@clear-capabilities/agentic-security-scanner 0.144.0 → 0.147.0

package/dist/5561.index.js

@@ -0,0 +1,436 @@
+export const id = 5561;
+export const ids = [5561];
+export const modules = {
+
+/***/ 5561:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   evaluateVerificationEvidence: () => (/* binding */ evaluateVerificationEvidence),
+/* harmony export */   foldRemediationLedger: () => (/* binding */ foldRemediationLedger),
+/* harmony export */   validateOpenPayload: () => (/* binding */ validateOpenPayload),
+/* harmony export */   validateTransition: () => (/* binding */ validateTransition)
+/* harmony export */ });
+/* unused harmony exports REMEDIATION_STATES, REMEDIATION_EVENT_TYPES, ACCEPTED_RISK_REQUIRED_FIELDS, foldRemediationItem */
+// remediation.js — M5 deliverable #6 (Blast-Radius: Remediation Command
+// Center, FR-507 + AC-31): the pure RemediationItem contract, its event
+// fold, its state machine, and the verification-evidence decision.
+//
+// Pure by contract — zero imports, no fs, no I/O of any kind, never
+// throws. The ledger layer (`posture/remediation-ledger.js`, Task 2 of
+// this same sub-project) owns every side effect: file locking, append,
+// tolerant read, hash chaining. This module mirrors `governance-edit.js`'s
+// own split (that module's own header makes the identical claim for its
+// own CLI-write boundary) and the "pure data + pure functions, boundary-
+// tested" precedent `flow-grade.js`/`obligation-mapping.js` already set
+// in this package.
+//
+// ── The `verified`-unreachable-from-`state_changed` rule (AC-31) ──────
+//
+// AC-31's own `then`-clause requires that marking remediation work
+// "done" can NEVER, by itself, mark a finding verified — only a real
+// scan re-confirming the flow is gone (`scan_verification`) or an
+// explicitly-permitted, explicitly-attributed manual attestation
+// (`manual_attestation`) may transition an item into `verified`. PRD
+// line 171 states the same rule as an explicit non-goal: this deliverable
+// must never let "I fixed it" (a human claim) substitute for "the scanner
+// re-observed the flow is gone" (an evidence-backed claim) without an
+// explicit, auditable manual-attestation opt-in. `validateTransition`
+// enforces this by rejecting `state_changed` with `state: 'verified'`
+// FIRST, before even looking at the item's current state — the rejection
+// is therefore genuinely unconditional, not just unreached from the
+// states this module happens to reach today.
+//
+// ── Deliberate scope narrowing in evaluateVerificationEvidence ────────
+//
+// A required-evidence flow id is treated as SATISFIED only when it
+// appears in `diff.removed.flows` with `causeClassification ===
+// 'application_change'` — i.e. the flow is genuinely gone from the graph
+// and its disappearance is attributable to an application change, not to
+// the scanner simply seeing less than it used to. A flow that is still
+// PRESENT in the graph but has merely become MORE PROTECTED (e.g. its
+// `protectionSummary` moved from `unprotected` to `protected` — visible
+// only as a `changed.flows` entry, never a `removed.flows` entry) is
+// explicitly OUT OF SCOPE for this first cut: recognizing an "improving
+// transition" as evidence of a fix needs its own deliberate, disclosed
+// heuristic (what counts as "protected enough", whether a policy verdict
+// change alone should count, etc.) that this module does not attempt.
+// A future increment could add it; until then, such a flow reports
+// `flows_still_present`, same as a flow with no change at all.
+//
+// `possible_coverage_regression` is computed DIFF-WIDE by
+// `computeGraphDiff` (see `graph-diff.js:328`'s own
+// `coverageRegressionReasons`/`flowRemovalCause` — every removed flow in
+// one diff shares the SAME cause once any completeness signal regressed)
+// — which is why a coverage-regression hit on any of the item's OWN
+// required-evidence flows refuses the WHOLE verification immediately (PRD
+// line 1975), rather than letting other, seemingly-clean required-
+// evidence flows in the same diff verify: an incomplete scan cannot be
+// trusted to have honestly seen everything it claims to have not seen.
+// (The loop below only ever inspects `diff.removed.flows` entries for
+// flows actually named in `requiredEvidenceFlowIds` — an unrelated
+// removed flow elsewhere in the same diff is never consulted.)
+
+const REMEDIATION_STATES = Object.freeze([
+  'open', 'in_progress', 'awaiting_verification', 'verified', 'accepted_risk', 'reopened',
+]);
+
+const REMEDIATION_EVENT_TYPES = Object.freeze([
+  'opened', 'state_changed', 'scan_verification', 'manual_attestation', 'accepted_risk', 'reopened',
+]);
+
+// PRD line 572's exact four-field list (scoping doc §4.3).
+const ACCEPTED_RISK_REQUIRED_FIELDS = Object.freeze(['approver', 'reason', 'scope', 'expiration']);
+
+function _isNonEmptyString(v) {
+  return typeof v === 'string' && v.length > 0;
+}
+
+function _isPlainObject(v) {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+
+// ── foldRemediationItem / foldRemediationLedger ────────────────────────
+
+/**
+ * Folds an ordered event list for ONE remediation item into its current
+ * shape, or `null` for an empty/malformed/non-`opened`-first list. Never
+ * throws.
+ */
+function foldRemediationItem(events) {
+  if (!Array.isArray(events) || events.length === 0) return null;
+  const openEvent = events[0];
+  if (!openEvent || openEvent.type !== 'opened') return null;
+
+  const item = {
+    id: openEvent.id,
+    state: 'open',
+    owner: openEvent.owner,
+    dueDate: openEvent.dueDate,
+    recommendedControl: openEvent.recommendedControl,
+    assessment: openEvent.assessment,
+    affectedFlowIds: openEvent.affectedFlowIds,
+    affectedNodeIds: openEvent.affectedNodeIds,
+    affectedEdgeIds: openEvent.affectedEdgeIds,
+    requiredEvidence: openEvent.requiredEvidence,
+    manualAttestationPermitted: openEvent.manualAttestationPermitted,
+    approvals: [],
+    exceptions: [],
+    verificationSnapshotId: null,
+    history: events,
+  };
+
+  for (let i = 1; i < events.length; i++) {
+    const ev = events[i];
+    if (!ev || typeof ev !== 'object') continue;
+    switch (ev.type) {
+      case 'state_changed':
+        item.state = ev.state;
+        break;
+      case 'scan_verification':
+        if (ev.outcome === 'verified') {
+          item.state = 'verified';
+          item.verificationSnapshotId = ev.snapshotId;
+        }
+        // an 'unverifiable' outcome changes neither state nor snapshot.
+        break;
+      case 'manual_attestation':
+        item.state = 'verified';
+        item.approvals.push({
+          approver: ev.approver, reason: ev.reason, at: ev.at, evidenceKind: 'manual',
+        });
+        // Records a real baseline (final-review fix round 1, Blocking-3):
+        // without this, a manually-attested item keeps whatever STALE
+        // `verificationSnapshotId` it happened to carry (or `null`,
+        // falling back to an even less defensible baseline) forever, and
+        // `reopen-check` keeps diffing from that stale anchor — reopening
+        // a just-permitted attestation on the very next run even though
+        // nothing changed. `ev.snapshotId` is optional (a manual
+        // attestation before any lineage scan has ever run is legitimate).
+        if (ev.snapshotId) item.verificationSnapshotId = ev.snapshotId;
+        break;
+      case 'accepted_risk':
+        item.state = 'accepted_risk';
+        item.exceptions.push({
+          approver: ev.approver, reason: ev.reason, scope: ev.scope, expiration: ev.expiration, at: ev.at,
+        });
+        break;
+      case 'reopened':
+        item.state = 'reopened';
+        // Retires the stale anchor (final-review fix round 1, Blocking-3)
+        // so it cannot outlive the verification it belonged to — the next
+        // verification (scan or manual) must establish its own baseline.
+        item.verificationSnapshotId = null;
+        break;
+      default:
+        // an unrecognized event type is ignored by the fold — validation
+        // of proposed events is validateTransition's job, not this one's.
+        break;
+    }
+  }
+
+  return item;
+}
+
+/**
+ * Groups a flat, interleaved event stream by item id (`ev.itemId`,
+ * falling back to `ev.id` on an `opened` event that carries only `id`),
+ * preserving per-group insertion order, and folds each group. Events with
+ * no resolvable item id are skipped. Groups that fold to `null` are
+ * dropped. Never throws.
+ */
+function foldRemediationLedger(allEvents) {
+  const result = {};
+  if (!Array.isArray(allEvents)) return result;
+
+  const groups = new Map();
+  for (const ev of allEvents) {
+    if (!ev || typeof ev !== 'object') continue;
+    const itemId = ev.itemId ?? (ev.type === 'opened' ? ev.id : undefined);
+    if (!_isNonEmptyString(itemId)) continue;
+    if (!groups.has(itemId)) groups.set(itemId, []);
+    groups.get(itemId).push(ev);
+  }
+
+  for (const [itemId, events] of groups) {
+    const item = foldRemediationItem(events);
+    if (item !== null) result[itemId] = item;
+  }
+
+  return result;
+}
+
+// ── validateOpenPayload ─────────────────────────────────────────────────
+
+const _REQUIRED_ASSESSMENT_FIELDS = [
+  'assessmentId', 'targetId', 'targetKind', 'traceKind', 'scope', 'graphId', 'graphDigest', 'snapshotId',
+];
+
+const _DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+
+/**
+ * Validates an `opened`-event-shaped payload. Returns `{valid, errors}`,
+ * `errors` as `[{field, message}]`. Never throws.
+ */
+function validateOpenPayload(payload) {
+  const errors = [];
+  const err = (field, message) => errors.push({ field, message });
+
+  if (!_isPlainObject(payload)) {
+    err('(payload)', 'payload must be an object');
+    return { valid: false, errors };
+  }
+
+  for (const field of ['id', 'owner', 'recommendedControl']) {
+    if (!_isNonEmptyString(payload[field])) err(field, `${field} is required and must be a non-empty string`);
+  }
+
+  if (!_isNonEmptyString(payload.dueDate) || !_DATE_RE.test(payload.dueDate)) {
+    err('dueDate', 'dueDate is required and must be a YYYY-MM-DD date');
+  }
+
+  if (!_isPlainObject(payload.assessment)) {
+    err('assessment', 'assessment is required and must be an object');
+  } else {
+    for (const field of _REQUIRED_ASSESSMENT_FIELDS) {
+      if (!_isNonEmptyString(payload.assessment[field])) {
+        err(`assessment.${field}`, `assessment.${field} is required and must be a non-empty string`);
+      }
+    }
+    // assessmentPath is the one OPTIONAL inline field — no check.
+  }
+
+  const evidence = payload.requiredEvidence;
+  if (!Array.isArray(evidence) || evidence.length === 0 || !evidence.every(_isNonEmptyString)) {
+    err('requiredEvidence', 'requiredEvidence is required and must be a non-empty array of non-empty strings');
+  }
+
+  return { valid: errors.length === 0, errors };
+}
+
+// ── validateTransition — AC-31's own state machine ──────────────────────
+
+/**
+ * Validates a proposed event against a remediation item's current state
+ * (or `null` for no item yet). Returns `{valid, errors}`, `errors` as
+ * `[{field, message}]`. Never throws.
+ */
+function validateTransition(item, proposedEvent) {
+  const errors = [];
+  const err = (field, message) => errors.push({ field, message });
+
+  if (!_isPlainObject(proposedEvent)) {
+    err('(event)', 'proposed event must be an object');
+    return { valid: false, errors };
+  }
+
+  const type = proposedEvent.type;
+
+  if (type === 'opened') {
+    if (item !== null && item !== undefined) {
+      err('type', 'a remediation item with this id already exists — opened is only valid when no item exists');
+      return { valid: false, errors };
+    }
+    return { valid: true, errors: [] };
+  }
+
+  // AC-31's own load-bearing rule: state_changed can never reach
+  // `verified`. Checked FIRST, before even the "item must exist" check
+  // below, so the rejection is genuinely unconditional — reachable from
+  // no state at all, including no item — and cannot be routed around by
+  // any current state. See this file's own header.
+  if (type === 'state_changed' && proposedEvent.state === 'verified') {
+    err('state', 'state_changed can never reach verified — only scan_verification or manual_attestation may');
+    return { valid: false, errors };
+  }
+
+  // Every other event type requires an existing item.
+  if (!_isPlainObject(item)) {
+    err('type', `${type} is not valid against no item — open the item first`);
+    return { valid: false, errors };
+  }
+
+  switch (type) {
+    case 'state_changed': {
+      if (proposedEvent.state === 'in_progress') {
+        if (item.state !== 'open' && item.state !== 'reopened') {
+          err('state', `state_changed to in_progress is only valid from open or reopened, not ${item.state}`);
+        }
+      } else if (proposedEvent.state === 'awaiting_verification') {
+        if (item.state !== 'in_progress') {
+          err('state', `state_changed to awaiting_verification is only valid from in_progress, not ${item.state}`);
+        }
+      } else {
+        err('state', `state_changed to ${JSON.stringify(proposedEvent.state)} is not a recognized transition`);
+      }
+      break;
+    }
+
+    case 'scan_verification': {
+      if (item.state !== 'awaiting_verification') {
+        err('type', `scan_verification is only valid from awaiting_verification, not ${item.state}`);
+        break;
+      }
+      if (proposedEvent.outcome === 'verified') {
+        if (!_isNonEmptyString(proposedEvent.snapshotId)) {
+          err('snapshotId', 'a verified outcome requires a snapshotId');
+        }
+      } else if (proposedEvent.outcome === 'unverifiable') {
+        // no further requirement beyond the outcome itself.
+      } else {
+        err('outcome', `outcome ${JSON.stringify(proposedEvent.outcome)} is not a recognized scan_verification outcome`);
+      }
+      break;
+    }
+
+    case 'manual_attestation': {
+      if (item.state !== 'awaiting_verification') {
+        err('type', `manual_attestation is only valid from awaiting_verification, not ${item.state}`);
+        break;
+      }
+      if (!item.manualAttestationPermitted) {
+        err('manualAttestationPermitted', 'manual attestation is not permitted for this item — it must be opened with --allow-manual-attestation to allow one (open a new item if this one predates that need)');
+        break;
+      }
+      if (!_isNonEmptyString(proposedEvent.approver)) err('approver', 'manual_attestation requires a non-empty approver');
+      if (!_isNonEmptyString(proposedEvent.reason)) err('reason', 'manual_attestation requires a non-empty reason');
+      break;
+    }
+
+    case 'accepted_risk': {
+      if (item.state === 'verified' || item.state === 'accepted_risk') {
+        err('type', `accepted_risk is not valid from ${item.state}`);
+        break;
+      }
+      for (const field of ACCEPTED_RISK_REQUIRED_FIELDS) {
+        if (!_isNonEmptyString(proposedEvent[field])) {
+          err(field, `accepted_risk requires a non-empty ${field}`);
+        }
+      }
+      break;
+    }
+
+    case 'reopened': {
+      if (item.state !== 'verified') {
+        err('type', `reopened is only valid from verified, not ${item.state}`);
+        break;
+      }
+      if (!_isNonEmptyString(proposedEvent.reason)) {
+        err('reason', 'reopened must always carry a non-empty reason naming what triggered it');
+      }
+      break;
+    }
+
+    default:
+      err('type', `${JSON.stringify(type)} is not a recognized remediation event type`);
+      break;
+  }
+
+  return { valid: errors.length === 0, errors };
+}
+
+// ── evaluateVerificationEvidence ────────────────────────────────────────
+
+/**
+ * Decides whether a GraphDiff's real, checkable evidence satisfies every
+ * flow id a remediation item required evidence for. See this file's own
+ * header for the deliberate scope narrowing and the coverage-regression
+ * whole-verification-refusal rule. Never throws.
+ */
+function evaluateVerificationEvidence(diff, requiredEvidenceFlowIds) {
+  if (!Array.isArray(requiredEvidenceFlowIds) || requiredEvidenceFlowIds.length === 0) {
+    return { outcome: 'unverifiable', reason: 'no_required_evidence' };
+  }
+
+  const removedFlows = diff?.removed?.flows;
+  const removedById = new Map();
+  if (Array.isArray(removedFlows)) {
+    for (const entry of removedFlows) {
+      if (entry && typeof entry.id === 'string') removedById.set(entry.id, entry);
+    }
+  }
+
+  const unsatisfiedFlowIds = [];
+
+  for (const flowId of requiredEvidenceFlowIds) {
+    const entry = removedById.get(flowId);
+    const cause = entry?.causeClassification;
+
+    if (cause === 'possible_coverage_regression') {
+      return {
+        outcome: 'unverifiable',
+        reason: 'possible_coverage_regression',
+        flowId,
+        coverageRegressionReasons: entry.coverageRegressionReasons,
+      };
+    }
+
+    if (cause === 'reidentified') {
+      return {
+        outcome: 'unverifiable',
+        reason: 'reidentified',
+        flowId,
+        reidentifiedTo: entry.reidentifiedTo,
+      };
+    }
+
+    if (cause === 'application_change') {
+      continue; // satisfied
+    }
+
+    // Absent from removed.flows entirely, or an unrecognized
+    // classification — either way, not satisfied.
+    unsatisfiedFlowIds.push(flowId);
+  }
+
+  if (unsatisfiedFlowIds.length > 0) {
+    return { outcome: 'unverifiable', reason: 'flows_still_present', unsatisfiedFlowIds };
+  }
+
+  return { outcome: 'verified' };
+}
+
+
+/***/ })
+
+};

package/dist/{637.index.js → 5637.index.js}

@@ -1,5 +1,5 @@
-export const id = 637;
-export const ids = [637];
+export const id = 5637;
+export const ids = [5637];
 export const modules = {
 
 /***/ 5637:
@@ -11,7 +11,8 @@ export const modules = {
 /* harmony export */   renderPrDeltaText: () => (/* binding */ renderPrDeltaText)
 /* harmony export */ });
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(7087);
+/* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8844);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(9753);
 // Shadowscan / security-DELTA on PR (v0.72).
 //
 // Most SAST PR-comment integrations show absolute counts — "12 findings
@@ -40,16 +41,25 @@ export const modules = {
 
 
 
+
 const FILE_EXT_RE = /\.(?:js|jsx|ts|tsx|mjs|cjs|py|java|cs|kt|go|rb|php|sol|swift|rs|tf|yml|yaml|json|toml|md)$/i;
 const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
 
+// `root` is the PR's repository — a scan target, not this project's own
+// trusted checkout — hardened per FR-PROV-024 / the second Finding
+// Provenance PRD audit (same exposure class as
+// provenance/git-evidence.js's `_run`).
 function _git(root, args) {
-  const r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)('git', args, { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  const r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)('git', (0,_util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__/* .hardenGitArgs */ .Ax)(args), { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, env: (0,_util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__/* .hardenGitEnv */ .Si)() });
   return { ok: r.status === 0, stdout: r.stdout || '', stderr: r.stderr || '' };
 }
 
 function _readFileAtRef(root, ref, file) {
-  const r = _git(root, ['show', `${ref}:${file}`]);
+  // `--no-textconv`: this blob-cat form of `show` (`<ref>:<file>`, not a
+  // diff) was verified NOT reachable via a hostile textconv driver in
+  // current git, same as git-evidence.js's getBlobAtCommit — kept for
+  // defense-in-depth/uniformity.
+  const r = _git(root, ['show', '--no-textconv', `${ref}:${file}`]);
   return r.ok ? r.stdout : null;
 }
 
@@ -70,7 +80,12 @@ async function _scanAtRef(root, ref) {
     const c = _readFileAtRef(root, ref, f);
     if (c != null) fileContents[f] = c;
   }
-  return (0,_engine_js__WEBPACK_IMPORTED_MODULE_1__/* .runFullScan */ .wW)({ fileContents, scanRoot: root }, () => {});
+  // `provenance:false` — a base-ref snapshot, not the current working state.
+  // Beyond the wasted git walks, updateLifecycle marks every open stableId
+  // absent from the finding set it is handed as `remediated`; running the PR
+  // delta gate would silently rewrite the project's lifecycle store from the
+  // base ref's findings.
+  return (0,_engine_js__WEBPACK_IMPORTED_MODULE_2__/* .runFullScan */ .wW)({ fileContents, scanRoot: root, provenance: false }, () => {});
 }
 
 function _summary(findings) {
@@ -85,7 +100,14 @@ function _summary(findings) {
 }
 
 function _changedFiles(root, baseRef, headRef) {
-  const r = _git(root, ['diff', '--name-only', `${baseRef}...${headRef}`]);
+  // `--no-ext-diff`: found during the second-audit-remediation sweep — this
+  // is a `git diff` call site (`--name-only`, no content rendered, so not
+  // itself a verified exploit path today, same as runScan.js's
+  // `changedSince`), but every `diff` invocation in this codebase gets it
+  // uniformly per the live exploit VERIFIED in material-change.js's
+  // classifyGitDiff (external diff drivers fire on `git diff` even with
+  // `--no-textconv`, which is a surface `--no-textconv` alone does not close).
+  const r = _git(root, ['diff', '--name-only', '--no-ext-diff', `${baseRef}...${headRef}`]);
   if (!r.ok) return new Set();
   return new Set(r.stdout.trim().split('\n').filter(Boolean));
 }

package/dist/{449.index.js → 5830.index.js}

@@ -1,5 +1,5 @@
-export const id = 449;
-export const ids = [449];
+export const id = 5830;
+export const ids = [5830];
 export const modules = {
 
 /***/ 5830:
@@ -14,6 +14,7 @@ export const modules = {
 /* harmony export */ });
 /* unused harmony export findingsExceedingSLA */
 /* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
+/* harmony import */ var _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(4594);
 // 0.8.0 Feat-11: MTTR / finding-age tracking — per-finding firstSeenAt/lastSeenAt with SLA breach detection.
 //
 // Stamps every finding with `firstSeenAt` (preserved from the baseline if the
@@ -25,6 +26,29 @@ export const modules = {
 
 
 
+
+// FR-PROV-019: "reports never show an age without its basis and confidence."
+// FINDING_ORIGIN is the only basis backed by a resolved git commit for the
+// finding's actual introduction; EARLIEST_OBSERVABLE is also git-derived but
+// partial (weaker claim, no exact introduction commit). UNCOMMITTED and
+// FIRST_OBSERVED are both wall-clock fallbacks — the age is a first-seen
+// timestamp, never resolved against git history — and must say so honestly
+// rather than read like a proven date.
+function _ageBasisLabel(ageBasis, confidence) {
+  const level = confidence?.level && confidence.level !== 'unknown' ? confidence.level.toUpperCase() : null;
+  switch (ageBasis) {
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FINDING_ORIGIN:
+      return `proven origin${level ? `, ${level} confidence` : ''}`;
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.EARLIEST_OBSERVABLE:
+      return `earliest observable commit, partial history${level ? `, ${level} confidence` : ''}`;
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.UNCOMMITTED:
+      return 'uncommitted — first-seen fallback, origin not proven';
+    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED:
+    default:
+      return 'first-seen fallback — origin not proven';
+  }
+}
+
 // Stable fingerprint for cross-scan finding identity. Mirrors the dedupe key.
 // Exported so a caller can compute the "removed since baseline" (i.e. fixed)
 // set that computeMTTR needs, using the exact same identity function
@@ -53,6 +77,25 @@ function stampFindingTimestamps(findings, baselineMap = new Map(), now = Date.no
     f.lastSeenAt = nowIso;
     const firstMs = Date.parse(f.firstSeenAt);
     f.ageDays = Math.max(0, Math.floor((now - firstMs) / 86400000));
+    // FR-PROV-019: age/SLA basis. ageDays above stays pure wall-clock —
+    // every existing SLA/computeMTTR consumer keeps its current meaning.
+    // ageBasis + provenAgeDays are ADDITIVE: a report can show both and
+    // explain the discrepancy, never silently swap which number "age" means.
+    const status = f.findingProvenance?.status;
+    const origin = f.findingProvenance?.findingOrigin;
+    if (status === 'complete' && origin?.authorDate) {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FINDING_ORIGIN;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'partial' && origin?.authorDate) {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.EARLIEST_OBSERVABLE;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'uncommitted') {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.UNCOMMITTED;
+      f.provenAgeDays = f.ageDays;
+    } else {
+      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED;
+      f.provenAgeDays = f.ageDays;
+    }
   }
   return findings;
 }
@@ -84,28 +127,49 @@ function findingsExceedingSLA(findings, slaDays = null) {
   });
 }
 
-// Median age (days) of the currently-open findings — a single-scan proxy for
-// "how long has this debt been sitting". True MTTR (computeMTTR) needs the set
-// of findings that were FIXED; this reports the open backlog's median age so a
-// scan can show whether debt is getting older. Returns null on empty input.
-// Local — surfaced only through renderSlaSummary (its sole consumer).
-function medianOpenAgeDays(findings) {
-  const ages = (findings || []).map(f => f.ageDays || 0).sort((a, b) => a - b);
-  if (!ages.length) return null;
-  return ages[Math.floor(ages.length / 2)];
+// Median age (days) of the currently-open findings, PLUS the ageBasis/
+// confidence of whichever finding landed on that median — a single-scan proxy
+// for "how long has this debt been sitting". True MTTR (computeMTTR) needs the
+// set of findings that were FIXED; this reports the open backlog's median age
+// so a scan can show whether debt is getting older. Returns null on empty
+// input. Local — surfaced only through renderSlaSummary (its sole consumer).
+//
+// FR-PROV-019: the days figure prefers `provenAgeDays` (git-derived when
+// available) over the pure-wall-clock `ageDays`, and the ageBasis/confidence
+// travel WITH the day count they describe — never a bare number with the
+// basis looked up separately, which is how the original miss happened
+// (ageBasis was stamped onto the finding but never reached the string that
+// printed its age). Findings stamped by an older/test caller that never ran
+// through stampFindingTimestamps (no ageBasis at all) degrade to the same
+// honest "not proven" label FIRST_OBSERVED gets, never a false claim.
+function medianOpenAge(findings) {
+  const entries = (findings || [])
+    .map(f => ({
+      days: f.provenAgeDays != null ? f.provenAgeDays : (f.ageDays || 0),
+      ageBasis: f.ageBasis || _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED,
+      confidence: f.findingProvenance?.confidence || null,
+    }))
+    .sort((a, b) => a.days - b.days);
+  if (!entries.length) return null;
+  return entries[Math.floor(entries.length / 2)];
 }
 
 // One-line SLA-breach summary for surfacing after a scan (#10). Returns null
-// when nothing is past its per-severity SLA. Pairs with medianOpenAgeDays for a
+// when nothing is past its per-severity SLA. Pairs with medianOpenAge for a
 // "is my security debt aging" readout that the vibecoder can act on.
+//
+// FR-PROV-019: never prints the median age number without its basis and
+// confidence alongside it — see medianOpenAge/_ageBasisLabel above.
 function renderSlaSummary(findings, slaDays = null) {
   const breached = findingsExceedingSLA(findings || [], slaDays);
   if (!breached.length) return null;
   const bySev = {};
   for (const f of breached) bySev[f.severity] = (bySev[f.severity] || 0) + 1;
   const parts = ['critical', 'high', 'medium', 'low', 'info'].filter(s => bySev[s]).map(s => `${bySev[s]} ${s}`);
-  const median = medianOpenAgeDays(findings);
-  const ageNote = median != null ? ` (median open age ${median}d)` : '';
+  const median = medianOpenAge(findings);
+  const ageNote = median != null
+    ? ` (median open age ${median.days}d, ${_ageBasisLabel(median.ageBasis, median.confidence)})`
+    : '';
   return `${breached.length} finding(s) past remediation SLA: ${parts.join(', ')}${ageNote}`;
 }