@clear-capabilities/agentic-security-scanner 0.148.1 → 0.148.4

package/src/posture/compliance-frameworks/nist-csf-2.json

@@ -4,8 +4,10 @@
   "publisher": "NIST",
   "license": "public-domain (US Federal publication)",
   "url": "https://www.nist.gov/cyberframework",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch): confirmed NIST Cybersecurity Framework, CSF 2.0 stated as current throughout the page, matching this bundle. No content hash pinned: this is a resource hub page (quick-start guides, profiles, informative references, a downloadable PDF), not a single fixed document.",
   "scope": "SELECTIVE SUBSET. 8 subcategories with a code-observable signal. CSF 2.0 has over 100 subcategories; GOVERN in particular is organisational and is NOT represented here.",
-  "controlsDigest": "bcff46f53e75f501",
+  "controlsDigest": "1df76b5bde1d0044",
   "controlCount": 8,
   "controls": [
     {
@@ -45,12 +47,11 @@
       "summary": "Vulnerabilities and threats are identified.",
       "codeTestable": "partial",
       "evidence": [
-        "Regular scan history under .agentic-security/scan-history/.",
-        "ATT&CK / ATLAS technique mapping on findings."
+        "ATT&CK / ATLAS technique mapping on findings (last-scan.json).",
+        "Removed module:exploitability-probability (adversarial premortem Q2, 2026-09-07): that name is not in the ARTIFACT vocabulary table — exploitability-probability.js is a real, live annotator (posture/exploitability-probability.js), but it sets fields directly on findings in memory and writes no standalone artifact of its own; its output lands in last-scan.json, the exact file the surviving module:attack-taxonomy leg on this control already checks. This mapping could never read 'present' via this leg, on any project, since it shipped — removed rather than pointed at a duplicate check with no new signal."
       ],
       "mapsTo": [
-        "module:attack-taxonomy",
-        "module:exploitability-probability"
+        "module:attack-taxonomy"
       ]
     },
     {

package/src/posture/compliance-frameworks/nist-privacy-1-1.json

@@ -4,9 +4,9 @@
   "publisher": "NIST",
   "license": "public-domain (US Federal publication)",
   "url": "https://www.nist.gov/privacy-framework",
-  "note": "Each control carries NIST's own `codeTestable` rating (yes/partial/no). That rating says whether a control COULD be assessed from source code — it does not say this engine assesses it. `mapsTo` is present only where this engine produces a real signal; a control that NIST rates testable but which this engine cannot see is reported as an ENGINE GAP rather than silently passed.",
-  "scope": "FULL CATALOGUE, partially assessable. All 104 controls are present and each carries `codeTestable`. 48 are governance controls no scanner can assess; those report `manual`, never `satisfied`. See posture/privacy-framework.js.",
-  "controlsDigest": "447154af306c58d3",
+  "note": "Each control carries a `codeTestable` rating (yes/partial/no). This rating is HAND-AUTHORED BY THIS PROJECT, not NIST: the Privacy Framework document ships no machine-readable testability column (unlike NIST AI 600-1, whose source workbook has one, read by scripts/nist-compliance/build-catalog.py). The rating says whether a control COULD be assessed from source code, in this project's judgment, it does not say this engine assesses it, and it is not NIST's own claim. `mapsTo` is present only where this engine produces a real signal; a control rated testable but which this engine cannot see is reported as an ENGINE GAP rather than silently passed.",
+  "scope": "FULL CATALOGUE, partially assessable, transcribed from an Initial Public Draft (IPD) NOT yet finalized by NIST as of the last verification (see sourceVerificationNote). All 104 controls are present and each carries `codeTestable`, hand-authored by this project (see `note`), NOT a NIST-published rating. 48 are governance controls no scanner can assess; those report `manual`, never `satisfied`. See posture/privacy-framework.js.",
+  "controlsDigest": "3b91775abd5ffc1b",
   "controlCount": 104,
   "controls": [
     {
@@ -494,8 +494,11 @@
       "summary": "Log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.",
       "codeTestable": "partial",
       "mapsTo": [
-        "module:scan-history",
-        "module:mcp-audit"
+        "module:scan-history"
+      ],
+      "evidence": [
+        "Scan history retained.",
+        "Removed module:mcp-audit after a second-review pass: mcp-audit.log records calls to THIS tool's own MCP server, not the organisation's own log-record policy and review practice. Category error (self-referential: about this tool, not the target)."
       ]
     },
     {
@@ -605,8 +608,10 @@
       "category": "Data Processing Awareness (CM.AW-P)",
       "summary": "Records of data disclosures and sharing are maintained and can be accessed for review or transmission/disclosure.",
       "codeTestable": "yes",
-      "mapsTo": [
-        "module:mcp-audit"
+      "mapsTo": [],
+      "evidence": [
+        "No automated signal in this engine after a second-review pass removed the only prior mapping. module:mcp-audit pointed at THIS scanner's own MCP call log, not at the organisation's own records of data disclosures and sharing. Category error (self-referential: about this tool, not the target).",
+        "Reported as an engine gap: NIST rates this control code-testable (data-disclosure records could in principle be evidenced from a disclosure-log artifact in the scanned project), but no detector here looks for one."
       ]
     },
     {
@@ -623,8 +628,11 @@
       "summary": "Data provenance and lineage are maintained and can be accessed for review or transmission/disclosure.",
       "codeTestable": "partial",
       "mapsTo": [
-        "module:sbom-diff",
-        "module:integrity"
+        "module:sbom-diff"
+      ],
+      "evidence": [
+        "SBOM diff history retained.",
+        "Removed module:integrity after a second-review pass: last-scan.json.sig is this scanner signing its OWN scan output, not evidence of the organisation's own data provenance and lineage tracking. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework."
       ]
     },
     {
@@ -845,5 +853,7 @@
       "summary": "Adequate resource capacity to ensure availability is maintained.",
       "codeTestable": "yes"
     }
-  ]
+  ],
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch, two independent prompts against https://www.nist.gov/privacy-framework): NIST Privacy Framework 1.1 is currently an Initial Public Draft (IPD), not a finalized standard, per the page's own \"PF 1.1 IPD\" labeling. Version 1.0 is NIST's current final release. This bundled framework's 104 controls were transcribed from the 1.1 IPD text; if NIST finalizes 1.1 with control-text or numbering changes, this file will not automatically reflect them and needs a re-check against the final publication when it ships. No sourcePdfSha256 is pinned because the source is a navigation hub page, not a single fixed document, and because a draft is expected to change before finalization, unlike a published SP."
 }

package/src/posture/compliance-frameworks/owasp-asvs-5.json

@@ -4,6 +4,8 @@
   "publisher": "OWASP Foundation",
   "license": "Creative Commons Attribution-ShareAlike 4.0",
   "url": "https://owasp.org/www-project-application-security-verification-standard/",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch): confirmed OWASP ASVS, latest stable release listed as 5.0.0, matching this bundle (owasp-asvs-5), released at Global AppSec EU Barcelona 2025-05-30. No content hash pinned: this is a project navigation page linking to a versioned downloads page, not the standard itself.",
   "scope": "SELECTIVE SUBSET. 10 verification requirements with a direct detector behind them. ASVS 5.0 has several hundred requirements across 17 chapters; the remainder are NOT represented here.",
   "controlsDigest": "6c4371a08f010f91",
   "controlCount": 10,

package/src/posture/compliance-frameworks/owasp-llm-top-10.json

@@ -4,8 +4,11 @@
   "publisher": "OWASP Foundation",
   "license": "Creative Commons Attribution-ShareAlike 4.0",
   "url": "https://owasp.org/www-project-top-10-for-large-language-model-applications/",
-  "scope": "FULL TOP-10. All ten categories are present. Each category is a broad class rather than a single testable requirement, so a mapping indicates a detector exists for part of the class, not that the class is fully covered.",
-  "controlsDigest": "0a0351a9536790e4",
+  "sourceVerifiedAt": "2026-09-07",
+  "sourceVersionDriftDetected": true,
+  "sourceVerificationNote": "Verified 2026-09-07 (WebFetch): confirmed page is OWASP Top 10 for LLM Applications, but the CURRENT published edition is now 2026 (2026-08-04), not the 2025 edition this file bundles. See scope field for the disclosure and what remediation this requires.",
+  "scope": "FULL TOP-10. All ten categories are present. Each category is a broad class rather than a single testable requirement, so a mapping indicates a detector exists for part of the class, not that the class is fully covered. VERSION DRIFT, disclosed 2026-09-07: this bundle is the 2025 edition. OWASP published a 2026 edition on 2026-08-04 (confirmed live, the project page now archives 2025 and lists 2026 as current); the 10-category taxonomy may have changed. This file has NOT been re-mapped to the 2026 edition, that requires a deliberate review of the new categories against this engine's detector families, not a rushed relabel. Treat this bundle as 2025-accurate only until that review lands.",
+  "controlsDigest": "7500b9c4268eba6f",
   "controlCount": 10,
   "controls": [
     {
@@ -101,11 +104,10 @@
       "summary": "Excessive Agency — agent autonomy is bounded by explicit guards.",
       "codeTestable": "partial",
       "evidence": [
-        "MCP server config limits write-tools to confirm:true + reserved-write-path refusal.",
-        "Apply-fix path requires HMAC-verified scan."
+        "Apply-fix path requires HMAC-verified scan.",
+        "Removed module:mcp-tools after a second-review pass: that path points at THIS scanner's own source file (scanner/src/mcp/tools.js), which only resolves inside this tool's own checkout, never inside an arbitrary assessed project. It cannot evidence that the assessed LLM application bounds ITS OWN agent's autonomy. Category error (self-referential: about this tool, not the target)."
       ],
       "mapsTo": [
-        "module:mcp-tools",
         "module:apply-fix"
       ]
     },
@@ -114,13 +116,10 @@
       "summary": "Overreliance — human review checkpoints exist.",
       "codeTestable": "partial",
       "evidence": [
-        "security-fixer agent has Stop-on-verify-fail loop.",
-        "PreToolUse bodyguard exists."
+        "No automated signal in this engine after a second-review pass removed both prior mappings. module:security-fixer pointed at THIS scanner's own agent definition file (agents/security-fixer.md) and module:pre-edit-bodyguard at THIS scanner's own installed hook — both resolve only inside this tool's own checkout/plugin install, never inside an arbitrary assessed project, and neither evidences that the assessed LLM application itself has human review checkpoints. Category error (self-referential: about this tool, not the target), same class as the 03.03.08 fix in the NIST 800-171 framework.",
+        "Reported as an engine gap: human review checkpoints around an LLM application's outputs are code-observable in principle (an approval-gate library, a human-in-the-loop wrapper in the assessed system's own code), but no detector here looks for that in the SCANNED project."
       ],
-      "mapsTo": [
-        "module:security-fixer",
-        "module:pre-edit-bodyguard"
-      ]
+      "mapsTo": []
     },
     {
       "id": "LLM10",

package/src/posture/verifier.js

@@ -32,6 +32,7 @@ import * as path from 'node:path';
 import * as os from 'node:os';
 import { runConfined, sandboxAvailable } from '../sandbox/index.js';
 import { isExplicitlyNoPoc } from './poc-cwe-map.js';
+import { isSafeStateDir, stateDir, statePath, stateWritesEnabled } from './state-dir.js';
 
 // ─── PoC static validation ──────────────────────────────────────────────────
 //
@@ -228,5 +229,74 @@ export function verifierCoverageSummary(findings) {
   return out;
 }
 
+// ─── Run persistence (adversarial premortem Q1, 2026-09-07) ────────────────
+//
+// `compliance-frameworks/*.json` has mapped `module:verifier` to
+// `verifier-runs/` since this framework's control-to-artifact table was
+// written, but nothing ever wrote to it: `cmdVerify` (bin/agentic-security.js)
+// ran the loop and printed a summary, but never persisted one. That made
+// NIST 800-171 `03.12.01` (Security Assessment) and NIST CSF 2.0 `RC.RP`
+// (Recovery plans executed and improved) permanently unable to read
+// 'present' via this leg of their mapping, on any project, ever — worse than
+// a self-referential mapping (which can at least clear, dishonestly), a
+// mapping that can never clear at all. This closes that gap for real, one
+// record per `agentic-security verify` run, same shape as fix-metrics.js's
+// append-per-attempt pattern (that file uses one growing JSONL; this one
+// uses one file per run, because the table entry it satisfies is a
+// directory, not a file, and a per-run file is what a reader would expect
+// under a name like "verifier-runs/").
+const RUN_DIR = 'verifier-runs';
+
+/**
+ * Persist one record of an `agentic-security verify` invocation. Best-effort
+ * and silent on failure, same convention as every other posture writer: a
+ * verify run's own findings must never be lost because the record of having
+ * run could not be written.
+ *
+ * @returns {boolean} whether the record was written (for tests, not callers).
+ */
+export function recordVerifierRun(scanRoot, summary) {
+  if (!scanRoot || !summary || typeof summary !== 'object') return false;
+  try {
+    const dir = stateDir(scanRoot);
+    if (!isSafeStateDir(dir)) return false;
+    if (!stateWritesEnabled()) return false;
+    const runsDir = statePath(scanRoot, RUN_DIR);
+    fs.mkdirSync(runsDir, { recursive: true });
+    const now = new Date();
+    // Millisecond Date timestamps collide under back-to-back calls (two
+    // `verify` invocations in the same test, or a scripted loop). hrtime is
+    // monotonic and nanosecond-resolution within this process, so appending
+    // it guarantees both a distinct filename AND correct chronological sort
+    // order (alphabetical == call order), which a random suffix alone would
+    // not: two records written in the same millisecond would sort by random
+    // bytes, not by which call happened first.
+    const stamp = now.toISOString().replace(/[^0-9TZ]/g, '-');
+    const seq = process.hrtime.bigint().toString().padStart(20, '0');
+    const record = { timestamp: now.toISOString(), ...summary };
+    // One writeFileSync of one complete file: a concurrent reader sees a
+    // whole record or nothing (never a partial one, unlike an append target).
+    fs.writeFileSync(path.join(runsDir, `${stamp}-${seq}.json`), JSON.stringify(record, null, 2), 'utf8');
+    return true;
+  } catch { return false; }
+}
+
+/**
+ * Read every well-formed run record, oldest first. A file that does not
+ * parse is skipped, not thrown on — same tolerant-read convention as
+ * fix-metrics.js's readFixAttempts.
+ */
+export function readVerifierRuns(scanRoot) {
+  try {
+    const runsDir = statePath(scanRoot, RUN_DIR);
+    const files = fs.readdirSync(runsDir).filter((f) => f.endsWith('.json')).sort();
+    const out = [];
+    for (const f of files) {
+      try { out.push(JSON.parse(fs.readFileSync(path.join(runsDir, f), 'utf8'))); } catch { /* skip malformed */ }
+    }
+    return out;
+  } catch { return []; }
+}
+
 // For tests and the no-dead-modules check.
 export const _internals = { MAX_POC_BYTES, BANNED_HOSTS, SANITIZER_TABLE, runSandboxed };