFromDisk(scanRoot, files);
   const testsOk = tests.skipped ? true : tests.passed === true;
-  let honesty = null;
-  if (fixMeta && typeof fixMeta === 'object') {
-    try { honesty = gateFixOutput(fixMeta); } catch { honesty = null; }
-  }
-  _lap('honesty');
-
   // R5 — the PoC leg. Re-run the finding's proof-of-concept against the
   // CANDIDATE patch inside R1's sandbox. A patch that still lets the PoC
   // demonstrate the predicted effect has not fixed anything, however green the
@@ -204,6 +206,11 @@ export async function verifyFix({
   // to run, or a sandbox that could not start, is recorded as `inconclusive`
   // and left out of the verdict entirely. Treating "could not prove it" as
   // "fixed" is exactly the false confidence this leg exists to prevent.
+  //
+  // Computed BEFORE the honesty gate (FR-308): a still-exploitable PoC is
+  // MECHANICAL evidence, not a self-report, and gateFixOutput cross-checks a
+  // self-reported FULL tier against it below — the ordering matters, not
+  // just the value.
   let pocLeg = { status: 'not-requested', reason: null, tier: null };
   if (poc?.code) {
     try {
@@ -222,7 +229,54 @@ export async function verifyFix({
   _lap('poc');
   const pocOk = pocLeg.status !== 'still-exploitable';
 
+  // FR-308: "a mitigation or workaround cannot be represented as a full
+  // fix" — gateFixOutput's tier/residual check is a pure self-consistency
+  // check (fixMeta.signals is agent-self-reported; see fix-honesty-gate.js's
+  // header for why nothing there is server-computable). pocLeg IS
+  // server-computable — a real execution result, not a claim — so it is
+  // passed through as the one MECHANICAL cross-check available: a
+  // self-reported FULL tier is refuted, not just internally inconsistent,
+  // when the PoC still demonstrates the vulnerability against the patch.
+  // D-0024: `fixMeta` is a shared envelope — FR-307/FR-1002's `approval`
+  // key lives alongside FR-308's completeness self-report (`residual`/
+  // `verdict`/`evidence`/`signals`). Gating on mere object-truthiness meant
+  // a caller supplying ONLY `approval` (a real, common shape once the CLI's
+  // --approved-by flag and the MCP schema fix made that reachable) got
+  // silently gated on an UNRELATED FR-308 self-consistency check it never
+  // engaged with — computeFixTier(undefined) defaults to MITIGATION, which
+  // then demands a `residual` nobody was ever asked to supply, blocking an
+  // otherwise-genuine, approved fix for a reason that has nothing to do
+  // with completeness honesty. Scope the gate to fixMeta shapes that
+  // actually make a completeness-adjacent claim.
+  const hasHonestyClaim = fixMeta && typeof fixMeta === 'object' &&
+    (fixMeta.residual !== undefined || fixMeta.verdict !== undefined ||
+     fixMeta.evidence !== undefined || fixMeta.signals !== undefined);
+  let honesty = null;
+  if (hasHonestyClaim) {
+    try { honesty = gateFixOutput(fixMeta, { pocLeg }); } catch { honesty = null; }
+  }
+  _lap('honesty');
+
   const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && pocOk && (honesty ? honesty.ok : true);
+
+  // FR-305 (assurance-hardening PRD): `ok` alone conflates "every leg
+  // genuinely ran and passed" with "passed, but a required leg was skipped
+  // or unavailable" — `lint.ok`/`testsOk` are both true in the skipped case
+  // by design (this codebase does not fail-closed just because a repo has
+  // no linter or no detected test runner), so a caller checking only `ok`
+  // cannot tell the difference. `lint.skipped` is only ever true when a
+  // linter WAS configured but its binary could not be run (missing config
+  // entirely returns `runner: 'none'` with no `skipped` field at all — that
+  // is a genuine N/A, nothing was required, not a degradation). `verifiedFull`
+  // is the honest label: true only when nothing that WAS required was
+  // skipped. A caller must never present `ok: true, verifiedFull: false` as
+  // "fully verified" — `degradedLegs` names exactly what was skipped so a
+  // report can say so plainly instead of a bare pass.
+  const degradedLegs = [];
+  if (lint.skipped) degradedLegs.push(`lint: ${lint.runner} not installed`);
+  if (tests.skipped) degradedLegs.push(`tests: skipped (${tests.reason})`);
+  const verifiedFull = ok && degradedLegs.length === 0;
+
   const durations = { ...stages, totalMs: Date.now() - t0 };
   const summary = [
     `re-scan: ${rescan.ok ? 'PASS' : 'FAIL — ' + rescan.reason}`,
@@ -244,6 +298,8 @@ export async function verifyFix({
       : pocLeg.status === 'still-exploitable' ? `poc:     FAIL — the proof-of-concept still demonstrates the vulnerability against the patch`
       : pocLeg.status === 'no-longer-proven' ? 'poc:     PASS (ran against the patch and no longer demonstrates the vulnerability)'
       : `poc:     inconclusive — not counted either way (${pocLeg.reason || 'no detail reported'})`,
+    // FR-305: never let a degraded pass read the same as a full one.
+    ok && !verifiedFull ? `NOTE:    PASSED, but NOT fully verified — ${degradedLegs.join('; ')}` : null,
   ].filter(Boolean).join('\n');
   // Persist the attempt so the distribution can be reported from real runs.
   // `testsRan` is the load-bearing field: it is what keeps "verified with no
@@ -256,6 +312,7 @@ export async function verifyFix({
       at: new Date().toISOString(),
       stableId: originalFindingStableId || null,
       ok,
+      verifiedFull,
       testsRan: !tests.skipped,
       testsPassed: tests.skipped ? null : tests.passed === true,
       testedPrePatch: _testedPrePatch,
@@ -268,5 +325,5 @@ export async function verifyFix({
     });
   }
 
-  return { ok, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
+  return { ok, verifiedFull, degradedLegs, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
 }

package/src/posture/flow-narration.js

@@ -13,6 +13,8 @@
 //
 // Fail-closed: any LLM error → template fallback, never a missing field.
 
+import { evaluateEgress } from '../egress/policy.js';
+
 const TEMPLATES = {
   'sql-injection': (f) =>
     `An unauthenticated attacker sends a crafted request containing UNION-style SQL syntax in the ${f.source?.variable || 'tainted'} field. The server's database driver executes the injected query verbatim, returning rows from any table the connection has read access to. Typical impact: full table dump of users (emails, password hashes), bypass of authentication via boolean-blind exfiltration. If the DB role has write privileges, the attacker can also INSERT/UPDATE arbitrary rows. Recovery cost: incident response, customer notification, password reset, regulatory reporting if PII leaked.`,
@@ -60,9 +62,12 @@ function _renderTemplate(f) {
 
 // Optional LLM call. Disabled by default; opt-in via env. Falls back to the
 // template on any error.
-async function _renderLlm(f) {
+async function _renderLlm(f, scanRoot) {
   const endpoint = process.env.AGENTIC_SECURITY_LLM_ENDPOINT;
   if (!endpoint) return null;
+  // FR-601: evaluated before the prompt below is built.
+  const egressDecision = evaluateEgress({ scanRoot, purpose: 'flow-narration', endpoint });
+  if (!egressDecision.allowed) return null;
   const apiKey = process.env.AGENTIC_SECURITY_LLM_API_KEY;
   const headers = { 'Content-Type': 'application/json' };
   if (apiKey) headers['Authorization'] = `Bearer ${apiKey}`;
@@ -101,7 +106,7 @@ export async function annotateNarration(findings, opts = {}) {
       f.narration = null;
       continue;
     }
-    let text = useLlm ? await _renderLlm(f) : null;
+    let text = useLlm ? await _renderLlm(f, opts.scanRoot) : null;
     if (!text) text = _renderTemplate(f);
     f.narration = text;
   }

package/src/posture/git-history.js

@@ -19,14 +19,19 @@
 import * as cp from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
 
 const MAX_BLAME_PER_SCAN = 500;
 const SUBPROC_TIMEOUT_MS = 1500;
 const PROMPT_MARKER_RE = /(?:^|\n)(?:Prompt|User asked|Original request|Co-Authored-By:\s*Claude)/i;
 
+// `scanRoot` is the scanned project's repository, not this project's own
+// trusted checkout — every call below is hardened per FR-PROV-024 / the
+// second Finding Provenance PRD audit (same exposure class as
+// provenance/git-evidence.js's `_run`).
 function _isGitRepo(scanRoot) {
   try {
-    cp.execFileSync('git', ['rev-parse', '--git-dir'], { cwd: scanRoot, stdio: 'ignore', timeout: SUBPROC_TIMEOUT_MS });
+    cp.execFileSync('git', hardenGitArgs(['rev-parse', '--git-dir']), { cwd: scanRoot, stdio: 'ignore', timeout: SUBPROC_TIMEOUT_MS, env: hardenGitEnv() });
     return true;
   } catch { return false; }
 }
@@ -36,10 +41,13 @@ function _blame(scanRoot, file, line) {
   const rel = path.isAbsolute(file) ? path.relative(scanRoot, file) : file;
   if (rel.startsWith('..')) return null;
   try {
+    // `--no-textconv`: VERIFIED exploitable without it — `git blame`
+    // applies a hostile `.gitattributes` textconv driver by default in
+    // current git, same as provenance/git-evidence.js's blameLine.
     const stdout = cp.execFileSync(
       'git',
-      ['blame', '-L', `${line},${line}`, '--porcelain', '--', rel],
-      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'] },
+      hardenGitArgs(['blame', '-L', `${line},${line}`, '--porcelain', '--no-textconv', '--', rel]),
+      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv() },
     );
     return _parsePorcelain(stdout);
   } catch { return null; }
@@ -66,8 +74,8 @@ function _parsePorcelain(out) {
 function _fullMessage(scanRoot, sha) {
   try {
     return cp.execFileSync(
-      'git', ['show', '-s', '--format=%B', sha],
-      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'] },
+      'git', hardenGitArgs(['show', '-s', '--no-textconv', '--format=%B', sha]),
+      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv() },
     );
   } catch { return ''; }
 }

package/src/posture/legal-hold.js

@@ -0,0 +1,140 @@
+// FR-707 (assurance-hardening PRD): "Support legal hold and policy-
+// authorized retention exceptions | Legal hold is identity-bound, reasoned,
+// time-bounded where applicable, and auditable."
+//
+// A third instance of the recurring {owner, reason, expires_at} exception
+// shape this codebase already uses twice — `posture/suppressions.js`'s
+// pro-tier exception (scoped to a FINDING) and `posture/compliance-policy.js`'s
+// structured `not-applicable` (scoped to a COMPLIANCE CONTROL). Per D-0025,
+// these are deliberately distinct mechanisms serving different subjects, not
+// one shared module — this file is the third subject: a STATE ARTIFACT.
+//
+// Field naming matches the existing two schemas' snake_case convention
+// (`owner`, `reason`, `expires_at`) rather than inventing a fourth style.
+//
+//   identity-bound   -> `owner` (required, who placed the hold and is
+//                        accountable for lifting it)
+//   reasoned         -> `reason` (required — "we might need this later" is
+//                        not a reason; same discipline suppressions.js
+//                        already enforces for its own exceptions)
+//   time-bounded
+//     where applicable -> `expires_at` is OPTIONAL: a null/absent value is
+//                        an INDEFINITE hold, which the acceptance
+//                        criterion's own "where applicable" phrase
+//                        explicitly allows (a genuine legal matter may have
+//                        no known end date) — an ISO date value behaves
+//                        exactly like FR-506/FR-1004's own expiring
+//                        exceptions: once past, the hold is no longer
+//                        active and the artifact is exposed to its normal
+//                        retention TTL again.
+//   auditable        -> persisted as a single JSON array under
+//                        `.agentic-security/legal-holds.json` (itself
+//                        registered as operator-config — an operator/legal
+//                        team's own input, never scanner-written from scan
+//                        results), readable via `listLegalHolds`.
+//
+// Consulted from TWO places, not one: `retention-policy.js#findExpiredArtifacts`
+// (defense in depth for any caller reaching it directly) AND `cmdReset`
+// itself for its PLAIN (non-`--expired`) path, which deletes every
+// registered 'generated' artifact unconditionally and would otherwise blow
+// through a hold that only gated TTL expiry.
+
+import * as fs from 'node:fs';
+import { statePath, safeWriteState } from './state-dir.js';
+import { isRegisteredArtifact } from './artifact-registry.js';
+
+export const LEGAL_HOLD_FILE = 'legal-holds.json';
+
+function _loadRaw(scanRoot) {
+  let fp;
+  try { fp = statePath(scanRoot, LEGAL_HOLD_FILE); } catch { return []; }
+  let raw;
+  try { raw = fs.readFileSync(fp, 'utf8'); } catch { return []; }
+  try {
+    const doc = JSON.parse(raw);
+    return Array.isArray(doc) ? doc : [];
+  } catch { return []; }
+}
+
+/**
+ * All legal holds ever recorded for this project, malformed entries
+ * dropped rather than throwing. Never filters by expiry — see
+ * `isUnderHold`/`listLegalHolds` for that.
+ */
+export function loadLegalHolds(scanRoot) {
+  return _loadRaw(scanRoot).filter(h => h && typeof h === 'object' && typeof h.artifact === 'string' && typeof h.owner === 'string' && typeof h.reason === 'string');
+}
+
+/**
+ * Is `artifactName` currently protected by an active (non-expired) hold?
+ * Returns the matching hold record, or null. Multiple holds on the same
+ * artifact are permitted (e.g. two independent legal matters); the first
+ * still-active one found is returned.
+ */
+export function isUnderHold(artifactName, holds, now = Date.now()) {
+  for (const h of holds) {
+    if (h.artifact !== artifactName) continue;
+    if (!h.expires_at) return h; // indefinite hold — always active
+    const t = Date.parse(h.expires_at);
+    if (!Number.isFinite(t) || t >= now) return h;
+  }
+  return null;
+}
+
+/**
+ * Active (non-expired) holds only, unless `includeExpired`. For
+ * `legal-hold list` / auditing.
+ */
+export function listLegalHolds(scanRoot, { includeExpired = false, now = Date.now() } = {}) {
+  const holds = loadLegalHolds(scanRoot);
+  if (includeExpired) return holds;
+  return holds.filter(h => {
+    if (!h.expires_at) return true;
+    const t = Date.parse(h.expires_at);
+    return !Number.isFinite(t) || t >= now;
+  });
+}
+
+/**
+ * Add a legal hold. Validates identity-bound + reasoned up front (both
+ * required, non-empty) and that `expires_at`, if given, is a parseable
+ * date in the future — an already-expired hold would be a hold that
+ * protects nothing, which is never a legitimate request. `artifact` must
+ * name a real registered artifact (artifact-registry.js) — a hold on an
+ * unrecognised name can never protect anything and almost always means a
+ * typo. Returns `{ok:true, hold}` or `{ok:false, reason}`; never throws.
+ */
+export function addLegalHold(scanRoot, { artifact, owner, reason, expires_at } = {}) {
+  if (!artifact || typeof artifact !== 'string') return { ok: false, reason: '--artifact is required' };
+  if (!isRegisteredArtifact(artifact)) return { ok: false, reason: `"${artifact}" is not a registered state artifact` };
+  if (!owner || typeof owner !== 'string') return { ok: false, reason: '--owner is required (identity-bound)' };
+  if (!reason || typeof reason !== 'string') return { ok: false, reason: '--reason is required (reasoned)' };
+  if (expires_at) {
+    const t = Date.parse(expires_at);
+    if (!Number.isFinite(t)) return { ok: false, reason: 'expires_at must be a parseable date' };
+    if (t < Date.now()) return { ok: false, reason: 'expires_at is in the past — a hold that already expired protects nothing' };
+  }
+  const hold = { artifact, owner, reason, expires_at: expires_at || null, created_at: new Date().toISOString() };
+  const holds = _loadRaw(scanRoot);
+  holds.push(hold);
+  const fp = statePath(scanRoot, LEGAL_HOLD_FILE);
+  if (!safeWriteState(fp, JSON.stringify(holds, null, 2) + '\n')) {
+    return { ok: false, reason: 'state writes are disabled (--no-state) or this is not a safe state directory' };
+  }
+  return { ok: true, hold };
+}
+
+/**
+ * Remove every hold on `artifact` (lifting a hold, not letting it expire).
+ * Returns the number removed. A no-op (0) if none existed — never an error.
+ */
+export function removeLegalHold(scanRoot, artifact) {
+  const holds = _loadRaw(scanRoot);
+  const remaining = holds.filter(h => !(h && h.artifact === artifact));
+  const removedCount = holds.length - remaining.length;
+  if (removedCount > 0) {
+    const fp = statePath(scanRoot, LEGAL_HOLD_FILE);
+    safeWriteState(fp, JSON.stringify(remaining, null, 2) + '\n');
+  }
+  return removedCount;
+}

package/src/posture/llm-redteam.js

@@ -13,6 +13,7 @@
 // strategies (encoding/role-play/authority/etc.), severity-graded report.
 
 import { RED_TEAM_PROMPTS, ATTACK_STRATEGIES, PLUGIN_SEVERITY, categorizePrompts, pluginCoverage } from './llm-redteam-prompts.js';
+import { evaluateEgress } from '../egress/policy.js';
 
 // ─── STATIC mode ─────────────────────────────────────────────────────────
 // Scan the repo for prompt files / system-prompt strings and check whether
@@ -173,8 +174,16 @@ function judgeResponse(response, expectedRejection) {
  *  opts: { endpoint, apiKey?, categories?, strategies?, concurrency? }
  *  Returns { results: [...], summary: {...} } */
 export async function runActiveRedteam(opts = {}) {
-  const { endpoint, apiKey, categories, strategies, concurrency = 4 } = opts;
+  const { endpoint, apiKey, categories, strategies, concurrency = 4, scanRoot } = opts;
   if (!endpoint) throw new Error('endpoint URL required');
+  // FR-601: one decision for the whole batch (same endpoint for every
+  // prompt) — evaluated before any prompt in the corpus is sent, not
+  // per-prompt, since a policy verdict on an endpoint does not vary by
+  // which static red-team prompt is about to be sent to it.
+  const egressDecision = evaluateEgress({ scanRoot, purpose: 'llm-redteam', endpoint });
+  if (!egressDecision.allowed) {
+    throw new Error(`egress policy denied this call: ${egressDecision.reason}`);
+  }
 
   let prompts = RED_TEAM_PROMPTS;
   if (Array.isArray(categories) && categories.length) {

package/src/posture/material-change.js

@@ -11,6 +11,8 @@
 // or the command runner) collects the unified diff and feeds hunks into classifyHunk.
 
 import * as cp from 'node:child_process';
+import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
+import { loadPrivacyTaxonomy } from '../dataflow/privacy-taxonomy.js';
 
 // Patterns that fire on the deletion side (auth/check removed).
 const DEL_PATTERNS = [
@@ -26,6 +28,21 @@ const DEL_PATTERNS = [
     kind: 'security-middleware-removed', sev: 'medium', evidence: 'Security middleware removed' },
 ];
 
+// FR-307: a new/modified PII/PHI-shaped field is one of the named
+// high-impact categories ("PII" — see HIGH_IMPACT_CATEGORY_OF_KIND below).
+// Reuses dataflow/privacy-taxonomy.js's FR-402 field-name vocabulary
+// (built-in defaults only — this is a coarse architectural-risk signal,
+// not the authoritative privacy classification egress/redact.js and
+// dataflow/privacy-taint.js already own) rather than inventing a second,
+// parallel PII field-name list that could drift from the first.
+const _PII_FIELD_NAMES = [
+  ...(loadPrivacyTaxonomy(null).taxonomy.PII?.patterns || []),
+  ...(loadPrivacyTaxonomy(null).taxonomy.PHI?.patterns || []),
+];
+const PII_FIELD_RE = _PII_FIELD_NAMES.length
+  ? new RegExp('(?:' + _PII_FIELD_NAMES.join('|') + ')\\s*[:=]', 'i')
+  : /(?!)/; // never matches — degrades safely if the taxonomy import ever returns nothing
+
 // Patterns that fire on the addition side (new attack surface introduced).
 const ADD_PATTERNS = [
   { re: /\b(?:app|router)\s*\.\s*(?:get|post|put|patch|delete|all)\s*\(\s*['"][^'"]+['"]/,
@@ -56,8 +73,38 @@ const ADD_PATTERNS = [
     kind: 'pipeline-floating-tag', sev: 'medium', evidence: 'GitHub Actions step pinned to floating tag' },
   { re: /\bprivileged\s*:\s*true\b/i,
     kind: 'new-iac-privilege', sev: 'high', evidence: 'Container/pod marked privileged' },
+  // FR-307: crypto, PII, and schema — the three named high-impact
+  // categories the pre-existing kind taxonomy above did not yet cover.
+  { re: /\b(?:md5|sha1)\s*\(/i,
+    kind: 'weak-crypto-added', sev: 'high', evidence: 'Weak/deprecated hash primitive (MD5/SHA-1) referenced' },
+  { re: /createCipheriv\s*\(\s*['"`](?:des|des-ede3|rc4|bf|rc2)/i,
+    kind: 'weak-crypto-added', sev: 'critical', evidence: 'Weak/deprecated cipher algorithm referenced' },
+  { re: /\b(?:createCipheriv|createDecipheriv|generateKeyPair(?:Sync)?|crypto\.subtle|jwt\.sign|jsonwebtoken)\s*[.(]/,
+    kind: 'crypto-primitive-changed', sev: 'high', evidence: 'Cryptographic primitive or JWT signing usage added or changed' },
+  { re: PII_FIELD_RE,
+    kind: 'new-pii-field', sev: 'high', evidence: 'PII/PHI-shaped field introduced or modified' },
+  { re: /\b(?:ALTER\s+TABLE|CREATE\s+TABLE|DROP\s+(?:TABLE|COLUMN)|ADD\s+COLUMN)\b/i,
+    kind: 'schema-change', sev: 'medium', evidence: 'Database schema change (DDL)' },
 ];
 
+// FR-307: which `kind`s constitute one of the PRD's named high-impact
+// change classes ("Auth, authZ, crypto, PII, schema, infrastructure
+// privilege, and public API changes cannot auto-apply without approval
+// evidence"). A finding whose kind is NOT in this map is still scored for
+// severity as before, but does not by itself trigger the approval gate —
+// only these specific, named categories do.
+export const HIGH_IMPACT_CATEGORY_OF_KIND = {
+  'auth-removed': 'auth',
+  'priv-from-body': 'authZ',
+  'new-pii-field': 'pii',
+  'weak-crypto-added': 'crypto',
+  'crypto-primitive-changed': 'crypto',
+  'schema-change': 'schema',
+  'new-iac-privilege': 'infra-privilege',
+  'pipeline-perms-widened': 'infra-privilege',
+  'new-endpoint': 'public-api',
+};
+
 // Routine / low-risk patterns (NEVER classify higher than 'low').
 const ROUTINE_PATTERNS = [
   /^\+\s*\/\//,                    // adding a comment
@@ -150,14 +197,76 @@ function summarize(findings) {
 }
 
 // Convenience: invoke `git diff <ref>...HEAD` for the project and classify it.
+//
+// `rootDir` is the scanned project's repository, not this project's own
+// trusted checkout. `--no-textconv` is load-bearing here, not
+// defense-in-depth: this renders real diff content, the same shape VERIFIED
+// exploitable via a hostile `.gitattributes` textconv driver in
+// provenance/git-evidence.js's `commitDiff` (FR-PROV-024 / the second audit).
+//
+// `--no-ext-diff` is ALSO load-bearing and is a SEPARATE surface from
+// `--no-textconv`: `git diff` (unlike `git show`/`git log -p`/`git blame`)
+// honours an external diff driver (`.gitattributes` `diff=<name>` +
+// `.git/config [diff "<name>"] command=<script>`, or the global
+// `diff.external`) even with `--no-textconv` set — VERIFIED empirically: the
+// exact argv this function shipped with before this fix
+// (`-c core.fsmonitor= -c core.hooksPath=/dev/null diff --unified=0
+// --no-textconv <ref>...HEAD`) still ran an attacker's `diff.evil.command`
+// script. This was the live, remaining RCE a second review caught: this
+// function is the real entry point for `/scan --diff` and
+// `security-material-change`, both invoked against the scanned project.
 export function classifyGitDiff(rootDir, ref) {
   let out;
   try {
-    out = cp.execFileSync('git', ['diff', '--unified=0', `${ref}...HEAD`], {
-      cwd: rootDir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+    out = cp.execFileSync('git', hardenGitArgs(['diff', '--unified=0', '--no-textconv', '--no-ext-diff', `${ref}...HEAD`]), {
+      cwd: rootDir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv(),
     });
   } catch (e) {
     return { materialRisk: 'unknown', error: 'git diff failed: ' + (e.message || e), findings: [], perKindCounts: {}, byFile: {} };
   }
   return classifyDiff(out);
 }
+
+/**
+ * FR-307: classify a candidate FIX (not a committed diff) for high-impact
+ * change classes. `files` is `{relPath: {before, after}}` — exactly the
+ * before/after content shape fix/apply-fix-service.js already has on hand
+ * for every candidate write, so no git invocation or unified-diff text is
+ * needed here. A crude but sufficient line-set diff (lines only in `after`
+ * are additions, lines only in `before` are deletions) is enough for
+ * PATTERN matching — classifyHunk operates per-line regardless of hunk
+ * boundaries, so an imprecise line-diff still detects the same risk
+ * signals a real diff would.
+ *
+ * Returns the same shape classifyDiff() does, plus `highImpactCategories`
+ * — the deduplicated, sorted list of named categories
+ * (auth/authZ/crypto/pii/schema/infra-privilege/public-api) any finding in
+ * this candidate belongs to. An empty list means nothing in the candidate
+ * matched one of the PRD's named high-impact classes — the approval gate
+ * in apply-fix-service.js is a no-op in that case, same
+ * restricts-nothing-until-triggered default this codebase's other policy
+ * gates (egress/policy.js, dataflow/privacy-sink-policy.js) already follow.
+ */
+export function classifyFixMaterialRisk(files) {
+  const findings = [];
+  for (const [file, pair] of Object.entries(files || {})) {
+    const before = String(pair?.before ?? '');
+    const after = String(pair?.after ?? '');
+    if (before === after) continue;
+    const beforeLines = before.split('\n');
+    const afterLines = after.split('\n');
+    const beforeSet = new Set(beforeLines);
+    const afterSet = new Set(afterLines);
+    const add = afterLines.filter(l => !beforeSet.has(l));
+    const del = beforeLines.filter(l => !afterSet.has(l));
+    if (!add.length && !del.length) continue;
+    findings.push(...classifyHunk({ file, add, del }));
+  }
+  const result = summarize(findings);
+  const categories = new Set();
+  for (const f of result.findings) {
+    const cat = HIGH_IMPACT_CATEGORY_OF_KIND[f.kind];
+    if (cat) categories.add(cat);
+  }
+  return { ...result, highImpactCategories: [...categories].sort() };
+}

package/src/posture/mttr.js

@@ -8,6 +8,29 @@
 // when to persist firstSeenAt back into the baseline.
 
 import * as crypto from 'node:crypto';
+import { AGE_BASIS } from './provenance/schema.js';
+
+// FR-PROV-019: "reports never show an age without its basis and confidence."
+// FINDING_ORIGIN is the only basis backed by a resolved git commit for the
+// finding's actual introduction; EARLIEST_OBSERVABLE is also git-derived but
+// partial (weaker claim, no exact introduction commit). UNCOMMITTED and
+// FIRST_OBSERVED are both wall-clock fallbacks — the age is a first-seen
+// timestamp, never resolved against git history — and must say so honestly
+// rather than read like a proven date.
+function _ageBasisLabel(ageBasis, confidence) {
+  const level = confidence?.level && confidence.level !== 'unknown' ? confidence.level.toUpperCase() : null;
+  switch (ageBasis) {
+    case AGE_BASIS.FINDING_ORIGIN:
+      return `proven origin${level ? `, ${level} confidence` : ''}`;
+    case AGE_BASIS.EARLIEST_OBSERVABLE:
+      return `earliest observable commit, partial history${level ? `, ${level} confidence` : ''}`;
+    case AGE_BASIS.UNCOMMITTED:
+      return 'uncommitted — first-seen fallback, origin not proven';
+    case AGE_BASIS.FIRST_OBSERVED:
+    default:
+      return 'first-seen fallback — origin not proven';
+  }
+}
 
 // Stable fingerprint for cross-scan finding identity. Mirrors the dedupe key.
 // Exported so a caller can compute the "removed since baseline" (i.e. fixed)
@@ -37,6 +60,25 @@ export function stampFindingTimestamps(findings, baselineMap = new Map(), now =
     f.lastSeenAt = nowIso;
     const firstMs = Date.parse(f.firstSeenAt);
     f.ageDays = Math.max(0, Math.floor((now - firstMs) / 86400000));
+    // FR-PROV-019: age/SLA basis. ageDays above stays pure wall-clock —
+    // every existing SLA/computeMTTR consumer keeps its current meaning.
+    // ageBasis + provenAgeDays are ADDITIVE: a report can show both and
+    // explain the discrepancy, never silently swap which number "age" means.
+    const status = f.findingProvenance?.status;
+    const origin = f.findingProvenance?.findingOrigin;
+    if (status === 'complete' && origin?.authorDate) {
+      f.ageBasis = AGE_BASIS.FINDING_ORIGIN;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'partial' && origin?.authorDate) {
+      f.ageBasis = AGE_BASIS.EARLIEST_OBSERVABLE;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'uncommitted') {
+      f.ageBasis = AGE_BASIS.UNCOMMITTED;
+      f.provenAgeDays = f.ageDays;
+    } else {
+      f.ageBasis = AGE_BASIS.FIRST_OBSERVED;
+      f.provenAgeDays = f.ageDays;
+    }
   }
   return findings;
 }
@@ -68,28 +110,49 @@ export function findingsExceedingSLA(findings, slaDays = null) {
   });
 }
 
-// Median age (days) of the currently-open findings — a single-scan proxy for
-// "how long has this debt been sitting". True MTTR (computeMTTR) needs the set
-// of findings that were FIXED; this reports the open backlog's median age so a
-// scan can show whether debt is getting older. Returns null on empty input.
-// Local — surfaced only through renderSlaSummary (its sole consumer).
-function medianOpenAgeDays(findings) {
-  const ages = (findings || []).map(f => f.ageDays || 0).sort((a, b) => a - b);
-  if (!ages.length) return null;
-  return ages[Math.floor(ages.length / 2)];
+// Median age (days) of the currently-open findings, PLUS the ageBasis/
+// confidence of whichever finding landed on that median — a single-scan proxy
+// for "how long has this debt been sitting". True MTTR (computeMTTR) needs the
+// set of findings that were FIXED; this reports the open backlog's median age
+// so a scan can show whether debt is getting older. Returns null on empty
+// input. Local — surfaced only through renderSlaSummary (its sole consumer).
+//
+// FR-PROV-019: the days figure prefers `provenAgeDays` (git-derived when
+// available) over the pure-wall-clock `ageDays`, and the ageBasis/confidence
+// travel WITH the day count they describe — never a bare number with the
+// basis looked up separately, which is how the original miss happened
+// (ageBasis was stamped onto the finding but never reached the string that
+// printed its age). Findings stamped by an older/test caller that never ran
+// through stampFindingTimestamps (no ageBasis at all) degrade to the same
+// honest "not proven" label FIRST_OBSERVED gets, never a false claim.
+function medianOpenAge(findings) {
+  const entries = (findings || [])
+    .map(f => ({
+      days: f.provenAgeDays != null ? f.provenAgeDays : (f.ageDays || 0),
+      ageBasis: f.ageBasis || AGE_BASIS.FIRST_OBSERVED,
+      confidence: f.findingProvenance?.confidence || null,
+    }))
+    .sort((a, b) => a.days - b.days);
+  if (!entries.length) return null;
+  return entries[Math.floor(entries.length / 2)];
 }
 
 // One-line SLA-breach summary for surfacing after a scan (#10). Returns null
-// when nothing is past its per-severity SLA. Pairs with medianOpenAgeDays for a
+// when nothing is past its per-severity SLA. Pairs with medianOpenAge for a
 // "is my security debt aging" readout that the vibecoder can act on.
+//
+// FR-PROV-019: never prints the median age number without its basis and
+// confidence alongside it — see medianOpenAge/_ageBasisLabel above.
 export function renderSlaSummary(findings, slaDays = null) {
   const breached = findingsExceedingSLA(findings || [], slaDays);
   if (!breached.length) return null;
   const bySev = {};
   for (const f of breached) bySev[f.severity] = (bySev[f.severity] || 0) + 1;
   const parts = ['critical', 'high', 'medium', 'low', 'info'].filter(s => bySev[s]).map(s => `${bySev[s]} ${s}`);
-  const median = medianOpenAgeDays(findings);
-  const ageNote = median != null ? ` (median open age ${median}d)` : '';
+  const median = medianOpenAge(findings);
+  const ageNote = median != null
+    ? ` (median open age ${median.days}d, ${_ageBasisLabel(median.ageBasis, median.confidence)})`
+    : '';
   return `${breached.length} finding(s) past remediation SLA: ${parts.join(', ')}${ageNote}`;
 }