@clear-capabilities/agentic-security-scanner 0.144.0 → 0.147.0

package/src/posture/auditor-walkthrough.js

@@ -41,9 +41,82 @@ import { statePath, stateWritesEnabled } from './state-dir.js';
 import { EVIDENCE_GRADE_DISCLAIMER_SHORT } from './evidence-grade-wording.js';
 import { COMPLIANCE_FAMILY_ALIAS, resolveFamilyKeys } from './family-resolve.js';
 import { strengthOfControl as _strengthOfControl } from './coverage-strength.js';
+// FR-PROV-026: earliestOrigin.authorName below is untrusted git commit
+// metadata. renderWalkthrough()'s output is console.log'd verbatim by
+// bin/agentic-security.js's `compliance --walkthrough` — the ONLY live
+// consumer today (persistWalkthrough below is exported and tested but has
+// zero callers anywhere in the CLI/command surface; no code in this repo
+// ever runs this text through a real Markdown renderer). sanitizeForTerminal
+// is therefore the correct sanitizer here, not a Markdown-escaping one — a
+// backslash-escaping sibling was tried and reverted (see schema.js's header
+// comment): printed raw or read as plain text, `Jean-Luc Picard` rendering
+// as `Jean\-Luc Picard` and `dependabot[bot]` as `dependabot\[bot\]` is a
+// visible regression on common real-world author names, not a fix.
+import { sanitizeForTerminal, pseudonymizeAuthor, PROVENANCE_COMPLIANCE_DISCLAIMER } from './provenance/schema.js';
+import { evaluateGraphFlowPredicate, buildObligationMappingFromGraphPredicate } from '../lineage/obligation-predicates.js';
+
+// Fix-round item 4b: this renderer had `sanitizeForTerminal` (injection
+// safety) but never honoured `--pseudonymize-authors` at all — an operator
+// who set that policy still saw a raw committer name in walkthrough output,
+// the one boundary that gap missed. Reads the SAME env var
+// `report/index.js`'s `_normalizedProvenance` and `mcp/tools.js`'s
+// `providerEnrichment`-aware call read back
+// (AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS=1 / --pseudonymize-authors). Keyed
+// on name only, not email: `deriveComplianceProvenance`'s `earliestOrigin`
+// deliberately never carries `authorEmail` (see its own comment — that
+// object bypasses the `redactFindingProvenance` sweep entirely), so the
+// pseudonym here is stable across repeated runs for the same author name but
+// not necessarily identical to the email-keyed pseudonym shown at other
+// output boundaries for the same person.
+function _maybePseudonymizeName(name) {
+  if (!name) return name;
+  return process.env.AGENTIC_SECURITY_PSEUDONYMIZE_AUTHORS === '1' ? pseudonymizeAuthor(name, null) : name;
+}
 
 // Re-exported so existing callers/tests keep importing these from here.
 export { COMPLIANCE_FAMILY_ALIAS, resolveFamilyKeys };
+
+// FR-PROV-016 (M2): "earliest proven open condition" among a control's
+// contributing findings. Prefers a finding whose findingProvenance resolved
+// findingOrigin.status:'complete' (the OLDEST such authorDate wins); falls
+// back to 'partial' entries with a resolved findingOrigin.authorDate when no
+// complete one exists. Never fabricates an origin — zero usable entries is
+// reported as null/'unknown', not the repo's first commit or "now".
+export function deriveComplianceProvenance(findings) {
+  const list = Array.isArray(findings) ? findings.filter(Boolean) : [];
+  const withOrigin = list
+    .map((f) => ({ f, fp: f && f.findingProvenance }))
+    .filter((x) => x.fp && x.fp.findingOrigin && x.fp.findingOrigin.authorDate);
+  const complete = withOrigin.filter((x) => x.fp.status === 'complete');
+  const partial = withOrigin.filter((x) => x.fp.status === 'partial');
+  // authorDate is git's `%aI` (strict ISO-8601, author's LOCAL UTC offset —
+  // see git-evidence.js's commitMeta), never normalized to Z. Two commits
+  // authored in different timezones near a day boundary can lexically sort
+  // in the wrong chronological order, so compare actual instants via
+  // Date.parse, never the raw strings.
+  const pickEarliest = (arr) => arr.reduce(
+    (min, x) => (!min || Date.parse(x.fp.findingOrigin.authorDate) < Date.parse(min.fp.findingOrigin.authorDate)) ? x : min,
+    null,
+  );
+  const best = complete.length ? pickEarliest(complete) : (partial.length ? pickEarliest(partial) : null);
+  return {
+    derivedFrom: [...new Set(list.map((f) => f && f.id).filter(Boolean))],
+    // Only commit/authorDate/authorName are ever read from findingOrigin
+    // here — this object is a SIBLING field to findingProvenance (not
+    // nested inside it), so it bypasses the redactFindingProvenance sweep
+    // that runs at report/mcp output boundaries. authorEmail must never be
+    // added to this shape without first routing it through
+    // redactFindingProvenance.
+    earliestOrigin: best ? {
+      commit: best.fp.findingOrigin.commit || null,
+      authorDate: best.fp.findingOrigin.authorDate,
+      authorName: best.fp.findingOrigin.authorName || null,
+    } : null,
+    confidence: complete.length ? 'high' : (partial.length ? 'low' : 'unknown'),
+    limitations: best ? [] : ['no contributing finding resolved a verified origin'],
+  };
+}
+
 const BUNDLED_DIR = path.join(path.dirname(new URL(import.meta.url).pathname), 'compliance-frameworks');
 function _readJson(fp) {
   try { return JSON.parse(fs.readFileSync(fp, 'utf8')); } catch { return null; }
@@ -275,24 +348,31 @@ export function evaluateFramework(scanRoot, fw, scan) {
   const results = [];
   for (const c of fw.controls || []) {
     const obs = [];
+    // FR-PROV-016: findings that contributed an OPEN condition to this
+    // control's `family:` mapping(s) — the exact objects `open` below
+    // filters to, not just their ids, so deriveComplianceProvenance can read
+    // .findingProvenance off them. Naturally empty for a control that ends
+    // up 'present' (present requires zero open findings across every
+    // mapping) or 'manual' (no family: mapping ever populates it) — so a
+    // consumer can treat a non-empty controlRefs as "this control has an
+    // attributable gap" without re-deriving the bucket classification.
+    const contributingFindings = [];
     let status = 'manual';
     const maps = Array.isArray(c.mapsTo) ? c.mapsTo : [];
 
     if (maps.length === 0) {
       obs.push('No automated mapping — requires manual evidence collection.');
-      // PRD F10.2: carry the MEASURED strength of the backing detector, so a
-    // control mapped to a detector that finds 3 of 18 independent advisories
-    // cannot read the same as one backed by a detector that finds nearly
-    // everything. Import is lazy so the evaluator keeps working if the bench
-    // artifacts are absent (they degrade to `unmeasured`, never to a default).
-    let evidence = null;
-    try { evidence = _strengthOfControl(c); } catch { /* strength is additive; never block evaluation */ }
-    results.push({
-      control: c,
-      status,
-      observations: obs,
-      ...(evidence ? { evidence, partiallyEvidenced: evidence.tier === 'weak' || evidence.tier === 'unmeasured' } : {}),
-    });
+      let evidence = null;
+      try { evidence = _strengthOfControl(c); } catch { /* strength is additive; never block evaluation */ }
+      results.push({
+        control: c,
+        status,
+        observations: obs,
+        controlRefs: [],
+        derivedProvenance: deriveComplianceProvenance([]),
+        obligationMappings: [],
+        ...(evidence ? { evidence, partiallyEvidenced: evidence.tier === 'weak' || evidence.tier === 'unmeasured' } : {}),
+      });
       continue;
     }
 
@@ -313,6 +393,15 @@ export function evaluateFramework(scanRoot, fw, scan) {
     // control at 'partial' — never 'present' — regardless of what the
     // family:/module: mappings in the same control found.
     let hasUnverifiableMapping = false;
+    // Sub-project 6b: real ObligationMapping records minted by graph:
+    // predicates on this control, collected separately from the
+    // present/partial/absent/manual status machinery above — a graph:
+    // mapping never touches anySignal/allCleared/anyCleared/
+    // hasUnverifiableMapping (purely additive, per the plan's own Global
+    // Constraints). Always an array, never undefined, so a caller can
+    // safely read `.length` regardless of whether this control has any
+    // graph: mappings at all.
+    const obligationMappings = [];
     for (const m of maps) {
       if (m.startsWith('family:')) {
         // `family:X` and the subfamily-qualified `family:X:Y` (used by
@@ -356,6 +445,7 @@ export function evaluateFramework(scanRoot, fw, scan) {
         const open = scoped.filter(f => !f.intentSuppressed && !f.pastDecision && (SEVERITY_RANK[f.severity] ?? 0) >= minRank);
         if (open.length) {
           allCleared = false;
+          contributingFindings.push(...open);
           obs.push(`${open.length} open ${fam} finding(s) at ${minSeverity}+.`);
         } else {
           obs.push(`✓ ${fam}: no open ${minSeverity}+ findings.`);
@@ -413,6 +503,70 @@ export function evaluateFramework(scanRoot, fw, scan) {
         obs.push(`(rule mapping) ${m} — verify manually that the bodyguard rule is enabled.`);
         anySignal = true;
         hasUnverifiableMapping = true;
+      } else if (m.startsWith('graph:')) {
+        // A graph: mapping never contributes to anySignal/allCleared/
+        // anyCleared/hasUnverifiableMapping — the existing
+        // present/partial/absent/manual status stays driven entirely by
+        // the family:/module:/rule: mappings a control already has (this
+        // task's own Global Constraint: purely additive). It instead
+        // mints a real ObligationMapping record, collected separately.
+        //
+        // First real predicate (scoping doc ruling 6): PHI/PII flowing to
+        // an external sink must cross a protected transit edge. The
+        // predicate STRING itself is currently a fixed label (not yet a
+        // parsed mini-language) — the first real graph: mapping this
+        // sub-project ships is HIPAA §164.312(e)'s
+        // "graph:transit-protection:PHI:external:transit:protected",
+        // hardcoded to this one spec until a second real case proves the
+        // parsing is worth generalizing (YAGNI — do not invent a parser
+        // for one caller).
+        const spec = { type: 'graph-flow', dataClass: 'PHI', sinkKind: 'external', dimension: 'transit', requiredVerdict: 'protected' };
+        const graph = scan.lineageGraph ?? null;
+        // Belt-and-suspenders, mirroring the sibling _strengthOfControl
+        // call above: obligation-predicates.js is now defensively
+        // hardened to never throw (see its own header), but this wrap
+        // keeps a future regression there from taking down the whole
+        // evaluateFramework call for every control in the framework
+        // (found by the final whole-branch review).
+        let mapping = null;
+        try {
+          const evaluation = graph ? evaluateGraphFlowPredicate(spec, graph) : null;
+          mapping = buildObligationMappingFromGraphPredicate({
+            framework: fw.id,
+            frameworkVersion: fw.controlsDigest,
+            requirementId: c.id,
+            requirementSource: fw.url ?? null,
+            predicateLabel: m,
+            graph,
+            evaluation,
+          });
+        } catch { /* graph obligation mapping is additive; never block evaluation */ }
+        if (mapping) {
+          obligationMappings.push(mapping);
+          // Found by the final whole-branch review of sub-project 6b: a
+          // graph: mapping's state is intentionally independent of the
+          // pre-existing present/partial/absent/manual status glyph
+          // (Global Constraint — see the block comment above), so a
+          // control can render a green ✅ header with a 'gap_detected'
+          // line buried underneath it in the observations. A ⚠️ prefix on
+          // a genuine gap keeps that visible to a reader who only scans
+          // headers, without touching the status computation itself.
+          // RE-CONFIRMED (sub-project 6c's own final review, F4): at the
+          // time this ⚠️ prefix was written, `graph:` mappings could only
+          // ever read 'unknown' end-to-end through the real CLI (a
+          // separate, then-undiscovered bug — see obligation-predicates.js
+          // and cmdCompliance/cmdAttest's own fix history), so this exact
+          // ✅-header-hiding-a-real-gap scenario was structurally
+          // unreachable. Sub-project 6c's CLI fixes make it genuinely
+          // reachable for the first time; the ruling above was written
+          // anticipating exactly this and needs no change — confirmed
+          // live via a real assessed HIPAA §164.312(e) gap
+          // (test/cli/attest-obligations.test.js's own gap_detected case).
+          const flag = mapping.state === 'gap_detected' ? '⚠️ ' : '';
+          obs.push(`${flag}(graph mapping) ${m} -> ${mapping.state}.`);
+        } else {
+          obs.push(`(graph mapping) ${m} -> evaluation failed, skipped.`);
+        }
       }
     }
 
@@ -461,10 +615,14 @@ export function evaluateFramework(scanRoot, fw, scan) {
     // artifacts are absent (they degrade to `unmeasured`, never to a default).
     let evidence = null;
     try { evidence = _strengthOfControl(c); } catch { /* strength is additive; never block evaluation */ }
+    const dedupedRefs = [...new Set(contributingFindings.map((f) => f.id).filter(Boolean))];
     results.push({
       control: c,
       status,
       observations: obs,
+      controlRefs: dedupedRefs,
+      derivedProvenance: deriveComplianceProvenance(contributingFindings),
+      obligationMappings,
       ...(evidence ? { evidence, partiallyEvidenced: evidence.tier === 'weak' || evidence.tier === 'unmeasured' } : {}),
     });
   }
@@ -519,6 +677,27 @@ export function renderWalkthrough(fw, evaluation, opts = {}) {
     if (ev.status === 'absent' || ev.status === 'partial') {
       lines.push(`**Remediation:** address the bullet(s) above, then re-run \`/compliance --walkthrough ${fw.id}\` to update this report.`);
       lines.push('');
+      if (Array.isArray(ev.controlRefs) && ev.controlRefs.length) {
+        lines.push(`**Contributing findings:** ${ev.controlRefs.join(', ')}`);
+        const dp = ev.derivedProvenance;
+        if (dp && dp.earliestOrigin) {
+          const short = String(dp.earliestOrigin.commit || '').slice(0, 7) || 'unknown';
+          const day = String(dp.earliestOrigin.authorDate || '').slice(0, 10);
+          // Only commit/authorDate/authorName are ever read here — same
+          // caveat as deriveComplianceProvenance's earliestOrigin: this
+          // object bypasses redactFindingProvenance, so authorEmail must
+          // never be surfaced from it without routing through that function
+          // first.
+          lines.push(`**Earliest proven origin:** ${short} — ${day} — ${sanitizeForTerminal(_maybePseudonymizeName(dp.earliestOrigin.authorName)) || 'unknown'} (confidence: ${dp.confidence})`);
+          // PRD Section 8 REQUIRED DISCLAIMER, alongside the claim it
+          // qualifies (not just once at the top of the document) — a reader
+          // who skips straight to a control's evidence must still see it.
+          lines.push(`_${PROVENANCE_COMPLIANCE_DISCLAIMER}_`);
+        } else if (dp) {
+          lines.push(`**Earliest proven origin:** unresolved (confidence: ${dp.confidence})`);
+        }
+        lines.push('');
+      }
     }
   }
 

package/src/posture/compliance-frameworks/hipaa-security-rule.json

@@ -5,7 +5,7 @@
   "license": "US Federal regulation (public)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164",
   "scope": "SELECTIVE SUBSET. 8 of the Security Rule technical safeguards. Administrative and physical safeguards are outside what a code scanner can observe and are NOT represented here.",
-  "controlsDigest": "a99f9c4015ffbf72",
+  "controlsDigest": "7e94038dd9a64d3d",
   "controlCount": 8,
   "controls": [
     {
@@ -102,7 +102,8 @@
       ],
       "mapsTo": [
         "family:crypto-tls-no-verify",
-        "family:crypto-tls-version"
+        "family:crypto-tls-version",
+        "graph:transit-protection:PHI:external:transit:protected"
       ]
     }
   ]

package/src/posture/compliance-policy.js

@@ -64,7 +64,8 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
-import { execSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
+import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
 import * as yaml from '../util/yaml.js';
 import { statePath, safeWriteState, STATE_DIR_NAME } from './state-dir.js';
 import { SCANNER_VERSION } from './version.js';
@@ -367,10 +368,19 @@ export function verifyPolicy(policy, ctx) {
   return { framework: policy.framework, version: policy.version, controls: results, summary, evidenceDigest };
 }
 
+// `scanRoot` is the scanned project's repository, not this project's own
+// trusted checkout — hardened per FR-PROV-024 / the second Finding
+// Provenance PRD audit sweep (found missing here by a follow-up review that
+// grepped for `child_process` usage beyond just `execFileSync('git'` call
+// sites). `rev-parse HEAD` was VERIFIED not to itself trigger
+// `core.fsmonitor`/a hook, so this is not a second live RCE — but the
+// shell-string `execSync` form was gratuitous risk with no upside (no
+// caller-controlled input to interpolate), and left this call outside the
+// config/env hardening every other git call in this codebase now has.
 function _currentCommit(scanRoot) {
   if (!scanRoot) return null;
   try {
-    return execSync('git rev-parse HEAD', { cwd: scanRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    return execFileSync('git', hardenGitArgs(['rev-parse', 'HEAD']), { cwd: scanRoot, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv() }).trim();
   } catch { return null; } // not a git repo, or git unavailable — not an error condition
 }
 

package/src/posture/cross-repo-memory.js

@@ -24,6 +24,7 @@ import * as cp from 'node:child_process';
 import * as fs from 'node:fs';
 import * as crypto from 'node:crypto';
 import * as path from 'node:path';
+import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
 
 // Lazy — process.env.HOME may be mutated mid-process (e.g. tests isolating).
 function _storeDir() {
@@ -43,8 +44,12 @@ function _ensureDir() { try { fs.mkdirSync(_storeDir(), { recursive: true }); }
 export function repoFingerprint(scanRoot) {
   let source = String(scanRoot || '');
   try {
-    const remote = cp.execFileSync('git', ['remote', 'get-url', 'origin'],
-      { cwd: scanRoot, encoding: 'utf8', timeout: 800, stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+    // `scanRoot` is the scanned project's repository, not this project's
+    // own trusted checkout — hardened per FR-PROV-024 / the second Finding
+    // Provenance PRD audit (same exposure class as
+    // provenance/git-evidence.js's `_run`).
+    const remote = cp.execFileSync('git', hardenGitArgs(['remote', 'get-url', 'origin']),
+      { cwd: scanRoot, encoding: 'utf8', timeout: 800, stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv() }).trim();
     if (remote) source = remote;
   } catch {}
   return crypto.createHash('sha256').update(source).digest('hex').slice(0, 12);

package/src/posture/fix-history.js

@@ -13,6 +13,7 @@ import * as fsp from 'node:fs/promises';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
 import { isSafeStateDir, statePath, stateWritesEnabled } from './state-dir.js';
+import { AGE_BASIS } from './provenance/schema.js';
 
 function historyDir(scanRoot) {
   return statePath(scanRoot, 'fix-history');
@@ -238,6 +239,26 @@ function _countPriorAttempts(log, stableId, findingId) {
   return n;
 }
 
+// FR-PROV §7.4 / M2 §2.2: how old was this finding, by which basis, at the
+// moment it was fixed. Computed ONCE, at fix time, and never re-derived
+// later — a finding's origin doesn't change, but re-computing "age at fix"
+// from a LATER read of findingProvenance would silently answer "how old is
+// it now", not "how old was it when fixed". Mirrors mttr.js's ageBasis
+// tiering (Task 6) so the two surfaces agree on vocabulary.
+function _snapshotProvenanceAtFix(findingProvenance, appliedAt) {
+  if (!findingProvenance) return null;
+  const status = findingProvenance.status;
+  const origin = findingProvenance.findingOrigin;
+  const observedAt = findingProvenance.firstObserved?.observedAt || null;
+  let ageBasis, basisDate;
+  if (status === 'complete' && origin?.authorDate) { ageBasis = AGE_BASIS.FINDING_ORIGIN; basisDate = origin.authorDate; }
+  else if (status === 'partial' && origin?.authorDate) { ageBasis = AGE_BASIS.EARLIEST_OBSERVABLE; basisDate = origin.authorDate; }
+  else if (status === 'uncommitted') { ageBasis = AGE_BASIS.UNCOMMITTED; basisDate = observedAt; }
+  else { ageBasis = AGE_BASIS.FIRST_OBSERVED; basisDate = observedAt; }
+  const ageDays = basisDate ? Math.max(0, Math.floor((Date.parse(appliedAt) - Date.parse(basisDate)) / 86400000)) : null;
+  return { commit: origin?.commit || null, authorDate: basisDate, ageBasis, ageDays };
+}
+
 // @param {boolean} [fileExisted] - did `file` exist on disk before this call?
 //   Determines what "restore" means on rollback: write `originalContent`
 //   back for a file that existed (default, for backward compatibility with
@@ -247,7 +268,7 @@ function _countPriorAttempts(log, stableId, findingId) {
 //   real-world meaning in this codebase's callers — writing '' back would
 //   leave a phantom empty file where none existed before, not a true
 //   rollback).
-export async function applyFix({ scanRoot, file, originalContent, newContent, findingId, ruleId, vuln, stableId, fileExisted = true }) {
+export async function applyFix({ scanRoot, file, originalContent, newContent, findingId, ruleId, vuln, stableId, fileExisted = true, findingProvenance = null }) {
   return _withLogLock(scanRoot, async () => {
     ensure(scanRoot);
     const absFile = path.resolve(scanRoot, file);
@@ -269,6 +290,7 @@ export async function applyFix({ scanRoot, file, originalContent, newContent, fi
     // is below — a corrupted backup is worse than no backup, because it
     // silently defeats rollback.
     await _writeAtomicAndSync(bakPath, originalContent);
+    const appliedAt = new Date().toISOString();
     const entry = {
       id,
       findingId,
@@ -280,10 +302,11 @@ export async function applyFix({ scanRoot, file, originalContent, newContent, fi
       backupPath: path.relative(scanRoot, bakPath),
       originalSha: sha(originalContent),
       newSha: sha(newContent),
-      appliedAt: new Date().toISOString(),
+      appliedAt,
       status: 'pending',
       reverted: false,
       attemptOrdinal: priorAttempts + 1,
+      provenanceAtFix: _snapshotProvenanceAtFix(findingProvenance, appliedAt),
     };
     // Phase 2: log entry marked pending + fsync.
     const log = priorLog;

package/src/posture/fix-verify.js

@@ -38,7 +38,15 @@ export async function verifyPatch({
   const fileContents = { ...files };
   let scan;
   try {
-    scan = await runFullScan({ fileContents, depFileContents, scanRoot }, () => {});
+    // `provenance:false` is REQUIRED here, not an optimisation. This scan is
+    // deliberately scoped to just the patched file(s), so its finding set is a
+    // tiny subset of the project's. updateLifecycle marks every open stableId
+    // NOT in the set it is handed as `remediated` — so a single fix
+    // verification (every /fix, apply_fix, and autopilot iteration runs one)
+    // would mass-mark the rest of the project as remediated, then
+    // `reintroduced` on the next real scan. The patched content is also not
+    // committed, so there is no history to resolve provenance against anyway.
+    scan = await runFullScan({ fileContents, depFileContents, scanRoot, provenance: false }, () => {});
   } catch (e) {
     return { ok: false, reason: 'rescan-failed', error: e.message };
   }

package/src/posture/git-history.js

@@ -19,14 +19,19 @@
 import * as cp from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
 
 const MAX_BLAME_PER_SCAN = 500;
 const SUBPROC_TIMEOUT_MS = 1500;
 const PROMPT_MARKER_RE = /(?:^|\n)(?:Prompt|User asked|Original request|Co-Authored-By:\s*Claude)/i;
 
+// `scanRoot` is the scanned project's repository, not this project's own
+// trusted checkout — every call below is hardened per FR-PROV-024 / the
+// second Finding Provenance PRD audit (same exposure class as
+// provenance/git-evidence.js's `_run`).
 function _isGitRepo(scanRoot) {
   try {
-    cp.execFileSync('git', ['rev-parse', '--git-dir'], { cwd: scanRoot, stdio: 'ignore', timeout: SUBPROC_TIMEOUT_MS });
+    cp.execFileSync('git', hardenGitArgs(['rev-parse', '--git-dir']), { cwd: scanRoot, stdio: 'ignore', timeout: SUBPROC_TIMEOUT_MS, env: hardenGitEnv() });
     return true;
   } catch { return false; }
 }
@@ -36,10 +41,13 @@ function _blame(scanRoot, file, line) {
   const rel = path.isAbsolute(file) ? path.relative(scanRoot, file) : file;
   if (rel.startsWith('..')) return null;
   try {
+    // `--no-textconv`: VERIFIED exploitable without it — `git blame`
+    // applies a hostile `.gitattributes` textconv driver by default in
+    // current git, same as provenance/git-evidence.js's blameLine.
     const stdout = cp.execFileSync(
       'git',
-      ['blame', '-L', `${line},${line}`, '--porcelain', '--', rel],
-      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'] },
+      hardenGitArgs(['blame', '-L', `${line},${line}`, '--porcelain', '--no-textconv', '--', rel]),
+      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv() },
     );
     return _parsePorcelain(stdout);
   } catch { return null; }
@@ -66,8 +74,8 @@ function _parsePorcelain(out) {
 function _fullMessage(scanRoot, sha) {
   try {
     return cp.execFileSync(
-      'git', ['show', '-s', '--format=%B', sha],
-      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'] },
+      'git', hardenGitArgs(['show', '-s', '--no-textconv', '--format=%B', sha]),
+      { cwd: scanRoot, encoding: 'utf8', timeout: SUBPROC_TIMEOUT_MS, stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv() },
     );
   } catch { return ''; }
 }

package/src/posture/material-change.js

@@ -11,6 +11,7 @@
 // or the command runner) collects the unified diff and feeds hunks into classifyHunk.
 
 import * as cp from 'node:child_process';
+import { hardenGitArgs, hardenGitEnv } from '../util/git-hardening.js';
 import { loadPrivacyTaxonomy } from '../dataflow/privacy-taxonomy.js';
 
 // Patterns that fire on the deletion side (auth/check removed).
@@ -196,11 +197,29 @@ function summarize(findings) {
 }
 
 // Convenience: invoke `git diff <ref>...HEAD` for the project and classify it.
+//
+// `rootDir` is the scanned project's repository, not this project's own
+// trusted checkout. `--no-textconv` is load-bearing here, not
+// defense-in-depth: this renders real diff content, the same shape VERIFIED
+// exploitable via a hostile `.gitattributes` textconv driver in
+// provenance/git-evidence.js's `commitDiff` (FR-PROV-024 / the second audit).
+//
+// `--no-ext-diff` is ALSO load-bearing and is a SEPARATE surface from
+// `--no-textconv`: `git diff` (unlike `git show`/`git log -p`/`git blame`)
+// honours an external diff driver (`.gitattributes` `diff=<name>` +
+// `.git/config [diff "<name>"] command=<script>`, or the global
+// `diff.external`) even with `--no-textconv` set — VERIFIED empirically: the
+// exact argv this function shipped with before this fix
+// (`-c core.fsmonitor= -c core.hooksPath=/dev/null diff --unified=0
+// --no-textconv <ref>...HEAD`) still ran an attacker's `diff.evil.command`
+// script. This was the live, remaining RCE a second review caught: this
+// function is the real entry point for `/scan --diff` and
+// `security-material-change`, both invoked against the scanned project.
 export function classifyGitDiff(rootDir, ref) {
   let out;
   try {
-    out = cp.execFileSync('git', ['diff', '--unified=0', `${ref}...HEAD`], {
-      cwd: rootDir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'],
+    out = cp.execFileSync('git', hardenGitArgs(['diff', '--unified=0', '--no-textconv', '--no-ext-diff', `${ref}...HEAD`]), {
+      cwd: rootDir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], env: hardenGitEnv(),
     });
   } catch (e) {
     return { materialRisk: 'unknown', error: 'git diff failed: ' + (e.message || e), findings: [], perKindCounts: {}, byFile: {} };

package/src/posture/mttr.js

@@ -8,6 +8,29 @@
 // when to persist firstSeenAt back into the baseline.
 
 import * as crypto from 'node:crypto';
+import { AGE_BASIS } from './provenance/schema.js';
+
+// FR-PROV-019: "reports never show an age without its basis and confidence."
+// FINDING_ORIGIN is the only basis backed by a resolved git commit for the
+// finding's actual introduction; EARLIEST_OBSERVABLE is also git-derived but
+// partial (weaker claim, no exact introduction commit). UNCOMMITTED and
+// FIRST_OBSERVED are both wall-clock fallbacks — the age is a first-seen
+// timestamp, never resolved against git history — and must say so honestly
+// rather than read like a proven date.
+function _ageBasisLabel(ageBasis, confidence) {
+  const level = confidence?.level && confidence.level !== 'unknown' ? confidence.level.toUpperCase() : null;
+  switch (ageBasis) {
+    case AGE_BASIS.FINDING_ORIGIN:
+      return `proven origin${level ? `, ${level} confidence` : ''}`;
+    case AGE_BASIS.EARLIEST_OBSERVABLE:
+      return `earliest observable commit, partial history${level ? `, ${level} confidence` : ''}`;
+    case AGE_BASIS.UNCOMMITTED:
+      return 'uncommitted — first-seen fallback, origin not proven';
+    case AGE_BASIS.FIRST_OBSERVED:
+    default:
+      return 'first-seen fallback — origin not proven';
+  }
+}
 
 // Stable fingerprint for cross-scan finding identity. Mirrors the dedupe key.
 // Exported so a caller can compute the "removed since baseline" (i.e. fixed)
@@ -37,6 +60,25 @@ export function stampFindingTimestamps(findings, baselineMap = new Map(), now =
     f.lastSeenAt = nowIso;
     const firstMs = Date.parse(f.firstSeenAt);
     f.ageDays = Math.max(0, Math.floor((now - firstMs) / 86400000));
+    // FR-PROV-019: age/SLA basis. ageDays above stays pure wall-clock —
+    // every existing SLA/computeMTTR consumer keeps its current meaning.
+    // ageBasis + provenAgeDays are ADDITIVE: a report can show both and
+    // explain the discrepancy, never silently swap which number "age" means.
+    const status = f.findingProvenance?.status;
+    const origin = f.findingProvenance?.findingOrigin;
+    if (status === 'complete' && origin?.authorDate) {
+      f.ageBasis = AGE_BASIS.FINDING_ORIGIN;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'partial' && origin?.authorDate) {
+      f.ageBasis = AGE_BASIS.EARLIEST_OBSERVABLE;
+      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
+    } else if (status === 'uncommitted') {
+      f.ageBasis = AGE_BASIS.UNCOMMITTED;
+      f.provenAgeDays = f.ageDays;
+    } else {
+      f.ageBasis = AGE_BASIS.FIRST_OBSERVED;
+      f.provenAgeDays = f.ageDays;
+    }
   }
   return findings;
 }
@@ -68,28 +110,49 @@ export function findingsExceedingSLA(findings, slaDays = null) {
   });
 }
 
-// Median age (days) of the currently-open findings — a single-scan proxy for
-// "how long has this debt been sitting". True MTTR (computeMTTR) needs the set
-// of findings that were FIXED; this reports the open backlog's median age so a
-// scan can show whether debt is getting older. Returns null on empty input.
-// Local — surfaced only through renderSlaSummary (its sole consumer).
-function medianOpenAgeDays(findings) {
-  const ages = (findings || []).map(f => f.ageDays || 0).sort((a, b) => a - b);
-  if (!ages.length) return null;
-  return ages[Math.floor(ages.length / 2)];
+// Median age (days) of the currently-open findings, PLUS the ageBasis/
+// confidence of whichever finding landed on that median — a single-scan proxy
+// for "how long has this debt been sitting". True MTTR (computeMTTR) needs the
+// set of findings that were FIXED; this reports the open backlog's median age
+// so a scan can show whether debt is getting older. Returns null on empty
+// input. Local — surfaced only through renderSlaSummary (its sole consumer).
+//
+// FR-PROV-019: the days figure prefers `provenAgeDays` (git-derived when
+// available) over the pure-wall-clock `ageDays`, and the ageBasis/confidence
+// travel WITH the day count they describe — never a bare number with the
+// basis looked up separately, which is how the original miss happened
+// (ageBasis was stamped onto the finding but never reached the string that
+// printed its age). Findings stamped by an older/test caller that never ran
+// through stampFindingTimestamps (no ageBasis at all) degrade to the same
+// honest "not proven" label FIRST_OBSERVED gets, never a false claim.
+function medianOpenAge(findings) {
+  const entries = (findings || [])
+    .map(f => ({
+      days: f.provenAgeDays != null ? f.provenAgeDays : (f.ageDays || 0),
+      ageBasis: f.ageBasis || AGE_BASIS.FIRST_OBSERVED,
+      confidence: f.findingProvenance?.confidence || null,
+    }))
+    .sort((a, b) => a.days - b.days);
+  if (!entries.length) return null;
+  return entries[Math.floor(entries.length / 2)];
 }
 
 // One-line SLA-breach summary for surfacing after a scan (#10). Returns null
-// when nothing is past its per-severity SLA. Pairs with medianOpenAgeDays for a
+// when nothing is past its per-severity SLA. Pairs with medianOpenAge for a
 // "is my security debt aging" readout that the vibecoder can act on.
+//
+// FR-PROV-019: never prints the median age number without its basis and
+// confidence alongside it — see medianOpenAge/_ageBasisLabel above.
 export function renderSlaSummary(findings, slaDays = null) {
   const breached = findingsExceedingSLA(findings || [], slaDays);
   if (!breached.length) return null;
   const bySev = {};
   for (const f of breached) bySev[f.severity] = (bySev[f.severity] || 0) + 1;
   const parts = ['critical', 'high', 'medium', 'low', 'info'].filter(s => bySev[s]).map(s => `${bySev[s]} ${s}`);
-  const median = medianOpenAgeDays(findings);
-  const ageNote = median != null ? ` (median open age ${median}d)` : '';
+  const median = medianOpenAge(findings);
+  const ageNote = median != null
+    ? ` (median open age ${median.days}d, ${_ageBasisLabel(median.ageBasis, median.confidence)})`
+    : '';
   return `${breached.length} finding(s) past remediation SLA: ${parts.join(', ')}${ageNote}`;
 }