@clear-capabilities/agentic-security-scanner 0.144.0 → 0.147.0

package/dist/{985.index.js → 2376.index.js}

@@ -1,8 +1,166 @@
-export const id = 985;
-export const ids = [985,752];
+export const id = 2376;
+export const ids = [2376,8218,9390,8752];
 export const modules = {
 
-/***/ 3985:
+/***/ 9390:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   auditCall: () => (/* binding */ auditCall)
+/* harmony export */ });
+/* unused harmony export verifyAuditLog */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(7598);
+/* harmony import */ var _redact_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(3468);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(1174);
+// Append-only audit log of MCP tool calls — OWASP MCP08.
+//
+// Format: one JSON object per line (NDJSON) at
+//   <sessionRoot>/.agentic-security/mcp-audit.log
+//
+// Each entry carries `prev` — the SHA-256 of the previous entry's serialized
+// form. The first entry's prev is "GENESIS". Tampering with any line breaks
+// the chain from that point forward; a reader can detect partial truncation
+// or in-place edits.
+//
+// REMOTE SINK (post-recommendation #10). The local file alone cannot detect
+// a total rewrite — an attacker with FS write can re-author the whole log
+// with fresh hashes. Closing that blind spot requires an off-host witness.
+// Set $AGENTIC_SECURITY_AUDIT_WEBHOOK to a POST endpoint; every entry is
+// fire-and-forget POSTed there in addition to the local append. Failures
+// to reach the webhook are best-effort — they NEVER block a tool call,
+// because that would let a network outage become a denial of service. They
+// DO get recorded as `_remoteSinkErr` on the local entry, so an operator
+// reviewing the log later can spot a forging attempt that targeted the
+// remote (any gap between local-sequence and remote-sequence is evidence).
+//
+// Argument blobs are redacted (OWASP MCP01/MCP10) so credentials passed in
+// arguments cannot leak via the audit trail OR via the remote sink.
+
+
+
+
+
+
+
+const MAX_ARG_BYTES = 1024;
+const GENESIS = 'GENESIS';
+const REMOTE_TIMEOUT_MS = 1500;
+
+// Per-process session ID (harness-anatomy #9). Stamped on every audit entry
+// so downstream metrics can aggregate by session and surface outliers like
+// "200 apply_fix calls in one session." The ID is `<pid>-<short-ts>` — not
+// cryptographically unique, but enough to disambiguate concurrent runs on
+// the same host. Stable for the lifetime of this Node process.
+const SESSION_ID = `${process.pid}-${Date.now().toString(36).slice(-6)}`;
+
+function _summarize(args) {
+  let s;
+  try { s = JSON.stringify(args); } catch { s = '<unserializable>'; }
+  s = (0,_redact_js__WEBPACK_IMPORTED_MODULE_4__/* .redactArgsBlob */ .MC)(s);
+  if (s.length > MAX_ARG_BYTES) s = s.slice(0, MAX_ARG_BYTES) + `…(+${s.length - MAX_ARG_BYTES})`;
+  return s;
+}
+
+function _sha(s) { return node_crypto__WEBPACK_IMPORTED_MODULE_2__.createHash('sha256').update(s).digest('hex'); }
+
+function _readLastEntryHash(logFile) {
+  if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(logFile)) return GENESIS;
+  try {
+    const all = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(logFile, 'utf8');
+    const lines = all.split('\n').filter(Boolean);
+    if (!lines.length) return GENESIS;
+    return _sha(lines[lines.length - 1]);
+  } catch { return GENESIS; }
+}
+
+// Fire-and-forget POST to the remote sink. Resolves to null on success,
+// to a short error string on failure. Never throws; never blocks longer
+// than REMOTE_TIMEOUT_MS. The local audit append happens regardless.
+async function _postRemote(url, entry) {
+  try {
+    const controller = new AbortController();
+    const t = setTimeout(() => controller.abort(), REMOTE_TIMEOUT_MS);
+    const r = await fetch(url, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(entry),
+      signal: controller.signal,
+    });
+    clearTimeout(t);
+    if (!r.ok) return `HTTP ${r.status}`;
+    return null;
+  } catch (e) {
+    return String((e && e.message) || e).slice(0, 200);
+  }
+}
+
+function auditCall({ sessionRoot, tool, args, outcome, reason }) {
+  if (!sessionRoot) return;
+  try {
+    // Safety: only write audit log if sessionRoot looks like a project root
+    const MARKERS = ['.git', 'package.json', 'pyproject.toml', 'go.mod', 'Cargo.toml', 'pom.xml', 'composer.json', 'Gemfile'];
+    let hasMarker = false;
+    for (const m of MARKERS) { try { if (node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(node_path__WEBPACK_IMPORTED_MODULE_1__.join(sessionRoot, m))) { hasMarker = true; break; } } catch {} }
+    if (!hasMarker) return;
+    const dir = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_3__/* .stateDir */ .Pn)(sessionRoot);
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
+    const logFile = node_path__WEBPACK_IMPORTED_MODULE_1__.join(dir, 'mcp-audit.log');
+    const entry = {
+      ts: new Date().toISOString(),
+      sessionId: SESSION_ID,
+      tool,
+      outcome,
+      ...(reason ? { reason } : {}),
+      args: _summarize(args),
+      prev: _readLastEntryHash(logFile),
+    };
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(logFile, JSON.stringify(entry) + '\n');
+    // Remote sink (post-recommendation #10). Fire-and-forget. We don't await
+    // the promise so the tool call returns immediately; the remote POST runs
+    // on its own microtask. Failures get logged to a sidecar file so the
+    // operator can detect when the sink is unreachable.
+    const webhook = process.env.AGENTIC_SECURITY_AUDIT_WEBHOOK;
+    if (webhook) {
+      _postRemote(webhook, entry).then((err) => {
+        if (!err) return;
+        try {
+          const errFile = node_path__WEBPACK_IMPORTED_MODULE_1__.join(dir, 'mcp-audit.remote-errors.log');
+          node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(errFile, JSON.stringify({
+            ts: new Date().toISOString(), entryTs: entry.ts, tool, err,
+          }) + '\n');
+        } catch { /* nothing else to do */ }
+      });
+    }
+  } catch { /* audit failure must never break a tool call */ }
+}
+
+// Verify the chain from start to end. Returns
+//   { ok: true, entries: N } if intact
+//   { ok: false, brokenAt: <line-index>, expected, got } if any link breaks
+// Reader/operator-facing tool.
+function verifyAuditLog(logFile) {
+  if (!fs.existsSync(logFile)) return { ok: true, entries: 0 };
+  const text = fs.readFileSync(logFile, 'utf8');
+  const lines = text.split('\n').filter(Boolean);
+  let expectedPrev = GENESIS;
+  for (let i = 0; i < lines.length; i++) {
+    let entry;
+    try { entry = JSON.parse(lines[i]); }
+    catch { return { ok: false, brokenAt: i, reason: 'not JSON' }; }
+    if (entry.prev !== expectedPrev) {
+      return { ok: false, brokenAt: i, expected: expectedPrev, got: entry.prev };
+    }
+    expectedPrev = _sha(lines[i]);
+  }
+  return { ok: true, entries: lines.length };
+}
+
+
+/***/ }),
+
+/***/ 2376:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -23,87 +181,261 @@ var external_node_url_ = __webpack_require__(3136);
 var promises_ = __webpack_require__(1455);
 // EXTERNAL MODULE: ./src/posture/fix-history.js
 var fix_history = __webpack_require__(4407);
-// EXTERNAL MODULE: ./src/posture/integrity.js
-var integrity = __webpack_require__(1130);
-// EXTERNAL MODULE: ./src/posture/cache-economics.js
-var cache_economics = __webpack_require__(8752);
-;// CONCATENATED MODULE: ./src/mcp/redact.js
-// Secret redactor for MCP tool outputs and audit log argument summaries.
+// EXTERNAL MODULE: ./src/fix/apply-fix-service.js
+var apply_fix_service = __webpack_require__(7730);
+// EXTERNAL MODULE: ./src/posture/material-change.js
+var material_change = __webpack_require__(4629);
+// EXTERNAL MODULE: ./src/fix/approver-registry.js
+var approver_registry = __webpack_require__(437);
+;// CONCATENATED MODULE: ./src/posture/deterministic-fix.js
+// Deterministic fix synthesis (#1) — for the narrow set of vulnerability classes
+// where a context-INDEPENDENT literal swap is a safe, correct fix, produce a
+// full-file replacement from the current file content. No LLM, no guessing, no
+// per-finding bloat in last-scan.json (the patch is materialized on demand by
+// synthesize_fix from the live file, not stored on every finding).
 //
-// OWASP MCP01 + MCP10: the scanner reads source code, and findings carry
-// `snippet` / `description` / `trace` strings that may contain hardcoded
-// credentials, API keys, JWTs, private keys, etc. When those flow back to
-// the agent through tools/call responses they land in the agent's context
-// — exposing the secret to model logs, transcripts, and any downstream tool
-// the agent passes them to.
+// Safety: every patch this produces is still gated by verify_fix before apply_fix
+// writes it (original finding gone + no new ≥medium + lint clean). So a swap that
+// a rule mis-attributed simply fails verification instead of landing a bad edit —
+// this module widens the deterministic-fix surface without weakening the gate.
 //
-// We replace high-confidence secret shapes with [REDACTED:<kind>] before
-// emitting them. The original full content is still on disk (scanner
-// findings); the MCP surface is the bottleneck we control.
-//
-// Patterns deliberately stay narrow: high-precision so we don't garble
-// non-secret long strings (UUIDs, SHAs, base64-encoded scan IDs).
-
-const PATTERNS = [
-  // Provider-specific high-entropy keys (anchored prefixes give very low FP)
-  [/AKIA[0-9A-Z]{16}/g, 'aws-access-key'],
-  [/ASIA[0-9A-Z]{16}/g, 'aws-temp-key'],
-  [/gh[pousr]_[A-Za-z0-9]{36,255}/g, 'github-token'],
-  [/xox[abprs]-[A-Za-z0-9-]{10,}/g, 'slack-token'],
-  [/sk-ant-[A-Za-z0-9_-]{20,}/g, 'anthropic-key'],
-  [/sk-proj-[A-Za-z0-9_-]{20,}/g, 'openai-project-key'],
-  [/sk-[A-Za-z0-9]{32,}/g, 'openai-or-stripe-key'],
-  [/sk_(?:live|test)_[A-Za-z0-9]{20,}/g, 'stripe-key'],
-  [/rk_(?:live|test)_[A-Za-z0-9]{20,}/g, 'stripe-restricted-key'],
-  [/SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/g, 'sendgrid-key'],
-  [/AIza[0-9A-Za-z_-]{35}/g, 'google-api-key'],
-  // JWT — three dot-separated b64url segments starting with eyJ
-  [/eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g, 'jwt'],
-  // PEM-encoded private keys
-  [/-----BEGIN (?:RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----/g, 'private-key-block'],
-  // Authorization headers — common copy-paste shape
-  [/(?:Authorization|authorization)\s*:\s*Bearer\s+[A-Za-z0-9._~+/-]{20,}={0,2}/g, 'bearer-token'],
-  // Hardcoded password literals — assignment shape with quoted value
-  [/(password|passwd|secret|api[_-]?key|access[_-]?token)\s*[:=]\s*["'][^"'\n]{6,}["']/gi, 'hardcoded-credential'],
+// Returns { patch: { [relFile]: newContent }, ruleId } or null when no
+// deterministic fix applies to the finding.
+
+const JS_EXT = /\.(?:js|jsx|ts|tsx|mjs|cjs)$/i;
+const PY_EXT = /\.py$/i;
+
+// Each rule gates on the finding's cwe/family, then rewrites the whole-file
+// content. transform() returns the new content, or null when nothing changed
+// (e.g. the vulnerable token isn't literally present — then we don't claim a fix).
+const RULES = [
+  {
+    id: 'weak-hash-sha256',
+    // md5 / sha1 → sha256. Every occurrence in the file is a weak hash, so
+    // swapping them all is safe; the verifier confirms the weak-hash finding is
+    // gone and nothing worse appeared.
+    applies: (f) => /CWE-(?:327|328|916)/.test(f.cwe || '') || /weak.?hash/i.test(f.family || ''),
+    transform: (content, file) => {
+      let out = content;
+      if (JS_EXT.test(file)) {
+        out = out.replace(/(\bcreateHash\s*\(\s*['"`])(?:md5|sha1)(['"`])/gi, '$1sha256$2');
+      } else if (PY_EXT.test(file)) {
+        out = out.replace(/\bhashlib\.(?:md5|sha1)\s*\(/g, 'hashlib.sha256(');
+      }
+      return out !== content ? out : null;
+    },
+  },
+  {
+    id: 'tls-verify-on',
+    // Disabled TLS verification → enabled. rejectUnauthorized:false → true (JS),
+    // verify=False → verify=True (Python requests).
+    applies: (f) => /CWE-295/.test(f.cwe || '') || /tls.?no.?verify|cert.?(?:none|verify)/i.test(f.family || ''),
+    transform: (content, file) => {
+      let out = content;
+      if (JS_EXT.test(file)) {
+        out = out.replace(/(\brejectUnauthorized\s*:\s*)false\b/g, '$1true');
+      } else if (PY_EXT.test(file)) {
+        out = out.replace(/(\bverify\s*=\s*)False\b/g, '$1True');
+      }
+      return out !== content ? out : null;
+    },
+  },
 ];
 
-const SNIPPET_MAX = 2000;
-// OWASP A03 — cap input before running 14 regex patterns over it. A forged
-// last-scan.json could plant a 50MB description string; without this cap a
-// single explain_finding/query_taint call would peg CPU. After truncation
-// the snippet still gets the final SNIPPET_MAX trim downstream.
-const INPUT_MAX = 100_000;
-
-function redactString(s) {
-  if (typeof s !== 'string') return s;
-  let out = s;
-  if (out.length > INPUT_MAX) out = out.slice(0, INPUT_MAX) + `…(+${out.length - INPUT_MAX})`;
-  for (const [re, kind] of PATTERNS) {
-    out = out.replace(re, `[REDACTED:${kind}]`);
+function synthesizeDeterministicPatch(finding, fileContent) {
+  if (!finding || typeof fileContent !== 'string' || !finding.file) return null;
+  for (const rule of RULES) {
+    try {
+      if (!rule.applies(finding)) continue;
+      const next = rule.transform(fileContent, finding.file);
+      if (next && next !== fileContent) return { patch: { [finding.file]: next }, ruleId: rule.id };
+    } catch { /* a single rule failing must never break synthesis */ }
   }
-  if (out.length > SNIPPET_MAX) out = out.slice(0, SNIPPET_MAX) + `…(+${out.length - SNIPPET_MAX})`;
-  return out;
+  return null;
 }
 
-// Deep-redact every string in a finding-like object (mutates returned copy).
-function redactFinding(f) {
-  if (!f || typeof f !== 'object') return f;
-  const out = { ...f };
-  for (const k of ['snippet', 'description', 'remediation', 'title', 'vuln', 'message']) {
-    if (typeof out[k] === 'string') out[k] = redactString(out[k]);
-  }
-  if (out.trace) {
-    try { out.trace = JSON.parse(redactString(JSON.stringify(out.trace))); }
-    catch { /* keep as-is if not round-trippable */ }
-  }
-  return out;
-}
+// EXTERNAL MODULE: ./src/posture/integrity.js
+var integrity = __webpack_require__(1130);
+// EXTERNAL MODULE: ./src/posture/state-dir.js
+var state_dir = __webpack_require__(1174);
+// EXTERNAL MODULE: ./src/posture/cache-economics.js
+var cache_economics = __webpack_require__(8752);
+// EXTERNAL MODULE: ./src/mcp/redact.js
+var redact = __webpack_require__(3468);
+// EXTERNAL MODULE: ./src/report/index.js + 3 modules
+var report = __webpack_require__(457);
+// EXTERNAL MODULE: ./src/posture/provenance/schema.js
+var schema = __webpack_require__(4594);
+// EXTERNAL MODULE: ./src/server/graph-loader.js
+var graph_loader = __webpack_require__(8218);
+// EXTERNAL MODULE: ./src/server/routes.js
+var routes = __webpack_require__(4268);
+// EXTERNAL MODULE: ./src/lineage/redact-graph.js
+var redact_graph = __webpack_require__(334);
+// EXTERNAL MODULE: ./src/lineage/export-json.js
+var export_json = __webpack_require__(859);
+;// CONCATENATED MODULE: ./src/mcp/dataflow-tools.js
+// dataflow-tools.js — Milestone 4, sub-project MCP tools.
+//
+// Thin, read-only MCP adapter over the DataFlowGraph v1 artifact. Every
+// piece of actual graph-loading and graph-query logic here is REUSED,
+// unmodified, from scanner/src/server/ (built for the `explore` HTTP
+// server, Milestone 3): loadSignedGraph does the signed-artifact
+// load+verify, the four handleX functions do the lookups. This module
+// adds nothing but MCP tool shape (name/description/inputSchema/handler)
+// and MCP-appropriate error handling — no new graph-query logic is
+// written here, on purpose (see this sub-project's own scoping doc).
+
+
+
 
-// Redact a freeform JSON-stringified argument blob (used by audit log).
-function redactArgsBlob(s) {
-  return redactString(s);
+
+
+const META = { source: 'agentic-security-mcp', untrusted_excerpts: true };
+
+function _loadOrFailure(sessionRoot) {
+  const loaded = (0,graph_loader.loadSignedGraph)(sessionRoot);
+  if (loaded.ok) return { graph: loaded.graph };
+  return {
+    failure: {
+      _meta: META,
+      hasResult: false,
+      reason: loaded.reason,
+      message: loaded.message,
+    },
+  };
 }
 
+// Milestone 5, large-graph pagination: an optional `filter` input narrows the
+// returned graph via the exact same `validateFilterShape`/`_filterGraph`
+// pair the CLI's own `--filter` and the `explore` server's new
+// `POST /api/v1/query` endpoint both already use — one real, shared
+// primitive, not a third drifting copy. KNOWN, DISCLOSED GAP (still open):
+// an OMITTED filter still returns the whole graph inline, with the same
+// stdio.js MAX_LINE_BYTES (4MB) risk on a very large, unfiltered scan as
+// before this change — this increment adds an opt-in capability for a
+// caller that supplies a filter, it does not add a forced fallback/offload
+// for a caller that doesn't. That remains a follow-up increment.
+// Final whole-branch review finding: `filter: {}` is NOT the same as
+// omitting `filter` — `_filterGraph` treats an empty (but well-formed)
+// filter object as "narrow to nothing" (empty nodeIds/edgeIds Sets), so
+// `filter: {}` returns an EMPTY graph (zero nodes/edges/flows), not the
+// whole one. Called out explicitly in this tool's own `description` below
+// so an agent reaching for "no restriction" reaches for OMITTING the
+// argument, never for `{}`.
+const dataflow_get_graph = {
+  name: 'dataflow_get_graph',
+  description: 'Return the DataFlowGraph v1 artifact from the last signed, verified deep-mode scan: nodes, edges, flows, scope, coverage, and limitations. Requires a prior `AGENTIC_SECURITY_LINEAGE_DEEP=1 agentic-security scan`. Optional `filter: {nodeIds, edgeIds}` narrows the returned nodes/edges/flows/dataElements (same primitive as the CLI\'s `--filter` and the `explore` server\'s `POST /api/v1/query`). IMPORTANT: omit `filter` entirely for the whole graph — passing `filter: {}` returns an EMPTY graph (zero nodes/edges/flows), not the whole one, since an empty filter narrows to nothing rather than meaning "no restriction". KNOWN GAP: an OMITTED filter still returns the whole graph inline with no pagination/offload — may exceed the stdio transport line cap on a very large, unfiltered graph; supply a real, non-empty filter to narrow the response.',
+  inputSchema: {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+      filter: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          nodeIds: { type: 'array', items: { type: 'string' } },
+          edgeIds: { type: 'array', items: { type: 'string' } },
+        },
+      },
+    },
+  },
+  async handler(args, ctx) {
+    const { graph, failure } = _loadOrFailure(ctx.sessionRoot);
+    if (failure) return failure;
+    // Milestone 5, large-graph pagination: reuses the exact same
+    // validateFilterShape/_filterGraph pair the new POST /api/v1/query
+    // server endpoint and the CLI's own --filter both use — one real,
+    // shared primitive, not a third drifting copy.
+    const filterCheck = (0,export_json.validateFilterShape)(args?.filter);
+    if (!filterCheck.valid) {
+      return { _meta: META, hasResult: false, reason: 'invalid-filter', message: filterCheck.error };
+    }
+    const { status, body } = (0,routes/* handleGraph */.fn)(graph);
+    return {
+      _meta: META,
+      hasResult: true,
+      status,
+      data: (0,redact_graph/* _redactGraph */.zl)(args?.filter ? (0,export_json/* _filterGraph */.e)(body.data, args.filter) : body.data),
+      digest: body.digest,
+      schemaVersion: body.schemaVersion,
+      extensions: body.extensions,
+      scope: body.scope,
+      coverage: body.coverage,
+      limitations: body.limitations,
+    };
+  },
+};
+
+const dataflow_get_node = {
+  name: 'dataflow_get_node',
+  description: 'Look up one node by canonical id in the DataFlowGraph v1 artifact.',
+  inputSchema: {
+    type: 'object',
+    additionalProperties: false,
+    properties: { id: { type: 'string', minLength: 1, maxLength: 512 } },
+    required: ['id'],
+  },
+  async handler({ id }, ctx) {
+    const { graph, failure } = _loadOrFailure(ctx.sessionRoot);
+    if (failure) return failure;
+    const { status, body } = (0,routes/* handleNode */.d5)(graph, id);
+    return {
+      _meta: META,
+      hasResult: true,
+      notFound: status === 404,
+      data: (0,redact_graph/* _redactNode */.T2)(body.data),
+      canonicalIds: body.canonicalIds,
+    };
+  },
+};
+
+const dataflow_get_edge = {
+  name: 'dataflow_get_edge',
+  description: 'Look up one edge by canonical id in the DataFlowGraph v1 artifact.',
+  inputSchema: {
+    type: 'object',
+    additionalProperties: false,
+    properties: { id: { type: 'string', minLength: 1, maxLength: 512 } },
+    required: ['id'],
+  },
+  async handler({ id }, ctx) {
+    const { graph, failure } = _loadOrFailure(ctx.sessionRoot);
+    if (failure) return failure;
+    const { status, body } = (0,routes/* handleEdge */.Yu)(graph, id);
+    return {
+      _meta: META,
+      hasResult: true,
+      notFound: status === 404,
+      data: body.data,
+      canonicalIds: body.canonicalIds,
+    };
+  },
+};
+
+const dataflow_get_flow = {
+  name: 'dataflow_get_flow',
+  description: 'Look up one flow by canonical id in the DataFlowGraph v1 artifact, including its contributing node/edge canonical ids.',
+  inputSchema: {
+    type: 'object',
+    additionalProperties: false,
+    properties: { id: { type: 'string', minLength: 1, maxLength: 512 } },
+    required: ['id'],
+  },
+  async handler({ id }, ctx) {
+    const { graph, failure } = _loadOrFailure(ctx.sessionRoot);
+    if (failure) return failure;
+    const { status, body } = (0,routes/* handleFlow */.jg)(graph, id);
+    return {
+      _meta: META,
+      hasResult: true,
+      notFound: status === 404,
+      data: body.data,
+      canonicalIds: body.canonicalIds,
+    };
+  },
+};
+
 ;// CONCATENATED MODULE: ./src/posture/agents-memory.js
 // AGENTS.md — writable continual-learning memory (harness-anatomy #2).
 //
@@ -136,6 +468,7 @@ function redactArgsBlob(s) {
 
 
 
+
 const MEMORY_FILE = '.agentic-security/AGENTS.md';
 const ARCHIVE_FILE = '.agentic-security/AGENTS.md.archive';
 const MAX_BYTES = 20 * 1024;
@@ -143,8 +476,8 @@ const MAX_ENTRY_BYTES = 2 * 1024;
 const ARCHIVE_MAX_BYTES = 200 * 1024;
 const HEADER = '# AGENTS.md\n\nAgent-authored continual-learning notes. Each entry: timestamp + agent name + one short paragraph. New entries appended at the bottom; oldest entries rotate to AGENTS.md.archive when this file exceeds 20 KB.\n\n';
 
-function _resolve(scanRoot) { return external_node_path_.join(scanRoot, MEMORY_FILE); }
-function _archivePath(scanRoot) { return external_node_path_.join(scanRoot, ARCHIVE_FILE); }
+function _resolve(scanRoot) { return (0,state_dir.statePath)(scanRoot, 'AGENTS.md'); }
+function _archivePath(scanRoot) { return (0,state_dir.statePath)(scanRoot, 'AGENTS.md.archive'); }
 
 function readAgentsMemory(scanRoot) {
   const fp = _resolve(scanRoot);
@@ -172,7 +505,8 @@ function appendAgentsMemory(scanRoot, { agent, body }) {
   const entry = `\n## ${ts}  agent: ${agent}\n\n${snippet}\n`;
   try {
     const fp = _resolve(scanRoot);
-    external_node_fs_.mkdirSync(external_node_path_.dirname(fp), { recursive: true });
+    if (!(0,state_dir.stateWritesEnabled)()) return;
+  external_node_fs_.mkdirSync(external_node_path_.dirname(fp), { recursive: true });
     if (!external_node_fs_.existsSync(fp)) external_node_fs_.writeFileSync(fp, HEADER);
     external_node_fs_.appendFileSync(fp, entry);
     _maybeRotate(scanRoot);
@@ -398,25 +732,36 @@ const cve_lookup_internals = { CACHE_DIR, CVE_RE, _stalenessTier };
 
 
 
-// Lazy-loaded: these transitively pull in npm packages (fast-glob,
-// @babel/core) that aren't available in the plugin-cache install path
+
+
+
+
+
+// Git-origin provenance (Finding Provenance M0/M1). Distinct from
+// `finding.provenance` (AI-authorship) and from an SCA entry's `provenance`
+// (Sigstore/SLSA attestation) — see report/index.js's import comment.
+
+
+
+// Lazy-loaded: these transitively pull in npm packages (@babel/core and
+// friends) that aren't available in the plugin-cache install path
 // (no node_modules). Deferring keeps the MCP server bootable everywhere;
 // the import only runs when a tool that needs them is actually called.
 let _runScan;
 async function getRunScan() {
-  if (!_runScan) _runScan = (await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 9099))).runScan;
+  if (!_runScan) _runScan = (await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 454))).runScan;
   return _runScan;
 }
 let _verifyFixCore;
 async function getVerifyFixCore() {
-  if (!_verifyFixCore) _verifyFixCore = (await __webpack_require__.e(/* import() */ 838).then(__webpack_require__.bind(__webpack_require__, 7838))).verifyFix;
+  if (!_verifyFixCore) _verifyFixCore = (await __webpack_require__.e(/* import() */ 3526).then(__webpack_require__.bind(__webpack_require__, 3526))).verifyFix;
   return _verifyFixCore;
 }
 
 const MAX_FILES_PER_SCAN = 1024;
 const MAX_FILE_BYTES = 500_000;
 const MAX_TOTAL_SCAN_BYTES = 50_000_000;
-const META = { source: 'agentic-security-mcp', untrusted_excerpts: true };
+const tools_META = { source: 'agentic-security-mcp', untrusted_excerpts: true };
 
 // OWASP A01 — refuse writes to paths that could subvert the security tool
 // itself or the host's source-control / dependency state. A forged finding
@@ -471,7 +816,29 @@ const RESERVED_WRITE_SUFFIXES = [
   '.tfvars',
   'docker-compose.yml',
   'docker-compose.yaml',
+  // _CONFINEMENT rule 3 — backup and lock files. The specific lock BASENAMES
+  // above cover the ecosystems we know; this catches the rest (`deps.lock`,
+  // `foo.bak`) without needing to enumerate them. Nothing an autofix should
+  // ever be rewriting: a `.bak` is someone's safety copy and a `.lock` is
+  // generated state.
+  '.bak',
+  '.lock',
 ];
+// _CONFINEMENT rule 3 — build output. Matched as a PATH SEGMENT at any depth,
+// not as a top-level prefix, because build output is routinely nested
+// (`packages/web/dist/`, `services/api/target/`) and a top-level-only check
+// would refuse the monorepo root and allow every package inside it.
+//
+// This matters most in THIS repository: `scanner/dist/` holds the shipped
+// bundle, which carries its own SHA-256 integrity sidecar precisely because
+// what it contains matters. Before this, `apply_fix` would rewrite it and
+// report success.
+//
+// NOTE for a future change, deliberately not made here: the PREFIX list above
+// (`node_modules/`, `.git/`, …) is still top-level-only, so a nested
+// `packages/a/node_modules/` is not covered by it. That is a separate widening
+// with its own blast radius and belongs in its own change with its own tests.
+const RESERVED_WRITE_DIR_SEGMENTS = new Set(['dist', 'build', 'target']);
 function _isReservedWritePath(sessionRoot, absFile) {
   // Resolve sessionRoot symlinks so the relative path is computed against
   // the same canonical root as `absFile` (which _confine already realpath'd).
@@ -480,9 +847,15 @@ function _isReservedWritePath(sessionRoot, absFile) {
   const rootReal = external_node_fs_.realpathSync(external_node_path_.resolve(sessionRoot));
   const rel = external_node_path_.relative(rootReal, absFile).replace(/\\/g, '/');
   if (RESERVED_WRITE_PREFIXES.some(p => rel === p.replace(/\/$/, '') || rel.startsWith(p))) return true;
-  const base = rel.split('/').pop() || '';
+  const segments = rel.split('/');
+  const base = segments[segments.length - 1] || '';
   if (RESERVED_WRITE_BASENAMES.has(base)) return true;
   if (RESERVED_WRITE_SUFFIXES.some(s => base === s || base.endsWith(s))) return true;
+  // Any DIRECTORY segment that names build output — checked over
+  // `segments.length - 1` so a source file legitimately called `build` or
+  // `dist` is not refused for its own name; only living inside such a
+  // directory counts.
+  if (segments.slice(0, -1).some(seg => RESERVED_WRITE_DIR_SEGMENTS.has(seg))) return true;
   return false;
 }
 
@@ -528,12 +901,17 @@ function _validateScratchpadPath(relPath) {
   return { ok: true, agent, session, fileParts };
 }
 
+// Routes through the same lstat+realpath confinement every other write/
+// path-taking tool uses (OWASP MCP05) — a lexical prefix/charset check
+// alone doesn't stop a pre-planted symlink at any path component from
+// relocating the write/read outside the session root. Throws on escape;
+// callers must catch (see append_scratchpad / read_scratchpad).
 function _scratchpadAbs(sessionRoot, relPath) {
-  return external_node_path_.resolve(sessionRoot, relPath.replace(/\\/g, '/'));
+  return _confine(sessionRoot, relPath.replace(/\\/g, '/'), 'scratchpad path');
 }
 
 function _scratchpadTotalBytes(sessionRoot) {
-  const base = external_node_path_.join(sessionRoot, '.agentic-security', 'agent-scratchpad');
+  const base = (0,state_dir.statePath)(sessionRoot, 'agent-scratchpad');
   if (!external_node_fs_.existsSync(base)) return 0;
   let total = 0;
   const walk = (dir) => {
@@ -598,8 +976,8 @@ function _confine(sessionRoot, candidate, label) {
 }
 
 function _readLastScanVerified(sessionRoot, { allowUnsigned = false } = {}) {
-  const stateDir = external_node_path_.join(sessionRoot, '.agentic-security');
-  const scanFile = external_node_path_.join(stateDir, 'last-scan.json');
+  const stateDirPath = (0,state_dir/* stateDir */.Pn)(sessionRoot);
+  const scanFile = external_node_path_.join(stateDirPath, 'last-scan.json');
   const sigFile = scanFile + '.sig';
   if (!external_node_fs_.existsSync(scanFile)) return { scan: null, status: 'missing' };
   const body = external_node_fs_.readFileSync(scanFile, 'utf8');
@@ -672,6 +1050,18 @@ function _maybeOffload(sessionRoot, toolName, items) {
 }
 
 // ─── scan_diff ───────────────────────────────────────────────────────────────
+// Test seam for the write boundary (PRD F6.4).
+//
+// `_confine` and `isReservedWrite` ARE the confinement contract in
+// agents/_CONFINEMENT.md. A boundary is only worth what its refusals are worth,
+// and refusals cannot be adversarially tested through the public tools without
+// also exercising a real scan, a real patch and a real filesystem write — so
+// the check would be measuring four things and attributing failure to one.
+//
+// Exported under the `_internals` convention this codebase already uses
+// (see posture/poc-inprocess.js). Not part of the MCP tool surface.
+const tools_internals = { _confine, isReservedWrite: _isReservedWritePath };
+
 const scan_diff = {
   name: 'scan_diff',
   description: 'Scan a list of files for security findings. Use BEFORE writing a Write/Edit to disk so the agent can self-correct. Returns findings with severity, file:line, title, remediation. Snippets are redacted of obvious secret patterns. Paths confined to the session root; symlinks are refused.',
@@ -708,16 +1098,52 @@ const scan_diff = {
       fileContents[rel] = content;
     }
 
+    // PRD R1 (docs/DETECTION_GAP_REMEDIATION_PRD.md): deep mode is default-on
+    // for the interactive CLI scan but was never requested here, so an
+    // agent's pre-write self-correction scan was regex/AST-only — blind to
+    // any bug whose source and sink are connected only through a call
+    // (`fileContents` scopes the deep engine's IR to exactly the files
+    // passed in, same bound this tool already enforces via MAX_FILES_PER_SCAN
+    // / MAX_TOTAL_SCAN_BYTES, so this does not turn scan_diff into a
+    // full-project deep scan).
     const runScan = await getRunScan();
-    const result = await runScan(sessionRoot, { network: false, fileContents });
+    // FR-704 (assurance-hardening PRD): this tool's own description promises
+    // "runs scan in memory" — without this, runFullScan's own state writers
+    // (dpia.md, ropa.md, privacy-framework.json, threat-model.json, and
+    // others) fire unconditionally on every call, silently mutating the
+    // user's real project on every pre-write self-correction scan. Confirmed
+    // by direct execution before this fix (11 state artifacts written by a
+    // single scan_diff-shaped call).
+    const result = await (0,state_dir/* withStateWritesDisabled */.Ao)(() =>
+      runScan(sessionRoot, { network: false, fileContents, deep: true, deepInCi: true }));
     const wantSet = new Set(Object.keys(fileContents));
     const sevRank = { info: 0, low: 1, medium: 2, high: 3, critical: 4 };
     const min = sevRank[severity] ?? 0;
-    const findings = (result.scan.findings || [])
+    // Stage 6 correctness audit (historical): this used to only read
+    // result.scan.findings (the SAST channel) — scan.secrets and
+    // scan.logicVulns are separate arrays on the raw runScan() result, and a
+    // hand-rolled 3-channel concat here was a second, divergent copy of the
+    // merge report/index.js's normalizeFindings() already does (four
+    // channels, plus per-channel defaulting and remediation-string
+    // resolution the old concat re-implemented separately and could drift
+    // from). Assurance-hardening PRD FR-105 ("JSON, SARIF, HTML, CSV, JUnit,
+    // and MCP outputs derive from the same validated object"): route through
+    // the same canonical merge every other output format uses.
+    //
+    // This closes the field-mapping/dedup divergence, but does NOT make
+    // scan_diff surface SCA/supply-chain findings end to end: this handler
+    // never builds a `depFileContents` map (everything a caller passes in
+    // `files`, manifests included, lands in `fileContents`), and manifest-
+    // based supply-chain detection in engine.js reads only `depFileContents`
+    // — so `result.scan.supplyChain` is always empty for this tool today
+    // regardless of this fix. That is a separate, real limitation (scan_diff
+    // was designed for pre-write code self-correction, not manifest
+    // scanning), left as-is rather than silently claimed fixed here.
+    const findings = (0,report.normalizeFindings)(result.scan)
       .filter(f => wantSet.has(String(f.file || '').replace(/\\/g, '/')) && (sevRank[f.severity] ?? 0) >= min)
-      .map(f => redactFinding({
+      .map(f => (0,redact/* redactFinding */.lE)({
         id: f.id, severity: f.severity, file: f.file, line: f.line,
-        title: f.title || f.vuln, cwe: f.cwe,
+        title: f.vuln, cwe: f.cwe,
         description: f.description, remediation: f.remediation,
       }));
     // Harness-anatomy #1: offload when the result exceeds OFFLOAD_THRESHOLD.
@@ -727,7 +1153,7 @@ const scan_diff = {
     const off = _maybeOffload(sessionRoot, 'scan_diff', findings);
     if (off.offloaded) {
       return {
-        _meta: META,
+        _meta: tools_META,
         scannedFiles: Object.keys(fileContents).length,
         findingCount: off.total,
         offloaded: true,
@@ -737,7 +1163,7 @@ const scan_diff = {
       };
     }
     return {
-      _meta: META,
+      _meta: tools_META,
       scannedFiles: Object.keys(fileContents).length,
       findingCount: findings.length,
       findings,
@@ -763,7 +1189,7 @@ const query_taint = {
   async handler({ source, sink, limit, offset }, ctx) {
     const { scan, status } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: true });
     if (!scan) {
-      return { _meta: META, hasResult: false, status, message: `No usable scan state (${status}).` };
+      return { _meta: tools_META, hasResult: false, status, message: `No usable scan state (${status}).` };
     }
     const lim = Number.isInteger(limit) ? Math.min(50, Math.max(1, limit)) : 10;
     const off = Number.isInteger(offset) ? Math.max(0, offset) : 0;
@@ -778,13 +1204,13 @@ const query_taint = {
       const hay = [f.description, f.title, f.vuln, f.snippet, JSON.stringify(f.trace || '')].join(' ').toLowerCase();
       return hay.includes(srcL) && hay.includes(sinkL);
     });
-    const page = all.slice(off, off + lim).map(f => redactFinding({
+    const page = all.slice(off, off + lim).map(f => (0,redact/* redactFinding */.lE)({
       id: f.id, severity: f.severity, file: f.file, line: f.line,
       title: f.title || f.vuln, description: f.description,
       trace: f.trace || null,
     }));
     return {
-      _meta: META,
+      _meta: tools_META,
       hasResult: true,
       integrity: status,
       scanStartedAt: scan.startedAt || scan.meta?.startedAt || null,
@@ -816,7 +1242,7 @@ const explain_finding = {
     if (!scan) throw new Error(`No usable scan state (${status}).`);
     const f = _findById(scan, finding_id);
     if (!f) throw new Error(`Finding not found: ${finding_id}`);
-    const redacted = redactFinding({
+    const redacted = (0,redact/* redactFinding */.lE)({
       id: f.id, severity: f.severity, file: f.file, line: f.line,
       title: f.title || f.vuln, cwe: f.cwe,
       description: f.description, remediation: f.remediation,
@@ -841,7 +1267,7 @@ const explain_finding = {
       }
     }
     return {
-      _meta: META,
+      _meta: tools_META,
       ...redacted,
       trace: traceTrimmed,
       traceOffload: traceMeta,
@@ -861,6 +1287,21 @@ const explain_finding = {
       epssScore: typeof f.epssScore === 'number' ? f.epssScore : null,
       epssPercentile: typeof f.epssPercentile === 'number' ? f.epssPercentile : null,
       exploitedNow: !!f.exploitedNow,
+      // Which commit introduced this finding. `includeEmail` stays at its
+      // DEFAULT (false) unconditionally — unlike the JSON report there is no
+      // operator-set env escape for it here, because the consumer is an
+      // agent that has no business receiving a committer's email address.
+      // `pseudonymize`, by contrast, IS read back from the same env var
+      // report/index.js's `_normalizedProvenance` reads
+      // (AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS=1 / --pseudonymize-authors) —
+      // fix-round item 4: an operator who set that policy was still getting
+      // raw committer names (and, via providerEnrichment, raw reviewer
+      // logins/CODEOWNERS lines) through this MCP surface because this call
+      // passed no options object at all, silently defeating their policy at
+      // this one output boundary while report/index.js honoured it.
+      findingProvenance: f.findingProvenance ? (0,schema/* redactFindingProvenance */.As)(f.findingProvenance, {
+        pseudonymize: process.env.AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS === '1',
+      }) : null,
     };
   },
 };
@@ -868,7 +1309,7 @@ const explain_finding = {
 // ─── apply_fix ───────────────────────────────────────────────────────────────
 const apply_fix = {
   name: 'apply_fix',
-  description: 'Apply the stored replacement fix for a finding. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if its file path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing.',
+  description: 'Apply a fix for a finding. Two modes: (1) the stored fix.replacement, or (2) a caller-supplied `patch` (a files map) which is RE-VERIFIED inline (rescan-clean + no new ≥medium + lint) before any write — this unblocks findings that ship only a template or description. Refuses if last-scan.json fails its HMAC check, if the finding is shadow-marked, or if a path escapes the session root via lexical traversal OR a symlink. Requires confirm:true. Supports dry_run:true to preview without writing. On success, `verified:true` means verification passed but `verifiedFull:true` is the honest signal that every required leg (lint when configured, tests when a runner exists) genuinely ran — a false `verifiedFull` with `verified:true` means the pass is real but degraded (see `verify.degradedLegs`), not a full verification.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -876,27 +1317,222 @@ const apply_fix = {
       finding_id: { type: 'string', minLength: 1, maxLength: 256 },
       confirm: { type: 'boolean' },
       dry_run: { type: 'boolean' },
+      patch: {
+        type: 'object',
+        additionalProperties: { type: 'string', maxLength: 500_000 },
+        minProperties: 1, maxProperties: 8,
+      },
+      // Stage 6 correctness audit: same gap and same fix as verify_fix — the
+      // honesty gate is reachable but was never wired to any real caller.
+      // Here it's stronger than advisory: the inline re-verify below already
+      // gates the WRITE on `verdict.ok`, and verifyFixCore's own `ok`
+      // formula already folds in `honesty.ok` when fixMeta is supplied — so
+      // passing it through here makes a dishonest fixMeta (hand-wave
+      // residual, uncited false-positive verdict) block the write itself,
+      // not just report a verdict.
+      fixMeta: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          residual: { type: 'string', maxLength: 2000 },
+          verdict: { type: 'string', maxLength: 64 },
+          evidence: { type: 'array', items: { type: 'string', maxLength: 500 }, maxItems: 20 },
+          signals: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+              sinkSignatureChanged: { type: 'boolean' },
+              allCallersRouted: { type: 'boolean' },
+              testDiscriminates: { type: 'boolean' },
+              rateLimitOnly: { type: 'boolean' },
+              docsOnly: { type: 'boolean' },
+              logOnlyNoReject: { type: 'boolean' },
+              partialSanitization: { type: 'boolean' },
+            },
+          },
+          // FR-307/FR-1002: this schema had `additionalProperties: false`
+          // and never declared `approval` — the property apply-fix-
+          // service.js's high-impact-change gate has required since FR-307
+          // was built. A real MCP caller supplying fixMeta.approval was
+          // rejected by validate.js at the schema layer before the handler
+          // ever ran, silently making the approval gate (and FR-1002's
+          // identity check layered on it) unreachable from this tool's
+          // only real production entry point. See D-0024.
+          approval: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+              approvedBy: { type: 'string', minLength: 1, maxLength: 200 },
+              reason: { type: 'string', minLength: 1, maxLength: 1000 },
+            },
+          },
+          // FR-1003: separation-of-duties. Self-reported the same way
+          // approvedBy is — this tool has no way to determine who actually
+          // wrote a patch, so `author` is a claim, checked against a
+          // configurable policy the same way `approval` is.
+          author: { type: 'string', minLength: 1, maxLength: 200 },
+        },
+      },
     },
     required: ['finding_id', 'confirm'],
   },
-  async handler({ finding_id, confirm, dry_run = false }, ctx) {
+  async handler({ finding_id, confirm, dry_run = false, patch = null, fixMeta = null }, ctx) {
     if (confirm !== true) {
-      return { _meta: META, applied: false, reason: 'apply_fix requires confirm: true.' };
+      return { _meta: tools_META, applied: false, reason: 'apply_fix requires confirm: true.' };
     }
     const { scan, status } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: false });
     if (!scan) {
-      return { _meta: META, applied: false, reason: `last-scan.json failed integrity check: ${status}. Run a fresh scan.` };
+      return { _meta: tools_META, applied: false, reason: `last-scan.json failed integrity check: ${status}. Run a fresh scan.` };
     }
     const f = _findById(scan, finding_id);
-    if (!f) return { _meta: META, applied: false, reason: `Finding not found: ${finding_id}` };
+    if (!f) return { _meta: tools_META, applied: false, reason: `Finding not found: ${finding_id}` };
     if (f._shadow === true) {
-      return { _meta: META, applied: false, reason: 'shadow findings cannot be auto-applied' };
+      return { _meta: tools_META, applied: false, reason: 'shadow findings cannot be auto-applied' };
     }
+
+    // #3 — verifier-approved patch path. When the caller supplies `patch` (a
+    // files map, same shape as verify_fix), apply_fix re-runs the verifier
+    // INLINE and writes only if it passes: the original finding's stableId is
+    // gone, no new ≥medium finding was introduced, and lint is clean. This lets
+    // a deterministic OR LLM-synthesized patch be applied for the ~100% of
+    // findings that ship only a template/description (no stored fix.replacement).
+    // Security: all existing gates hold (confirm, last-scan HMAC, reserved
+    // paths, confinement, fix-history backup + attempt budget); the write is
+    // additionally gated on a FRESH verification, so a stale/forged patch can't
+    // slip through — there is no token to replay, the verify runs here and now.
+    if (patch && typeof patch === 'object' && Object.keys(patch).length) {
+      if (!f.stableId) {
+        return { _meta: tools_META, applied: false, reason: 'finding has no stableId — cannot verify a patch against it' };
+      }
+      const confinedAbs = {};
+      for (const [rel, content] of Object.entries(patch)) {
+        let abs;
+        try { abs = _confine(ctx.sessionRoot, rel, 'patch key'); }
+        catch (e) { return { _meta: tools_META, applied: false, reason: `path-escape refused: ${e.message}` }; }
+        if (_isReservedWritePath(ctx.sessionRoot, abs)) {
+          return { _meta: tools_META, applied: false, reason: `reserved path refused: ${rel}` };
+        }
+        confinedAbs[rel] = { abs, content: String(content) };
+      }
+      // Inline re-verify — the load-bearing gate. Must pass to write.
+      let verdict;
+      try {
+        const _files = Object.fromEntries(Object.entries(confinedAbs).map(([rel, v]) => [rel, v.content]));
+        if (process.env.AGENTIC_SECURITY_FIX_RUN_TESTS === '1') {
+          // Addition #7 — connect the closed-loop verifier: add the project test
+          // suite as a fourth verification leg (scan + lint + tests). Opt-in
+          // because many repos have no runner and we must not fail-closed by
+          // default. Normalized to the scan+lint verdict shape used below.
+          const { verifyFixWithTests } = await __webpack_require__.e(/* import() */ 4113).then(__webpack_require__.bind(__webpack_require__, 4113));
+          const t = await verifyFixWithTests({ scanRoot: ctx.sessionRoot, originalFindingStableId: f.stableId, files: _files });
+          verdict = { ok: t.ok, summary: t.summary, rescan: t.legs?.scan?.detail, lint: t.legs?.lint?.detail, tests: t.legs?.tests, testVerdict: t.verdict };
+        } else {
+          const verifyFixCore = await getVerifyFixCore();
+          verdict = await verifyFixCore({
+            scanRoot: ctx.sessionRoot,
+            originalFindingStableId: f.stableId,
+            files: _files,
+            fixMeta,
+          });
+        }
+      } catch (e) {
+        return { _meta: tools_META, applied: false, reason: `patch verification failed: ${e.message}` };
+      }
+      if (!verdict.ok) {
+        return {
+          _meta: tools_META, applied: false,
+          reason: `patch rejected by verifier: ${verdict.summary || verdict.rescan?.reason || 'did not verify'}`,
+          verify: { rescan: verdict.rescan, lint: { runner: verdict.lint?.runner, ok: verdict.lint?.ok }, honesty: verdict.honesty || null },
+        };
+      }
+      // FR-307/FR-1002/D-0024: this caller-supplied-patch branch writes via
+      // applyFixHistory() directly and never called applyVerifiedFix() — so
+      // the high-impact-change approval gate (auth/authZ/crypto/PII/schema/
+      // infra-privilege/public-API) built for the OTHER apply_fix branch
+      // (stored fix.replacement) never ran here at all, for any input. Since
+      // this is the branch the tool's own description calls the one that
+      // covers "~100% of findings that ship only a template," that gap was
+      // the larger of the two found this cycle. Same before/after content
+      // shape `apply-fix-service.js` already uses — read-first-in-try/catch
+      // (D-0012), never existsSync-then-readFileSync.
+      const filesForMaterialClassification = {};
+      for (const [rel, v] of Object.entries(confinedAbs)) {
+        let before = '';
+        try { before = await promises_.readFile(v.abs, 'utf8'); } catch { /* new file — before stays '' */ }
+        filesForMaterialClassification[rel] = { before, after: v.content };
+      }
+      const materialClassification = (0,material_change/* classifyFixMaterialRisk */.kz)(filesForMaterialClassification);
+      if (dry_run) {
+        return { _meta: tools_META, applied: false, dryRun: true, verified: true, files: Object.keys(confinedAbs), summary: verdict.summary, materialClassification };
+      }
+      if (materialClassification.highImpactCategories.length) {
+        const approval = fixMeta && typeof fixMeta === 'object' ? fixMeta.approval : null;
+        const hasApprovalEvidence = !!(approval && typeof approval === 'object' &&
+          typeof approval.approvedBy === 'string' && approval.approvedBy.trim().length > 0 &&
+          typeof approval.reason === 'string' && approval.reason.trim().length > 0);
+        if (!hasApprovalEvidence) {
+          return {
+            _meta: tools_META, applied: false,
+            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) requires approval evidence — pass fixMeta.approval: {approvedBy, reason} — before it can be applied`,
+            materialClassification,
+          };
+        }
+        const approverRegistry = (0,approver_registry.loadApproverRegistry)(ctx.sessionRoot);
+        const requiredRoles = (0,approver_registry/* requiredRolesFor */.K)(approverRegistry, materialClassification.highImpactCategories);
+        const identityCheck = (0,approver_registry.verifyApprover)(approverRegistry, approval.approvedBy, requiredRoles);
+        if (!identityCheck.verified) {
+          return {
+            _meta: tools_META, applied: false,
+            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${identityCheck.reason}`,
+            materialClassification,
+          };
+        }
+        // FR-1003: separation-of-duties, same no-op-unless-configured gate
+        // as apply-fix-service.js's own copy — see approver-registry.js.
+        const sodCheck = (0,approver_registry.checkSeparationOfDuties)(approverRegistry, fixMeta?.author, approval.approvedBy);
+        if (!sodCheck.ok) {
+          return {
+            _meta: tools_META, applied: false,
+            reason: `high-impact change (${materialClassification.highImpactCategories.join(', ')}) approval rejected: ${sodCheck.reason}`,
+            materialClassification,
+          };
+        }
+      }
+      const written = [];
+      try {
+        for (const [rel, v] of Object.entries(confinedAbs)) {
+          const fileExisted = external_node_fs_.existsSync(v.abs);
+          const originalContent = fileExisted ? await promises_.readFile(v.abs, 'utf8') : '';
+          const entry = await (0,fix_history/* applyFix */.oM)({
+            scanRoot: ctx.sessionRoot, file: rel, originalContent, newContent: v.content, fileExisted,
+            findingId: f.id, stableId: f.stableId, ruleId: f.ruleId || f.cwe || f.family || null, vuln: f.vuln || f.title || null,
+            findingProvenance: f.findingProvenance || null,
+          });
+          written.push({ file: rel, historyId: entry.id, backupPath: entry.backupPath });
+        }
+      } catch (e) {
+        // FR-306: roll back every file THIS batch already wrote before the
+        // failure — applyFixHistory already restored the one file that just
+        // failed; this covers the rest, so a multi-file patch never leaves
+        // some files patched and others not.
+        for (const w of written) {
+          try { await (0,fix_history/* revertEntryById */.rJ)(ctx.sessionRoot, w.historyId); } catch { /* best-effort; original error still propagates below */ }
+        }
+        if (e && e.name === 'FixAttemptBudgetExceededError') {
+          return { _meta: tools_META, applied: false, reason: `budget-exceeded: ${e.message}`, budgetExceeded: true, attempts: e.attempts, maxAttempts: e.max, key: e.key };
+        }
+        throw e;
+      }
+      let acceptance = null;
+      try { acceptance = (0,fix_history/* fixAcceptanceRate */.XR)(ctx.sessionRoot); } catch { /* best-effort */ }
+      return { _meta: tools_META, applied: true, verified: true, patched: written, integrity: status, verify: { summary: verdict.summary }, acceptance, materialClassification };
+    }
+
     if (typeof f.fix?.replacement !== 'string') {
       // Premortem #2: templates are patch-shaped text. Same reasoning as
       // the replacement path — do NOT pass through redactString here.
       return {
-        _meta: META, applied: false,
+        _meta: tools_META, applied: false,
         reason: 'No full replacement available — only a template. Apply the template manually.',
         template: f.fix?.code || '',
         file: f.file, line: f.line,
@@ -905,19 +1541,19 @@ const apply_fix = {
     let absFile;
     try { absFile = _confine(ctx.sessionRoot, f.file, 'finding.file'); }
     catch (e) {
-      return { _meta: META, applied: false, reason: `path-escape refused: ${e.message}` };
+      return { _meta: tools_META, applied: false, reason: `path-escape refused: ${e.message}` };
     }
     if (_isReservedWritePath(ctx.sessionRoot, absFile)) {
-      return { _meta: META, applied: false, reason: `reserved path refused: writes to .git/, .agentic-security/, or node_modules/ are not permitted via apply_fix` };
+      return { _meta: tools_META, applied: false, reason: `reserved path refused: writes to .git/, .agentic-security/, or node_modules/ are not permitted via apply_fix` };
     }
     if (!external_node_fs_.existsSync(absFile)) {
-      return { _meta: META, applied: false, reason: `File not found: ${absFile}` };
+      return { _meta: tools_META, applied: false, reason: `File not found: ${absFile}` };
     }
     const originalContent = await promises_.readFile(absFile, 'utf8');
 
     if (dry_run) {
       return {
-        _meta: META,
+        _meta: tools_META,
         applied: false, dryRun: true,
         file: f.file,
         originalSize: originalContent.length,
@@ -926,41 +1562,47 @@ const apply_fix = {
       };
     }
 
-    let entry;
-    try {
-      entry = await (0,fix_history/* applyFix */.oM)({
-        scanRoot: ctx.sessionRoot,
-        file: f.file,
-        originalContent,
-        newContent: f.fix.replacement,
-        findingId: f.id,
-        stableId: f.stableId || null,   // premortem 4R-8
-        ruleId: f.rule || null,
-        vuln: f.vuln || f.title || null,
-      });
-    } catch (e) {
-      // Harness-engineering: step-budget refusal (post-derived). The
-      // deterministic layer enforces at-most-N attempts per stableId. When
-      // exceeded, surface it as a structured `budget-exceeded` outcome the
-      // agent can recognize — not a generic error.
-      if (e && e.name === 'FixAttemptBudgetExceededError') {
-        return {
-          _meta: META,
-          applied: false,
-          reason: `budget-exceeded: ${e.message}`,
-          budgetExceeded: true,
-          attempts: e.attempts,
-          maxAttempts: e.max,
-          key: e.key,
-        };
+    // FR-301/A-08 (assurance-hardening PRD): this branch used to write
+    // f.fix.replacement straight to disk with NO fresh verification — no
+    // rescan, no lint, nothing confirming the stored replacement actually
+    // closes the finding it claims to fix. The caller-patch branch above
+    // already required this; there is no reason a STORED fix should be
+    // trusted more than a caller-supplied one just because it shipped with
+    // the finding. Routed through the same applyVerifiedFix() service the
+    // CLI's `fix --apply` now also uses (src/fix/apply-fix-service.js) —
+    // confinement/reserved-path are re-checked there too (harmless
+    // redundancy with the dry_run preview above, kept for that preview's
+    // size-diff shape) but the load-bearing addition is the verification
+    // gate before the write.
+    if (!f.stableId) {
+      return { _meta: tools_META, applied: false, reason: 'finding has no stableId — cannot verify a stored fix against it' };
+    }
+    const result = await (0,apply_fix_service/* applyVerifiedFix */.On)({
+      scanRoot: ctx.sessionRoot,
+      finding: f,
+      files: { [f.file]: f.fix.replacement },
+      fixMeta,
+    });
+    if (!result.ok) {
+      if (result.budgetExceeded) {
+        return { _meta: tools_META, applied: false, reason: result.reason, budgetExceeded: true, attempts: result.attempts, maxAttempts: result.maxAttempts, key: result.key };
       }
-      throw e;
+      return { _meta: tools_META, applied: false, reason: result.reason, verify: result.verify || null };
     }
     // R25 (PRD §5): surface the running auto-fix acceptance rate after each
     // applied fix, so the closed loop reports its own success metric.
     let acceptance = null;
     try { acceptance = (0,fix_history/* fixAcceptanceRate */.XR)(ctx.sessionRoot); } catch { /* metric is best-effort */ }
-    return { _meta: META, applied: true, historyId: entry.id, file: f.file, backupPath: entry.backupPath, integrity: status, attemptOrdinal: entry.attemptOrdinal, acceptance };
+    const entry = result.written[0];
+    return {
+      // FR-305: verifiedFull distinguishes "every required leg (lint, tests)
+      // genuinely ran and passed" from "passed, but a required leg was
+      // skipped or unavailable" — verified:true alone conflates them.
+      _meta: tools_META, applied: true, verified: true, verifiedFull: result.verifiedFull,
+      historyId: entry.historyId, file: entry.file, backupPath: entry.backupPath,
+      integrity: status, attemptOrdinal: entry.attemptOrdinal, acceptance,
+      verify: result.verify,
+    };
   },
 };
 
@@ -972,7 +1614,7 @@ const apply_fix = {
 // proceed with apply_fix.
 const verify_fix = {
   name: 'verify_fix',
-  description: 'Verify a proposed patch before applying. Re-scans the patched files in memory and runs the project linter. Returns { ok, rescan, lint, summary }. No filesystem writes.',
+  description: 'Verify a proposed patch before applying. Re-scans the patched files in memory, runs the project linter, runs the project test suite, checks fix honesty (FULL/MITIGATION/WORKAROUND) when fixMeta is supplied, and re-runs the PoC when one exists. Returns { ok, rescan, lint, tests, honesty, poc, summary }. Does not write to the target project’s own files, but DOES append one record per attempt to .agentic-security/fix-metrics.jsonl for the measured fix-loop.',
   inputSchema: {
     type: 'object',
     additionalProperties: false,
@@ -984,36 +1626,98 @@ const verify_fix = {
         minProperties: 1,
         maxProperties: 8,
       },
+      // Stage 6 correctness audit: posture/fix-honesty-gate.js's deterministic
+      // honesty checks (vague-assurance residual prose, unbacked false-
+      // positive verdicts, tier/residual consistency) were fully built and
+      // fix-verify.js already consulted them when given a `fixMeta` — but
+      // this schema never had a `fixMeta` property, so no call through the
+      // MCP surface could ever supply one. The gate can only run against
+      // claims the AGENT self-reports (residual risk, verdict, evidence,
+      // completeness signals) — nothing here is server-computable — so
+      // fixing this meant exposing the property, not inventing a lookup.
+      fixMeta: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          residual: { type: 'string', maxLength: 2000 },
+          verdict: { type: 'string', maxLength: 64 },
+          evidence: { type: 'array', items: { type: 'string', maxLength: 500 }, maxItems: 20 },
+          signals: {
+            type: 'object',
+            additionalProperties: false,
+            properties: {
+              sinkSignatureChanged: { type: 'boolean' },
+              allCallersRouted: { type: 'boolean' },
+              testDiscriminates: { type: 'boolean' },
+              rateLimitOnly: { type: 'boolean' },
+              docsOnly: { type: 'boolean' },
+              logOnlyNoReject: { type: 'boolean' },
+              partialSanitization: { type: 'boolean' },
+            },
+          },
+        },
+      },
     },
     required: ['stable_id', 'files'],
   },
-  async handler({ stable_id, files }, ctx) {
+  async handler({ stable_id, files, fixMeta }, ctx) {
     // Confine every file path before passing to the verifier.
     const confined = {};
     for (const [relPath, content] of Object.entries(files || {})) {
       try {
         _confine(ctx.sessionRoot, relPath, 'files key');
       } catch (e) {
-        return { _meta: META, ok: false, reason: `path-escape refused: ${e.message}` };
+        return { _meta: tools_META, ok: false, reason: `path-escape refused: ${e.message}` };
       }
       confined[relPath] = String(content);
     }
     try {
+      // The PoC-re-check leg (verifyFixCore's `pocLeg`) needs a `poc` param
+      // to do anything — until now nothing supplied one, so it always
+      // reported {status:'not-requested'} through this surface (see
+      // posture/CLAUDE.md's disclosure). Rather than widening inputSchema
+      // to make the CALLER pass PoC data back, look it up server-side: the
+      // scan pipeline already attaches an HTTP-shaped f.poc to matching
+      // findings by default (engine.js's annotatePocs), and last-scan.json
+      // already carries it under the same stableId this handler receives.
+      // Best-effort: a missing/unsigned/tampered scan just means no PoC is
+      // available to re-check, not a verify_fix failure — the rescan/lint/
+      // tests legs below are independent of this and still apply.
+      let poc = null;
+      try {
+        const { scan: lastScan } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: true });
+        const orig = lastScan && (lastScan.findings || []).find(f => f.stableId === stable_id);
+        if (orig && orig.poc && orig.poc.code) poc = { ...orig.poc, finding: orig };
+      } catch { /* best-effort lookup; poc stays null */ }
+
       const verifyFixCore = await getVerifyFixCore();
       const r = await verifyFixCore({
         scanRoot: ctx.sessionRoot,
         originalFindingStableId: stable_id,
         files: confined,
+        poc,
+        fixMeta,
       });
       return {
-        _meta: META,
+        _meta: tools_META,
         ok: r.ok,
         rescan: { ok: r.rescan.ok, reason: r.rescan.reason, introduced: r.rescan.introduced || [] },
-        lint: { runner: r.lint.runner, ok: r.lint.ok, skipped: r.lint.skipped || false, output: redactString(r.lint.output || '').slice(0, 1500) },
+        lint: { runner: r.lint.runner, ok: r.lint.ok, skipped: r.lint.skipped || false, output: (0,redact/* redactString */.rd)(r.lint.output || '').slice(0, 1500) },
+        // verifyFix computes five legs, not two — tests/honesty/poc were
+        // being silently dropped here, leaving an agent with no structured
+        // way to see WHY verification failed when the failure was in one
+        // of those three (only the free-text summary carried it).
+        // test-runner.js's runProjectTests never returns raw stdout/stderr,
+        // so no redaction is needed there; honesty.violations are static,
+        // code-generated strings; poc.reason is redacted defensively since
+        // it can echo proof-harness detail derived from scanned source.
+        tests: r.tests,
+        honesty: r.honesty,
+        poc: r.poc ? { ...r.poc, reason: r.poc.reason ? (0,redact/* redactString */.rd)(r.poc.reason) : r.poc.reason } : r.poc,
         summary: r.summary,
       };
     } catch (e) {
-      return { _meta: META, ok: false, reason: `verify_fix failed: ${e.message}` };
+      return { _meta: tools_META, ok: false, reason: `verify_fix failed: ${e.message}` };
     }
   },
 };
@@ -1036,11 +1740,11 @@ const synthesize_fix = {
   async handler({ finding_id }, ctx) {
     const { scan, status } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: false });
     if (!scan) {
-      return { _meta: META, ok: false, reason: `last-scan.json failed integrity check: ${status}` };
+      return { _meta: tools_META, ok: false, reason: `last-scan.json failed integrity check: ${status}` };
     }
     const f = _findById(scan, finding_id);
-    if (!f) return { _meta: META, ok: false, reason: `Finding not found: ${finding_id}` };
-    if (f._shadow === true) return { _meta: META, ok: false, reason: 'shadow findings have no synthesized fix' };
+    if (!f) return { _meta: tools_META, ok: false, reason: `Finding not found: ${finding_id}` };
+    if (f._shadow === true) return { _meta: tools_META, ok: false, reason: 'shadow findings have no synthesized fix' };
     const fix = f.fix || {};
     const hasReplacement = typeof fix.replacement === 'string' && fix.replacement.length > 0;
     // Patch bounds: count files touched + LoC delta.
@@ -1055,6 +1759,20 @@ const synthesize_fix = {
       locDelta = Math.abs(fix.replacement.split('\n').length - orig.split('\n').length);
     }
     const oversized = touchedFiles > 3 || locDelta > 100;
+    // #1 — deterministic autofix: for classes with a safe context-independent
+    // swap (weak hash, TLS verify-off), materialize a full-file patch from the
+    // live file. The agent passes `autofix.patch` straight to apply_fix, which
+    // re-verifies it (rescan-clean + no new ≥medium + lint) before writing — so
+    // even a mis-attributed swap can't land a bad edit. No stored replacement,
+    // no per-finding bloat in last-scan.json.
+    let autofix = null;
+    if (!hasReplacement) {
+      try {
+        const abs = _confine(ctx.sessionRoot, f.file, 'finding.file');
+        const det = synthesizeDeterministicPatch(f, external_node_fs_.readFileSync(abs, 'utf8'));
+        if (det) autofix = { deterministic: true, ruleId: det.ruleId, patch: det.patch };
+      } catch { /* best-effort — no file / no rule → no autofix */ }
+    }
     // Premortem #2: `replacement` is a *patch* (the code we'll write to disk),
     // not a finding excerpt. Running it through redactString silently corrupts
     // valid patches whose content happens to match a secret-shape (e.g. a
@@ -1062,7 +1780,7 @@ const synthesize_fix = {
     // verbatim. Snippet/description/etc. continue to be redacted in
     // explain_finding / scan_diff — that's the right surface for redaction.
     return {
-      _meta: META,
+      _meta: tools_META,
       ok: true,
       stable_id: f.stableId || null,
       file: f.file, line: f.line,
@@ -1071,9 +1789,21 @@ const synthesize_fix = {
       hasReplacement,
       replacement: hasReplacement ? fix.replacement : null,
       template: fix.code || null,
+      autofix,
+      // #15 — the regression test the scan annotator already generated for this
+      // finding (present when a PoC was built). Surfaced here so the fix flow
+      // writes the test alongside the patch; fix-verify-loop then runs it, so an
+      // applied fix ships with a test that fails pre-fix and passes post-fix.
+      regression_test: f.regression_test || null,
       remediation: typeof fix.description === 'string' ? fix.description : (typeof fix === 'string' ? fix : null),
       patchBounds: { touchedFiles, locDelta, oversized },
-      recommendsFixPlan: oversized && !hasReplacement,
+      // oversized can only be true when hasReplacement is true (locDelta is
+      // only computed in that branch, and touchedFiles never varies) — a
+      // `!hasReplacement` conjunct here was a structural contradiction that
+      // made this permanently false. The correct signal: the stored
+      // replacement itself is too big to trust auto-applying, and there's
+      // no safer deterministic alternative.
+      recommendsFixPlan: oversized && !autofix,
     };
   },
 };
@@ -1100,14 +1830,14 @@ const find_rule_module = {
   },
   async handler({ cwe, family }, ctx) {
     if (!cwe && !family) {
-      return { _meta: META, ok: false, reason: 'provide cwe (e.g. "CWE-89") or family (e.g. "sql-injection")' };
+      return { _meta: tools_META, ok: false, reason: 'provide cwe (e.g. "CWE-89") or family (e.g. "sql-injection")' };
     }
     // Pattern enforcement — the mini-schema validator doesn't do `pattern`.
     if (cwe && !/^CWE-\d+$/.test(cwe)) {
-      return { _meta: META, ok: false, reason: 'cwe must match /^CWE-\\d+$/ (e.g. "CWE-89")' };
+      return { _meta: tools_META, ok: false, reason: 'cwe must match /^CWE-\\d+$/ (e.g. "CWE-89")' };
     }
     if (family && !/^[a-z][a-z0-9-]+$/.test(family)) {
-      return { _meta: META, ok: false, reason: 'family must match /^[a-z][a-z0-9-]+$/ (e.g. "sql-injection")' };
+      return { _meta: tools_META, ok: false, reason: 'family must match /^[a-z][a-z0-9-]+$/ (e.g. "sql-injection")' };
     }
     const sessionRoot = ctx.sessionRoot;
     const roots = [
@@ -1161,7 +1891,7 @@ const find_rule_module = {
       if (hits.length >= 20) break;
     }
     return {
-      _meta: META,
+      _meta: tools_META,
       ok: true,
       query: { cwe: cwe || null, family: family || null },
       hitCount: hits.length,
@@ -1204,12 +1934,14 @@ const append_scratchpad = {
   },
   async handler({ path: relPath, content }, ctx) {
     const v = _validateScratchpadPath(relPath);
-    if (!v.ok) return { _meta: META, ok: false, reason: v.reason };
-    const abs = _scratchpadAbs(ctx.sessionRoot, relPath);
+    if (!v.ok) return { _meta: tools_META, ok: false, reason: v.reason };
+    let abs;
+    try { abs = _scratchpadAbs(ctx.sessionRoot, relPath); }
+    catch (e) { return { _meta: tools_META, ok: false, reason: `path-escape refused: ${e.message}` }; }
     const total = _scratchpadTotalBytes(ctx.sessionRoot);
     if (total + content.length > SCRATCHPAD_MAX_TOTAL_BYTES) {
       return {
-        _meta: META, ok: false,
+        _meta: tools_META, ok: false,
         reason: `scratchpad-total-exceeded: ${total} + ${content.length} > ${SCRATCHPAD_MAX_TOTAL_BYTES}. Clean up via "rm -rf .agentic-security/agent-scratchpad" or rotate sessions.`,
       };
     }
@@ -1217,7 +1949,7 @@ const append_scratchpad = {
     try { if (external_node_fs_.existsSync(abs)) existing = external_node_fs_.statSync(abs).size; } catch {}
     if (existing + content.length > SCRATCHPAD_MAX_FILE_BYTES) {
       return {
-        _meta: META, ok: false,
+        _meta: tools_META, ok: false,
         reason: `scratchpad-file-exceeded: ${existing} + ${content.length} > ${SCRATCHPAD_MAX_FILE_BYTES}. Start a new file.`,
       };
     }
@@ -1225,12 +1957,12 @@ const append_scratchpad = {
       external_node_fs_.mkdirSync(external_node_path_.dirname(abs), { recursive: true });
       external_node_fs_.appendFileSync(abs, content);
       return {
-        _meta: META, ok: true,
+        _meta: tools_META, ok: true,
         path: relPath, bytesWritten: content.length, fileSize: existing + content.length,
         scratchpadTotal: total + content.length,
       };
     } catch (e) {
-      return { _meta: META, ok: false, reason: `write-failed: ${e.message}` };
+      return { _meta: tools_META, ok: false, reason: `write-failed: ${e.message}` };
     }
   },
 };
@@ -1250,12 +1982,14 @@ const read_scratchpad = {
   },
   async handler({ path: relPath, offset, limit }, ctx) {
     const v = _validateScratchpadPath(relPath);
-    if (!v.ok) return { _meta: META, ok: false, reason: v.reason };
-    const abs = _scratchpadAbs(ctx.sessionRoot, relPath);
-    if (!external_node_fs_.existsSync(abs)) return { _meta: META, ok: false, reason: 'not-found' };
+    if (!v.ok) return { _meta: tools_META, ok: false, reason: v.reason };
+    let abs;
+    try { abs = _scratchpadAbs(ctx.sessionRoot, relPath); }
+    catch (e) { return { _meta: tools_META, ok: false, reason: `path-escape refused: ${e.message}` }; }
+    if (!external_node_fs_.existsSync(abs)) return { _meta: tools_META, ok: false, reason: 'not-found' };
     let stat;
-    try { stat = external_node_fs_.statSync(abs); } catch (e) { return { _meta: META, ok: false, reason: `stat-failed: ${e.message}` }; }
-    if (!stat.isFile()) return { _meta: META, ok: false, reason: 'not-a-file' };
+    try { stat = external_node_fs_.statSync(abs); } catch (e) { return { _meta: tools_META, ok: false, reason: `stat-failed: ${e.message}` }; }
+    if (!stat.isFile()) return { _meta: tools_META, ok: false, reason: 'not-a-file' };
     const off = Number.isInteger(offset) ? Math.max(0, offset) : 0;
     const lim = Number.isInteger(limit) ? Math.min(64 * 1024, Math.max(1, limit)) : 4096;
     let buf;
@@ -1265,10 +1999,10 @@ const read_scratchpad = {
       const read = external_node_fs_.readSync(fd, tmp, 0, lim, off);
       external_node_fs_.closeSync(fd);
       buf = tmp.slice(0, read);
-    } catch (e) { return { _meta: META, ok: false, reason: `read-failed: ${e.message}` }; }
+    } catch (e) { return { _meta: tools_META, ok: false, reason: `read-failed: ${e.message}` }; }
     const text = buf.toString('utf8');
     return {
-      _meta: META, ok: true,
+      _meta: tools_META, ok: true,
       path: relPath,
       offset: off, limit: lim, bytesRead: buf.length,
       totalSize: stat.size,
@@ -1285,6 +2019,7 @@ const read_scratchpad = {
 
 
 
+
 const append_agents_memory = {
   name: 'append_agents_memory',
   description: 'Append a short narrative entry to AGENTS.md — agent-authored continual-learning notes. Use at session end to record "what worked / what didn\'t / what I\'d try differently next time" so the next agent can pick up the lesson. Bounded: 2 KB per entry, 20 KB total before rotation to AGENTS.md.archive. Use sparingly — narrative, not structured data.',
@@ -1299,7 +2034,7 @@ const append_agents_memory = {
   },
   async handler({ agent, body }, ctx) {
     const r = appendAgentsMemory(ctx.sessionRoot, { agent, body });
-    return { _meta: META, ...r };
+    return { _meta: tools_META, ...r };
   },
 };
 
@@ -1315,16 +2050,16 @@ const read_agents_memory = {
   },
   async handler({ full }, ctx) {
     const body = readAgentsMemory(ctx.sessionRoot);
-    if (!body) return { _meta: META, present: false };
-    if (full) return { _meta: META, present: true, length: body.length, content: body };
+    if (!body) return { _meta: tools_META, present: false };
+    if (full) return { _meta: tools_META, present: true, length: body.length, content: body };
     // Tail-only — same logic as summarizeForSession but inlined to avoid a
     // second import surface.
     const limit = 6 * 1024;
-    if (body.length <= limit) return { _meta: META, present: true, length: body.length, content: body };
+    if (body.length <= limit) return { _meta: tools_META, present: true, length: body.length, content: body };
     const tail = body.slice(-limit);
     const firstSection = tail.indexOf('\n## ');
     const slice = firstSection >= 0 ? tail.slice(firstSection) : tail;
-    return { _meta: META, present: true, length: body.length, truncated: true, content: slice };
+    return { _meta: tools_META, present: true, length: body.length, truncated: true, content: slice };
   },
 };
 
@@ -1346,9 +2081,22 @@ const query_triage_memory = {
   },
   async handler({ query }, ctx) {
     const { queryMemory } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 1905));
-    const results = queryMemory(ctx.sessionRoot, query || '');
+    const raw = queryMemory(ctx.sessionRoot, query || '');
+    // Stage 6 correctness audit: this returned queryMemory's output
+    // verbatim, with no redaction pass — every other tool that echoes
+    // scanned-source-derived text redacts it (mcp/CLAUDE.md's "Adding a new
+    // tool" step 3). Round-trip through redactString the same way
+    // redactFinding already does for its own opaque `.trace` field: results
+    // here mix shapes (a triage decision's free-text `reason`, a finding's
+    // `vuln`/`family`/file path), so scrubbing the whole serialized
+    // structure catches secret-shaped substrings regardless of which field
+    // they landed in, rather than hardcoding a field allowlist that could
+    // miss one.
+    let results;
+    try { results = JSON.parse((0,redact/* redactString */.rd)(JSON.stringify(raw))); }
+    catch { results = raw; }
     return {
-      _meta: META,
+      _meta: tools_META,
       count: results.length,
       results,
     };
@@ -1373,8 +2121,17 @@ const query_findings_memory = {
     required: ['query'],
   },
   async handler({ query }, ctx) {
-    const { queryFindingsMemory } = await __webpack_require__.e(/* import() */ 839).then(__webpack_require__.bind(__webpack_require__, 3839));
-    return { _meta: META, ...queryFindingsMemory(ctx.sessionRoot, query || '') };
+    const { queryFindingsMemory } = await __webpack_require__.e(/* import() */ 3839).then(__webpack_require__.bind(__webpack_require__, 3839));
+    const raw = queryFindingsMemory(ctx.sessionRoot, query || '');
+    // Stage 6 correctness audit — same redaction gap and same fix as
+    // query_triage_memory just above: this mixes four differently-shaped
+    // result kinds (finding / triage / history / AGENTS.md text), so a
+    // whole-structure redactString round-trip is applied rather than a
+    // per-field allowlist that could miss one of the four shapes.
+    let body;
+    try { body = JSON.parse((0,redact/* redactString */.rd)(JSON.stringify(raw))); }
+    catch { body = raw; }
+    return { _meta: tools_META, ...body };
   },
 };
 
@@ -1395,7 +2152,7 @@ const lookup_cve = {
   },
   async handler({ cve }, _ctx) {
     const r = lookupCve(cve);
-    return { _meta: META, ...r };
+    return { _meta: tools_META, ...r };
   },
 };
 
@@ -1413,9 +2170,9 @@ const query_cache_telemetry = {
   },
   async handler({ transcript_path } = {}, ctx) {
     const result = (0,cache_economics.analyzeTranscript)({ transcriptPath: transcript_path, projectDir: ctx?.sessionRoot || process.cwd() });
-    if (!result.ok) return { _meta: META, ok: false, reason: result.reason };
+    if (!result.ok) return { _meta: tools_META, ok: false, reason: result.reason };
     return {
-      _meta: META,
+      _meta: tools_META,
       ok: true,
       metrics: result.metrics,
       leaks: result.leaks,
@@ -1431,7 +2188,7 @@ const query_cache_telemetry = {
 // ecosystem's native --dry-run command. Safe to call any number of times.
 let _scaUpgrade;
 async function _getScaUpgrade() {
-  if (!_scaUpgrade) _scaUpgrade = await __webpack_require__.e(/* import() */ 333).then(__webpack_require__.bind(__webpack_require__, 5333));
+  if (!_scaUpgrade) _scaUpgrade = await __webpack_require__.e(/* import() */ 5333).then(__webpack_require__.bind(__webpack_require__, 5333));
   return _scaUpgrade;
 }
 const synthesize_sca_upgrade = {
@@ -1451,11 +2208,11 @@ const synthesize_sca_upgrade = {
     const f = _findById(scan, finding_id);
     if (!f) throw new Error(`Finding not found: ${finding_id}`);
     if (f.type !== 'vulnerable_dep') {
-      return { _meta: META, ok: false, reason: 'finding is not an SCA vulnerable_dep — use synthesize_fix for SAST findings' };
+      return { _meta: tools_META, ok: false, reason: 'finding is not an SCA vulnerable_dep — use synthesize_fix for SAST findings' };
     }
     const { planScaUpgrade } = await _getScaUpgrade();
     const plan = await planScaUpgrade({ scanRoot: ctx.sessionRoot, finding: f });
-    return { _meta: META, ...plan };
+    return { _meta: tools_META, ...plan };
   },
 };
 
@@ -1482,24 +2239,24 @@ const apply_sca_upgrade = {
   },
   async handler({ finding_id, confirm, run_tests = true }, ctx) {
     if (confirm !== true) {
-      return { _meta: META, applied: false, reason: 'apply_sca_upgrade requires confirm: true.' };
+      return { _meta: tools_META, applied: false, reason: 'apply_sca_upgrade requires confirm: true.' };
     }
     const { scan, status } = _readLastScanVerified(ctx.sessionRoot, { allowUnsigned: false });
     if (!scan) {
-      return { _meta: META, applied: false, reason: `last-scan.json failed integrity check: ${status}. Run a fresh scan.` };
+      return { _meta: tools_META, applied: false, reason: `last-scan.json failed integrity check: ${status}. Run a fresh scan.` };
     }
     const f = _findById(scan, finding_id);
-    if (!f) return { _meta: META, applied: false, reason: `Finding not found: ${finding_id}` };
+    if (!f) return { _meta: tools_META, applied: false, reason: `Finding not found: ${finding_id}` };
     if (f.type !== 'vulnerable_dep') {
-      return { _meta: META, applied: false, reason: 'finding is not an SCA vulnerable_dep — use apply_fix for SAST findings' };
+      return { _meta: tools_META, applied: false, reason: 'finding is not an SCA vulnerable_dep — use apply_fix for SAST findings' };
     }
     const { applyScaUpgrade } = await _getScaUpgrade();
     const result = await applyScaUpgrade({ scanRoot: ctx.sessionRoot, finding: f, runTests: run_tests });
-    return { _meta: META, ...result };
+    return { _meta: tools_META, ...result };
   },
 };
 
-const ALL_TOOLS = [scan_diff, query_taint, explain_finding, apply_fix, verify_fix, synthesize_fix, find_rule_module, append_scratchpad, read_scratchpad, append_agents_memory, read_agents_memory, lookup_cve, synthesize_sca_upgrade, apply_sca_upgrade, query_triage_memory, query_findings_memory, query_cache_telemetry];
+const ALL_TOOLS = [scan_diff, query_taint, explain_finding, apply_fix, verify_fix, synthesize_fix, find_rule_module, append_scratchpad, read_scratchpad, append_agents_memory, read_agents_memory, lookup_cve, synthesize_sca_upgrade, apply_sca_upgrade, query_triage_memory, query_findings_memory, query_cache_telemetry, dataflow_get_graph, dataflow_get_node, dataflow_get_edge, dataflow_get_flow];
 
 ;// CONCATENATED MODULE: ./src/mcp/validate.js
 // Minimal JSON Schema validator — just the subset our tool schemas use.
@@ -1552,149 +2309,8 @@ function validate(schema, value, path = 'arguments') {
   }
 }
 
-;// CONCATENATED MODULE: ./src/mcp/audit.js
-// Append-only audit log of MCP tool calls — OWASP MCP08.
-//
-// Format: one JSON object per line (NDJSON) at
-//   <sessionRoot>/.agentic-security/mcp-audit.log
-//
-// Each entry carries `prev` — the SHA-256 of the previous entry's serialized
-// form. The first entry's prev is "GENESIS". Tampering with any line breaks
-// the chain from that point forward; a reader can detect partial truncation
-// or in-place edits.
-//
-// REMOTE SINK (post-recommendation #10). The local file alone cannot detect
-// a total rewrite — an attacker with FS write can re-author the whole log
-// with fresh hashes. Closing that blind spot requires an off-host witness.
-// Set $AGENTIC_SECURITY_AUDIT_WEBHOOK to a POST endpoint; every entry is
-// fire-and-forget POSTed there in addition to the local append. Failures
-// to reach the webhook are best-effort — they NEVER block a tool call,
-// because that would let a network outage become a denial of service. They
-// DO get recorded as `_remoteSinkErr` on the local entry, so an operator
-// reviewing the log later can spot a forging attempt that targeted the
-// remote (any gap between local-sequence and remote-sequence is evidence).
-//
-// Argument blobs are redacted (OWASP MCP01/MCP10) so credentials passed in
-// arguments cannot leak via the audit trail OR via the remote sink.
-
-
-
-
-
-
-const MAX_ARG_BYTES = 1024;
-const GENESIS = 'GENESIS';
-const REMOTE_TIMEOUT_MS = 1500;
-
-// Per-process session ID (harness-anatomy #9). Stamped on every audit entry
-// so downstream metrics can aggregate by session and surface outliers like
-// "200 apply_fix calls in one session." The ID is `<pid>-<short-ts>` — not
-// cryptographically unique, but enough to disambiguate concurrent runs on
-// the same host. Stable for the lifetime of this Node process.
-const SESSION_ID = `${process.pid}-${Date.now().toString(36).slice(-6)}`;
-
-function _summarize(args) {
-  let s;
-  try { s = JSON.stringify(args); } catch { s = '<unserializable>'; }
-  s = redactArgsBlob(s);
-  if (s.length > MAX_ARG_BYTES) s = s.slice(0, MAX_ARG_BYTES) + `…(+${s.length - MAX_ARG_BYTES})`;
-  return s;
-}
-
-function _sha(s) { return external_node_crypto_.createHash('sha256').update(s).digest('hex'); }
-
-function _readLastEntryHash(logFile) {
-  if (!external_node_fs_.existsSync(logFile)) return GENESIS;
-  try {
-    const all = external_node_fs_.readFileSync(logFile, 'utf8');
-    const lines = all.split('\n').filter(Boolean);
-    if (!lines.length) return GENESIS;
-    return _sha(lines[lines.length - 1]);
-  } catch { return GENESIS; }
-}
-
-// Fire-and-forget POST to the remote sink. Resolves to null on success,
-// to a short error string on failure. Never throws; never blocks longer
-// than REMOTE_TIMEOUT_MS. The local audit append happens regardless.
-async function _postRemote(url, entry) {
-  try {
-    const controller = new AbortController();
-    const t = setTimeout(() => controller.abort(), REMOTE_TIMEOUT_MS);
-    const r = await fetch(url, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(entry),
-      signal: controller.signal,
-    });
-    clearTimeout(t);
-    if (!r.ok) return `HTTP ${r.status}`;
-    return null;
-  } catch (e) {
-    return String((e && e.message) || e).slice(0, 200);
-  }
-}
-
-function auditCall({ sessionRoot, tool, args, outcome, reason }) {
-  if (!sessionRoot) return;
-  try {
-    // Safety: only write audit log if sessionRoot looks like a project root
-    const MARKERS = ['.git', 'package.json', 'pyproject.toml', 'go.mod', 'Cargo.toml', 'pom.xml', 'composer.json', 'Gemfile'];
-    let hasMarker = false;
-    for (const m of MARKERS) { try { if (external_node_fs_.existsSync(external_node_path_.join(sessionRoot, m))) { hasMarker = true; break; } } catch {} }
-    if (!hasMarker) return;
-    const dir = external_node_path_.join(sessionRoot, '.agentic-security');
-    external_node_fs_.mkdirSync(dir, { recursive: true });
-    const logFile = external_node_path_.join(dir, 'mcp-audit.log');
-    const entry = {
-      ts: new Date().toISOString(),
-      sessionId: SESSION_ID,
-      tool,
-      outcome,
-      ...(reason ? { reason } : {}),
-      args: _summarize(args),
-      prev: _readLastEntryHash(logFile),
-    };
-    external_node_fs_.appendFileSync(logFile, JSON.stringify(entry) + '\n');
-    // Remote sink (post-recommendation #10). Fire-and-forget. We don't await
-    // the promise so the tool call returns immediately; the remote POST runs
-    // on its own microtask. Failures get logged to a sidecar file so the
-    // operator can detect when the sink is unreachable.
-    const webhook = process.env.AGENTIC_SECURITY_AUDIT_WEBHOOK;
-    if (webhook) {
-      _postRemote(webhook, entry).then((err) => {
-        if (!err) return;
-        try {
-          const errFile = external_node_path_.join(dir, 'mcp-audit.remote-errors.log');
-          external_node_fs_.appendFileSync(errFile, JSON.stringify({
-            ts: new Date().toISOString(), entryTs: entry.ts, tool, err,
-          }) + '\n');
-        } catch { /* nothing else to do */ }
-      });
-    }
-  } catch { /* audit failure must never break a tool call */ }
-}
-
-// Verify the chain from start to end. Returns
-//   { ok: true, entries: N } if intact
-//   { ok: false, brokenAt: <line-index>, expected, got } if any link breaks
-// Reader/operator-facing tool.
-function verifyAuditLog(logFile) {
-  if (!fs.existsSync(logFile)) return { ok: true, entries: 0 };
-  const text = fs.readFileSync(logFile, 'utf8');
-  const lines = text.split('\n').filter(Boolean);
-  let expectedPrev = GENESIS;
-  for (let i = 0; i < lines.length; i++) {
-    let entry;
-    try { entry = JSON.parse(lines[i]); }
-    catch { return { ok: false, brokenAt: i, reason: 'not JSON' }; }
-    if (entry.prev !== expectedPrev) {
-      return { ok: false, brokenAt: i, expected: expectedPrev, got: entry.prev };
-    }
-    expectedPrev = _sha(lines[i]);
-  }
-  return { ok: true, entries: lines.length };
-}
-
+// EXTERNAL MODULE: ./src/mcp/audit.js
+var audit = __webpack_require__(9390);
 ;// CONCATENATED MODULE: ./src/mcp/server.js
 // MCP server core — JSON-RPC 2.0 handler for the Model Context Protocol.
 //
@@ -1741,7 +2357,7 @@ const TOOLS_BY_NAME = Object.fromEntries(ALL_TOOLS.map(t => [t.name, t]));
 function _codeFingerprint() {
   try {
     const here = external_node_path_.dirname((0,external_node_url_.fileURLToPath)(import.meta.url));
-    const files = ['server.js', 'tools.js', 'stdio.js', 'audit.js', 'validate.js', 'redact.js'];
+    const files = ['server.js', 'tools.js', 'dataflow-tools.js', 'stdio.js', 'audit.js', 'validate.js', 'redact.js'];
     const h = external_node_crypto_.createHash('sha256');
     for (const f of files) {
       try { h.update(f); h.update(external_node_fs_.readFileSync(external_node_path_.join(here, f))); } catch {}
@@ -1804,7 +2420,7 @@ function createServer({ sessionRoot = process.cwd() } = {}) {
         const name = msg.params?.name;
         const args = msg.params?.arguments ?? {};
         if (disabled) {
-          auditCall({ sessionRoot, tool: name, args, outcome: 'rejected', reason: 'server-disabled' });
+          (0,audit.auditCall)({ sessionRoot, tool: name, args, outcome: 'rejected', reason: 'server-disabled' });
           return _ok(id, {
             content: [{ type: 'text', text: 'MCP server is disabled (AGENTIC_SECURITY_MCP_DISABLED=1).' }],
             isError: true,
@@ -1812,12 +2428,12 @@ function createServer({ sessionRoot = process.cwd() } = {}) {
         }
         const tool = TOOLS_BY_NAME[name];
         if (!tool) {
-          auditCall({ sessionRoot, tool: name, args, outcome: 'rejected', reason: 'unknown-tool' });
+          (0,audit.auditCall)({ sessionRoot, tool: name, args, outcome: 'rejected', reason: 'unknown-tool' });
           return _err(id, -32602, `Unknown tool: ${name}`);
         }
         try { validate(tool.inputSchema, args); }
         catch (e) {
-          auditCall({ sessionRoot, tool: name, args, outcome: 'rejected', reason: `invalid-args: ${e.message}` });
+          (0,audit.auditCall)({ sessionRoot, tool: name, args, outcome: 'rejected', reason: `invalid-args: ${e.message}` });
           return _ok(id, {
             content: [{ type: 'text', text: `Invalid arguments: ${e.message}` }],
             isError: true,
@@ -1825,13 +2441,13 @@ function createServer({ sessionRoot = process.cwd() } = {}) {
         }
         try {
           const result = await tool.handler(args, ctx);
-          auditCall({ sessionRoot, tool: name, args, outcome: 'ok' });
+          (0,audit.auditCall)({ sessionRoot, tool: name, args, outcome: 'ok' });
           return _ok(id, {
             content: [{ type: 'text', text: JSON.stringify(result, null, 2) }],
             isError: false,
           });
         } catch (e) {
-          auditCall({ sessionRoot, tool: name, args, outcome: 'error', reason: e.message });
+          (0,audit.auditCall)({ sessionRoot, tool: name, args, outcome: 'error', reason: e.message });
           return _ok(id, {
             content: [{ type: 'text', text: `Error: ${e.message}` }],
             isError: true,
@@ -1983,9 +2599,11 @@ function money(n) {
 
 // Per-1M-token rates (input / output). Mirror hooks/model-cost-advisor.js MODELS.
 const MODEL_RATES = {
-  opus:   { label: 'Opus 4.8',   in: 5, out: 25 },
-  sonnet: { label: 'Sonnet 4.6', in: 3, out: 15 },
-  haiku:  { label: 'Haiku 4.5',  in: 1, out: 5 },
+  fable:   { label: 'Fable 5',    in: 10, out: 50 },
+  opus:    { label: 'Opus 4.8',   in: 5,  out: 25 },
+  sonnet5: { label: 'Sonnet 5',   in: 3,  out: 15 },
+  sonnet:  { label: 'Sonnet 4.6', in: 3,  out: 15 },
+  haiku:   { label: 'Haiku 4.5',  in: 1,  out: 5 },
 };
 const CACHE_READ_MULT = 0.1;   // cache read ≈ 0.1× input
 const CACHE_WRITE_MULT = 1.25; // 5-minute cache write ≈ 1.25× input
@@ -1997,8 +2615,9 @@ const TTL_MS = 5 * 60 * 1000;
 function rateFor(model) {
   if (typeof model !== 'string') return null;
   const s = model.toLowerCase();
+  if (s.includes('fable') || s.includes('mythos')) return MODEL_RATES.fable;
   if (s.includes('haiku')) return MODEL_RATES.haiku;
-  if (s.includes('sonnet')) return MODEL_RATES.sonnet;
+  if (s.includes('sonnet')) return (s.includes('sonnet-5') || s.includes('sonnet 5')) ? MODEL_RATES.sonnet5 : MODEL_RATES.sonnet;
   if (s.includes('opus')) return MODEL_RATES.opus;
   return null;
 }
@@ -2226,6 +2845,307 @@ const _internal = {
 };
 
 
+/***/ }),
+
+/***/ 8218:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   loadFreshLineageGraph: () => (/* binding */ loadFreshLineageGraph),
+/* harmony export */   loadSignedGraph: () => (/* binding */ loadSignedGraph)
+/* harmony export */ });
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1174);
+/* harmony import */ var _posture_integrity_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1130);
+// graph-loader.js — Milestone 3, sub-project Server, increment 1.
+//
+// Reads and VERIFIES the `.agentic-security/lineage-graph.json` artifact
+// before `explore` is allowed to serve a single byte of it. Reuses
+// `posture/integrity.js`'s `verifyLastScan` DIRECTLY (per the plan and the
+// root CLAUDE.md's own instruction) — this module does not implement any
+// signature comparison of its own. `verifyLastScan` already uses
+// `crypto.timingSafeEqual` internally.
+//
+// Loaded ONCE at server startup (see bin/agentic-security.js's cmdExplore)
+// and held in memory for the life of the process — this is a read-only,
+// single-scan-snapshot server; a change to the graph on disk mid-session is
+// out of scope for this increment (threat-model doc's own "P0 is
+// read-only" framing).
+
+
+
+
+
+/**
+ * @param {string} scanRoot
+ * @returns {{ok:true, graph:object} | {ok:false, reason:'missing'|'unsigned'|'tampered'|'malformed', message:string}}
+ *
+ * Four, and only four, distinct failure reasons — each with its own clear
+ * message so an operator knows exactly what to do next:
+ *   - 'missing'  — no lineage-graph.json at all. Run a scan with
+ *                  AGENTIC_SECURITY_LINEAGE_DEEP=1 first.
+ *   - 'unsigned' — the graph exists but its .sig sibling does not
+ *                  (verifyLastScan returns null). Refuse to serve an
+ *                  unverifiable graph.
+ *   - 'tampered' — the graph exists and has a .sig, but the signature does
+ *                  not match the body (verifyLastScan returns false). The
+ *                  file was modified after signing, or signed under a
+ *                  different install key.
+ *   - 'malformed' — the body passed signature verification but is not
+ *                  valid JSON. Should not happen from a normal scan; the
+ *                  file may be corrupted on disk after signing.
+ */
+function loadSignedGraph(scanRoot) {
+  const graphPath = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.statePath)(scanRoot, 'lineage-graph.json');
+  const sigPath = graphPath + '.sig';
+
+  if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(graphPath)) {
+    return {
+      ok: false,
+      reason: 'missing',
+      message: `No lineage graph found at ${graphPath}. Run a scan with AGENTIC_SECURITY_LINEAGE_DEEP=1 first (e.g. \`AGENTIC_SECURITY_LINEAGE_DEEP=1 agentic-security scan\`), then re-run \`agentic-security explore\`.`,
+    };
+  }
+
+  let body;
+  try {
+    body = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(graphPath, 'utf8');
+  } catch (e) {
+    return {
+      ok: false,
+      reason: 'missing',
+      message: `Lineage graph found at ${graphPath} but could not be read: ${e && e.message ? e.message : e}.`,
+    };
+  }
+
+  const verified = (0,_posture_integrity_js__WEBPACK_IMPORTED_MODULE_2__/* .verifyLastScan */ .Ef)(body, sigPath);
+  if (verified === null) {
+    return {
+      ok: false,
+      reason: 'unsigned',
+      message: `Lineage graph at ${graphPath} has no signature file (${sigPath} is missing). Refusing to serve an unverifiable graph. Re-run the scan (AGENTIC_SECURITY_LINEAGE_DEEP=1) to regenerate both files together.`,
+    };
+  }
+  if (verified === false) {
+    return {
+      ok: false,
+      reason: 'tampered',
+      message: `Lineage graph at ${graphPath} FAILED signature verification — its contents do not match ${sigPath}. The file may have been modified after the scan, or signed under a different install key. Refusing to serve a tampered graph. Re-run the scan to regenerate it.`,
+    };
+  }
+
+  let graph;
+  try {
+    graph = JSON.parse(body);
+  } catch (e) {
+    return {
+      ok: false,
+      reason: 'malformed',
+      message: `Lineage graph at ${graphPath} passed signature verification but is not valid JSON (${e && e.message ? e.message : e}). This should not happen from a normal scan — the file may be corrupted. Re-run the scan to regenerate it.`,
+    };
+  }
+
+  return { ok: true, graph };
+}
+
+/**
+ * Load .agentic-security/lineage-graph.json ONLY when it is genuinely
+ * fresh for THIS scan — never merely because a file happens to exist on
+ * disk. Shared by every caller that signs or narrates a graph:-derived
+ * compliance claim (M4 sub-project 6c's final whole-branch review found
+ * the identical staleness gap independently reachable from
+ * `attest --obligations` AND `compliance --walkthrough`, and required
+ * this predicate to live in exactly one place rather than being
+ * copy-pasted per caller — a safety check that drifts between two
+ * near-identical inline copies is worse than one shared bug).
+ *
+ * `.agentic-security/lineage-graph.json` is only rewritten when a scan
+ * actually finishes building a graph (`if (scan.lineageGraph)` in
+ * bin/agentic-security.js's persistence code) — an ordinary non-deep
+ * rescan, or a deep scan whose lineage build fails, leaves whatever file
+ * was there from an earlier successful deep scan untouched. Loading that
+ * stale graph and joining it to the CURRENT scan's other data would let a
+ * caller assert a graph-derived fact (e.g. "transit protected") about
+ * code that has since changed.
+ *
+ * `enabled: true` in `scan.scanHealth.lineageAnalysis` does NOT by itself
+ * mean the build succeeded — engine.js sets it the moment
+ * AGENTIC_SECURITY_LINEAGE_DEEP=1 is read, before the build even starts,
+ * and leaves it `true` even when the build later throws (only `failure`
+ * gets set in that case). `requested && enabled` alone therefore still
+ * accepts a stale graph after a failed rebuild — reproduced live via the
+ * scan's own already-shipped fault-injection fixture
+ * (test/lineage-fault-injection.test.js) before this `failure === null`
+ * check was added.
+ *
+ * @param {string} scanRoot
+ * @param {object} scan - the parsed last-scan.json for the CURRENT scan
+ * @returns {{graph:object|null, fresh:boolean, loaded:ReturnType<typeof loadSignedGraph>}}
+ *   `fresh` is true only when a signed graph loaded successfully AND this
+ *   scan's own scanHealth confirms lineage analysis was requested,
+ *   enabled, and did not fail. `graph` is `loaded.graph` when fresh, else
+ *   `null` — never the stale file, even when one exists on disk.
+ *   `loaded` is the raw `loadSignedGraph` result, so a caller can still
+ *   distinguish "no file at all" from "a file exists but isn't fresh" for
+ *   its own disclosure message.
+ */
+function loadFreshLineageGraph(scanRoot, scan) {
+  const la = scan?.scanHealth?.lineageAnalysis;
+  const requested = la?.requested === true;
+  const enabled = la?.enabled === true;
+  const failure = la?.failure ?? null;
+  const loaded = loadSignedGraph(scanRoot);
+  const fresh = loaded.ok && requested && enabled && failure === null;
+  return { graph: fresh ? loaded.graph : null, fresh, loaded };
+}
+
+
+/***/ }),
+
+/***/ 4268:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   Yo: () => (/* binding */ handleScan),
+/* harmony export */   Yu: () => (/* binding */ handleEdge),
+/* harmony export */   d5: () => (/* binding */ handleNode),
+/* harmony export */   fn: () => (/* binding */ handleGraph),
+/* harmony export */   jg: () => (/* binding */ handleFlow),
+/* harmony export */   rR: () => (/* binding */ handleQuery)
+/* harmony export */ });
+/* unused harmony export wrapResponse */
+/* harmony import */ var _lineage_export_json_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(859);
+// routes.js — Milestone 3, sub-project Server, increment 1.
+//
+// Five pure GET-endpoint handlers, each `(graph, ...) -> {status, body}`.
+// No req/res access anywhere in this file — that is what makes these
+// handlers unit-testable without an HTTP layer at all. http-server.js is
+// the only module that touches node:http and calls into these.
+//
+// Every response body is wrapped in `wrapResponse`, which adds the exact
+// envelope fields PRD line 1326 names (quoted in the implementation plan):
+// "base graph/snapshot digest, schema/extension versions, scope, coverage,
+// limitations, and contributing canonical IDs."
+
+
+
+/**
+ * Shared response envelope. Maps PRD line 1326's required fields onto the
+ * graph's own real fields:
+ *   - digest              -> graph.graphId (the base graph/snapshot digest)
+ *   - schemaVersion        -> graph.schemaVersion
+ *   - extensions           -> graph.extensions (schema/extension versions —
+ *                             today always `{}`; see schema.js)
+ *   - scope                -> graph.scope
+ *   - coverage              -> graph.coverage
+ *   - limitations           -> graph.limitations
+ *   - canonicalIds          -> see the design note below
+ *
+ * "contributing canonical IDs" design decision (disclosed per the plan):
+ * for `handleScan`/`handleGraph`, which describe the WHOLE graph rather
+ * than one entity, `canonicalIds` is `null` — the response body for
+ * `handleGraph` already IS the full nodes/edges/flows arrays, so echoing
+ * every id again here would be pure duplication with no informational
+ * gain, and for a large graph would materially bloat the response for
+ * zero benefit. For `handleNode`/`handleEdge`, `canonicalIds` is the
+ * single id the response is about. For `handleFlow`, `canonicalIds` is
+ * the flow's own id PLUS the node/edge ids that flow's evidence draws
+ * from (source, sink, edgeIds) — a flow is a derived record referencing
+ * several underlying entities, and naming all of them here is genuinely
+ * useful metadata a client would otherwise have to re-derive from the
+ * flow body itself.
+ */
+function wrapResponse(data, graph, { canonicalIds = null } = {}) {
+  return {
+    digest: graph?.graphId ?? null,
+    schemaVersion: graph?.schemaVersion ?? null,
+    extensions: graph?.extensions ?? {},
+    scope: graph?.scope ?? null,
+    coverage: graph?.coverage ?? null,
+    limitations: graph?.limitations ?? [],
+    canonicalIds,
+    data,
+  };
+}
+
+function _findById(list, id) {
+  if (!Array.isArray(list)) return null;
+  return list.find((item) => item && item.id === id) ?? null;
+}
+
+/** Scan/graph metadata — NOT the full node/edge arrays. */
+function handleScan(graph) {
+  const data = {
+    schemaVersion: graph?.schemaVersion ?? null,
+    graphId: graph?.graphId ?? null,
+    generatedAt: graph?.generatedAt ?? null,
+    scope: graph?.scope ?? null,
+    scanHealth: graph?.scanHealth ?? null,
+    coverage: graph?.coverage ?? null,
+  };
+  return { status: 200, body: wrapResponse(data, graph, { canonicalIds: null }) };
+}
+
+/** The full graph document, unfiltered. For a scoped/narrowed projection, use `handleQuery` (`POST /api/v1/query`, Milestone 5) below instead. */
+function handleGraph(graph) {
+  return { status: 200, body: wrapResponse(graph, graph, { canonicalIds: null }) };
+}
+
+/**
+ * A deterministic typed projection query — Milestone 5's own
+ * `POST /api/v1/query`, the S2 endpoint `handleGraph`'s own header
+ * comment named and deferred. `filter` is the exact `{nodeIds, edgeIds}`
+ * shape `dataflow export --filter`/`exportGraphJSON` already use — reused
+ * via `_filterGraph`, never reimplemented. Final whole-branch review
+ * finding: `undefined` (filter omitted entirely) returns the WHOLE graph,
+ * identical to `handleGraph` — but `{}` (an empty, well-formed filter
+ * object) is NOT the same thing, and does NOT mean "no restriction": both
+ * `nodeIds`/`edgeIds` default to empty Sets inside `_filterGraph`, so `{}`
+ * narrows the graph down to EMPTY node/edge/flow/dataElement arrays. A
+ * caller that wants the whole graph must omit `filter` entirely, never
+ * pass `{}` meaning "everything." A malformed filter is a 400, never a
+ * thrown exception reaching the caller.
+ */
+function handleQuery(graph, filter) {
+  const check = (0,_lineage_export_json_js__WEBPACK_IMPORTED_MODULE_0__.validateFilterShape)(filter);
+  if (!check.valid) {
+    return { status: 400, body: { error: check.error } };
+  }
+  return { status: 200, body: wrapResponse((0,_lineage_export_json_js__WEBPACK_IMPORTED_MODULE_0__/* ._filterGraph */ .e)(graph, filter), graph, { canonicalIds: null }) };
+}
+
+/** Look up one node by id. 404 with a clear body if not found. */
+function handleNode(graph, id) {
+  const node = _findById(graph?.nodes, id);
+  if (!node) {
+    return { status: 404, body: wrapResponse({ error: `node not found: ${id}` }, graph, { canonicalIds: [] }) };
+  }
+  return { status: 200, body: wrapResponse(node, graph, { canonicalIds: [id] }) };
+}
+
+/** Look up one edge by id. 404 with a clear body if not found. */
+function handleEdge(graph, id) {
+  const edge = _findById(graph?.edges, id);
+  if (!edge) {
+    return { status: 404, body: wrapResponse({ error: `edge not found: ${id}` }, graph, { canonicalIds: [] }) };
+  }
+  return { status: 200, body: wrapResponse(edge, graph, { canonicalIds: [id] }) };
+}
+
+/** Look up one flow by id. 404 with a clear body if not found. */
+function handleFlow(graph, id) {
+  const flow = _findById(graph?.flows, id);
+  if (!flow) {
+    return { status: 404, body: wrapResponse({ error: `flow not found: ${id}` }, graph, { canonicalIds: [] }) };
+  }
+  const contributing = new Set([id]);
+  if (flow.source) contributing.add(flow.source);
+  if (flow.sink) contributing.add(flow.sink);
+  for (const eid of (flow.edgeIds || [])) contributing.add(eid);
+  return { status: 200, body: wrapResponse(flow, graph, { canonicalIds: [...contributing] }) };
+}
+
+
 /***/ })
 
 };