@clear-capabilities/agentic-security-scanner 0.144.0 → 0.145.0

package/src/posture/artifact-registry.js

@@ -125,6 +125,28 @@ export const ARTIFACT_REGISTRY = [
   { name: 'sca-upgrade-history', kind: 'dir', classification: 'generated', retentionClass: 'scan' },
   { name: 'scan-baselines', kind: 'dir', classification: 'generated', retentionClass: 'scan', source: 'posture/pr-augment.js' },
   { name: 'agent-scratchpad', kind: 'dir', classification: 'generated', retentionClass: 'cache', source: 'mcp/tools.js (append_scratchpad)' },
+  // Finding Provenance (M0/M1, split per PRD Section 8 retention task). Used
+  // to be one directory with two writers sharing it, which meant they could
+  // not get different retention treatment — `cmdReset`/`findExpiredArtifacts`
+  // only ever operate on exact TOP-LEVEL `.agentic-security/` directory
+  // names, never on a `/`-qualified sub-path. Now physically split:
+  //   - posture/provenance/cache.js writes provenance-cache/<hash>.json — a
+  //     pure HEAD-keyed memo of resolved origins, safely regenerable, no
+  //     correctness dependency on being preserved. Gets retentionClass:
+  //     'cache' (7-day default / 30-day max TTL, RETENTION_DEFAULTS.cache).
+  //   - posture/provenance/lifecycle.js writes provenance/lifecycle.json +
+  //     .lock — the introduce/remediate/reintroduce ledger. Deliberately NO
+  //     retentionClass: this is permanent history, not a cache; auto-expiring
+  //     it would silently lose lifecycle events a report may already have
+  //     cited. `reset` (without `--expired`) still clears it, which is
+  //     explicit operator action, unlike TTL-driven auto-expiry.
+  // Old-location cache files (`provenance/cache/*.json`, written before this
+  // split) are DELIBERATELY NOT migrated — see cache.js's own comment and the
+  // commit that introduced this split. They are simply orphaned: invisible to
+  // this registry, un-swept by reset/retention, silently ignored by the new
+  // code, and harmless to leave until a human deletes them by hand.
+  { name: 'provenance-cache', kind: 'dir', classification: 'generated', retentionClass: 'cache', source: 'posture/provenance/cache.js -- pure HEAD-keyed memo, safely regenerable, no correctness dependency on being preserved' },
+  { name: 'provenance', kind: 'dir', classification: 'generated', source: 'posture/provenance/lifecycle.js -- the introduce/remediate/reintroduce ledger. Deliberately NO retentionClass: this is permanent history, not a cache; auto-expiring it would silently lose lifecycle events a report may already have cited.' },
   { name: 'AGENTS.md', kind: 'file', classification: 'generated', source: 'posture/agents-memory.js' },
   { name: 'AGENTS.md.archive', kind: 'file', classification: 'generated', source: 'posture/agents-memory.js' },
   { name: 'baseline.json', kind: 'file', classification: 'generated', source: 'bin/agentic-security.js (--set-baseline)', note: 'operator-set intent, functionally closer to operator-config than scan output — no auto-expiry' },
@@ -171,6 +193,8 @@ export const ARTIFACT_REGISTRY = [
   { name: 'legal-holds.json', kind: 'file', classification: 'operator-config', note: 'FR-707 legal holds ({artifact, owner, reason, expires_at}) — read by posture/retention-policy.js and bin/agentic-security.js cmdReset; WRITTEN by the CLI (legal-hold add/remove), but classified operator-config (not generated) deliberately: a plain `reset` must never be able to delete the very record protecting other artifacts from deletion' },
   { name: 'calibration-feedback.jsonl', kind: 'file', classification: 'operator-config', note: 'FR-806 opt-in calibration ground truth ({at, findingId, outcome: accept-risk|realized-incident, predicted*, note}) — WRITTEN by the CLI (calibration-feedback record), but classified operator-config like exploit-history.jsonl: real, hard-to-recreate customer-reported ground truth, never scanner-regenerable, so a routine reset must never delete it' },
   { name: 'encryption-policy.yml', kind: 'file', classification: 'operator-config', note: 'FR-705 encryption provider/required opt-in policy ({provider: local-key, required: true|false}) — read by posture/encryption-provider.js, never written by the scanner' },
+  { name: 'provenance-providers.yml', kind: 'file', classification: 'operator-config', note: 'Finding Provenance M3 §3.4 GitHub/GitLab provider enrichment opt-in ({token} or provider-scoped tokens) — read by posture/provenance/providers/config.js, never written by the scanner; env vars (AGENTIC_SECURITY_GITHUB_TOKEN/AGENTIC_SECURITY_GITLAB_TOKEN) take precedence when set' },
+  { name: 'repo-lineage.json', kind: 'file', classification: 'operator-config', note: 'Finding Provenance M4 §4.2 cross-repository lineage declaration ({linkedFrom: {path, atCommit}}) — read by posture/provenance/repo-lineage.js, never written by the scanner; the linked path is verified as a real local git repo before use, no remote fetch' },
   { name: 'logic-claims.json', kind: 'file', classification: 'operator-config', note: 'authored by an external reviewing agent; engine.js only ever reads it (fs.readFileSync, never written)' },
   { name: 'current-intent.md', kind: 'file', classification: 'operator-config', note: 'developer-authored; no writer exists anywhere in src/ or bin/' },
   { name: 'exploit-history.jsonl', kind: 'file', classification: 'operator-config', note: 'own header comment: "operator-curated record of past confirmed exploits"' },

package/src/posture/auditor-walkthrough.js

@@ -41,9 +41,81 @@ import { statePath, stateWritesEnabled } from './state-dir.js';
 import { EVIDENCE_GRADE_DISCLAIMER_SHORT } from './evidence-grade-wording.js';
 import { COMPLIANCE_FAMILY_ALIAS, resolveFamilyKeys } from './family-resolve.js';
 import { strengthOfControl as _strengthOfControl } from './coverage-strength.js';
+// FR-PROV-026: earliestOrigin.authorName below is untrusted git commit
+// metadata. renderWalkthrough()'s output is console.log'd verbatim by
+// bin/agentic-security.js's `compliance --walkthrough` — the ONLY live
+// consumer today (persistWalkthrough below is exported and tested but has
+// zero callers anywhere in the CLI/command surface; no code in this repo
+// ever runs this text through a real Markdown renderer). sanitizeForTerminal
+// is therefore the correct sanitizer here, not a Markdown-escaping one — a
+// backslash-escaping sibling was tried and reverted (see schema.js's header
+// comment): printed raw or read as plain text, `Jean-Luc Picard` rendering
+// as `Jean\-Luc Picard` and `dependabot[bot]` as `dependabot\[bot\]` is a
+// visible regression on common real-world author names, not a fix.
+import { sanitizeForTerminal, pseudonymizeAuthor, PROVENANCE_COMPLIANCE_DISCLAIMER } from './provenance/schema.js';
+
+// Fix-round item 4b: this renderer had `sanitizeForTerminal` (injection
+// safety) but never honoured `--pseudonymize-authors` at all — an operator
+// who set that policy still saw a raw committer name in walkthrough output,
+// the one boundary that gap missed. Reads the SAME env var
+// `report/index.js`'s `_normalizedProvenance` and `mcp/tools.js`'s
+// `providerEnrichment`-aware call read back
+// (AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS=1 / --pseudonymize-authors). Keyed
+// on name only, not email: `deriveComplianceProvenance`'s `earliestOrigin`
+// deliberately never carries `authorEmail` (see its own comment — that
+// object bypasses the `redactFindingProvenance` sweep entirely), so the
+// pseudonym here is stable across repeated runs for the same author name but
+// not necessarily identical to the email-keyed pseudonym shown at other
+// output boundaries for the same person.
+function _maybePseudonymizeName(name) {
+  if (!name) return name;
+  return process.env.AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS === '1' ? pseudonymizeAuthor(name, null) : name;
+}
 
 // Re-exported so existing callers/tests keep importing these from here.
 export { COMPLIANCE_FAMILY_ALIAS, resolveFamilyKeys };
+
+// FR-PROV-016 (M2): "earliest proven open condition" among a control's
+// contributing findings. Prefers a finding whose findingProvenance resolved
+// findingOrigin.status:'complete' (the OLDEST such authorDate wins); falls
+// back to 'partial' entries with a resolved findingOrigin.authorDate when no
+// complete one exists. Never fabricates an origin — zero usable entries is
+// reported as null/'unknown', not the repo's first commit or "now".
+export function deriveComplianceProvenance(findings) {
+  const list = Array.isArray(findings) ? findings.filter(Boolean) : [];
+  const withOrigin = list
+    .map((f) => ({ f, fp: f && f.findingProvenance }))
+    .filter((x) => x.fp && x.fp.findingOrigin && x.fp.findingOrigin.authorDate);
+  const complete = withOrigin.filter((x) => x.fp.status === 'complete');
+  const partial = withOrigin.filter((x) => x.fp.status === 'partial');
+  // authorDate is git's `%aI` (strict ISO-8601, author's LOCAL UTC offset —
+  // see git-evidence.js's commitMeta), never normalized to Z. Two commits
+  // authored in different timezones near a day boundary can lexically sort
+  // in the wrong chronological order, so compare actual instants via
+  // Date.parse, never the raw strings.
+  const pickEarliest = (arr) => arr.reduce(
+    (min, x) => (!min || Date.parse(x.fp.findingOrigin.authorDate) < Date.parse(min.fp.findingOrigin.authorDate)) ? x : min,
+    null,
+  );
+  const best = complete.length ? pickEarliest(complete) : (partial.length ? pickEarliest(partial) : null);
+  return {
+    derivedFrom: [...new Set(list.map((f) => f && f.id).filter(Boolean))],
+    // Only commit/authorDate/authorName are ever read from findingOrigin
+    // here — this object is a SIBLING field to findingProvenance (not
+    // nested inside it), so it bypasses the redactFindingProvenance sweep
+    // that runs at report/mcp output boundaries. authorEmail must never be
+    // added to this shape without first routing it through
+    // redactFindingProvenance.
+    earliestOrigin: best ? {
+      commit: best.fp.findingOrigin.commit || null,
+      authorDate: best.fp.findingOrigin.authorDate,
+      authorName: best.fp.findingOrigin.authorName || null,
+    } : null,
+    confidence: complete.length ? 'high' : (partial.length ? 'low' : 'unknown'),
+    limitations: best ? [] : ['no contributing finding resolved a verified origin'],
+  };
+}
+
 const BUNDLED_DIR = path.join(path.dirname(new URL(import.meta.url).pathname), 'compliance-frameworks');
 function _readJson(fp) {
   try { return JSON.parse(fs.readFileSync(fp, 'utf8')); } catch { return null; }
@@ -275,24 +347,30 @@ export function evaluateFramework(scanRoot, fw, scan) {
   const results = [];
   for (const c of fw.controls || []) {
     const obs = [];
+    // FR-PROV-016: findings that contributed an OPEN condition to this
+    // control's `family:` mapping(s) — the exact objects `open` below
+    // filters to, not just their ids, so deriveComplianceProvenance can read
+    // .findingProvenance off them. Naturally empty for a control that ends
+    // up 'present' (present requires zero open findings across every
+    // mapping) or 'manual' (no family: mapping ever populates it) — so a
+    // consumer can treat a non-empty controlRefs as "this control has an
+    // attributable gap" without re-deriving the bucket classification.
+    const contributingFindings = [];
     let status = 'manual';
     const maps = Array.isArray(c.mapsTo) ? c.mapsTo : [];
 
     if (maps.length === 0) {
       obs.push('No automated mapping — requires manual evidence collection.');
-      // PRD F10.2: carry the MEASURED strength of the backing detector, so a
-    // control mapped to a detector that finds 3 of 18 independent advisories
-    // cannot read the same as one backed by a detector that finds nearly
-    // everything. Import is lazy so the evaluator keeps working if the bench
-    // artifacts are absent (they degrade to `unmeasured`, never to a default).
-    let evidence = null;
-    try { evidence = _strengthOfControl(c); } catch { /* strength is additive; never block evaluation */ }
-    results.push({
-      control: c,
-      status,
-      observations: obs,
-      ...(evidence ? { evidence, partiallyEvidenced: evidence.tier === 'weak' || evidence.tier === 'unmeasured' } : {}),
-    });
+      let evidence = null;
+      try { evidence = _strengthOfControl(c); } catch { /* strength is additive; never block evaluation */ }
+      results.push({
+        control: c,
+        status,
+        observations: obs,
+        controlRefs: [],
+        derivedProvenance: deriveComplianceProvenance([]),
+        ...(evidence ? { evidence, partiallyEvidenced: evidence.tier === 'weak' || evidence.tier === 'unmeasured' } : {}),
+      });
       continue;
     }
 
@@ -356,6 +434,7 @@ export function evaluateFramework(scanRoot, fw, scan) {
         const open = scoped.filter(f => !f.intentSuppressed && !f.pastDecision && (SEVERITY_RANK[f.severity] ?? 0) >= minRank);
         if (open.length) {
           allCleared = false;
+          contributingFindings.push(...open);
           obs.push(`${open.length} open ${fam} finding(s) at ${minSeverity}+.`);
         } else {
           obs.push(`✓ ${fam}: no open ${minSeverity}+ findings.`);
@@ -461,10 +540,13 @@ export function evaluateFramework(scanRoot, fw, scan) {
     // artifacts are absent (they degrade to `unmeasured`, never to a default).
     let evidence = null;
     try { evidence = _strengthOfControl(c); } catch { /* strength is additive; never block evaluation */ }
+    const dedupedRefs = [...new Set(contributingFindings.map((f) => f.id).filter(Boolean))];
     results.push({
       control: c,
       status,
       observations: obs,
+      controlRefs: dedupedRefs,
+      derivedProvenance: deriveComplianceProvenance(contributingFindings),
       ...(evidence ? { evidence, partiallyEvidenced: evidence.tier === 'weak' || evidence.tier === 'unmeasured' } : {}),
     });
   }
@@ -519,6 +601,27 @@ export function renderWalkthrough(fw, evaluation, opts = {}) {
     if (ev.status === 'absent' || ev.status === 'partial') {
       lines.push(`**Remediation:** address the bullet(s) above, then re-run \`/compliance --walkthrough ${fw.id}\` to update this report.`);
       lines.push('');
+      if (Array.isArray(ev.controlRefs) && ev.controlRefs.length) {
+        lines.push(`**Contributing findings:** ${ev.controlRefs.join(', ')}`);
+        const dp = ev.derivedProvenance;
+        if (dp && dp.earliestOrigin) {
+          const short = String(dp.earliestOrigin.commit || '').slice(0, 7) || 'unknown';
+          const day = String(dp.earliestOrigin.authorDate || '').slice(0, 10);
+          // Only commit/authorDate/authorName are ever read here — same
+          // caveat as deriveComplianceProvenance's earliestOrigin: this
+          // object bypasses redactFindingProvenance, so authorEmail must
+          // never be surfaced from it without routing through that function
+          // first.
+          lines.push(`**Earliest proven origin:** ${short} — ${day} — ${sanitizeForTerminal(_maybePseudonymizeName(dp.earliestOrigin.authorName)) || 'unknown'} (confidence: ${dp.confidence})`);
+          // PRD Section 8 REQUIRED DISCLAIMER, alongside the claim it
+          // qualifies (not just once at the top of the document) — a reader
+          // who skips straight to a control's evidence must still see it.
+          lines.push(`_${PROVENANCE_COMPLIANCE_DISCLAIMER}_`);
+        } else if (dp) {
+          lines.push(`**Earliest proven origin:** unresolved (confidence: ${dp.confidence})`);
+        }
+        lines.push('');
+      }
     }
   }
 

package/src/posture/compliance-policy.js

@@ -64,7 +64,8 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
+import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
 import * as yaml from '../util/yaml.js';
 import { statePath, safeWriteState, STATE_DIR_NAME } from './state-dir.js';
 import { SCANNER_VERSION } from './version.js';
@@ -367,10 +368,19 @@ export function verifyPolicy(policy, ctx) {
   return { framework: policy.framework, version: policy.version, controls: results, summary, evidenceDigest };
 }
 
+// `scanRoot` is the scanned project's repository, not this project's own
+// trusted checkout — hardened per FR-PROV-024 / the second Finding
+// Provenance PRD audit sweep (found missing here by a follow-up review that
+// grepped for `child_process` usage beyond just `execFileSync('git'` call
+// sites). `rev-parse HEAD` was VERIFIED not to itself trigger
+// `core.fsmonitor`/a hook, so this is not a second live RCE — but the
+// shell-string `execSync` form was gratuitous risk with no upside (no
+// caller-controlled input to interpolate), and left this call outside the
+// config/env hardening every other git call in this codebase now has.
 function _currentCommit(scanRoot) {
   if (!scanRoot) return null;
   try {
-    return execSync('git rev-parse HEAD', { cwd: scanRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    return execFileSync('git', hardenGitArgs(['rev-parse', 'HEAD']), { cwd: scanRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv() }).trim();
   } catch { return null; } // not a git repo, or git unavailable — not an error condition
 }
 

package/src/posture/cross-repo-memory.js

@@ -24,6 +24,7 @@ import * as cp from 'node:child_process';
 import * as fs from 'node:fs';
 import * as crypto from 'node:crypto';
 import * as path from 'node:path';
+import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
 
 // Lazy — process.env.HOME may be mutated mid-process (e.g. tests isolating).
 function _storeDir() {
@@ -43,8 +44,12 @@ function _ensureDir() { try { fs.mkdirSync(_storeDir(), { recursive: true }); }
 export function repoFingerprint(scanRoot) {
   let source = String(scanRoot || '');
   try {
-    const remote = cp.execFileSync('git', ['remote', 'get-url', 'origin'],
-      { cwd: scanRoot, encoding: 'utf8', timeout: 800, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    // `scanRoot` is the scanned project's repository, not this project's
+    // own trusted checkout — hardened per FR-PROV-024 / the second Finding
+    // Provenance PRD audit (same exposure class as
+    // provenance/git-evidence.js's `_run`).
+    const remote = cp.execFileSync('git', hardenGitArgs(['remote', 'get-url', 'origin']),
+      { cwd: scanRoot, encoding: 'utf8', timeout: 800, stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv() }).trim();
     if (remote) source = remote;
   } catch {}
   return crypto.createHash('sha256').update(source).digest('hex').slice(0, 12);

package/src/posture/fix-history.js

@@ -13,6 +13,7 @@ import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { isSafeStateDir, statePath, stateWritesEnabled } from './state-dir.js';
+import { AGE_BASIS } from './provenance/schema.js';
 
 function historyDir(scanRoot) {
   return statePath(scanRoot, 'fix-history');
@@ -238,6 +239,26 @@ function _countPriorAttempts(log, stableId, findingId) {
   return n;
 }
 
+// FR-PROV §7.4 / M2 §2.2: how old was this finding, by which basis, at the
+// moment it was fixed. Computed ONCE, at fix time, and never re-derived
+// later — a finding's origin doesn't change, but re-computing "age at fix"
+// from a LATER read of findingProvenance would silently answer "how old is
+// it now", not "how old was it when fixed". Mirrors mttr.js's ageBasis
+// tiering (Task 6) so the two surfaces agree on vocabulary.
+function _snapshotProvenanceAtFix(findingProvenance, appliedAt) {
+  if (!findingProvenance) return null;
+  const status = findingProvenance.status;
+  const origin = findingProvenance.findingOrigin;
+  const observedAt = findingProvenance.firstObserved?.observedAt || null;
+  let ageBasis, basisDate;
+  if (status === 'complete' && origin?.authorDate) { ageBasis = AGE_BASIS.FINDING_ORIGIN; basisDate = origin.authorDate; }
+  else if (status === 'partial' && origin?.authorDate) { ageBasis = AGE_BASIS.EARLIEST_OBSERVABLE; basisDate = origin.authorDate; }
+  else if (status === 'uncommitted') { ageBasis = AGE_BASIS.UNCOMMITTED; basisDate = observedAt; }
+  else { ageBasis = AGE_BASIS.FIRST_OBSERVED; basisDate = observedAt; }
+  const ageDays = basisDate ? Math.max(0, Math.floor((Date.parse(appliedAt) - Date.parse(basisDate)) / 86400000)) : null;
+  return { commit: origin?.commit || null, authorDate: basisDate, ageBasis, ageDays };
+}
+
 // @param {boolean} [fileExisted] - did `file` exist on disk before this call?
 //   Determines what "restore" means on rollback: write `originalContent`
 //   back for a file that existed (default, for backward compatibility with
@@ -247,7 +268,7 @@ function _countPriorAttempts(log, stableId, findingId) {
 //   real-world meaning in this codebase's callers — writing '' back would
 //   leave a phantom empty file where none existed before, not a true
 //   rollback).
-export async function applyFix({ scanRoot, file, originalContent, newContent, findingId, ruleId, vuln, stableId, fileExisted = true }) {
+export async function applyFix({ scanRoot, file, originalContent, newContent, findingId, ruleId, vuln, stableId, fileExisted = true, findingProvenance = null }) {
   return _withLogLock(scanRoot, async () => {
     ensure(scanRoot);
     const absFile = path.resolve(scanRoot, file);
@@ -269,6 +290,7 @@ export async function applyFix({ scanRoot, file, originalContent, newContent, fi
     // is below — a corrupted backup is worse than no backup, because it
     // silently defeats rollback.
     await _writeAtomicAndSync(bakPath, originalContent);
+    const appliedAt = new Date().toISOString();
     const entry = {
       id,
       findingId,
@@ -280,10 +302,11 @@ export async function applyFix({ scanRoot, file, originalContent, newContent, fi
       backupPath: path.relative(scanRoot, bakPath),
       originalSha: sha(originalContent),
       newSha: sha(newContent),
-      appliedAt: new Date().toISOString(),
+      appliedAt,
       status: 'pending',
       reverted: false,
       attemptOrdinal: priorAttempts + 1,
+      provenanceAtFix: _snapshotProvenanceAtFix(findingProvenance, appliedAt),
     };
     // Phase 2: log entry marked pending + fsync.
     const log = priorLog;

package/src/posture/fix-verify.js

@@ -38,7 +38,15 @@ export async function verifyPatch({
   const fileContents = { ...files };
   let scan;
   try {
-    scan = await runFullScan({ fileContents, depFileContents, scanRoot }, () => {});
+    // `provenance:false` is REQUIRED here, not an optimisation. This scan is
+    // deliberately scoped to just the patched file(s), so its finding set is a
+    // tiny subset of the project's. updateLifecycle marks every open stableId
+    // NOT in the set it is handed as `remediated` — so a single fix
+    // verification (every /fix, apply_fix, and autopilot iteration runs one)
+    // would mass-mark the rest of the project as remediated, then
+    // `reintroduced` on the next real scan. The patched content is also not
+    // committed, so there is no history to resolve provenance against anyway.
+    scan = await runFullScan({ fileContents, depFileContents, scanRoot, provenance: false }, () => {});
   } catch (e) {
     return { ok: false, reason: 'rescan-failed', error: e.message };
   }

package/src/posture/git-history.js

@@ -19,14 +19,19 @@
 import * as cp from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
 
 const MAX_BLAME_PER_SCAN = 500;
 const SUBPROC_TIMEOUT_MS = 1500;
 const PROMPT_MARKER_RE = /(?:^|\n)(?:Prompt|User asked|Original request|Co-Authored-By:\s*Claude)/i;
 
+// `scanRoot` is the scanned project's repository, not this project's own
+// trusted checkout — every call below is hardened per FR-PROV-024 / the
+// second Finding Provenance PRD audit (same exposure class as
+// provenance/git-evidence.js's `_run`).
 function _isGitRepo(scanRoot) {
   try {
-    cp.execFileSync('git', ['rev-parse', '--git-dir'], { cwd: scanRoot, stdio: 'ignore', timeout: SUBPROC_TIMEOUT_MS });
+    cp.execFileSync('git', hardenGitArgs(['rev-parse', '--git-dir']), { cwd: scanRoot, stdio: 'ignore', timeout: SUBPROC_TIMEOUT_MS, env: hardenGitEnv() });
     return true;
   } catch { return false; }
 }
@@ -36,10 +41,13 @@ function _blame(scanRoot, file, line) {
   const rel = path.isAbsolute(file) ? path.relative(scanRoot, file) : file;
   if (rel.startsWith('..')) return null;
   try {
+    // `--no-textconv`: VERIFIED exploitable without it — `git blame`
+    // applies a hostile `.gitattributes` textconv driver by default in
+    // current git, same as provenance/git-evidence.js's blameLine.
     const stdout = cp.execFileSync(
       'git',
-      ['blame', '-L', `${line},${line}`, '--porcelain', '--', rel],
-      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'] },
+      hardenGitArgs(['blame', '-L', `${line},${line}`, '--porcelain', '--no-textconv', '--', rel]),
+      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv() },
     );
     return _parsePorcelain(stdout);
   } catch { return null; }
@@ -66,8 +74,8 @@ function _parsePorcelain(out) {
 function _fullMessage(scanRoot, sha) {
   try {
     return cp.execFileSync(
-      'git', ['show', '-s', '--format=%B', sha],
-      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'] },
+      'git', hardenGitArgs(['show', '-s', '--no-textconv', '--format=%B', sha]),
+      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv() },
     );
   } catch { return ''; }
 }

package/src/posture/material-change.js

@@ -11,6 +11,7 @@
 // or the command runner) collects the unified diff and feeds hunks into classifyHunk.
 
 import * as cp from 'node:child_process';
+import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
 import { loadPrivacyTaxonomy } from '../dataflow/privacy-taxonomy.js';
 
 // Patterns that fire on the deletion side (auth/check removed).
@@ -196,11 +197,29 @@ function summarize(findings) {
 }
 
 // Convenience: invoke `git diff <ref>...HEAD` for the project and classify it.
+//
+// `rootDir` is the scanned project's repository, not this project's own
+// trusted checkout. `--no-textconv` is load-bearing here, not
+// defense-in-depth: this renders real diff content, the same shape VERIFIED
+// exploitable via a hostile `.gitattributes` textconv driver in
+// provenance/git-evidence.js's `commitDiff` (FR-PROV-024 / the second audit).
+//
+// `--no-ext-diff` is ALSO load-bearing and is a SEPARATE surface from
+// `--no-textconv`: `git diff` (unlike `git show`/`git log -p`/`git blame`)
+// honours an external diff driver (`.gitattributes` `diff=<name>` +
+// `.git/config [diff "<name>"] command=<script>`, or the global
+// `diff.external`) even with `--no-textconv` set — VERIFIED empirically: the
+// exact argv this function shipped with before this fix
+// (`-c core.fsmonitor= -c core.hooksPath=/dev/null diff --unified=0
+// --no-textconv <ref>...HEAD`) still ran an attacker's `diff.evil.command`
+// script. This was the live, remaining RCE a second review caught: this
+// function is the real entry point for `/scan --diff` and
+// `security-material-change`, both invoked against the scanned project.
 export function classifyGitDiff(rootDir, ref) {
   let out;
   try {
-    out = cp.execFileSync('git', ['diff', '--unified=0', `${ref}...HEAD`], {
-      cwd: rootDir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+    out = cp.execFileSync('git', hardenGitArgs(['diff', '--unified=0', '--no-textconv', '--no-ext-diff', `${ref}...HEAD`]), {
+      cwd: rootDir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv(),
     });
   } catch (e) {
     return { materialRisk: 'unknown', error: 'git diff failed: ' + (e.message || e), findings: [], perKindCounts: {}, byFile: {} };

package/src/posture/mttr.js

@@ -8,6 +8,29 @@
 // when to persist firstSeenAt back into the baseline.
 
 import * as crypto from 'node:crypto';
+import { AGE_BASIS } from './provenance/schema.js';
+
+// FR-PROV-019: "reports never show an age without its basis and confidence."
+// FINDING_ORIGIN is the only basis backed by a resolved git commit for the
+// finding's actual introduction; EARLIEST_OBSERVABLE is also git-derived but
+// partial (weaker claim, no exact introduction commit). UNCOMMITTED and
+// FIRST_OBSERVED are both wall-clock fallbacks — the age is a first-seen
+// timestamp, never resolved against git history — and must say so honestly
+// rather than read like a proven date.
+function _ageBasisLabel(ageBasis, confidence) {
+  const level = confidence?.level && confidence.level !== 'unknown' ? confidence.level.toUpperCase() : null;
+  switch (ageBasis) {
+    case AGE_BASIS.FINDING_ORIGIN:
+      return `proven origin${level ? `, ${level} confidence` : ''}`;
+    case AGE_BASIS.EARLIEST_OBSERVABLE:
+      return `earliest observable commit, partial history${level ? `, ${level} confidence` : ''}`;
+    case AGE_BASIS.UNCOMMITTED:
+      return 'uncommitted — first-seen fallback, origin not proven';
+    case AGE_BASIS.FIRST_OBSERVED:
+    default:
+      return 'first-seen fallback — origin not proven';
+  }
+}
 
 // Stable fingerprint for cross-scan finding identity. Mirrors the dedupe key.
 // Exported so a caller can compute the "removed since baseline" (i.e. fixed)
@@ -37,6 +60,25 @@ export function stampFindingTimestamps(findings, baselineMap = new Map(), now =
     f.lastSeenAt = nowIso;
     const firstMs = Date.parse(f.firstSeenAt);
     f.ageDays = Math.max(0, Math.floor((now - firstMs) / 86400000));
+    // FR-PROV-019: age/SLA basis. ageDays above stays pure wall-clock —
+    // every existing SLA/computeMTTR consumer keeps its current meaning.
+    // ageBasis + provenAgeDays are ADDITIVE: a report can show both and
+    // explain the discrepancy, never silently swap which number "age" means.
+    const status = f.findingProvenance?.status;
+    const origin = f.findingProvenance?.findingOrigin;
+    if (status === 'complete' && origin?.authorDate) {
+      f.ageBasis = AGE_BASIS.FINDING_ORIGIN;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'partial' && origin?.authorDate) {
+      f.ageBasis = AGE_BASIS.EARLIEST_OBSERVABLE;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'uncommitted') {
+      f.ageBasis = AGE_BASIS.UNCOMMITTED;
+      f.provenAgeDays = f.ageDays;
+    } else {
+      f.ageBasis = AGE_BASIS.FIRST_OBSERVED;
+      f.provenAgeDays = f.ageDays;
+    }
   }
   return findings;
 }
@@ -68,28 +110,49 @@ export function findingsExceedingSLA(findings, slaDays = null) {
   });
 }
 
-// Median age (days) of the currently-open findings — a single-scan proxy for
-// "how long has this debt been sitting". True MTTR (computeMTTR) needs the set
-// of findings that were FIXED; this reports the open backlog's median age so a
-// scan can show whether debt is getting older. Returns null on empty input.
-// Local — surfaced only through renderSlaSummary (its sole consumer).
-function medianOpenAgeDays(findings) {
-  const ages = (findings || []).map(f => f.ageDays || 0).sort((a, b) => a - b);
-  if (!ages.length) return null;
-  return ages[Math.floor(ages.length / 2)];
+// Median age (days) of the currently-open findings, PLUS the ageBasis/
+// confidence of whichever finding landed on that median — a single-scan proxy
+// for "how long has this debt been sitting". True MTTR (computeMTTR) needs the
+// set of findings that were FIXED; this reports the open backlog's median age
+// so a scan can show whether debt is getting older. Returns null on empty
+// input. Local — surfaced only through renderSlaSummary (its sole consumer).
+//
+// FR-PROV-019: the days figure prefers `provenAgeDays` (git-derived when
+// available) over the pure-wall-clock `ageDays`, and the ageBasis/confidence
+// travel WITH the day count they describe — never a bare number with the
+// basis looked up separately, which is how the original miss happened
+// (ageBasis was stamped onto the finding but never reached the string that
+// printed its age). Findings stamped by an older/test caller that never ran
+// through stampFindingTimestamps (no ageBasis at all) degrade to the same
+// honest "not proven" label FIRST_OBSERVED gets, never a false claim.
+function medianOpenAge(findings) {
+  const entries = (findings || [])
+    .map(f => ({
+      days: f.provenAgeDays != null ? f.provenAgeDays : (f.ageDays || 0),
+      ageBasis: f.ageBasis || AGE_BASIS.FIRST_OBSERVED,
+      confidence: f.findingProvenance?.confidence || null,
+    }))
+    .sort((a, b) => a.days - b.days);
+  if (!entries.length) return null;
+  return entries[Math.floor(entries.length / 2)];
 }
 
 // One-line SLA-breach summary for surfacing after a scan (#10). Returns null
-// when nothing is past its per-severity SLA. Pairs with medianOpenAgeDays for a
+// when nothing is past its per-severity SLA. Pairs with medianOpenAge for a
 // "is my security debt aging" readout that the vibecoder can act on.
+//
+// FR-PROV-019: never prints the median age number without its basis and
+// confidence alongside it — see medianOpenAge/_ageBasisLabel above.
 export function renderSlaSummary(findings, slaDays = null) {
   const breached = findingsExceedingSLA(findings || [], slaDays);
   if (!breached.length) return null;
   const bySev = {};
   for (const f of breached) bySev[f.severity] = (bySev[f.severity] || 0) + 1;
   const parts = ['critical', 'high', 'medium', 'low', 'info'].filter(s => bySev[s]).map(s => `${bySev[s]} ${s}`);
-  const median = medianOpenAgeDays(findings);
-  const ageNote = median != null ? ` (median open age ${median}d)` : '';
+  const median = medianOpenAge(findings);
+  const ageNote = median != null
+    ? ` (median open age ${median.days}d, ${_ageBasisLabel(median.ageBasis, median.confidence)})`
+    : '';
   return `${breached.length} finding(s) past remediation SLA: ${parts.join(', ')}${ageNote}`;
 }