@clear-capabilities/agentic-security-scanner 0.149.4 → 0.150.2

package/dist/1379.index.js

@@ -2,7 +2,7 @@ export const id = 1379;
 export const ids = [1379];
 export const modules = {
 
-/***/ 1379:
+/***/ 31379:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -322,9 +322,9 @@ function renderStageCell(cell, row) {
 }
 
 // EXTERNAL MODULE: ./src/dataflow/privacy-governance.js
-var privacy_governance = __webpack_require__(3308);
+var privacy_governance = __webpack_require__(63308);
 // EXTERNAL MODULE: ./src/lineage/export-json.js
-var export_json = __webpack_require__(859);
+var export_json = __webpack_require__(40859);
 ;// CONCATENATED MODULE: ./src/lineage/export-privacy.js
 // export-privacy.js — Milestone 4 deliverable #10 (DFG-020): graph-derived
 // DPIA/RoPA export, migrating off the Layer-2 taint engine's

package/dist/1444.index.js

@@ -2,15 +2,15 @@ export const id = 1444;
 export const ids = [1444];
 export const modules = {
 
-/***/ 1444:
+/***/ 51444:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   sweepGitHistory: () => (/* binding */ sweepGitHistory)
 /* harmony export */ });
 /* unused harmony exports extractAddedLines, scanHistoryDiff */
-/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8844);
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(31421);
+/* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(78844);
 // R15 (PRD §5) — git-history secret sweep.
 //
 // A secret removed from HEAD but present in any past commit is still

package/dist/1660.index.js

@@ -2,7 +2,7 @@ export const id = 1660;
 export const ids = [1660];
 export const modules = {
 
-/***/ 1660:
+/***/ 51660:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {

package/dist/1700.index.js

@@ -2,17 +2,17 @@ export const id = 1700;
 export const ids = [1700];
 export const modules = {
 
-/***/ 1700:
+/***/ 31700:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   validateOsvFunctionsExist: () => (/* binding */ validateOsvFunctionsExist)
 /* harmony export */ });
 /* unused harmony export extractPythonPackageFunctions */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
-/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1421);
-/* harmony import */ var _ir_parser_py_cst_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(682);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31421);
+/* harmony import */ var _ir_parser_py_cst_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(40682);
 // Python package function extraction via the CST parser.
 //
 // Locates an installed Python package in site-packages or .venv,

package/dist/1905.index.js

@@ -2,7 +2,7 @@ export const id = 1905;
 export const ids = [1905,3499];
 export const modules = {
 
-/***/ 4286:
+/***/ 11905:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -14,7 +14,7 @@ __webpack_require__.d(__webpack_exports__, {
 // UNUSED EXPORTS: makeBudget, makeTaintProbe
 
 // EXTERNAL MODULE: external "node:crypto"
-var external_node_crypto_ = __webpack_require__(7598);
+var external_node_crypto_ = __webpack_require__(77598);
 ;// CONCATENATED MODULE: ./src/discovery/partition.js
 //
 // Split the codebase into disjoint focus areas so parallel hunters cannot
@@ -110,9 +110,13 @@ function partitionCallGraph(callGraph, opts = {}) {
 }
 
 // EXTERNAL MODULE: ./src/discovery/lenses.js
-var discovery_lenses = __webpack_require__(3499);
+var discovery_lenses = __webpack_require__(33499);
 // EXTERNAL MODULE: ./src/egress/policy.js
-var policy = __webpack_require__(5712);
+var policy = __webpack_require__(45712);
+// EXTERNAL MODULE: ./src/llm-validator/providers.js
+var providers = __webpack_require__(38947);
+// EXTERNAL MODULE: ./src/llm-validator/ollama-provider.js
+var ollama_provider = __webpack_require__(23837);
 ;// CONCATENATED MODULE: ./src/discovery/llm-invoke.js
 //
 // Shared LLM endpoint caller. Both the hunter and the refutation panel need
@@ -123,10 +127,65 @@ var policy = __webpack_require__(5712);
 
 
 
+
+
 const DEFAULT_TIMEOUT_MS = 60000;
 
+// agentic-security-ollama-offline-prd.md §32 — hunt is one of the highest-
+// value initial Ollama use cases, and this is the single injected caller both
+// hunter.js and disprove.js already share (per this directory's CLAUDE.md:
+// "no other module may talk to an LLM directly"). Rather than give hunt its
+// own separate provider-resolution copy, `defaultLlmInvoke` now checks
+// `resolveProvider()` FIRST — but only when the caller hasn't already pinned
+// a literal `opts.endpoint` (the multi-endpoint consensus path in this same
+// file does exactly that, one resolved URL per voter, predating the provider
+// abstraction; that path must keep POSTing `{prompt}` to that literal URL
+// exactly as before, so it deliberately skips provider resolution).
+//
+// BACKWARD COMPATIBILITY: for every existing deployment that sets
+// AGENTIC_SECURITY_LLM_ENDPOINT with no PRESET, resolveProvider() resolves
+// that to `provider: 'byo'`, not `'ollama'` — so this function falls straight
+// through to the untouched raw-fetch path below, byte-identical to before.
+// Only `PRESET=ollama` takes the new branch. `'hunt'` is passed as the role
+// deliberately: it is not a member of providers.js's ROLES set, so
+// `resolveProvider` never picks up a role-specific override
+// (AGENTIC_SECURITY_LLM_MODEL_VALIDATE etc.) that was never meant to apply
+// to a hunt call — only the global AGENTIC_SECURITY_LLM_PRESET/_MODEL.
 async function defaultLlmInvoke(prompt, opts = {}) {
   const timeoutMs = Number.isFinite(opts.timeoutMs) ? opts.timeoutMs : DEFAULT_TIMEOUT_MS;
+
+  if (!opts.endpoint) {
+    const resolved = (0,providers.resolveProvider)({ role: opts.role || 'hunt' });
+    // A REFUSAL (a preset was explicitly configured and declined — e.g. a
+    // non-loopback Ollama host, or `local`'s own non-loopback refusal) must
+    // propagate here, not silently fall through to the legacy raw-endpoint
+    // path below. Falling through would mean a refused `ollama`/`local`
+    // config could still reach a network call via a leftover
+    // AGENTIC_SECURITY_LLM_ENDPOINT — exactly the bypass PRD §23.2 exists to
+    // prevent. `resolved.reason` is non-null ONLY for a genuine refusal;
+    // "nothing configured" always carries `reason: null` (providers.js).
+    if (!resolved.ok && resolved.reason) throw new Error(resolved.reason);
+    if (resolved.ok && resolved.config.provider === 'ollama') {
+      const oc = resolved.config.ollama;
+      const r = await (0,ollama_provider/* callOllamaChat */.L5)({
+        host: resolved.config.endpoint,
+        model: resolved.config.model,
+        messages: [{ role: 'user', content: prompt }],
+        keepAlive: oc?.keepAlive,
+        timeouts: oc
+          ? { connectTimeoutMs: oc.connectTimeoutMs, requestTimeoutMs: oc.requestTimeoutMs }
+          : { connectTimeoutMs: 3000, requestTimeoutMs: timeoutMs },
+      });
+      // PRD §23.4: never fall back to a cloud provider on failure — throwing
+      // here is exactly what the pre-existing raw-fetch path already does on
+      // a non-2xx/network error, and both hunter.js and disprove.js already
+      // treat a thrown/rejected llmInvoke as "this voter did not answer",
+      // never as "try something else".
+      if (!r.ok) throw new Error(`ollama ${r.code}: ${r.reason || 'request failed'}`);
+      return r.result.text;
+    }
+  }
+
   // The URL is the operator's own configured endpoint, read from an environment
   // variable they set. Reaching it is this module's entire purpose; no
   // request-controlled input exists anywhere on this path, and an operator who
@@ -275,6 +334,28 @@ function resolveLlmInvokeWithDecision(opts = {}) {
     return { invoke, decision, decisions };
   }
 
+  // ollama-offline-prd.md §32: PRESET=ollama is a configured provider even
+  // when no raw AGENTIC_SECURITY_LLM_ENDPOINT is set — resolve it the exact
+  // same way llm-validator/index.js's endpointConfig() does, so hunt gets
+  // the SAME egress-evaluated-before-any-call treatment every other
+  // configured provider already gets here (this function's whole reason to
+  // exist, per the block comment above). Checked BEFORE the legacy
+  // raw-endpoint fallback below, matching providers.js's own precedence
+  // (ollama/local checked before a bare BYO endpoint).
+  const resolved = (0,providers.resolveProvider)({ role: opts.role || 'hunt' });
+  if (!resolved.ok && resolved.reason) {
+    // A REFUSAL (non-loopback ollama/local, explicitly configured and
+    // declined) is itself a policy decision — same shape as an egress
+    // denial below, so callers' existing "read .reason when invoke is
+    // null" handling covers it without a new branch on their side.
+    return { invoke: null, decision: { allowed: false, reason: resolved.reason } };
+  }
+  if (resolved.ok && resolved.config.provider === 'ollama') {
+    const decision = (0,policy/* evaluateEgress */.nn)({ scanRoot: opts.scanRoot, purpose: opts.purpose || 'discovery', endpoint: resolved.config.endpoint, provider: 'ollama' });
+    if (!decision.allowed) return { invoke: null, decision };
+    return { invoke: (prompt) => defaultLlmInvoke(prompt, { timeoutMs: opts.timeoutMs, role: opts.role }), decision };
+  }
+
   const endpoint = process.env.AGENTIC_SECURITY_LLM_ENDPOINT;
   if (!endpoint) return { invoke: null, decision: null };
 
@@ -369,7 +450,16 @@ async function runHunter(focusArea, lens, ctx = {}, opts = {}) {
   const transcript = [];
   const lensKey = lens?.key || 'unknown';
   const base = { focusAreaId: focusArea.id, lens: lensKey, transcript };
-  const { invoke: llmInvoke, decision: egressDecision } = resolveLlmInvokeWithDecision({ ...opts, purpose: 'discovery-hunter' });
+  // ollama-offline-prd.md §32 — "permit each refutation-panel member to be a
+  // separately configured local model" extends naturally to the hunter's own
+  // lenses: the `business-logic` lens is exactly the PRD's `logic` role
+  // ("cross-file business-logic reasoning"), so it alone routes through
+  // role='logic' (honoring AGENTIC_SECURITY_LLM_MODEL_LOGIC) while every
+  // other lens keeps the existing role='hunt' default — a caller-supplied
+  // `opts.role` still wins over both, same precedence resolveProvider
+  // already documents.
+  const role = opts.role || (lensKey === 'business-logic' ? 'logic' : 'hunt');
+  const { invoke: llmInvoke, decision: egressDecision } = resolveLlmInvokeWithDecision({ ...opts, role, purpose: 'discovery-hunter' });
 
   if (typeof llmInvoke !== 'function') {
     // FR-601: distinguish "policy denied a configured endpoint" from "nothing
@@ -520,7 +610,12 @@ async function disproveCandidate(candidate, opts = {}) {
   // missing endpoint always has, so it falls straight into this module's own
   // pre-existing rule — "silence never refutes" — with zero votes cast and no
   // prompt ever built for a denied endpoint.
-  const { invoke: llmInvoke, decision: egressDecision } = resolveLlmInvokeWithDecision({ ...opts, purpose: 'discovery-disprove' });
+  // ollama-offline-prd.md §32 — the refutation panel is the PRD's `verify`
+  // role ("adversarial verification"): route it through role='verify' by
+  // default so AGENTIC_SECURITY_LLM_MODEL_VERIFY applies, same precedence
+  // (a caller-supplied opts.role still wins) hunter.js's lens routing uses.
+  const role = opts.role || 'verify';
+  const { invoke: llmInvoke, decision: egressDecision } = resolveLlmInvokeWithDecision({ ...opts, role, purpose: 'discovery-disprove' });
 
   const votes = [];
   if (typeof llmInvoke === 'function') {
@@ -548,7 +643,7 @@ async function disprovePanel(candidates, opts = {}) {
 }
 
 // EXTERNAL MODULE: ./src/posture/stable-id.js
-var stable_id = __webpack_require__(838);
+var stable_id = __webpack_require__(90838);
 ;// CONCATENATED MODULE: ./src/discovery/judge.js
 //
 // Turn surviving candidates into findings, then decide which are actually new.
@@ -649,11 +744,11 @@ function judgeCandidates(candidates, priorScan, triageFeedback) {
 }
 
 // EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __webpack_require__(3024);
+var external_node_fs_ = __webpack_require__(73024);
 // EXTERNAL MODULE: external "node:path"
-var external_node_path_ = __webpack_require__(6760);
+var external_node_path_ = __webpack_require__(76760);
 // EXTERNAL MODULE: ./src/posture/state-dir.js
-var state_dir = __webpack_require__(1174);
+var state_dir = __webpack_require__(31174);
 ;// CONCATENATED MODULE: ./src/discovery/memory.js
 // Cross-run discovery memory — PRD Phase 3 / C4.
 //
@@ -866,7 +961,7 @@ function makeTaintProbe(perFileIR, callGraph) {
 
 async function runDeepAnalysisSafe(perFileIR, callGraph) {
   try {
-    const { runDeepAnalysis } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 2555));
+    const { runDeepAnalysis } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 72555));
     return runDeepAnalysis(perFileIR, callGraph, {});
   } catch {
     return null;
@@ -1155,7 +1250,7 @@ async function runDiscovery(ctx = {}, opts = {}) {
 
 /***/ }),
 
-/***/ 3499:
+/***/ 33499:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {

package/dist/1920.index.js

@@ -2,7 +2,7 @@ export const id = 1920;
 export const ids = [1920,2238];
 export const modules = {
 
-/***/ 2238:
+/***/ 32238:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -12,9 +12,9 @@ export const modules = {
 /* harmony export */   sU: () => (/* binding */ loadFixAttempts)
 /* harmony export */ });
 /* unused harmony exports FIX_STAGES, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31174);
 // Time-to-validated-fix (R5, the reporting half).
 //
 // `verifyFix` already RUNS the stages and `test-runner.js` already times the
@@ -292,7 +292,7 @@ function renderFixAxes(sum) {
 
 /***/ }),
 
-/***/ 1920:
+/***/ 61920:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -300,11 +300,11 @@ function renderFixAxes(sum) {
 /* harmony export */   renderProductionFeedbackSummary: () => (/* binding */ renderProductionFeedbackSummary)
 /* harmony export */ });
 /* unused harmony exports CATEGORIES, collectFeedbackEvents, summarizeFeedbackTrend, _internals */
-/* harmony import */ var _suppressions_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9277);
-/* harmony import */ var _triage_memory_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1905);
-/* harmony import */ var _sca_policy_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(123);
-/* harmony import */ var _fix_history_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4407);
-/* harmony import */ var _fix_metrics_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(2238);
+/* harmony import */ var _suppressions_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(89277);
+/* harmony import */ var _triage_memory_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(21905);
+/* harmony import */ var _sca_policy_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(30123);
+/* harmony import */ var _fix_history_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(84407);
+/* harmony import */ var _fix_metrics_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(32238);
 // FR-907 (assurance-hardening PRD): "Add longitudinal production feedback
 // measurement | Metrics separate user suppression, accepted risk, invalid
 // finding, fixed finding, and verification outcome."

package/dist/2238.index.js

@@ -2,7 +2,7 @@ export const id = 2238;
 export const ids = [2238];
 export const modules = {
 
-/***/ 2238:
+/***/ 32238:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -12,9 +12,9 @@ export const modules = {
 /* harmony export */   sU: () => (/* binding */ loadFixAttempts)
 /* harmony export */ });
 /* unused harmony exports FIX_STAGES, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31174);
 // Time-to-validated-fix (R5, the reporting half).
 //
 // `verifyFix` already RUNS the stages and `test-runner.js` already times the

package/dist/2271.index.js

@@ -2,7 +2,7 @@ export const id = 2271;
 export const ids = [2271];
 export const modules = {
 
-/***/ 2271:
+/***/ 22271:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -12,8 +12,8 @@ export const modules = {
 /* harmony export */   signProvenanceEvidenceBundle: () => (/* binding */ signProvenanceEvidenceBundle),
 /* harmony export */   verifyProvenanceEvidenceBundle: () => (/* binding */ verifyProvenanceEvidenceBundle)
 /* harmony export */ });
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
-/* harmony import */ var _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8317);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+/* harmony import */ var _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(98317);
 // Signed provenance evidence bundles (Finding Provenance PRD, M4 §4.1).
 //
 // Sibling to posture/evidence-bundle.js, not a generalization of it — that

package/dist/2432.index.js

@@ -2,7 +2,7 @@ export const id = 2432;
 export const ids = [2432,5561];
 export const modules = {
 
-/***/ 5561:
+/***/ 75561:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -433,7 +433,7 @@ function evaluateVerificationEvidence(diff, requiredEvidenceFlowIds) {
 
 /***/ }),
 
-/***/ 2432:
+/***/ 52432:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -443,12 +443,12 @@ function evaluateVerificationEvidence(diff, requiredEvidenceFlowIds) {
 /* harmony export */   ledgerPaths: () => (/* binding */ ledgerPaths),
 /* harmony export */   readLedgerEvents: () => (/* binding */ readLedgerEvents)
 /* harmony export */ });
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_fs_promises__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1455);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(7598);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(1174);
-/* harmony import */ var _lineage_remediation_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(5561);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_fs_promises__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(51455);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(77598);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(31174);
+/* harmony import */ var _lineage_remediation_js__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(75561);
 // remediation-ledger.js — M5 deliverable #6 (Blast-Radius: Remediation
 // Command Center, FR-507 + AC-31), Task 2 of the sub-project: the IMPURE
 // half. `../lineage/remediation.js` (Task 1) ships the pure RemediationItem

package/dist/2659.index.js

@@ -2,7 +2,7 @@ export const id = 2659;
 export const ids = [2659];
 export const modules = {
 
-/***/ 2659:
+/***/ 42659:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {

package/dist/2826.index.js

@@ -2,14 +2,14 @@ export const id = 2826;
 export const ids = [2826];
 export const modules = {
 
-/***/ 2826:
+/***/ 32826:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   renderPrComment: () => (/* binding */ renderPrComment)
 /* harmony export */ });
 /* unused harmony export _internal */
-/* harmony import */ var _util_untrusted_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7097);
+/* harmony import */ var _util_untrusted_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(17097);
 // Advisor-tone PR comment renderer (v0.72).
 //
 // Replaces the typical "12 findings detected, see SARIF" wall of text

package/dist/2830.index.js

@@ -10,9 +10,9 @@ export const modules = {
 /* harmony export */   summarizeHarnessPresence: () => (/* binding */ summarizeHarnessPresence)
 /* harmony export */ });
 /* unused harmony export HARNESS_DIRS */
-/* harmony import */ var node_fs_promises__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1455);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
-/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(8161);
+/* harmony import */ var node_fs_promises__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(51455);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(48161);
 // Multi-harness configuration discovery.
 //
 // Finds every agent-harness configuration directory the user has, both at

package/dist/2923.index.js

@@ -2,7 +2,7 @@ export const id = 2923;
 export const ids = [2923];
 export const modules = {
 
-/***/ 2923:
+/***/ 12923:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {

package/dist/3001.index.js

@@ -2,7 +2,7 @@ export const id = 3001;
 export const ids = [3001];
 export const modules = {
 
-/***/ 3001:
+/***/ 53001:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -12,9 +12,9 @@ export const modules = {
 /* harmony export */   renderCalibrationReportSummary: () => (/* binding */ renderCalibrationReportSummary)
 /* harmony export */ });
 /* unused harmony exports CALIBRATION_FEEDBACK_FILE, loadCalibrationFeedback, _internals */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(7598);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(77598);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31174);
 // FR-806 (assurance-hardening PRD): "Validate model calibration against
 // accepted and realized incidents where customers opt in | Calibration
 // reports are aggregated and privacy-preserving."

package/dist/3117.index.js

@@ -2,7 +2,7 @@ export const id = 3117;
 export const ids = [3117];
 export const modules = {
 
-/***/ 3117:
+/***/ 93117:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -10,9 +10,9 @@ export const modules = {
 /* harmony export */   renderBadge: () => (/* binding */ renderBadge)
 /* harmony export */ });
 /* unused harmony exports badgeFromScanRoot, renderSvg, _internal */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
-/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31174);
 // Live SVG badge generator (v0.72).
 //
 // Every repo can drop a badge in its README pulling from the latest scan:

package/dist/3180.index.js

@@ -2,7 +2,7 @@ export const id = 3180;
 export const ids = [3180];
 export const modules = {
 
-/***/ 3180:
+/***/ 73180:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -12,11 +12,11 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __webpack_require__(3024);
+var external_node_fs_ = __webpack_require__(73024);
 // EXTERNAL MODULE: external "node:path"
-var external_node_path_ = __webpack_require__(6760);
+var external_node_path_ = __webpack_require__(76760);
 // EXTERNAL MODULE: external "node:url"
-var external_node_url_ = __webpack_require__(3136);
+var external_node_url_ = __webpack_require__(73136);
 ;// CONCATENATED MODULE: ./scripts/bundle-frontend.mjs
 // bundle-frontend.mjs — Milestone 4, sub-project Self-contained HTML
 // report. A minimal, hand-rolled ES-module bundler, deliberately NOT a
@@ -196,9 +196,9 @@ function bundleFrontendModules(entryAbsPath) {
 }
 
 // EXTERNAL MODULE: ./src/lineage/export-json.js
-var export_json = __webpack_require__(859);
+var export_json = __webpack_require__(40859);
 // EXTERNAL MODULE: ./src/shared/frontend-root.js
-var frontend_root = __webpack_require__(1185);
+var frontend_root = __webpack_require__(61185);
 ;// CONCATENATED MODULE: ./scripts/generate-html-report.mjs
 // generate-html-report.mjs — Milestone 4, sub-project Self-contained
 // HTML report. Assembles ONE offline-safe HTML document: inline CSS,
@@ -312,14 +312,14 @@ ${bundledJs}
 
 /***/ }),
 
-/***/ 1185:
+/***/ 61185:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   D: () => (/* binding */ resolveFrontendRoot)
 /* harmony export */ });
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
 // frontend-root.js — locates the Data Flow Explorer's `frontend/` assets
 // (index.html/src/styles) regardless of whether this code is running:
 //   - unbundled, straight out of scanner/src/ or scanner/scripts/ (dev/test —

package/dist/3276.index.js

@@ -2,7 +2,7 @@ export const id = 3276;
 export const ids = [3276];
 export const modules = {
 
-/***/ 3276:
+/***/ 63276:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {

package/dist/3415.index.js

@@ -2,7 +2,7 @@ export const id = 3415;
 export const ids = [3415];
 export const modules = {
 
-/***/ 3415:
+/***/ 13415:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {

package/dist/3499.index.js

@@ -2,7 +2,7 @@ export const id = 3499;
 export const ids = [3499];
 export const modules = {
 
-/***/ 3499:
+/***/ 33499:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {

package/dist/3518.index.js

@@ -2,16 +2,16 @@ export const id = 3518;
 export const ids = [3518];
 export const modules = {
 
-/***/ 3518:
+/***/ 83518:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   computeGraphDiff: () => (/* binding */ computeGraphDiff)
 /* harmony export */ });
 /* unused harmony exports WATCHED_FLOW_FIELDS, validateGraphDiff */
-/* harmony import */ var _graph_snapshot_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(373);
-/* harmony import */ var _ids_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(5034);
-/* harmony import */ var _dataflow_privacy_governance_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(3308);
+/* harmony import */ var _graph_snapshot_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(30373);
+/* harmony import */ var _ids_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(45034);
+/* harmony import */ var _dataflow_privacy_governance_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(63308);
 // graph-diff.js — M4 deliverable #9 (FR-503 §14, DFG-022), sub-project
 // 8b, Task 1: the GraphDiff extension contract + computeGraphDiff + honest
 // change-cause classification.