@clear-capabilities/agentic-security-scanner 0.148.0 → 0.148.3

package/src/engine.js

@@ -257,6 +257,7 @@ import { generateBundles as generateExploitBundles } from './posture/exploit-bun
 import { buildMigrationPlan as buildPqcPlan, persistMigrationPlan as persistPqcPlan } from './posture/pqc-migration-plan.js';
 import { analyzeLicenseGraph, loadLicenseGraphPolicy } from './posture/license-graph.js';
 import { generateAttributions, persistAttributions } from './posture/license-attributions.js';
+import { buildAIBOM, persistAIBOM } from './posture/aibom.js';
 import { annotateAttackTaxonomy, summarizeTaxonomy } from './posture/attack-taxonomy.js';
 import { suppressByPastDecisions } from './posture/triage-memory.js';
 import { suppressByIntent } from './posture/intent-context.js';
@@ -1862,7 +1863,22 @@ function scanRoutes(fp,raw){const cleaned=stripNoise(raw,fp);const lines=raw.spl
 
 const LOGIC_PATTERNS=[
   {regex:/Math\.random\s*\(\s*\)/g,vuln:"Weak Randomness",severity:"medium",cwe:"CWE-330",stride:"Spoofing",fix:"Use crypto.randomBytes or crypto.randomUUID for security-sensitive values.",code:"// BEFORE\nconst token = Math.random().toString(36);\n\n// AFTER\nconst token = crypto.randomBytes(32).toString('hex');"},
-  {regex:/(?:password|secret|api_?key|token|auth)\s*[:=]\s*['"][^'"]{3,}['"]/gi,vuln:"Hardcoded Secret",severity:"critical",cwe:"CWE-798",stride:"Information Disclosure",kind:"secret",fix:"Use environment variables or a secrets manager.",code:"// BEFORE\nconst apiKey = 'sk-abc123';\n\n// AFTER\nconst apiKey = process.env.API_KEY;"},
+  // Real false positive (customer report): `[^'"]` matches newlines, so the
+  // "value" capture could pair the CLOSING quote of an unrelated string with
+  // some OTHER quote found anywhere later in the file, fabricating a fake
+  // "secret" spanning arbitrary source text in between. Confirmed
+  // reproduction: `HUGGINGFACE_TOKEN = getpass.getpass("Enter your Hugging
+  // Face token: ")` — the trigger word "token" occurs inside the human-
+  // readable PROMPT text, immediately followed by ": " (satisfying the
+  // `[:=]` requirement) and then that string's own closing quote (accepted
+  // as the regex's opening quote); `[^'"]{3,}` then consumed everything up
+  // to the next unrelated quote anywhere below, including subsequent
+  // function definitions. getpass() collects a credential interactively at
+  // runtime — the only literal in the source is the prompt, not a secret.
+  // Excluding `\n` from the captured-value class confines a match to a
+  // single physical line, which is what "hardcoded" is supposed to mean:
+  // a real inline literal, not two coincidental quote characters far apart.
+  {regex:/(?:password|secret|api_?key|token|auth)\s*[:=]\s*['"][^'"\n]{3,}['"]/gi,vuln:"Hardcoded Secret",severity:"critical",cwe:"CWE-798",stride:"Information Disclosure",kind:"secret",fix:"Use environment variables or a secrets manager.",code:"// BEFORE\nconst apiKey = 'sk-abc123';\n\n// AFTER\nconst apiKey = process.env.API_KEY;"},
   {regex:/===?\s*['"](?:admin|root|password|123456|test|default)['"]/gi,vuln:"Hardcoded Credential Check",severity:"high",cwe:"CWE-798",stride:"Spoofing",kind:"secret",fix:"Use hashed password verification, never hardcoded strings.",code:"// BEFORE\nif (password === 'admin') grant();\n\n// AFTER\nconst valid = await bcrypt.compare(password, user.hashedPassword);"},
   {regex:/if\s*\(\s*(?:fs\.existsSync|fs\.access|stat)\s*\([^)]+\)\s*\)[^{]*(?:readFile|writeFile|unlink|rename)/g,vuln:"Race Condition (TOCTOU)",severity:"medium",cwe:"CWE-367",stride:"Tampering",fix:"Use atomic operations instead of check-then-act patterns.",code:"// BEFORE\nif (fs.existsSync(p)) fs.unlinkSync(p);\n\n// AFTER\ntry { fs.unlinkSync(p); } catch(e) { if(e.code!=='ENOENT') throw e; }"},
   {regex:/\.(?:isAdmin|isRole|role)\s*(?:===?\s*(?:true|['"]admin['"])|\)\s*\{)/g,vuln:"Inline Privilege Check",severity:"medium",cwe:"CWE-863",stride:"Elevation of Privilege",fix:"Use middleware-based RBAC instead of inline role checks.",code:"// BEFORE\nif (user.isAdmin) deleteAll();\n\n// AFTER\nrouter.delete('/all', requireRole('admin'), handler);"},
@@ -1889,7 +1905,19 @@ const LOGIC_PATTERNS=[
   // ── Missing Bounds on Financial/Quantity Fields ──────────────────────────────
   {regex:/(?:req|request|ctx)\s*(?:\.\s*body|\[\s*['"]body['"]\s*\])\s*[.[\s]*(?:quantity|amount|price|units|count|qty)\b(?![^;]{0,200}(?:Number\.isInteger|isNaN|Math\.abs|>=\s*1|>\s*0|>0|>=1|max\s*:))/g,vuln:"Missing Positive-Integer Validation on Financial Field",severity:"medium",cwe:"CWE-20",stride:"Tampering",fix:"Validate that financial/quantity fields are positive integers before processing. Negative values can create credit or reverse transactions.",code:"// BEFORE\nawait Order.create({ quantity: req.body.quantity, price: product.price });\n\n// AFTER\nconst qty = req.body.quantity;\nif (!Number.isInteger(qty) || qty < 1 || qty > 10000)\n  return res.status(400).json({ error: 'quantity must be 1-10000' });\nawait Order.create({ quantity: qty, price: product.price });"},
   // ── #22: Missing timeout on outbound HTTP requests (DoS) ─────────────────────
-  {regex:/(?:await\s+)?\b(?:fetch|axios\.(?:get|post|put|patch|delete|request)|http\.(?:get|request)|https\.(?:get|request)|got)\s*\(/gi,vuln:"Missing Timeout on Outbound HTTP Request (DoS)",severity:"medium",cwe:"CWE-400",stride:"Denial of Service",appliesTo:["server"],fix:"Set a timeout on all outbound requests to prevent event-loop starvation from stalled upstreams.",code:"// fetch (Node 18+)\nconst resp = await fetch(url, { signal: AbortSignal.timeout(5000) });\n\n// axios\nawait axios.get(url, { timeout: 5000 });\n\n// node http\nconst req = http.get(url, cb);\nreq.setTimeout(5000, () => req.destroy());"},
+  // Real false positive (customer report): this rule names JS/Node APIs
+  // (fetch/axios/http.get) but carried no langScope, so it ran on every
+  // language and matched the literal text "fetch(" wherever it occurred —
+  // including a Python method DEFINITION (`def fetch(self, ...)`) and its
+  // interface declaration and every call site, none of which perform an
+  // outbound HTTP request in that language at all. The remediation shown was
+  // also unconditionally JS (fetch/axios/node http), which made no sense on
+  // a Python finding. Two fixes: scope to the languages these API names
+  // actually mean something in, and exclude a `function fetch(...)`
+  // declaration from matching a call-shaped rule — the same declaration-vs-
+  // call confusion that made the Python case fire, reproduced once more
+  // inside JS/TS itself (a local polyfill/wrapper named `fetch`).
+  {regex:/(?<!\bfunction\s)(?:await\s+)?\b(?:fetch|axios\.(?:get|post|put|patch|delete|request)|http\.(?:get|request)|https\.(?:get|request)|got)\s*\(/gi,vuln:"Missing Timeout on Outbound HTTP Request (DoS)",severity:"medium",cwe:"CWE-400",stride:"Denial of Service",appliesTo:["server"],langScope:/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i,fix:"Set a timeout on all outbound requests to prevent event-loop starvation from stalled upstreams.",code:"// fetch (Node 18+)\nconst resp = await fetch(url, { signal: AbortSignal.timeout(5000) });\n\n// axios\nawait axios.get(url, { timeout: 5000 });\n\n// node http\nconst req = http.get(url, cb);\nreq.setTimeout(5000, () => req.destroy());"},
   // ── #24: ORM collection queries without pagination limit (DoS) ───────────────
   {regex:/\.\s*(?:findAll|findMany|findAndCountAll)\s*\(\s*\{[^}]{0,500}\}/g,vuln:"ORM Collection Query Without Pagination Limit (DoS)",severity:"medium",cwe:"CWE-400",stride:"Denial of Service",appliesTo:["server"],fix:"Always set limit/take on collection queries to bound memory and DB load.",code:"const items = await Model.findAll({\n  where: { userId: req.user.id },\n  limit: Math.min(Number(req.query.limit) || 50, 100),\n  offset: Number(req.query.offset) || 0,\n});"},
   // ── #27: Missing audit log on sensitive mutations (Repudiation) ──────────────
@@ -10153,7 +10181,13 @@ function _deterministicFileTimings(timings) {
   await _runAnnotator("_v3.calibrationDrift", () => { _v3.calibrationDrift = computeCalibrationDrift(scanRoot); });
   // v3 next-gen: why-fired provenance is captured LAST so it reflects the
   // final state of each finding after every other annotator has run.
-  await _runAnnotator("annotateWhyFired", () => { annotateWhyFired(finalFindings, {}); });
+  // Real customer-reported inconsistency: this call passed a hardcoded `{}`
+  // context, so `ctx.rulesetVersion` inside why-fired.js was always
+  // undefined and every finding's `whyFired.scanner.rulesetVersion` read
+  // `null` — even though the top-level attestation, computed from the same
+  // `_effectiveRulesetVersion(scanRoot)` this file already calls at two
+  // other sites, correctly named the real ruleset version. Thread it through.
+  await _runAnnotator("annotateWhyFired", () => { annotateWhyFired(finalFindings, { rulesetVersion: (_effectiveRulesetVersion(scanRoot) || {}).version || null }); });
   // SCA-SAST correlation: link SAST findings to SCA vulnerable packages
   try{for(const f of finalFindings){if(!f.chain||!f.chain.length)continue;const src=f.chain[0]?.label||'';for(const sc of supplyChain){if(sc.type!=='vulnerable_dep')continue;if(src.includes(sc.name)||f.vuln?.toLowerCase().includes(sc.name)){f.scaCorrelation={osvId:sc.osvId,package:sc.name,version:sc.version,confirmed:true};sc.sastConfirmed=true;break;}}}}catch(_){}
   // Multi-sink chain detection: group findings by source variable
@@ -10232,6 +10266,19 @@ function _deterministicFileTimings(timings) {
         if (_attributions && _attributions.componentCount) persistAttributions(scanRoot, _attributions);
       } catch (_) {}
     }
+    // AI-BOM: emit aibom.json (adversarial premortem Q2, 2026-09-07 — see
+    // aibom.js's persistAIBOM header comment for why this was missing).
+    // Previously only reachable via the CLI's --format aibom, which never
+    // wrote it here, so module:aibom (eu-ai-act.json Art.11, nist-800-171-r3
+    // .json 03.04.10, nist-ai-600-1.json MG-4.1-001) could never clear.
+    if (process.env.AGENTIC_SECURITY_NO_AIBOM !== '1') {
+      try {
+        const _aibom = buildAIBOM({ components: annotatedComponents || [] }, fc, {});
+        if (_aibom && (_aibom.models.length || _aibom.promptTemplates.length || _aibom.frameworks.length)) {
+          persistAIBOM(scanRoot, _aibom);
+        }
+      } catch (_) {}
+    }
     // Attack taxonomy summary — aggregates ATT&CK / ATLAS / kill-chain
     // distribution over all findings for the report layer.
     if (process.env.AGENTIC_SECURITY_NO_ATTACK_TAX !== '1') {
@@ -10691,7 +10738,7 @@ function _deterministicFileTimings(timings) {
     compliance: _complianceReport ? { stale: _complianceReport.summary?.stale || 0 } : null,
   });
   } // end if (!skipAnnotators) — FR-PROV-029
-  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,proofCoverage:_proofCoverage,kevCatalog:kevCatalogMeta(),routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,detectorErrors:_detectorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,privacyIrBacked:_privacyIrBacked,privacyTaxonomyVersion:_privacyTaxonomyVersion,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary,scanHealth:_scanHealth,coverageLedger:_coverageLedger,lineageGraph:_lineageGraph,lineageStatus:_lineageStatus};}
+  return{entrypointInventory:_entrypointInventory,rootCauseSweep:_rootCauseSweep,proofCoverage:_proofCoverage,kevCatalog:kevCatalogMeta(),routes:dd(aR,r=>`${r.method}:${r.path}:${r.file}:${r.line}`),findings:finalFindings,sources:aSrc,sinks:aSink,sanitizers:aSan,filesScanned:files.length,linesScanned:Object.values(fc).reduce((_n,_c)=>_n+(typeof _c==='string'?_c.split("\n").length:0),0),crossFileCount:cf.length,logicVulns:aLogic,supplyChain,components:annotatedComponents,secrets:aSecrets,ciphers:{atRest:aCiphersRest,inTransit:aCiphersTransit},pfr,fc,suppressions:_getSuppressions(),_v3,_scanMeta,_engineErrors:{cppDataflowParseErrors:_cppDataflowParseErrors.value},annotatorErrors:_annotatorErrors,detectorErrors:_detectorErrors,executionProof:_executionProofSummary,logicClaims:_logicClaims,vulnHistory:_vulnHistory,threatModel:_threatModel,privacyFramework:_privacyFramework,privacyIrBacked:_privacyIrBacked,privacyTaxonomyVersion:_privacyTaxonomyVersion,sbomDiff:_sbomDiff,complianceReport:_complianceReport,exploitBundles:_exploitBundles,pqcPlan:_pqcPlan,licenseGraph:_licenseGraph,attributions:_attributions,attackTaxonomy:_taxonomySummary,scanHealth:_scanHealth,coverageLedger:_coverageLedger,lineageGraph:_lineageGraph,lineageStatus:_lineageStatus};}
 
 // Post-aggregation classification: every source becomes "unsafe"|"safe"; every sink becomes "confirmed"|"safe".
 // Orphans (no finding linkage) are bucketed by file-local heuristic so the UI shows binary states only.

package/src/pipeline/assurance-mode.js

@@ -51,6 +51,62 @@ function _isValidMode(mode) {
   return ASSURANCE_MODES.includes(mode);
 }
 
+// A real user hit this: `agentic-security ci <a directory downloaded as a
+// GitHub zip, no .git present> --assurance strict` failed with the bare
+// count this function used to produce alone — "1210 finding(s) have status
+// outside [complete, uncommitted]" — with no indication that all 1210
+// findings failed for the exact same, simple, fixable reason
+// (`coordinator.js`'s `annotateGitProvenance` already knows and records it,
+// in `finding.findingProvenance.limitations[0]`, but that reason never
+// reached this message). A user reading "1210 problems" reasonably assumes
+// their CODE has 1210 problems, not that their DIRECTORY isn't a git
+// repository. This surfaces the dominant recorded reason instead of a bare
+// count, and gives the two most common, fully-fixable reasons ("not a Git
+// repository" from a zip download instead of `git clone`; a shallow CI
+// checkout) a one-line, specific remedy — the same specificity the
+// scanHealth branch above already gives for a stale-EPSS-cache failure.
+function _provenanceFailureReason(badProvenance, totalFindings) {
+  const counts = new Map();
+  for (const f of badProvenance) {
+    const reason = f?.findingProvenance?.limitations?.[0] || f?.findingProvenance?.status || 'unknown';
+    counts.set(reason, (counts.get(reason) || 0) + 1);
+  }
+  const ranked = [...counts.entries()].sort((a, b) => b[1] - a[1]);
+  const [topReason, topCount] = ranked[0];
+  const allSameReason = ranked.length === 1;
+  const base = `strict mode requires complete finding provenance; ${badProvenance.length}/${totalFindings} finding(s) have status outside [complete, uncommitted]`;
+
+  if (topReason === 'not a Git repository' || topReason === 'repository state unavailable') {
+    return `${base} — reason: ${allSameReason ? 'all of them are' : `${topCount} of them are`} "${topReason}". ` +
+      `strict mode resolves finding provenance from git history, so it requires a real git repository ` +
+      `(a GitHub "Download ZIP" extracts without one). Run \`git init && git add -A && git commit -m init\` in ` +
+      `the scanned directory, point the scan at a real \`git clone\`, or drop --assurance strict for standard/advisory.`;
+  }
+  // engine.js's own comment on this branch: "unpinned_dep / no_lockfile and
+  // friends... describe the ABSENCE of a declaration, so 'which commit
+  // introduced this version' is not a question that has an answer to defer
+  // ... this is a known, disclosed limitation, not a bug... strict mode
+  // WILL fail on nearly any real project that has a package.json." That
+  // disclosure lived only in a source comment nobody hits this error reads —
+  // the README's own quickstart explicitly invites pointing --assurance
+  // strict at "your own project," where this is the single most likely
+  // outcome. Named here so the person who hits it learns it is expected and
+  // permanent, not something to keep investigating.
+  const supplyChainCount = ranked.filter(([r]) => r.startsWith('origin resolution does not apply to a')).reduce((s, [, n]) => s + n, 0);
+  if (supplyChainCount > 0 && supplyChainCount >= badProvenance.length / 2) {
+    return `${base} — ${supplyChainCount} of them describe an ABSENT dependency declaration ` +
+      `(an unpinned version, a missing lockfile) that has no origin commit to resolve, by design. This is a ` +
+      `known, permanent limitation: strict mode cannot pass while any are present, on any real project with ` +
+      `such a dependency. Fix the underlying SCA finding(s) (pin the version / add a lockfile) if you want ` +
+      `strict to pass, or use --assurance standard/advisory for a project you don't control the dependencies of.`;
+  }
+  if (allSameReason) {
+    return `${base} — all ${badProvenance.length} share the same reason: "${topReason}".`;
+  }
+  const breakdown = ranked.slice(0, 5).map(([reason, n]) => `${n}× "${reason}"`).join(', ');
+  return `${base} — breakdown: ${breakdown}${ranked.length > 5 ? ', …' : ''}.`;
+}
+
 /**
  * @param {string} mode - one of ASSURANCE_MODES; invalid/missing degrades to the default.
  * @param {object|null} scanHealth - the engine's computed scan.scanHealth (FR-206).
@@ -143,7 +199,7 @@ export function evaluateAssuranceMode(mode, scanHealth, findings = []) {
     return {
       ok: false,
       mode: 'strict',
-      reason: `strict mode requires complete finding provenance; ${badProvenance.length} finding(s) have status outside [complete, uncommitted]`,
+      reason: _provenanceFailureReason(badProvenance, findings.length),
       conditions,
     };
   }
@@ -151,4 +207,4 @@ export function evaluateAssuranceMode(mode, scanHealth, findings = []) {
   return { ok: true, mode: 'strict', reason: null, conditions };
 }
 
-export const _internals = { _isValidMode };
+export const _internals = { _isValidMode, _provenanceFailureReason };

package/src/posture/accuracy-scorecard.js

@@ -266,6 +266,16 @@ export function buildScorecard(inputs) {
         }
         : null,
     },
+    // Adversarial premortem Q7 (2026-09-07). See mappingCoverageOf's own
+    // header comment (posture/auditor-walkthrough.js) for why this exists:
+    // measuring the trend, not gating it — no threshold, no baseline, no
+    // pass/fail, since a drop is sometimes the correct outcome of an honest
+    // fix and sometimes a real regression, and only a human reading the
+    // diff each release can tell which. `[]` (never omitted) when the
+    // caller supplies nothing, so a reader can tell "measured, zero
+    // frameworks" from "this scorecard predates the metric" the same way
+    // every other section here distinguishes absence from zero.
+    complianceMappingCoverage: inputs.complianceMappingCoverage || [],
   };
 }
 
@@ -530,6 +540,30 @@ export function renderScorecardMarkdown(m) {
     L.push('not a channel this measurement structurally cannot yet cover.');
     L.push('');
   }
+  if (Array.isArray(m.complianceMappingCoverage) && m.complianceMappingCoverage.length) {
+    L.push('## Compliance mapping coverage');
+    L.push('');
+    L.push('Adversarial premortem Q7 (2026-09-07): each fix to a category-error');
+    L.push('mapping (a control checking an artifact that evidences this scanner,');
+    L.push('not the target — see `03.03.08` in the NIST 800-171 coverage doc for the');
+    L.push('original instance) correctly SUBTRACTS a `mapsTo` entry. Nobody was');
+    L.push('tracking the cumulative effect release over release. This is not a');
+    L.push('gate — a drop is sometimes a correct, honest fix and sometimes a real');
+    L.push('regression, and only a human reading the diff each release can tell');
+    L.push('which — it exists so the trend is visible instead of assumed.');
+    L.push('');
+    L.push('| Framework | Controls with a live mapping | Share |');
+    L.push('| --- | --- | --- |');
+    for (const row of [...m.complianceMappingCoverage].sort((a, b) => String(a.id).localeCompare(String(b.id)))) {
+      L.push(`| ${row.id} | ${row.mappedCount}/${row.controlCount} | ${formatRate(row.mappedCount, row.controlCount)} |`);
+    }
+    L.push('');
+    L.push('"Live mapping" means the control carries at least one `family:`/`module:`/');
+    L.push('`rule:`/`graph:` entry, regardless of whether it would clear on any given');
+    L.push('scan — this counts what the engine CAN evidence, not what it evidenced');
+    L.push('this run.');
+    L.push('');
+  }
   // PRD F12.6 — the honest scorecard publishes the LIMITS too, not only the
   // rates. Three claims this project makes are only meaningful with their
   // caveat attached, and each caveat was invisible before this section:

package/src/posture/aibom.js

@@ -21,6 +21,7 @@
 // a labelled fixture set.
 
 import * as crypto from 'node:crypto';
+import { statePath, safeWriteState } from './state-dir.js';
 
 // SDK / API endpoint detection — same family list as scanner/src/sast/llm.js
 const HF_FROM_PRETRAINED_RE = /(?:Auto(?:Model|Tokenizer|Config|Processor|FeatureExtractor)|[A-Z][A-Za-z]*Model|[A-Z][A-Za-z]*Tokenizer)\.from_pretrained\s*\(\s*['"]([\w./-]+)['"](?:[^)]*?revision\s*=\s*['"]([\w]+)['"])?/g;
@@ -395,3 +396,24 @@ export function validateMLBOM(doc) {
   }
   return { ok: errors.length === 0, errors, checked: 'structural (required fields + ML-BOM component shape), NOT full JSON-Schema validation' };
 }
+
+// ─── Persistence (adversarial premortem Q2, 2026-09-07) ────────────────────
+//
+// `compliance-frameworks/*.json` has mapped `module:aibom` to `aibom.json`
+// since those mappings were written (eu-ai-act.json Art.11, nist-800-171-r3
+// .json 03.04.10, nist-ai-600-1.json MG-4.1-001), but nothing ever wrote it
+// there automatically: `buildAIBOM` was only ever reachable through the CLI's
+// `--format aibom`/`--format aibom-md` report emitters, which print to
+// stdout (or wherever `--output` sends them) and never touch
+// `.agentic-security/`. Three controls across three frameworks could never
+// read 'present' via this leg, on any project, unless an operator happened
+// to manually redirect `--format aibom` output to that exact path. Fixed the
+// same way `license-attributions.js`'s `persistAttributions` and
+// `threat-model.js`'s `persistAutoThreatModel` already are: a default-on
+// (opt-out via AGENTIC_SECURITY_NO_AIBOM), best-effort write during every
+// scan, wired in engine.js next to those two.
+export function persistAIBOM(scanRoot, aibom) {
+  if (!aibom || typeof aibom !== 'object') return null;
+  safeWriteState(statePath(scanRoot, 'aibom.json'), JSON.stringify(aibom, null, 2));
+  return aibom;
+}

package/src/posture/artifact-registry.js

@@ -119,6 +119,7 @@ export const ARTIFACT_REGISTRY = [
   { name: 'findings.csv', kind: 'file', classification: 'generated', retentionClass: 'scan' },
   { name: 'llm-cache', kind: 'dir', classification: 'generated', retentionClass: 'cache' },
   { name: 'fix-history', kind: 'dir', classification: 'generated', retentionClass: 'backup' },
+  { name: 'verifier-runs', kind: 'dir', classification: 'generated', retentionClass: 'evidence', source: 'src/posture/verifier.js (recordVerifierRun)', note: 'Adversarial premortem Q1 (2026-09-07): one JSON record per `agentic-security verify` run, added so module:verifier (nist-800-171-r3.json 03.12.01, nist-csf-2.json RC.RP) has a real artifact to check for instead of a name in the ARTIFACT table nothing ever wrote.' },
   { name: 'fix-plans', kind: 'dir', classification: 'generated', retentionClass: 'scan' },
   // The following were confirmed missing from the old hardcoded WIPE/
   // WIPE_DIRS sets (A-10) and confirmed GENERATED by reading their write
@@ -135,6 +136,7 @@ export const ARTIFACT_REGISTRY = [
   { name: 'compliance-evidence.json', kind: 'file', classification: 'generated', retentionClass: 'evidence', confidential: true, source: 'posture/compliance-policy.js' },
   { name: 'compliance-evidence.md', kind: 'file', classification: 'generated', retentionClass: 'evidence', confidential: true, source: 'posture/compliance-policy.js' },
   { name: 'ATTRIBUTIONS.md', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'posture/license-attributions.js' },
+  { name: 'aibom.json', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'posture/aibom.js (persistAIBOM)', note: 'Adversarial premortem Q2 (2026-09-07): module:aibom (eu-ai-act.json Art.11, nist-800-171-r3.json 03.04.10, nist-ai-600-1.json MG-4.1-001) mapped to this path since those mappings were written, but nothing wrote it here until now — buildAIBOM was only reachable via the CLI --format aibom emitter, which never touched .agentic-security/.' },
   { name: 'NOTICE', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'posture/license-attributions.js' },
   { name: 'accepted.json', kind: 'file', classification: 'generated', source: 'posture/suppressions.js (soft-accept save path)', note: 'already self-managing per-entry expiry (FR-1004-adjacent) — no additional class-level TTL' },
   { name: 'triage.json', kind: 'file', classification: 'generated', source: 'posture/triage.js (_save)' },

package/src/posture/auditor-walkthrough.js

@@ -328,6 +328,96 @@ function _resolveOpenFindingMinSeverity(scanRoot, frameworkId) {
     : OPEN_FINDING_MIN_SEVERITY;
 }
 
+// `module:` mapping vocabulary → the on-disk artifact(s) that evidence it.
+// Hoisted to module scope (was previously re-declared on every control
+// evaluated, a wasted allocation with no reader) and exported so
+// `test/module-artifact-liveness.test.js` can check every entry here is
+// actually written somewhere in scanner/src/, without keeping a second,
+// driftable copy of this list. A table entry is either one path or an array
+// of acceptable ones — see the `scan-history` comment below for why an array
+// means "any of these satisfies it." A `.../` prefix marks a source-relative
+// artifact (resolved against the scan root itself, not the state dir).
+export const MODULE_ARTIFACTS = {
+  'sbom-diff':            'sbom-history/',
+  'license-attributions': 'ATTRIBUTIONS.md',
+  'threat-model-auto':    'threat-model.json',
+  'compliance-policy':    'compliance-evidence.json',
+  'fix-history':          'fix-history/log.json',
+  'privacy-taint':        'dpia.md',
+  'aibom':                'aibom.json',
+  'attack-taxonomy':      'last-scan.json',
+  // Two real spellings, both live in this codebase: security-trend.js and
+  // router.js read `scan-history.json` (a FILE), findings-memory.js uses
+  // `scan-history` (a DIRECTORY). Only the directory was listed here, so
+  // on a normal scan — which writes the .json — every control mapped to
+  // module:scan-history reported the artifact missing and could never
+  // clear. Five bundled frameworks were affected. An array means "any of
+  // these satisfies it", which is the honest reading: the control asks
+  // whether a scan history exists, not which shape it took.
+  'scan-history':         ['scan-history.json', 'scan-history/'],
+  'watch-mode':           'watch-status.json',
+  'cve-alert-daemon':     'cve-alerts/',
+  'triage':               'triage.json',
+  'triage-memory':        'triage-memory.jsonl',
+  // Adversarial premortem Q1 (2026-09-07): this entry existed since the
+  // ARTIFACT table did, but nothing ever wrote verifier-runs/ — no control
+  // mapped to it could ever read 'present', on any project, permanently.
+  // `verifier.js`'s `recordVerifierRun` now writes one record per real
+  // `agentic-security verify` invocation, closing the gap for real.
+  'verifier':             'verifier-runs/',
+  'apply-fix':            'fix-history/log.json',
+  // REMOVED, deliberately (adversarial premortem P2.8 + Q1/Q2/Q6, 2026-09-07):
+  // 'integrity' (last-scan.json.sig), 'mcp-audit' (mcp-audit.log),
+  // 'calibration' (calibration-seed.json), 'holdout-eval'
+  // (holdout-eval.jsonl), 'sigstore-verify' (sigstore-attestations/, never
+  // written — see hipaa-security-rule.json's §164.312(c) removal note),
+  // 'pre-edit-bodyguard' (hooks/pre-edit-bodyguard.js), 'security-fixer'
+  // (agents/security-fixer.md), 'mcp-tools' (scanner/src/mcp/tools.js), and
+  // 'why-fired' (last-scan.json — its CONTENT is target-derived, unlike the
+  // others, but it evidences THIS TOOL's own detection provenance, not any
+  // property of the assessed system; adjudicated on eu-ai-act.json Art.13's
+  // actual text, see that control's evidence[] for the full reasoning) all
+  // evidence THIS SCANNER's own state, operation, or installed files —
+  // never the scanned project's — and are structurally incapable of validly
+  // backing any `module:` mapping, not just accidentally missing a writer.
+  // Every live mapsTo reference to any of them was removed and disclosed as
+  // an engine gap (see each affected framework file's evidence[] for the
+  // specific reasoning); they are removed from the vocabulary table itself,
+  // not merely un-referenced, so there is nothing left to copy-paste back
+  // in. `compliance-mapping-liveness.test.js`'s self-referential-module test
+  // remains as a permanent regression guard against the STRING key
+  // reappearing in a mapsTo array even without a table entry to source it
+  // from.
+};
+
+// Adversarial premortem Q7 (2026-09-07): each `03.03.08`-style fix
+// (P2.8/Q1/Q2/Q6) subtracts a `mapsTo` entry to correct a category error —
+// the right call every time it happened, but nobody was tracking the
+// CUMULATIVE effect. "Always subtract, never invent" is correct engineering
+// discipline that can still trend, unmeasured, toward a framework that
+// automatically clears fewer and fewer controls each release, which looks
+// to a buyer like the tool doing less over time even though every
+// individual change made it more honest. This computes the number that
+// makes the trend visible instead of assumed: how many of a framework's
+// controls carry at least one LIVE mapsTo (family:/module:/rule:/graph:),
+// regardless of whether that mapping would currently clear on any given
+// scan — the question is "can this control ever be evidenced by this
+// engine at all," not "did today's scan clear it." Pure and side-effect
+// free, like the rest of this module's exports; the caller supplies the
+// already-loaded framework object (see `scripts/scorecard.mjs` for the
+// driver that loads every bundled framework and calls this once each).
+export function mappingCoverageOf(fw) {
+  const controls = (fw && fw.controls) || [];
+  const controlCount = controls.length;
+  const mappedCount = controls.filter((c) => Array.isArray(c.mapsTo) && c.mapsTo.length > 0).length;
+  return {
+    id: fw && fw.id,
+    controlCount,
+    mappedCount,
+    mappedFraction: controlCount ? mappedCount / controlCount : null,
+  };
+}
+
 export function evaluateFramework(scanRoot, fw, scan) {
   const minSeverity = _resolveOpenFindingMinSeverity(scanRoot, fw && fw.id);
   // CMP-2: last-scan.json (what this is actually handed in production) carries
@@ -521,46 +611,12 @@ export function evaluateFramework(scanRoot, fw, scan) {
         anySignal = true;
       } else if (m.startsWith('module:')) {
         const mod = m.slice('module:'.length);
-        const ARTIFACT = {
-          'sbom-diff':            'sbom-history/',
-          'license-attributions': 'ATTRIBUTIONS.md',
-          'threat-model-auto':    'threat-model.json',
-          'compliance-policy':    'compliance-evidence.json',
-          'mcp-audit':            'mcp-audit.log',
-          'fix-history':          'fix-history/log.json',
-          'privacy-taint':        'dpia.md',
-          'aibom':                'aibom.json',
-          'attack-taxonomy':      'last-scan.json',
-          'why-fired':            'last-scan.json',
-          // Two real spellings, both live in this codebase: security-trend.js and
-          // router.js read `scan-history.json` (a FILE), findings-memory.js uses
-          // `scan-history` (a DIRECTORY). Only the directory was listed here, so
-          // on a normal scan — which writes the .json — every control mapped to
-          // module:scan-history reported the artifact missing and could never
-          // clear. Five bundled frameworks were affected. An array means "any of
-          // these satisfies it", which is the honest reading: the control asks
-          // whether a scan history exists, not which shape it took.
-          'scan-history':         ['scan-history.json', 'scan-history/'],
-          'integrity':            'last-scan.json.sig',
-          'watch-mode':           'watch-status.json',
-          'cve-alert-daemon':     'cve-alerts/',
-          'triage':               'triage.json',
-          'triage-memory':        'triage-memory.jsonl',
-          'verifier':             'verifier-runs/',
-          'calibration':          'calibration-seed.json',
-          'holdout-eval':         'holdout-eval.jsonl',
-          'sigstore-verify':      'sigstore-attestations/',
-          'pre-edit-bodyguard':   '.../hooks/pre-edit-bodyguard.js',
-          'apply-fix':            'fix-history/log.json',
-          'security-fixer':       '.../agents/security-fixer.md',
-          'mcp-tools':            '.../scanner/src/mcp/tools.js',
-        };
         // A table entry is either one path or an array of acceptable ones. An
         // array means the artifact has more than one real spelling in this
         // codebase and any of them evidences the control; the FIRST is the
         // canonical name used in the observation text when none is found, so
         // the message still names something a reader can go create.
-        const target = ARTIFACT[mod];
+        const target = MODULE_ARTIFACTS[mod];
         const candidates = target == null ? [] : (Array.isArray(target) ? target : [target]);
         // A '.../' sentinel marks a source-relative artifact (project source,
         // e.g. a hook or agent file) — resolve it against the scan root itself.

package/src/posture/compliance-frameworks/ccpa.json

@@ -4,6 +4,8 @@
   "publisher": "California Legislature",
   "license": "California statute (public)",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch): resolves to California Civil Code Title 1.81.5 sections 1798.100-1798.145, correctly reflecting amendments through Stats. 2025, Ch. 67 (effective 2026-01-01). No content hash is pinned deliberately: this URL serves the CURRENT, continuously-amended text of codified law by design, not a fixed publication, hash-pinning would misrepresent a living legal source as a static one.",
   "scope": "SELECTIVE SUBSET. 4 of the CCPA/CPRA obligations, chosen because a code scanner can produce evidence for them. The statute is far broader; the majority of its duties (notice, consumer request handling, contracts, retention policy) are organisational and are NOT represented here. Absence of a control is not a statement of compliance.",
   "controlsDigest": "ebc1f708c329ab42",
   "controlCount": 4,

package/src/posture/compliance-frameworks/eu-ai-act.json

@@ -4,8 +4,10 @@
   "publisher": "European Parliament & Council",
   "license": "EU law (Official Journal)",
   "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
+  "sourceVerificationAttempted": "2026-09-07",
+  "sourceVerificationNote": "Verification attempted 2026-09-07 and NOT completed: eur-lex.europa.eu returned HTTP 202 with an empty body and an x-amzn-waf-action: challenge header (AWS WAF bot challenge), both via the WebFetch tool and via a direct curl request with a standard browser User-Agent. This is recorded honestly as an unverified URL rather than a false confirmation. GDPR (the sibling eur-lex.europa.eu/eli/reg/2016/679/oj source, same domain) resolved successfully in the same session, so this appears to be per-request or per-path challenge behavior, not a durable domain-wide block. Re-attempt this check periodically; a human should confirm the URL manually until automated verification succeeds.",
   "scope": "SELECTIVE SUBSET. 7 obligations drawn from the high-risk-system and GPAI articles where a code signal exists. The Act is far broader; conformity assessment, registration, human oversight and post-market monitoring are organisational and are NOT represented here.",
-  "controlsDigest": "16d15998a686a19b",
+  "controlsDigest": "f63f5763df191224",
   "controlCount": 7,
   "controls": [
     {
@@ -53,11 +55,10 @@
       "summary": "Record-keeping — automatic logging of system events for traceability.",
       "codeTestable": "partial",
       "evidence": [
-        "MCP audit log .agentic-security/mcp-audit.log present.",
-        "Scan history retained."
+        "Scan history retained.",
+        "Removed module:mcp-audit after a second-review pass: mcp-audit.log records calls to THIS tool's own MCP server, i.e. how an agent used this scanner — it is not evidence that the assessed AI system logs its own events. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework."
       ],
       "mapsTo": [
-        "module:mcp-audit",
         "module:scan-history"
       ]
     },
@@ -66,11 +67,10 @@
       "summary": "Transparency — instructions for use enable users to interpret the system's output correctly.",
       "codeTestable": "partial",
       "evidence": [
-        "why-fired annotation surfaces detection provenance on every finding."
+        "Removed module:why-fired after adversarial premortem Q6 (2026-09-07, re-run): why-fired.js explains why THIS SCANNER's OWN detectors fired on a finding ('the user can see exactly what produced the finding without reading the scanner source' — its own header comment) — it is provenance for this tool's decisions, not evidence that the ASSESSED AI system gives its own users instructions to interpret ITS OWN output, which is what Article 13 actually asks. Every other control in this framework uses 'the system' to mean the assessed AI product (Art.9's risk management system, Art.12's event logging), so this reads Art.13 the same way rather than as an exception. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework — this one was initially judged a borderline, undecided open question in the first premortem pass and is now adjudicated on a full reading of the actual control text and the actual module code.",
+        "Reported as an engine gap: whether an assessed AI system documents its own output for its own users is not something this engine, which never sees the assessed system's user-facing product surface, can evidence at all."
       ],
-      "mapsTo": [
-        "module:why-fired"
-      ]
+      "mapsTo": []
     },
     {
       "id": "Art.14",
@@ -78,10 +78,9 @@
       "codeTestable": "partial",
       "evidence": [
         "Fix application requires confirm:true.",
-        "Bodyguard hook can refuse risky edits."
+        "Removed module:pre-edit-bodyguard after a second-review pass: that file is this scanning tool's OWN installed hook, not an artifact of the assessed AI system. Its presence only shows this tool's plugin is installed, never that the assessed system itself permits human override or interruption. Category error (self-referential: about this tool, not the target)."
       ],
       "mapsTo": [
-        "module:pre-edit-bodyguard",
         "module:apply-fix"
       ]
     },
@@ -90,13 +89,10 @@
       "summary": "Accuracy, robustness, cybersecurity — appropriate level of accuracy and resilience.",
       "codeTestable": "partial",
       "evidence": [
-        "Calibration + held-out evaluation present (.agentic-security/calibration-seed.json).",
-        "OWASP Benchmark regression gate."
+        "No automated signal in this engine after a second-review pass removed both prior mappings. module:calibration and module:holdout-eval pointed at THIS scanner's own ML calibration corpus and held-out evaluation labels (calibration-seed.json, holdout-eval.jsonl) — files that describe how accurately this tool's OWN detectors are calibrated, not whether the assessed AI system has an appropriate level of accuracy, robustness or cybersecurity. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework.",
+        "Reported as an engine gap: an AI system's own accuracy/robustness testing is code-observable in principle (evaluation harnesses, robustness test suites in the assessed system's own repo), but no detector here looks for that in the SCANNED project."
       ],
-      "mapsTo": [
-        "module:calibration",
-        "module:holdout-eval"
-      ]
+      "mapsTo": []
     }
   ]
 }

package/src/posture/compliance-frameworks/gdpr.json

@@ -4,8 +4,10 @@
   "publisher": "European Parliament & Council",
   "license": "EU law (Official Journal)",
   "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch): eur-lex.europa.eu/eli/reg/2016/679/oj resolves to the consolidated text of Regulation (EU) 2016/679 (GDPR), confirming Articles 5, 25, 32, 33, 35 and 44 (the six represented here) match the mapped summaries. No content hash is pinned deliberately: EUR-Lex serves the CURRENT consolidated text and its page template can change independently of the legal text itself, so a page hash would drift on template changes that carry no legal-content change and would need constant, meaningless re-pinning — hash-pinning would misrepresent a living legal source as a static publication.",
   "scope": "SELECTIVE SUBSET. 6 articles where a code scanner can produce evidence (security of processing, data minimisation, DPIA inputs). GDPR has 99 articles; lawful basis, data-subject rights, transfers and records of processing are organisational and are NOT represented here.",
-  "controlsDigest": "749f9dad2b5657cb",
+  "controlsDigest": "cd018b0daad4fa66",
   "controlCount": 6,
   "controls": [
     {
@@ -67,11 +69,10 @@
       "codeTestable": "partial",
       "evidence": [
         "Fix history retained.",
-        "Audit log preserves the breach-window evidence."
+        "Removed module:mcp-audit after a second-review pass: mcp-audit.log records calls to THIS tool's own MCP server, not the controller's own breach-detection or notification workflow. Category error (self-referential: about this tool, not the target)."
       ],
       "mapsTo": [
-        "module:fix-history",
-        "module:mcp-audit"
+        "module:fix-history"
       ]
     },
     {
@@ -79,10 +80,11 @@
       "summary": "Data protection impact assessment (DPIA) for high-risk processing.",
       "codeTestable": "partial",
       "evidence": [
-        "DPIA artifact present at .agentic-security/dpia.md."
+        "DPIA artifact present at .agentic-security/dpia.md (privacy-taint.js's emitDpiaArtifact).",
+        "Fixed a malformed mapsTo entry (adversarial premortem Q2, 2026-09-07): 'module:privacy-taint:emitDpiaArtifact' does not match any key in the ARTIFACT vocabulary table (auditor-walkthrough.js parses everything after 'module:' as one literal key, with no ':'-suffix syntax) — this control could never read 'present' via this leg, on any project, since the mapping shipped. Corrected to the real key, 'module:privacy-taint'."
       ],
       "mapsTo": [
-        "module:privacy-taint:emitDpiaArtifact"
+        "module:privacy-taint"
       ]
     }
   ]

package/src/posture/compliance-frameworks/hipaa-security-rule.json

@@ -4,8 +4,10 @@
   "publisher": "US Department of Health and Human Services",
   "license": "US Federal regulation (public)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07: the WebFetch tool was blocked by eCFR's automated bot detection (redirected to unblock.federalregister.gov, a CAPTCHA challenge). Verified instead via a direct HTTP request (curl with a standard browser User-Agent, HTTP 200), confirming sections 164.302/304/306/308 (the HIPAA Security Rule administrative safeguards) are present at this URL. No content hash is pinned: eCFR explicitly serves the CURRENT version of the regulation by design (the URL path itself says \"current\"), so hash-pinning would treat a living regulatory text as a fixed publication.",
   "scope": "SELECTIVE SUBSET. 8 of the Security Rule technical safeguards. Administrative and physical safeguards are outside what a code scanner can observe and are NOT represented here.",
-  "controlsDigest": "7e94038dd9a64d3d",
+  "controlsDigest": "4be9e2264a574e33",
   "controlCount": 8,
   "controls": [
     {
@@ -73,10 +75,10 @@
       "summary": "Audit controls — record and examine activity in systems containing PHI.",
       "codeTestable": "partial",
       "evidence": [
-        "MCP audit log + fix history present and hash-chained."
+        "Fix history present and hash-chained.",
+        "Removed module:mcp-audit after a second-review pass: mcp-audit.log records calls to THIS tool's own MCP server, not activity in the covered entity's own systems containing PHI. Category error (self-referential: about this tool, not the target)."
       ],
       "mapsTo": [
-        "module:mcp-audit",
         "module:fix-history"
       ]
     },
@@ -85,13 +87,11 @@
       "summary": "Integrity — PHI not altered or destroyed in an unauthorized manner.",
       "codeTestable": "partial",
       "evidence": [
-        "last-scan.json HMAC integrity check passing.",
-        "Sigstore provenance verified for ML model files (if opt-in)."
+        "Removed module:integrity after a second-review pass: last-scan.json.sig is this scanner signing its OWN scan output, not evidence that the covered entity's PHI is protected from unauthorized alteration or destruction. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework.",
+        "Removed module:sigstore-verify after a second-review pass (adversarial premortem Q1, 2026-09-07): sigstore-attestations/ is never written anywhere in this codebase — the real Sigstore verification logic (scanner/src/sca/sigstore-verify.js) caches results in a per-user home-directory cache (~/.claude/agentic-security/sigstore-cache/), shared across every project scanned on that machine, by design (content-addressed by package sha256, correctly reused rather than duplicated per project). Its own annotation call is fire-and-forget async in engine.js, not awaited, so even a project-relative summary write would not reliably complete before the scan process exits — building one blind, without first fixing that completion guarantee, was judged a bigger and riskier change than this task's scope, so this mapping is disclosed as a gap instead of built unverified.",
+        "Reported as an engine gap: whether PHI integrity is protected against unauthorized alteration or destruction is code-observable in principle (checksums, WORM storage, tamper-evident logging in the covered entity's own application code), but no detector here evidences that in the SCANNED project."
       ],
-      "mapsTo": [
-        "module:integrity",
-        "module:sigstore-verify"
-      ]
+      "mapsTo": []
     },
     {
       "id": "§164.312(e)",