@clear-capabilities/agentic-security-scanner 0.143.0 → 0.145.0

package/dist/435.index.js

@@ -23,6 +23,12 @@ var external_node_url_ = __webpack_require__(3136);
 var promises_ = __webpack_require__(1455);
 // EXTERNAL MODULE: ./src/posture/fix-history.js
 var fix_history = __webpack_require__(4407);
+// EXTERNAL MODULE: ./src/fix/apply-fix-service.js
+var apply_fix_service = __webpack_require__(7730);
+// EXTERNAL MODULE: ./src/posture/material-change.js
+var material_change = __webpack_require__(4629);
+// EXTERNAL MODULE: ./src/fix/approver-registry.js
+var approver_registry = __webpack_require__(437);
 ;// CONCATENATED MODULE: ./src/posture/deterministic-fix.js
 // Deterministic fix synthesis (#1) — for the narrow set of vulnerability classes
 // where a context-INDEPENDENT literal swap is a safe, correct fix, produce a
@@ -92,6 +98,8 @@ function synthesizeDeterministicPatch(finding, fileContent) {
 
 // EXTERNAL MODULE: ./src/posture/integrity.js
 var integrity = __webpack_require__(1130);
+// EXTERNAL MODULE: ./src/posture/state-dir.js
+var state_dir = __webpack_require__(1174);
 // EXTERNAL MODULE: ./src/posture/cache-economics.js
 var cache_economics = __webpack_require__(8752);
 ;// CONCATENATED MODULE: ./src/mcp/redact.js
@@ -197,10 +205,10 @@ function redactArgsBlob(s) {
   return redactString(s);
 }
 
-// EXTERNAL MODULE: ./src/report/index.js + 2 modules
-var report = __webpack_require__(3550);
-// EXTERNAL MODULE: ./src/posture/state-dir.js
-var state_dir = __webpack_require__(1174);
+// EXTERNAL MODULE: ./src/report/index.js + 3 modules
+var report = __webpack_require__(457);
+// EXTERNAL MODULE: ./src/posture/provenance/schema.js
+var schema = __webpack_require__(4594);
 ;// CONCATENATED MODULE: ./src/posture/agents-memory.js
 // AGENTS.md — writable continual-learning memory (harness-anatomy #2).
 //
@@ -499,6 +507,14 @@ const cve_lookup_internals = { CACHE_DIR, CVE_RE, _stalenessTier };
 
 
 
+
+
+
+// Git-origin provenance (Finding Provenance M0/M1). Distinct from
+// `finding.provenance` (AI-authorship) and from an SCA entry's `provenance`
+// (Sigstore/SLSA attestation) — see report/index.js's import comment.
+
+
 // Lazy-loaded: these transitively pull in npm packages (@babel/core and
 // friends) that aren't available in the plugin-cache install path
 // (no node_modules). Deferring keeps the MCP server bootable everywhere;
@@ -863,26 +879,44 @@ const scan_diff = {
     // / MAX_TOTAL_SCAN_BYTES, so this does not turn scan_diff into a
     // full-project deep scan).
     const runScan = await getRunScan();
-    const result = await runScan(sessionRoot, { network: false, fileContents, deep: true, deepInCi: true });
+    // FR-704 (assurance-hardening PRD): this tool's own description promises
+    // "runs scan in memory" — without this, runFullScan's own state writers
+    // (dpia.md, ropa.md, privacy-framework.json, threat-model.json, and
+    // others) fire unconditionally on every call, silently mutating the
+    // user's real project on every pre-write self-correction scan. Confirmed
+    // by direct execution before this fix (11 state artifacts written by a
+    // single scan_diff-shaped call).
+    const result = await (0,state_dir/* withStateWritesDisabled */.Ao)(() =>
+      runScan(sessionRoot, { network: false, fileContents, deep: true, deepInCi: true }));
     const wantSet = new Set(Object.keys(fileContents));
     const sevRank = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
     const min = sevRank[severity] ?? 0;
-    // Stage 6 correctness audit: this only ever read result.scan.findings
-    // (the SAST channel) — scan.secrets and scan.logicVulns are separate
-    // arrays on the raw runScan() result (report/index.js's normalizeFindings
-    // is what merges all four channels, and that merge hasn't run yet here).
-    // A file containing a bare hardcoded credential reported findingCount: 0
-    // through a tool whose own description promises "Use BEFORE writing a
-    // Write/Edit to disk so the agent can self-correct". Also reused
-    // _remediationOf so a fix-string detector (the majority of engine.js's
-    // own, ~127 call sites) doesn't silently report an empty `description`
-    // the way reading only `.remediation` did.
-    const findings = [...(result.scan.findings || []), ...(result.scan.secrets || []), ...(result.scan.logicVulns || [])]
+    // Stage 6 correctness audit (historical): this used to only read
+    // result.scan.findings (the SAST channel) — scan.secrets and
+    // scan.logicVulns are separate arrays on the raw runScan() result, and a
+    // hand-rolled 3-channel concat here was a second, divergent copy of the
+    // merge report/index.js's normalizeFindings() already does (four
+    // channels, plus per-channel defaulting and remediation-string
+    // resolution the old concat re-implemented separately and could drift
+    // from). Assurance-hardening PRD FR-105 ("JSON, SARIF, HTML, CSV, JUnit,
+    // and MCP outputs derive from the same validated object"): route through
+    // the same canonical merge every other output format uses.
+    //
+    // This closes the field-mapping/dedup divergence, but does NOT make
+    // scan_diff surface SCA/supply-chain findings end to end: this handler
+    // never builds a `depFileContents` map (everything a caller passes in
+    // `files`, manifests included, lands in `fileContents`), and manifest-
+    // based supply-chain detection in engine.js reads only `depFileContents`
+    // — so `result.scan.supplyChain` is always empty for this tool today
+    // regardless of this fix. That is a separate, real limitation (scan_diff
+    // was designed for pre-write code self-correction, not manifest
+    // scanning), left as-is rather than silently claimed fixed here.
+    const findings = (0,report.normalizeFindings)(result.scan)
       .filter(f => wantSet.has(String(f.file || '').replace(/\\/g, '/')) && (sevRank[f.severity] ?? 0) >= min)
       .map(f => redactFinding({
         id: f.id, severity: f.severity, file: f.file, line: f.line,
-        title: f.title || f.vuln, cwe: f.cwe,
-        description: f.description, remediation: (0,report/* _remediationOf */.uV)(f),
+        title: f.vuln, cwe: f.cwe,
+        description: f.description, remediation: f.remediation,
       }));
     // Harness-anatomy #1: offload when the result exceeds OFFLOAD_THRESHOLD.
     // The agent gets a head+tail preview plus a path it can page through;
@@ -1025,6 +1059,21 @@ const explain_finding = {
       epssScore: typeof f.epssScore === 'number' ? f.epssScore : null,
       epssPercentile: typeof f.epssPercentile === 'number' ? f.epssPercentile : null,
       exploitedNow: !!f.exploitedNow,
+      // Which commit introduced this finding. `includeEmail` stays at its
+      // DEFAULT (false) unconditionally — unlike the JSON report there is no
+      // operator-set env escape for it here, because the consumer is an
+      // agent that has no business receiving a committer's email address.
+      // `pseudonymize`, by contrast, IS read back from the same env var
+      // report/index.js's `_normalizedProvenance` reads
+      // (AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS=1 / --pseudonymize-authors) —
+      // fix-round item 4: an operator who set that policy was still getting
+      // raw committer names (and, via providerEnrichment, raw reviewer
+      // logins/CODEOWNERS lines) through this MCP surface because this call
+      // passed no options object at all, silently defeating their policy at
+      // this one output boundary while report/index.js honoured it.
+      findingProvenance: f.findingProvenance ? (0,schema/* redactFindingProvenance */.As)(f.findingProvenance, {
+        pseudonymize: process.env.AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS === '1',
+      }) : null,
     };
   },
 };
@@ -1032,7 +1081,7 @@ const explain_finding = {
 // ─── apply_fix ───────────────────────────────────────────────────────────────
 const apply_fix = {
   name: 'apply_fix',
-  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing.',
+  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing. On success, `verified:true` means verification passed but `verifiedFull:true` is the honest signal that every required leg (lint when configured, tests when a runner exists) genuinely ran — a false `verifiedFull` with `verified:true` means the pass is real but degraded (see `verify.degradedLegs`), not a full verification.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -1073,6 +1122,27 @@ const apply_fix = {
               partialSanitization: { type: 'boolean' },
             },
           },
+          // FR-307/FR-1002: this schema had `additionalProperties: false`
+          // and never declared `approval` — the property apply-fix-
+          // service.js's high-impact-change gate has required since FR-307
+          // was built. A real MCP caller supplying fixMeta.approval was
+          // rejected by validate.js at the schema layer before the handler
+          // ever ran, silently making the approval gate (and FR-1002's
+          // identity check layered on it) unreachable from this tool's
+          // only real production entry point. See D-0024.
+          approval: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+              approvedBy: { type: 'string', minLength: 1, maxLength: 200 },
+              reason: { type: 'string', minLength: 1, maxLength: 1000 },
+            },
+          },
+          // FR-1003: separation-of-duties. Self-reported the same way
+          // approvedBy is — this tool has no way to determine who actually
+          // wrote a patch, so `author` is a claim, checked against a
+          // configurable policy the same way `approval` is.
+          author: { type: 'string', minLength: 1, maxLength: 200 },
         },
       },
     },
@@ -1147,20 +1217,79 @@ const apply_fix = {
           verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok }, honesty: verdict.honesty || null },
         };
       }
+      // FR-307/FR-1002/D-0024: this caller-supplied-patch branch writes via
+      // applyFixHistory() directly and never called applyVerifiedFix() — so
+      // the high-impact-change approval gate (auth/authZ/crypto/PII/schema/
+      // infra-privilege/public-API) built for the OTHER apply_fix branch
+      // (stored fix.replacement) never ran here at all, for any input. Since
+      // this is the branch the tool's own description calls the one that
+      // covers "~100% of findings that ship only a template," that gap was
+      // the larger of the two found this cycle. Same before/after content
+      // shape `apply-fix-service.js` already uses — read-first-in-try/catch
+      // (D-0012), never existsSync-then-readFileSync.
+      const filesForMaterialClassification = {};
+      for (const [rel, v] of Object.entries(confinedAbs)) {
+        let before = '';
+        try { before = await promises_.readFile(v.abs, 'utf8'); } catch { /* new file — before stays '' */ }
+        filesForMaterialClassification[rel] = { before, after: v.content };
+      }
+      const materialClassification = (0,material_change/* classifyFixMaterialRisk */.kz)(filesForMaterialClassification);
       if (dry_run) {
-        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary };
+        return { _meta: META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, materialClassification };
+      }
+      if (materialClassification.highImpactCategories.length) {
+        const approval = fixMeta && typeof fixMeta === 'object' ? fixMeta.approval : null;
+        const hasApprovalEvidence = !!(approval && typeof approval === 'object' &&
+          typeof approval.approvedBy === 'string' && approval.approvedBy.trim().length > 0 &&
+          typeof approval.reason === 'string' && approval.reason.trim().length > 0);
+        if (!hasApprovalEvidence) {
+          return {
+            _meta: META, applied: false,
+            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) requires approval evidence — pass fixMeta.approval: {approvedBy, reason} — before it can be applied`,
+            materialClassification,
+          };
+        }
+        const approverRegistry = (0,approver_registry/* loadApproverRegistry */.P4)(ctx.sessionRoot);
+        const requiredRoles = (0,approver_registry/* requiredRolesFor */.Kq)(approverRegistry, materialClassification.highImpactCategories);
+        const identityCheck = (0,approver_registry/* verifyApprover */.$N)(approverRegistry, approval.approvedBy, requiredRoles);
+        if (!identityCheck.verified) {
+          return {
+            _meta: META, applied: false,
+            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${identityCheck.reason}`,
+            materialClassification,
+          };
+        }
+        // FR-1003: separation-of-duties, same no-op-unless-configured gate
+        // as apply-fix-service.js's own copy — see approver-registry.js.
+        const sodCheck = (0,approver_registry/* checkSeparationOfDuties */.I0)(approverRegistry, fixMeta?.author, approval.approvedBy);
+        if (!sodCheck.ok) {
+          return {
+            _meta: META, applied: false,
+            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${sodCheck.reason}`,
+            materialClassification,
+          };
+        }
       }
       const written = [];
       try {
         for (const [rel, v] of Object.entries(confinedAbs)) {
-          const originalContent = external_node_fs_.existsSync(v.abs) ? await promises_.readFile(v.abs, 'utf8') : '';
+          const fileExisted = external_node_fs_.existsSync(v.abs);
+          const originalContent = fileExisted ? await promises_.readFile(v.abs, 'utf8') : '';
           const entry = await (0,fix_history/* applyFix */.oM)({
-            scanRoot: ctx.sessionRoot, file: rel, originalContent, newContent: v.content,
+            scanRoot: ctx.sessionRoot, file: rel, originalContent, newContent: v.content, fileExisted,
             findingId: f.id, stableId: f.stableId, ruleId: f.ruleId || f.cwe || f.family || null, vuln: f.vuln || f.title || null,
+            findingProvenance: f.findingProvenance || null,
           });
           written.push({ file: rel, historyId: entry.id, backupPath: entry.backupPath });
         }
       } catch (e) {
+        // FR-306: roll back every file THIS batch already wrote before the
+        // failure — applyFixHistory already restored the one file that just
+        // failed; this covers the rest, so a multi-file patch never leaves
+        // some files patched and others not.
+        for (const w of written) {
+          try { await (0,fix_history/* revertEntryById */.rJ)(ctx.sessionRoot, w.historyId); } catch { /* best-effort; original error still propagates below */ }
+        }
         if (e && e.name === 'FixAttemptBudgetExceededError') {
           return { _meta: META, applied: false, reason: `budget-exceeded: ${e.message}`, budgetExceeded: true, attempts: e.attempts, maxAttempts: e.max, key: e.key };
         }
@@ -1168,7 +1297,7 @@ const apply_fix = {
       }
       let acceptance = null;
       try { acceptance = (0,fix_history/* fixAcceptanceRate */.XR)(ctx.sessionRoot); } catch { /* best-effort */ }
-      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance };
+      return { _meta: META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance, materialClassification };
     }
 
     if (typeof f.fix?.replacement !== 'string') {
@@ -1205,41 +1334,47 @@ const apply_fix = {
       };
     }
 
-    let entry;
-    try {
-      entry = await (0,fix_history/* applyFix */.oM)({
-        scanRoot: ctx.sessionRoot,
-        file: f.file,
-        originalContent,
-        newContent: f.fix.replacement,
-        findingId: f.id,
-        stableId: f.stableId || null,   // premortem 4R-8
-        ruleId: f.ruleId || f.cwe || f.family || null,
-        vuln: f.vuln || f.title || null,
-      });
-    } catch (e) {
-      // Harness-engineering: step-budget refusal (post-derived). The
-      // deterministic layer enforces at-most-N attempts per stableId. When
-      // exceeded, surface it as a structured `budget-exceeded` outcome the
-      // agent can recognize — not a generic error.
-      if (e && e.name === 'FixAttemptBudgetExceededError') {
-        return {
-          _meta: META,
-          applied: false,
-          reason: `budget-exceeded: ${e.message}`,
-          budgetExceeded: true,
-          attempts: e.attempts,
-          maxAttempts: e.max,
-          key: e.key,
-        };
+    // FR-301/A-08 (assurance-hardening PRD): this branch used to write
+    // f.fix.replacement straight to disk with NO fresh verification — no
+    // rescan, no lint, nothing confirming the stored replacement actually
+    // closes the finding it claims to fix. The caller-patch branch above
+    // already required this; there is no reason a STORED fix should be
+    // trusted more than a caller-supplied one just because it shipped with
+    // the finding. Routed through the same applyVerifiedFix() service the
+    // CLI's `fix --apply` now also uses (src/fix/apply-fix-service.js) —
+    // confinement/reserved-path are re-checked there too (harmless
+    // redundancy with the dry_run preview above, kept for that preview's
+    // size-diff shape) but the load-bearing addition is the verification
+    // gate before the write.
+    if (!f.stableId) {
+      return { _meta: META, applied: false, reason: 'finding has no stableId — cannot verify a stored fix against it' };
+    }
+    const result = await (0,apply_fix_service/* applyVerifiedFix */.On)({
+      scanRoot: ctx.sessionRoot,
+      finding: f,
+      files: { [f.file]: f.fix.replacement },
+      fixMeta,
+    });
+    if (!result.ok) {
+      if (result.budgetExceeded) {
+        return { _meta: META, applied: false, reason: result.reason, budgetExceeded: true, attempts: result.attempts, maxAttempts: result.maxAttempts, key: result.key };
       }
-      throw e;
+      return { _meta: META, applied: false, reason: result.reason, verify: result.verify || null };
     }
     // R25 (PRD §5): surface the running auto-fix acceptance rate after each
     // applied fix, so the closed loop reports its own success metric.
     let acceptance = null;
     try { acceptance = (0,fix_history/* fixAcceptanceRate */.XR)(ctx.sessionRoot); } catch { /* metric is best-effort */ }
-    return { _meta: META, applied: true, historyId: entry.id, file: f.file, backupPath: entry.backupPath, integrity: status, attemptOrdinal: entry.attemptOrdinal, acceptance };
+    const entry = result.written[0];
+    return {
+      // FR-305: verifiedFull distinguishes "every required leg (lint, tests)
+      // genuinely ran and passed" from "passed, but a required leg was
+      // skipped or unavailable" — verified:true alone conflates them.
+      _meta: META, applied: true, verified: true, verifiedFull: result.verifiedFull,
+      historyId: entry.historyId, file: entry.file, backupPath: entry.backupPath,
+      integrity: status, attemptOrdinal: entry.attemptOrdinal, acceptance,
+      verify: result.verify,
+    };
   },
 };
 

package/dist/444.index.js

@@ -10,6 +10,7 @@ export const modules = {
 /* harmony export */ });
 /* unused harmony exports extractAddedLines, scanHistoryDiff */
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
+/* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8844);
 // R15 (PRD §5) — git-history secret sweep.
 //
 // A secret removed from HEAD but present in any past commit is still
@@ -25,6 +26,7 @@ export const modules = {
 
 
 
+
 // Pull the post-image (added) lines out of a unified diff: lines starting with
 // a single '+' (not the '+++' file header). Returns reconstructed text.
 function extractAddedLines(diffText) {
@@ -74,8 +76,15 @@ function sweepGitHistory(scanRoot, detectFn, { maxCommits = 50, timeoutMs = 2000
   if (!scanRoot || typeof detectFn !== 'function') return [];
   let out;
   try {
-    out = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.execFileSync)('git', ['-C', scanRoot, 'log', '-p', '-n', String(maxCommits), '--no-color', '--no-merges', '--no-textconv'],
-      { encoding: 'utf8', maxBuffer: 96 * 1024 * 1024, timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'] });
+    // Second independent Finding Provenance PRD audit (FR-PROV-024): this
+    // scanRoot is a scanned repository, not this project's own trusted
+    // checkout. `--no-textconv` alone (the pre-existing hardening here) closes
+    // the .gitattributes textconv surface but NOT `core.fsmonitor` /
+    // `core.hooksPath` — this `log -p` call renders every historical commit's
+    // diff content, the same shape verified exploitable in
+    // provenance/git-evidence.js, so it gets the full hardening too.
+    out = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.execFileSync)('git', (0,_util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__/* .hardenGitArgs */ .Ax)(['-C', scanRoot, 'log', '-p', '-n', String(maxCommits), '--no-color', '--no-merges', '--no-textconv']),
+      { encoding: 'utf8', maxBuffer: 96 * 1024 * 1024, timeout: timeoutMs, stdio: ['ignore', 'pipe', 'ignore'], env: (0,_util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__/* .hardenGitEnv */ .Si)() });
   } catch { return []; }
   const parts = out.split(/^commit ([0-9a-f]{7,40})/m); // [pre, sha, body, sha, body, ...]
   const findings = [];

package/dist/449.index.js

@@ -14,6 +14,7 @@ export const modules = {
 /* harmony export */ });
 /* unused harmony export findingsExceedingSLA */
 /* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
+/* harmony import */ var _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(4594);
 // 0.8.0 Feat-11: MTTR / finding-age tracking — per-finding firstSeenAt/lastSeenAt with SLA breach detection.
 //
 // Stamps every finding with `firstSeenAt` (preserved from the baseline if the
@@ -25,6 +26,29 @@ export const modules = {
 
 
 
+
+// FR-PROV-019: "reports never show an age without its basis and confidence."
+// FINDING_ORIGIN is the only basis backed by a resolved git commit for the
+// finding's actual introduction; EARLIEST_OBSERVABLE is also git-derived but
+// partial (weaker claim, no exact introduction commit). UNCOMMITTED and
+// FIRST_OBSERVED are both wall-clock fallbacks — the age is a first-seen
+// timestamp, never resolved against git history — and must say so honestly
+// rather than read like a proven date.
+function _ageBasisLabel(ageBasis, confidence) {
+  const level = confidence?.level && confidence.level !== 'unknown' ? confidence.level.toUpperCase() : null;
+  switch (ageBasis) {
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FINDING_ORIGIN:
+      return `proven origin${level ? `, ${level} confidence` : ''}`;
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.EARLIEST_OBSERVABLE:
+      return `earliest observable commit, partial history${level ? `, ${level} confidence` : ''}`;
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.UNCOMMITTED:
+      return 'uncommitted — first-seen fallback, origin not proven';
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED:
+    default:
+      return 'first-seen fallback — origin not proven';
+  }
+}
+
 // Stable fingerprint for cross-scan finding identity. Mirrors the dedupe key.
 // Exported so a caller can compute the "removed since baseline" (i.e. fixed)
 // set that computeMTTR needs, using the exact same identity function
@@ -53,6 +77,25 @@ function stampFindingTimestamps(findings, baselineMap = new Map(), now = Date.no
     f.lastSeenAt = nowIso;
     const firstMs = Date.parse(f.firstSeenAt);
     f.ageDays = Math.max(0, Math.floor((now - firstMs) / 86400000));
+    // FR-PROV-019: age/SLA basis. ageDays above stays pure wall-clock —
+    // every existing SLA/computeMTTR consumer keeps its current meaning.
+    // ageBasis + provenAgeDays are ADDITIVE: a report can show both and
+    // explain the discrepancy, never silently swap which number "age" means.
+    const status = f.findingProvenance?.status;
+    const origin = f.findingProvenance?.findingOrigin;
+    if (status === 'complete' && origin?.authorDate) {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FINDING_ORIGIN;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'partial' && origin?.authorDate) {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.EARLIEST_OBSERVABLE;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'uncommitted') {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.UNCOMMITTED;
+      f.provenAgeDays = f.ageDays;
+    } else {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED;
+      f.provenAgeDays = f.ageDays;
+    }
   }
   return findings;
 }
@@ -84,28 +127,49 @@ function findingsExceedingSLA(findings, slaDays = null) {
   });
 }
 
-// Median age (days) of the currently-open findings — a single-scan proxy for
-// "how long has this debt been sitting". True MTTR (computeMTTR) needs the set
-// of findings that were FIXED; this reports the open backlog's median age so a
-// scan can show whether debt is getting older. Returns null on empty input.
-// Local — surfaced only through renderSlaSummary (its sole consumer).
-function medianOpenAgeDays(findings) {
-  const ages = (findings || []).map(f => f.ageDays || 0).sort((a, b) => a - b);
-  if (!ages.length) return null;
-  return ages[Math.floor(ages.length / 2)];
+// Median age (days) of the currently-open findings, PLUS the ageBasis/
+// confidence of whichever finding landed on that median — a single-scan proxy
+// for "how long has this debt been sitting". True MTTR (computeMTTR) needs the
+// set of findings that were FIXED; this reports the open backlog's median age
+// so a scan can show whether debt is getting older. Returns null on empty
+// input. Local — surfaced only through renderSlaSummary (its sole consumer).
+//
+// FR-PROV-019: the days figure prefers `provenAgeDays` (git-derived when
+// available) over the pure-wall-clock `ageDays`, and the ageBasis/confidence
+// travel WITH the day count they describe — never a bare number with the
+// basis looked up separately, which is how the original miss happened
+// (ageBasis was stamped onto the finding but never reached the string that
+// printed its age). Findings stamped by an older/test caller that never ran
+// through stampFindingTimestamps (no ageBasis at all) degrade to the same
+// honest "not proven" label FIRST_OBSERVED gets, never a false claim.
+function medianOpenAge(findings) {
+  const entries = (findings || [])
+    .map(f => ({
+      days: f.provenAgeDays != null ? f.provenAgeDays : (f.ageDays || 0),
+      ageBasis: f.ageBasis || _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED,
+      confidence: f.findingProvenance?.confidence || null,
+    }))
+    .sort((a, b) => a.days - b.days);
+  if (!entries.length) return null;
+  return entries[Math.floor(entries.length / 2)];
 }
 
 // One-line SLA-breach summary for surfacing after a scan (#10). Returns null
-// when nothing is past its per-severity SLA. Pairs with medianOpenAgeDays for a
+// when nothing is past its per-severity SLA. Pairs with medianOpenAge for a
 // "is my security debt aging" readout that the vibecoder can act on.
+//
+// FR-PROV-019: never prints the median age number without its basis and
+// confidence alongside it — see medianOpenAge/_ageBasisLabel above.
 function renderSlaSummary(findings, slaDays = null) {
   const breached = findingsExceedingSLA(findings || [], slaDays);
   if (!breached.length) return null;
   const bySev = {};
   for (const f of breached) bySev[f.severity] = (bySev[f.severity] || 0) + 1;
   const parts = ['critical', 'high', 'medium', 'low', 'info'].filter(s => bySev[s]).map(s => `${bySev[s]} ${s}`);
-  const median = medianOpenAgeDays(findings);
-  const ageNote = median != null ? ` (median open age ${median}d)` : '';
+  const median = medianOpenAge(findings);
+  const ageNote = median != null
+    ? ` (median open age ${median.days}d, ${_ageBasisLabel(median.ageBasis, median.confidence)})`
+    : '';
   return `${breached.length} finding(s) past remediation SLA: ${parts.join(', ')}${ageNote}`;
 }