@clear-capabilities/agentic-security-scanner 0.148.1 → 0.148.4

package/src/pipeline/assurance-mode.js

@@ -51,6 +51,112 @@ function _isValidMode(mode) {
   return ASSURANCE_MODES.includes(mode);
 }
 
+// A real user hit this: `agentic-security ci <a directory downloaded as a
+// GitHub zip, no .git present> --assurance strict` failed with the bare
+// count this function used to produce alone — "1210 finding(s) have status
+// outside [complete, uncommitted]" — with no indication that all 1210
+// findings failed for the exact same, simple, fixable reason
+// (`coordinator.js`'s `annotateGitProvenance` already knows and records it,
+// in `finding.findingProvenance.limitations[0]`, but that reason never
+// reached this message). A user reading "1210 problems" reasonably assumes
+// their CODE has 1210 problems, not that their DIRECTORY isn't a git
+// repository. This surfaces the dominant recorded reason instead of a bare
+// count, and gives the two most common, fully-fixable reasons ("not a Git
+// repository" from a zip download instead of `git clone`; a shallow CI
+// checkout) a one-line, specific remedy — the same specificity the
+// scanHealth branch above already gives for a stale-EPSS-cache failure.
+function _provenanceFailureReason(badProvenance, totalFindings) {
+  const counts = new Map();
+  for (const f of badProvenance) {
+    const reason = f?.findingProvenance?.limitations?.[0] || f?.findingProvenance?.status || 'unknown';
+    counts.set(reason, (counts.get(reason) || 0) + 1);
+  }
+  const ranked = [...counts.entries()].sort((a, b) => b[1] - a[1]);
+  const base = `strict mode requires complete finding provenance; ${badProvenance.length}/${totalFindings} finding(s) have status outside [complete, uncommitted]`;
+
+  const gitReasons = ranked.filter(([r]) => r === 'not a Git repository' || r === 'repository state unavailable');
+  const gitCount = gitReasons.reduce((s, [, n]) => s + n, 0);
+  // engine.js's own comment on this branch: "unpinned_dep / no_lockfile...
+  // describe the ABSENCE of a declaration, so 'which commit introduced this
+  // version' is not a question that has an answer to defer ... this is a
+  // known, disclosed limitation, not a bug... strict mode WILL fail on
+  // nearly any real project that has a package.json." That disclosure lived
+  // only in a source comment nobody hits this error reads — the README's
+  // own quickstart explicitly invites pointing --assurance strict at "your
+  // own project," where this is the single most likely outcome. Named here
+  // so the person who hits it learns it is expected and permanent, not
+  // something to keep investigating. This prefix is deliberately narrower
+  // than "every non-vulnerable_dep supply-chain entry" — engine.js's
+  // provenance-stamping loop only uses it for unpinned_dep/no_lockfile,
+  // which genuinely have no origin commit; cdn_no_integrity/dynamic_require
+  // carry a real file:line and get a DIFFERENT string precisely so they
+  // never land in this "permanent, give up" bucket (adversarial premortem
+  // R2, 2026-09-07 — conflating the two told a user a resolvable coverage
+  // gap was an unfixable, by-design limitation).
+  const supplyChainReasons = ranked.filter(([r]) => r.startsWith('origin resolution does not apply to a'));
+  const supplyChainCount = supplyChainReasons.reduce((s, [, n]) => s + n, 0);
+  const knownReasonSet = new Set([...gitReasons, ...supplyChainReasons].map(([r]) => r));
+  const otherReasons = ranked.filter(([r]) => !knownReasonSet.has(r));
+  const otherCount = badProvenance.length - gitCount - supplyChainCount;
+  const knownCategoryCount = (gitCount > 0 ? 1 : 0) + (supplyChainCount > 0 ? 1 : 0);
+
+  // Exactly one KNOWN category, and nothing outside it — the shape every
+  // caller before this fix assumed was the only shape, and the one every
+  // existing test was written against. Kept as tight, single-topic prose
+  // rather than the multi-segment form below.
+  if (knownCategoryCount === 0) {
+    if (otherReasons.length === 1) {
+      return `${base} — all ${badProvenance.length} share the same reason: "${otherReasons[0][0]}".`;
+    }
+    const breakdown = otherReasons.slice(0, 5).map(([reason, n]) => `${n}× "${reason}"`).join(', ');
+    return `${base} — breakdown: ${breakdown}${otherReasons.length > 5 ? ', …' : ''}.`;
+  }
+  if (knownCategoryCount === 1 && otherCount === 0) {
+    if (gitCount > 0) {
+      const gitReasonNames = gitReasons.map(([r]) => `"${r}"`).join(' and ');
+      return `${base} — reason: ${gitCount === badProvenance.length ? 'all of them are' : `${gitCount} of them are`} ${gitReasonNames}. ` +
+        `strict mode resolves finding provenance from git history, so it requires a real git repository ` +
+        `(a GitHub "Download ZIP" extracts without one). Run \`git init && git add -A && git commit -m init\` in ` +
+        `the scanned directory, point the scan at a real \`git clone\`, or drop --assurance strict for standard/advisory.`;
+    }
+    return `${base} — ${supplyChainCount} of them describe an ABSENT dependency declaration ` +
+      `(an unpinned version, a missing lockfile) that has no origin commit to resolve, by design. This is a ` +
+      `known, permanent limitation: strict mode cannot pass while any are present, on any real project with ` +
+      `such a dependency. Fix the underlying SCA finding(s) (pin the version / add a lockfile) if you want ` +
+      `strict to pass, or use --assurance standard/advisory for a project you don't control the dependencies of.`;
+  }
+
+  // Two or more independently-blocking categories on the SAME scan — the
+  // defect this closes (adversarial premortem R1, 2026-09-07): the old
+  // code picked whichever category had the most findings and silently
+  // dropped every other one, so a user could "fix" the reported problem,
+  // rerun, and hit a second wall the first run already had full information
+  // about but never mentioned — the same "the tool knew and didn't tell me"
+  // complaint this whole function exists to fix, recurring in a milder form.
+  const segments = [];
+  if (gitCount > 0) {
+    const gitReasonNames = gitReasons.map(([r]) => `"${r}"`).join(' and ');
+    segments.push(`${gitCount} of them are ${gitReasonNames} (strict mode requires a real git repository — ` +
+      `run \`git init && git add -A && git commit\`, or scan a real \`git clone\`)`);
+  }
+  if (supplyChainCount > 0) {
+    segments.push(`${supplyChainCount} of them describe an ABSENT dependency declaration (unpinned version / ` +
+      `missing lockfile) with no origin commit to resolve — a known, permanent limitation, not something a ` +
+      `rerun will fix`);
+  }
+  if (otherCount > 0) {
+    if (otherReasons.length === 1) {
+      segments.push(`${otherCount} share the reason "${otherReasons[0][0]}"`);
+    } else {
+      const breakdown = otherReasons.slice(0, 5).map(([reason, n]) => `${n}× "${reason}"`).join(', ');
+      segments.push(`${otherCount} break down as: ${breakdown}${otherReasons.length > 5 ? ', …' : ''}`);
+    }
+  }
+  return `${base} — MULTIPLE distinct reasons, not just one: ${segments.join('; ')}. Every category above must ` +
+    `be resolved for strict to pass (or drop to --assurance standard/advisory) — fixing only one will surface ` +
+    `the next on your following run.`;
+}
+
 /**
  * @param {string} mode - one of ASSURANCE_MODES; invalid/missing degrades to the default.
  * @param {object|null} scanHealth - the engine's computed scan.scanHealth (FR-206).
@@ -143,7 +249,7 @@ export function evaluateAssuranceMode(mode, scanHealth, findings = []) {
     return {
       ok: false,
       mode: 'strict',
-      reason: `strict mode requires complete finding provenance; ${badProvenance.length} finding(s) have status outside [complete, uncommitted]`,
+      reason: _provenanceFailureReason(badProvenance, findings.length),
       conditions,
     };
   }
@@ -151,4 +257,4 @@ export function evaluateAssuranceMode(mode, scanHealth, findings = []) {
   return { ok: true, mode: 'strict', reason: null, conditions };
 }
 
-export const _internals = { _isValidMode };
+export const _internals = { _isValidMode, _provenanceFailureReason };

package/src/posture/accuracy-scorecard.js

@@ -266,6 +266,16 @@ export function buildScorecard(inputs) {
         }
         : null,
     },
+    // Adversarial premortem Q7 (2026-09-07). See mappingCoverageOf's own
+    // header comment (posture/auditor-walkthrough.js) for why this exists:
+    // measuring the trend, not gating it — no threshold, no baseline, no
+    // pass/fail, since a drop is sometimes the correct outcome of an honest
+    // fix and sometimes a real regression, and only a human reading the
+    // diff each release can tell which. `[]` (never omitted) when the
+    // caller supplies nothing, so a reader can tell "measured, zero
+    // frameworks" from "this scorecard predates the metric" the same way
+    // every other section here distinguishes absence from zero.
+    complianceMappingCoverage: inputs.complianceMappingCoverage || [],
   };
 }
 
@@ -530,6 +540,30 @@ export function renderScorecardMarkdown(m) {
     L.push('not a channel this measurement structurally cannot yet cover.');
     L.push('');
   }
+  if (Array.isArray(m.complianceMappingCoverage) && m.complianceMappingCoverage.length) {
+    L.push('## Compliance mapping coverage');
+    L.push('');
+    L.push('Adversarial premortem Q7 (2026-09-07): each fix to a category-error');
+    L.push('mapping (a control checking an artifact that evidences this scanner,');
+    L.push('not the target — see `03.03.08` in the NIST 800-171 coverage doc for the');
+    L.push('original instance) correctly SUBTRACTS a `mapsTo` entry. Nobody was');
+    L.push('tracking the cumulative effect release over release. This is not a');
+    L.push('gate — a drop is sometimes a correct, honest fix and sometimes a real');
+    L.push('regression, and only a human reading the diff each release can tell');
+    L.push('which — it exists so the trend is visible instead of assumed.');
+    L.push('');
+    L.push('| Framework | Controls with a live mapping | Share |');
+    L.push('| --- | --- | --- |');
+    for (const row of [...m.complianceMappingCoverage].sort((a, b) => String(a.id).localeCompare(String(b.id)))) {
+      L.push(`| ${row.id} | ${row.mappedCount}/${row.controlCount} | ${formatRate(row.mappedCount, row.controlCount)} |`);
+    }
+    L.push('');
+    L.push('"Live mapping" means the control carries at least one `family:`/`module:`/');
+    L.push('`rule:`/`graph:` entry, regardless of whether it would clear on any given');
+    L.push('scan — this counts what the engine CAN evidence, not what it evidenced');
+    L.push('this run.');
+    L.push('');
+  }
   // PRD F12.6 — the honest scorecard publishes the LIMITS too, not only the
   // rates. Three claims this project makes are only meaningful with their
   // caveat attached, and each caveat was invisible before this section:

package/src/posture/aibom.js

@@ -21,6 +21,7 @@
 // a labelled fixture set.
 
 import * as crypto from 'node:crypto';
+import { statePath, safeWriteState } from './state-dir.js';
 
 // SDK / API endpoint detection — same family list as scanner/src/sast/llm.js
 const HF_FROM_PRETRAINED_RE = /(?:Auto(?:Model|Tokenizer|Config|Processor|FeatureExtractor)|[A-Z][A-Za-z]*Model|[A-Z][A-Za-z]*Tokenizer)\.from_pretrained\s*\(\s*['"]([\w./-]+)['"](?:[^)]*?revision\s*=\s*['"]([\w]+)['"])?/g;
@@ -395,3 +396,24 @@ export function validateMLBOM(doc) {
   }
   return { ok: errors.length === 0, errors, checked: 'structural (required fields + ML-BOM component shape), NOT full JSON-Schema validation' };
 }
+
+// ─── Persistence (adversarial premortem Q2, 2026-09-07) ────────────────────
+//
+// `compliance-frameworks/*.json` has mapped `module:aibom` to `aibom.json`
+// since those mappings were written (eu-ai-act.json Art.11, nist-800-171-r3
+// .json 03.04.10, nist-ai-600-1.json MG-4.1-001), but nothing ever wrote it
+// there automatically: `buildAIBOM` was only ever reachable through the CLI's
+// `--format aibom`/`--format aibom-md` report emitters, which print to
+// stdout (or wherever `--output` sends them) and never touch
+// `.agentic-security/`. Three controls across three frameworks could never
+// read 'present' via this leg, on any project, unless an operator happened
+// to manually redirect `--format aibom` output to that exact path. Fixed the
+// same way `license-attributions.js`'s `persistAttributions` and
+// `threat-model.js`'s `persistAutoThreatModel` already are: a default-on
+// (opt-out via AGENTIC_SECURITY_NO_AIBOM), best-effort write during every
+// scan, wired in engine.js next to those two.
+export function persistAIBOM(scanRoot, aibom) {
+  if (!aibom || typeof aibom !== 'object') return null;
+  safeWriteState(statePath(scanRoot, 'aibom.json'), JSON.stringify(aibom, null, 2));
+  return aibom;
+}

package/src/posture/artifact-registry.js

@@ -119,6 +119,7 @@ export const ARTIFACT_REGISTRY = [
   { name: 'findings.csv', kind: 'file', classification: 'generated', retentionClass: 'scan' },
   { name: 'llm-cache', kind: 'dir', classification: 'generated', retentionClass: 'cache' },
   { name: 'fix-history', kind: 'dir', classification: 'generated', retentionClass: 'backup' },
+  { name: 'verifier-runs', kind: 'dir', classification: 'generated', retentionClass: 'evidence', source: 'src/posture/verifier.js (recordVerifierRun)', note: 'Adversarial premortem Q1 (2026-09-07): one JSON record per `agentic-security verify` run, added so module:verifier (nist-800-171-r3.json 03.12.01, nist-csf-2.json RC.RP) has a real artifact to check for instead of a name in the ARTIFACT table nothing ever wrote.' },
   { name: 'fix-plans', kind: 'dir', classification: 'generated', retentionClass: 'scan' },
   // The following were confirmed missing from the old hardcoded WIPE/
   // WIPE_DIRS sets (A-10) and confirmed GENERATED by reading their write
@@ -135,6 +136,7 @@ export const ARTIFACT_REGISTRY = [
   { name: 'compliance-evidence.json', kind: 'file', classification: 'generated', retentionClass: 'evidence', confidential: true, source: 'posture/compliance-policy.js' },
   { name: 'compliance-evidence.md', kind: 'file', classification: 'generated', retentionClass: 'evidence', confidential: true, source: 'posture/compliance-policy.js' },
   { name: 'ATTRIBUTIONS.md', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'posture/license-attributions.js' },
+  { name: 'aibom.json', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'posture/aibom.js (persistAIBOM)', note: 'Adversarial premortem Q2 (2026-09-07): module:aibom (eu-ai-act.json Art.11, nist-800-171-r3.json 03.04.10, nist-ai-600-1.json MG-4.1-001) mapped to this path since those mappings were written, but nothing wrote it here until now — buildAIBOM was only reachable via the CLI --format aibom emitter, which never touched .agentic-security/.' },
   { name: 'NOTICE', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'posture/license-attributions.js' },
   { name: 'accepted.json', kind: 'file', classification: 'generated', source: 'posture/suppressions.js (soft-accept save path)', note: 'already self-managing per-entry expiry (FR-1004-adjacent) — no additional class-level TTL' },
   { name: 'triage.json', kind: 'file', classification: 'generated', source: 'posture/triage.js (_save)' },

package/src/posture/auditor-walkthrough.js

@@ -328,6 +328,96 @@ function _resolveOpenFindingMinSeverity(scanRoot, frameworkId) {
     : OPEN_FINDING_MIN_SEVERITY;
 }
 
+// `module:` mapping vocabulary → the on-disk artifact(s) that evidence it.
+// Hoisted to module scope (was previously re-declared on every control
+// evaluated, a wasted allocation with no reader) and exported so
+// `test/module-artifact-liveness.test.js` can check every entry here is
+// actually written somewhere in scanner/src/, without keeping a second,
+// driftable copy of this list. A table entry is either one path or an array
+// of acceptable ones — see the `scan-history` comment below for why an array
+// means "any of these satisfies it." A `.../` prefix marks a source-relative
+// artifact (resolved against the scan root itself, not the state dir).
+export const MODULE_ARTIFACTS = {
+  'sbom-diff':            'sbom-history/',
+  'license-attributions': 'ATTRIBUTIONS.md',
+  'threat-model-auto':    'threat-model.json',
+  'compliance-policy':    'compliance-evidence.json',
+  'fix-history':          'fix-history/log.json',
+  'privacy-taint':        'dpia.md',
+  'aibom':                'aibom.json',
+  'attack-taxonomy':      'last-scan.json',
+  // Two real spellings, both live in this codebase: security-trend.js and
+  // router.js read `scan-history.json` (a FILE), findings-memory.js uses
+  // `scan-history` (a DIRECTORY). Only the directory was listed here, so
+  // on a normal scan — which writes the .json — every control mapped to
+  // module:scan-history reported the artifact missing and could never
+  // clear. Five bundled frameworks were affected. An array means "any of
+  // these satisfies it", which is the honest reading: the control asks
+  // whether a scan history exists, not which shape it took.
+  'scan-history':         ['scan-history.json', 'scan-history/'],
+  'watch-mode':           'watch-status.json',
+  'cve-alert-daemon':     'cve-alerts/',
+  'triage':               'triage.json',
+  'triage-memory':        'triage-memory.jsonl',
+  // Adversarial premortem Q1 (2026-09-07): this entry existed since the
+  // ARTIFACT table did, but nothing ever wrote verifier-runs/ — no control
+  // mapped to it could ever read 'present', on any project, permanently.
+  // `verifier.js`'s `recordVerifierRun` now writes one record per real
+  // `agentic-security verify` invocation, closing the gap for real.
+  'verifier':             'verifier-runs/',
+  'apply-fix':            'fix-history/log.json',
+  // REMOVED, deliberately (adversarial premortem P2.8 + Q1/Q2/Q6, 2026-09-07):
+  // 'integrity' (last-scan.json.sig), 'mcp-audit' (mcp-audit.log),
+  // 'calibration' (calibration-seed.json), 'holdout-eval'
+  // (holdout-eval.jsonl), 'sigstore-verify' (sigstore-attestations/, never
+  // written — see hipaa-security-rule.json's §164.312(c) removal note),
+  // 'pre-edit-bodyguard' (hooks/pre-edit-bodyguard.js), 'security-fixer'
+  // (agents/security-fixer.md), 'mcp-tools' (scanner/src/mcp/tools.js), and
+  // 'why-fired' (last-scan.json — its CONTENT is target-derived, unlike the
+  // others, but it evidences THIS TOOL's own detection provenance, not any
+  // property of the assessed system; adjudicated on eu-ai-act.json Art.13's
+  // actual text, see that control's evidence[] for the full reasoning) all
+  // evidence THIS SCANNER's own state, operation, or installed files —
+  // never the scanned project's — and are structurally incapable of validly
+  // backing any `module:` mapping, not just accidentally missing a writer.
+  // Every live mapsTo reference to any of them was removed and disclosed as
+  // an engine gap (see each affected framework file's evidence[] for the
+  // specific reasoning); they are removed from the vocabulary table itself,
+  // not merely un-referenced, so there is nothing left to copy-paste back
+  // in. `compliance-mapping-liveness.test.js`'s self-referential-module test
+  // remains as a permanent regression guard against the STRING key
+  // reappearing in a mapsTo array even without a table entry to source it
+  // from.
+};
+
+// Adversarial premortem Q7 (2026-09-07): each `03.03.08`-style fix
+// (P2.8/Q1/Q2/Q6) subtracts a `mapsTo` entry to correct a category error —
+// the right call every time it happened, but nobody was tracking the
+// CUMULATIVE effect. "Always subtract, never invent" is correct engineering
+// discipline that can still trend, unmeasured, toward a framework that
+// automatically clears fewer and fewer controls each release, which looks
+// to a buyer like the tool doing less over time even though every
+// individual change made it more honest. This computes the number that
+// makes the trend visible instead of assumed: how many of a framework's
+// controls carry at least one LIVE mapsTo (family:/module:/rule:/graph:),
+// regardless of whether that mapping would currently clear on any given
+// scan — the question is "can this control ever be evidenced by this
+// engine at all," not "did today's scan clear it." Pure and side-effect
+// free, like the rest of this module's exports; the caller supplies the
+// already-loaded framework object (see `scripts/scorecard.mjs` for the
+// driver that loads every bundled framework and calls this once each).
+export function mappingCoverageOf(fw) {
+  const controls = (fw && fw.controls) || [];
+  const controlCount = controls.length;
+  const mappedCount = controls.filter((c) => Array.isArray(c.mapsTo) && c.mapsTo.length > 0).length;
+  return {
+    id: fw && fw.id,
+    controlCount,
+    mappedCount,
+    mappedFraction: controlCount ? mappedCount / controlCount : null,
+  };
+}
+
 export function evaluateFramework(scanRoot, fw, scan) {
   const minSeverity = _resolveOpenFindingMinSeverity(scanRoot, fw && fw.id);
   // CMP-2: last-scan.json (what this is actually handed in production) carries
@@ -521,46 +611,12 @@ export function evaluateFramework(scanRoot, fw, scan) {
         anySignal = true;
       } else if (m.startsWith('module:')) {
         const mod = m.slice('module:'.length);
-        const ARTIFACT = {
-          'sbom-diff':            'sbom-history/',
-          'license-attributions': 'ATTRIBUTIONS.md',
-          'threat-model-auto':    'threat-model.json',
-          'compliance-policy':    'compliance-evidence.json',
-          'mcp-audit':            'mcp-audit.log',
-          'fix-history':          'fix-history/log.json',
-          'privacy-taint':        'dpia.md',
-          'aibom':                'aibom.json',
-          'attack-taxonomy':      'last-scan.json',
-          'why-fired':            'last-scan.json',
-          // Two real spellings, both live in this codebase: security-trend.js and
-          // router.js read `scan-history.json` (a FILE), findings-memory.js uses
-          // `scan-history` (a DIRECTORY). Only the directory was listed here, so
-          // on a normal scan — which writes the .json — every control mapped to
-          // module:scan-history reported the artifact missing and could never
-          // clear. Five bundled frameworks were affected. An array means "any of
-          // these satisfies it", which is the honest reading: the control asks
-          // whether a scan history exists, not which shape it took.
-          'scan-history':         ['scan-history.json', 'scan-history/'],
-          'integrity':            'last-scan.json.sig',
-          'watch-mode':           'watch-status.json',
-          'cve-alert-daemon':     'cve-alerts/',
-          'triage':               'triage.json',
-          'triage-memory':        'triage-memory.jsonl',
-          'verifier':             'verifier-runs/',
-          'calibration':          'calibration-seed.json',
-          'holdout-eval':         'holdout-eval.jsonl',
-          'sigstore-verify':      'sigstore-attestations/',
-          'pre-edit-bodyguard':   '.../hooks/pre-edit-bodyguard.js',
-          'apply-fix':            'fix-history/log.json',
-          'security-fixer':       '.../agents/security-fixer.md',
-          'mcp-tools':            '.../scanner/src/mcp/tools.js',
-        };
         // A table entry is either one path or an array of acceptable ones. An
         // array means the artifact has more than one real spelling in this
         // codebase and any of them evidences the control; the FIRST is the
         // canonical name used in the observation text when none is found, so
         // the message still names something a reader can go create.
-        const target = ARTIFACT[mod];
+        const target = MODULE_ARTIFACTS[mod];
         const candidates = target == null ? [] : (Array.isArray(target) ? target : [target]);
         // A '.../' sentinel marks a source-relative artifact (project source,
         // e.g. a hook or agent file) — resolve it against the scan root itself.

package/src/posture/compliance-frameworks/ccpa.json

@@ -4,6 +4,8 @@
   "publisher": "California Legislature",
   "license": "California statute (public)",
   "url": "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch): resolves to California Civil Code Title 1.81.5 sections 1798.100-1798.145, correctly reflecting amendments through Stats. 2025, Ch. 67 (effective 2026-01-01). No content hash is pinned deliberately: this URL serves the CURRENT, continuously-amended text of codified law by design, not a fixed publication, hash-pinning would misrepresent a living legal source as a static one.",
   "scope": "SELECTIVE SUBSET. 4 of the CCPA/CPRA obligations, chosen because a code scanner can produce evidence for them. The statute is far broader; the majority of its duties (notice, consumer request handling, contracts, retention policy) are organisational and are NOT represented here. Absence of a control is not a statement of compliance.",
   "controlsDigest": "ebc1f708c329ab42",
   "controlCount": 4,

package/src/posture/compliance-frameworks/eu-ai-act.json

@@ -4,8 +4,10 @@
   "publisher": "European Parliament & Council",
   "license": "EU law (Official Journal)",
   "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
+  "sourceVerificationAttempted": "2026-09-07",
+  "sourceVerificationNote": "Verification attempted 2026-09-07 and NOT completed: eur-lex.europa.eu returned HTTP 202 with an empty body and an x-amzn-waf-action: challenge header (AWS WAF bot challenge), both via the WebFetch tool and via a direct curl request with a standard browser User-Agent. This is recorded honestly as an unverified URL rather than a false confirmation. GDPR (the sibling eur-lex.europa.eu/eli/reg/2016/679/oj source, same domain) resolved successfully in the same session, so this appears to be per-request or per-path challenge behavior, not a durable domain-wide block. Re-attempt this check periodically; a human should confirm the URL manually until automated verification succeeds.",
   "scope": "SELECTIVE SUBSET. 7 obligations drawn from the high-risk-system and GPAI articles where a code signal exists. The Act is far broader; conformity assessment, registration, human oversight and post-market monitoring are organisational and are NOT represented here.",
-  "controlsDigest": "16d15998a686a19b",
+  "controlsDigest": "f63f5763df191224",
   "controlCount": 7,
   "controls": [
     {
@@ -53,11 +55,10 @@
       "summary": "Record-keeping — automatic logging of system events for traceability.",
       "codeTestable": "partial",
       "evidence": [
-        "MCP audit log .agentic-security/mcp-audit.log present.",
-        "Scan history retained."
+        "Scan history retained.",
+        "Removed module:mcp-audit after a second-review pass: mcp-audit.log records calls to THIS tool's own MCP server, i.e. how an agent used this scanner — it is not evidence that the assessed AI system logs its own events. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework."
       ],
       "mapsTo": [
-        "module:mcp-audit",
         "module:scan-history"
       ]
     },
@@ -66,11 +67,10 @@
       "summary": "Transparency — instructions for use enable users to interpret the system's output correctly.",
       "codeTestable": "partial",
       "evidence": [
-        "why-fired annotation surfaces detection provenance on every finding."
+        "Removed module:why-fired after adversarial premortem Q6 (2026-09-07, re-run): why-fired.js explains why THIS SCANNER's OWN detectors fired on a finding ('the user can see exactly what produced the finding without reading the scanner source' — its own header comment) — it is provenance for this tool's decisions, not evidence that the ASSESSED AI system gives its own users instructions to interpret ITS OWN output, which is what Article 13 actually asks. Every other control in this framework uses 'the system' to mean the assessed AI product (Art.9's risk management system, Art.12's event logging), so this reads Art.13 the same way rather than as an exception. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework — this one was initially judged a borderline, undecided open question in the first premortem pass and is now adjudicated on a full reading of the actual control text and the actual module code.",
+        "Reported as an engine gap: whether an assessed AI system documents its own output for its own users is not something this engine, which never sees the assessed system's user-facing product surface, can evidence at all."
       ],
-      "mapsTo": [
-        "module:why-fired"
-      ]
+      "mapsTo": []
     },
     {
       "id": "Art.14",
@@ -78,10 +78,9 @@
       "codeTestable": "partial",
       "evidence": [
         "Fix application requires confirm:true.",
-        "Bodyguard hook can refuse risky edits."
+        "Removed module:pre-edit-bodyguard after a second-review pass: that file is this scanning tool's OWN installed hook, not an artifact of the assessed AI system. Its presence only shows this tool's plugin is installed, never that the assessed system itself permits human override or interruption. Category error (self-referential: about this tool, not the target)."
       ],
       "mapsTo": [
-        "module:pre-edit-bodyguard",
         "module:apply-fix"
       ]
     },
@@ -90,13 +89,10 @@
       "summary": "Accuracy, robustness, cybersecurity — appropriate level of accuracy and resilience.",
       "codeTestable": "partial",
       "evidence": [
-        "Calibration + held-out evaluation present (.agentic-security/calibration-seed.json).",
-        "OWASP Benchmark regression gate."
+        "No automated signal in this engine after a second-review pass removed both prior mappings. module:calibration and module:holdout-eval pointed at THIS scanner's own ML calibration corpus and held-out evaluation labels (calibration-seed.json, holdout-eval.jsonl) — files that describe how accurately this tool's OWN detectors are calibrated, not whether the assessed AI system has an appropriate level of accuracy, robustness or cybersecurity. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework.",
+        "Reported as an engine gap: an AI system's own accuracy/robustness testing is code-observable in principle (evaluation harnesses, robustness test suites in the assessed system's own repo), but no detector here looks for that in the SCANNED project."
       ],
-      "mapsTo": [
-        "module:calibration",
-        "module:holdout-eval"
-      ]
+      "mapsTo": []
     }
   ]
 }

package/src/posture/compliance-frameworks/gdpr.json

@@ -4,8 +4,10 @@
   "publisher": "European Parliament & Council",
   "license": "EU law (Official Journal)",
   "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch): eur-lex.europa.eu/eli/reg/2016/679/oj resolves to the consolidated text of Regulation (EU) 2016/679 (GDPR), confirming Articles 5, 25, 32, 33, 35 and 44 (the six represented here) match the mapped summaries. No content hash is pinned deliberately: EUR-Lex serves the CURRENT consolidated text and its page template can change independently of the legal text itself, so a page hash would drift on template changes that carry no legal-content change and would need constant, meaningless re-pinning — hash-pinning would misrepresent a living legal source as a static publication.",
   "scope": "SELECTIVE SUBSET. 6 articles where a code scanner can produce evidence (security of processing, data minimisation, DPIA inputs). GDPR has 99 articles; lawful basis, data-subject rights, transfers and records of processing are organisational and are NOT represented here.",
-  "controlsDigest": "749f9dad2b5657cb",
+  "controlsDigest": "cd018b0daad4fa66",
   "controlCount": 6,
   "controls": [
     {
@@ -67,11 +69,10 @@
       "codeTestable": "partial",
       "evidence": [
         "Fix history retained.",
-        "Audit log preserves the breach-window evidence."
+        "Removed module:mcp-audit after a second-review pass: mcp-audit.log records calls to THIS tool's own MCP server, not the controller's own breach-detection or notification workflow. Category error (self-referential: about this tool, not the target)."
       ],
       "mapsTo": [
-        "module:fix-history",
-        "module:mcp-audit"
+        "module:fix-history"
       ]
     },
     {
@@ -79,10 +80,11 @@
       "summary": "Data protection impact assessment (DPIA) for high-risk processing.",
       "codeTestable": "partial",
       "evidence": [
-        "DPIA artifact present at .agentic-security/dpia.md."
+        "DPIA artifact present at .agentic-security/dpia.md (privacy-taint.js's emitDpiaArtifact).",
+        "Fixed a malformed mapsTo entry (adversarial premortem Q2, 2026-09-07): 'module:privacy-taint:emitDpiaArtifact' does not match any key in the ARTIFACT vocabulary table (auditor-walkthrough.js parses everything after 'module:' as one literal key, with no ':'-suffix syntax) — this control could never read 'present' via this leg, on any project, since the mapping shipped. Corrected to the real key, 'module:privacy-taint'."
       ],
       "mapsTo": [
-        "module:privacy-taint:emitDpiaArtifact"
+        "module:privacy-taint"
       ]
     }
   ]

package/src/posture/compliance-frameworks/hipaa-security-rule.json

@@ -4,8 +4,10 @@
   "publisher": "US Department of Health and Human Services",
   "license": "US Federal regulation (public)",
   "url": "https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07: the WebFetch tool was blocked by eCFR's automated bot detection (redirected to unblock.federalregister.gov, a CAPTCHA challenge). Verified instead via a direct HTTP request (curl with a standard browser User-Agent, HTTP 200), confirming sections 164.302/304/306/308 (the HIPAA Security Rule administrative safeguards) are present at this URL. No content hash is pinned: eCFR explicitly serves the CURRENT version of the regulation by design (the URL path itself says \"current\"), so hash-pinning would treat a living regulatory text as a fixed publication.",
   "scope": "SELECTIVE SUBSET. 8 of the Security Rule technical safeguards. Administrative and physical safeguards are outside what a code scanner can observe and are NOT represented here.",
-  "controlsDigest": "7e94038dd9a64d3d",
+  "controlsDigest": "4be9e2264a574e33",
   "controlCount": 8,
   "controls": [
     {
@@ -73,10 +75,10 @@
       "summary": "Audit controls — record and examine activity in systems containing PHI.",
       "codeTestable": "partial",
       "evidence": [
-        "MCP audit log + fix history present and hash-chained."
+        "Fix history present and hash-chained.",
+        "Removed module:mcp-audit after a second-review pass: mcp-audit.log records calls to THIS tool's own MCP server, not activity in the covered entity's own systems containing PHI. Category error (self-referential: about this tool, not the target)."
       ],
       "mapsTo": [
-        "module:mcp-audit",
         "module:fix-history"
       ]
     },
@@ -85,13 +87,11 @@
       "summary": "Integrity — PHI not altered or destroyed in an unauthorized manner.",
       "codeTestable": "partial",
       "evidence": [
-        "last-scan.json HMAC integrity check passing.",
-        "Sigstore provenance verified for ML model files (if opt-in)."
+        "Removed module:integrity after a second-review pass: last-scan.json.sig is this scanner signing its OWN scan output, not evidence that the covered entity's PHI is protected from unauthorized alteration or destruction. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework.",
+        "Removed module:sigstore-verify after a second-review pass (adversarial premortem Q1, 2026-09-07): sigstore-attestations/ is never written anywhere in this codebase — the real Sigstore verification logic (scanner/src/sca/sigstore-verify.js) caches results in a per-user home-directory cache (~/.claude/agentic-security/sigstore-cache/), shared across every project scanned on that machine, by design (content-addressed by package sha256, correctly reused rather than duplicated per project). Its own annotation call is fire-and-forget async in engine.js, not awaited, so even a project-relative summary write would not reliably complete before the scan process exits — building one blind, without first fixing that completion guarantee, was judged a bigger and riskier change than this task's scope, so this mapping is disclosed as a gap instead of built unverified.",
+        "Reported as an engine gap: whether PHI integrity is protected against unauthorized alteration or destruction is code-observable in principle (checksums, WORM storage, tamper-evident logging in the covered entity's own application code), but no detector here evidences that in the SCANNED project."
       ],
-      "mapsTo": [
-        "module:integrity",
-        "module:sigstore-verify"
-      ]
+      "mapsTo": []
     },
     {
       "id": "§164.312(e)",

package/src/posture/compliance-frameworks/nist-800-171-r3.json

@@ -4,9 +4,12 @@
   "publisher": "NIST",
   "license": "public-domain (US Federal publication)",
   "url": "https://csrc.nist.gov/pubs/sp/800/171/r3/final",
+  "sourceDoi": "https://doi.org/10.6028/NIST.SP.800-171r3",
+  "sourcePdfSha256": "3e4631df8b5d61f40a6e542b52779ef30ddbbfff31e09214fa94ad6e6f5e6d08",
+  "sourceVerificationNote": "Verified 2026-09-07: the CSRC landing page URL resolves and states title \"Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations\", Rev. 3, published May 2024. The DOI resolves (302) to the PDF at nvlpubs.nist.gov, whose own embedded XMP metadata (pdfx:DOI, pdfx:Comments) confirms NIST.SP.800-171r3. sourcePdfSha256 is the SHA-256 of that exact downloaded PDF, so a future re-check can detect if NIST republishes under the same URL/DOI with different content. This does not verify the CSV control export against the PDF text control-by-control — see scripts/nist-800-171/README for that gap.",
   "note": "Control text is generated from docs/standards/NIST_SP_800_171r3_Controls.csv by scripts/nist-800-171/build-catalog.py. The codeTestable rating is THIS ENGINE'S judgment, not NIST's. Unlike the AI 600-1 workbook, the 800-171 export rates no control for testability. Ratings and their rationales live in scripts/nist-800-171/code-testability.json.",
   "scope": "FULL CATALOGUE — all 97 requirements of NIST SP 800-171 Rev. 3 are carried, deliberately including those this engine cannot assess, because omitting them would read as coverage. Automated evidence is PARTIAL and unevenly distributed: 16 requirements are rated code-testable, 38 partial, and 43 are organisational, physical or personnel controls NOT represented by any automated signal: all of Awareness and Training, Personnel Security and Physical Protection, and most of Incident Response, Maintenance and Media Protection. Those are forced to 'partial' with an explicit disclosure and can never read as satisfied. This is not a CMMC assessment and produces no SPRS score.",
-  "controlsDigest": "28e4a38c393e1457",
+  "controlsDigest": "927295dcd1594189",
   "controlCount": 97,
   "controls": [
     {
@@ -330,10 +333,8 @@
       "summary": "Protection of Audit Information: a. Protect audit information and audit logging tools from unauthorized access, modification, and deletion. b. Authorize access to management of audit logging functionality to only a subset of…",
       "codeTestable": "partial",
       "evidence": [
-        "Artifact(s) present: integrity."
-      ],
-      "mapsTo": [
-        "module:integrity"
+        "No automated signal in this engine — this tool can sign and verify its OWN scan output (module:integrity), but that evidences this scanner's integrity, not whether the SCANNED PROJECT protects its own audit logs from unauthorized access, modification or deletion. No detector here inspects the scanned codebase for log-signing, tamper-evident storage, or access controls on audit data. Removed after a second-review pass found the original mapping was a category error (self-referential: about this tool, not the target).",
+        "Reported as an engine gap: this requirement is code-observable in principle (a detector could look for tamper-evident logging libraries or access-controlled log stores in application code), but no detector here decides it."
       ]
     },
     {

package/src/posture/compliance-frameworks/nist-ai-600-1.json

@@ -4,8 +4,11 @@
   "publisher": "NIST",
   "license": "public-domain (US Federal publication)",
   "url": "https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf",
+  "sourceDoi": "https://doi.org/10.6028/NIST.AI.600-1",
+  "sourcePdfSha256": "6e73620ab6b64e90ef2c04bf0e0d6246185a2f4b1b13cab0df494496cff89b6a",
+  "sourceVerificationNote": "Verified 2026-09-07: the doi.org DOI resolves (302) to this exact url, and the downloaded PDF's own embedded XMP metadata (pdfx:Category, dc:title) confirms \"NIST AI 600-1\" / \"Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile\". sourcePdfSha256 is the SHA-256 of that exact downloaded PDF, so a future re-check can detect if NIST republishes under the same URL/DOI with different content.",
   "scope": "SELECTIVE SUBSET. 6 actions from the Generative AI Profile with a code-observable signal. The profile is far larger; governance, provenance and incident-response actions are organisational and are NOT represented here. The full control catalogue is built and gated separately by scripts/nist-compliance/build-catalog.py.",
-  "controlsDigest": "a6ad567713796b05",
+  "controlsDigest": "6e7cc01c5ba8ae22",
   "controlCount": 6,
   "controls": [
     {
@@ -84,11 +87,10 @@
       "summary": "Establish content provenance / authenticity controls.",
       "codeTestable": "partial",
       "evidence": [
-        "Sigstore provenance opt-in configured for model loads.",
-        "ATTRIBUTIONS.md generated."
+        "ATTRIBUTIONS.md generated.",
+        "Removed module:sigstore-verify after a second-review pass (adversarial premortem Q1, 2026-09-07): sigstore-attestations/ is never written anywhere in this codebase — see the identical removal note on hipaa-security-rule.json's §164.312(c) for the full reasoning (home-directory cache by design, fire-and-forget async producer, not a quick artifact-path fix). Content-provenance / authenticity controls for model loads remain only partially evidenced by this control's surviving module:license-attributions leg."
       ],
       "mapsTo": [
-        "module:sigstore-verify",
         "module:license-attributions"
       ]
     }