@clear-capabilities/agentic-security-scanner 0.150.1 → 0.150.2

package/CHANGELOG.md

@@ -10,6 +10,82 @@
 
 
 
+## 0.150.2 - Two adversarial-review passes on 0.150.0's Ollama support: redaction, disclosure, and robustness fixes
+
+0.150.0's offline-Ollama release was put through two rounds of adversarial premortem review after
+shipping. Both surfaced real gaps; this release closes them.
+
+**Security — secret redaction (the most important fix here).** The general-purpose `redactSecrets`
+function every Ollama-backed role (`fix`/`explain`/`poc`, the `ask` agent loop's `read_file`/
+`search_code` tools) routes untrusted file content through before it reaches a model had several
+real gaps, found and closed in order as review went deeper:
+
+1. Unquoted `.env`/shell-export syntax (`DB_PASSWORD=x`, no quotes) evaded the existing
+   quote-requiring pattern entirely — this was a previously-documented, never-fixed-at-the-general-
+   level gap (`secret-redaction.test.js`'s own long-standing comment named it).
+2. Compound identifiers joined by `_`/`-` (`DB_PASSWORD`, `STRIPE_API_KEY`) didn't match even in the
+   already-supported quoted form, because a plain `\b` treats `_` as a word character.
+3. A second review pass found the above fix was narrower than the real threat surface: **camelCase**
+   compounds (`authToken`, `apiSecret`), a **JSON-quoted key** (`"password": "value"` — the closing
+   quote wasn't consumed before the operator), **YAML** `key: value` syntax (added, deliberately
+   scoped to `.yml`/`.yaml` files only, to avoid colliding with the already-tested TypeScript
+   type-annotation and JS object-literal-key exclusions), and a secret **split across a string
+   concatenation** (`"Super" + "Secret123"` — only the first segment was redacted, leaking the tail)
+   all still leaked. All four are fixed, each with an explicit false-positive regression test
+   (`primaryKey`/`cacheKey` must not redact; `password: string;` in a `.ts` file must not redact;
+   ordinary string-building with no secret-shaped key name must not redact).
+
+**Governance — the "AI Assistance" report's role-scope disclosure had a blind spot.** 0.150.0 added
+a report block scoped to the `validate` role, with a warning when another role resolves to a remote
+provider — but `hunt` (the heaviest LLM-driven discovery work) is deliberately not one of
+`providers.js`'s per-role-overridable roles, so it could never appear in that warning, by
+construction. `hunt` is now checked explicitly.
+
+**Robustness.**
+- The wall-clock/per-call timeout mismatch in the `ask` agent loop (a slow call could exceed the
+  loop's own overall budget, and raising the documented remedy for slow models did nothing to help)
+  is fixed and was verified against two real installed Ollama models on real hardware
+  (`gemma4:e4b`, `qwen3.5:9b`) — both complete a live tool-calling round trip within the new budget.
+- The capability-probe cache now has a 30-day safety-net TTL and a `--force` flag
+  (`agentic-security models test <model> --force`), on top of its existing version+digest+name key.
+- Added `AGENTIC_SECURITY_OLLAMA_DISABLED=1`, a kill switch checked in the one function every Ollama
+  call path resolves through — closes a gap where a per-role override could survive an operator
+  unsetting only the global preset during an incident.
+- `agentic-security fix`'s Ollama-proposed-patch path now retries exactly once with the
+  deterministic gate's own rejection reason fed back into the prompt, instead of asking an
+  identical (temperature-0) question and getting an identical bad patch back. Automated test
+  coverage added (`test/cli/fix-retry.test.js`); previously this had only ever been verified by a
+  single manual run.
+- A real, observed out-of-memory failure is now recorded per-model and surfaced as a warning
+  wherever that model is used again — including proactively in the `ask` loop itself, not only in
+  `models doctor` (a user who never runs `doctor` used to get no warning at all before repeating the
+  same failure).
+- Built the PRD's own required opt-in live-model contract tier (`AGENTIC_SECURITY_OLLAMA_E2E=1 npm
+  run test:ollama-e2e`), which did not exist at 0.150.0 despite being an explicit requirement — run
+  against two real installed models, all 7 required contract checks pass. This tests the WIRE
+  CONTRACT (valid structured output, a real tool-call round trip, prompt-injection resistance,
+  graceful context-overflow handling), not output QUALITY — a model-quality benchmark suite remains
+  future work, and `docs/guides/ollama.md` says so explicitly rather than letting contract-passing
+  read as quality-proven.
+
+**Documentation.** `docs/guides/ollama.md` gained an honest statement of the Ollama supply-chain
+trust boundary (no Sigstore-equivalent verification exists for the `ollama` binary or pulled model
+weights, unlike this project's own npm dependencies) and a doc-drift test
+(`test/ollama-doc-drift.test.js`) that fails if the guide's stated numeric defaults (timeouts,
+context sizes, cache TTL, the tool-loop iteration ceiling) ever diverge from the real source
+constants — verified by deliberately breaking one and confirming the test catches it.
+
+**Clarification, not a correction, to 0.150.0's own wording** (this project's changelog convention
+is to never rewrite a past entry): "the same offline guarantee the existing `local` preset already
+made — nothing leaves the machine" describes LLM inference traffic only. The same scan still makes
+separate, deterministic OSV/KEV/EPSS network calls unless `AGENTIC_SECURITY_OFFLINE=1` is also set —
+`docs/guides/ollama.md` already said this; this entry says it here too, next to the original claim.
+Separately, PRD §26 asked for a combined validate/verify/explain/fix/hunt "AI Assistance" summary;
+what shipped in 0.150.0 measures the `validate` role only (the one role that runs automatically
+during a plain `scan`) — `docs/guides/ollama.md` and this entry disclose the scope-down; the other
+five roles are each single-finding or discovery-run commands with no natural combined-scan moment to
+summarize.
+
 ## 0.150.1 - Fix 0.150.0's release-gate failure: @babel/core dependency currency
 
 0.150.0's tag push failed `release.yml`'s gate on its one network-dependent, deliberately-excluded-

package/bin/agentic-security.js

@@ -1938,6 +1938,7 @@ async function cmdModels(args) {
   const { getModelCapabilities } = await import('../src/llm-validator/model-probe.js');
   const { resolveProvider } = await import('../src/llm-validator/providers.js');
   const wantsProbe = !!args.flags.probe;
+  const wantsForceProbe = !!args.flags.force;
 
   const envOverride = {};
   if (args.flags.host) envOverride.AGENTIC_SECURITY_OLLAMA_HOST = String(args.flags.host);
@@ -2004,12 +2005,16 @@ async function cmdModels(args) {
       } else {
         lines.push(`  ✗ memory admission FAILED — ${admission.reason}`);
       }
-      const capsResult = await getModelCapabilities({ host: cfg.config.host, model, probe: wantsProbe });
+      // Adversarial-review fix (2026-09): a memory estimate that has already
+      // been proven wrong by a real OOM on this machine no longer gets
+      // presented with the same unqualified confidence.
+      if (admission.priorOOMWarning) lines.push(`  ⚠ ${admission.priorOOMWarning}`);
+      const capsResult = await getModelCapabilities({ host: cfg.config.host, model, probe: wantsProbe, force: wantsForceProbe });
       const caps = capsResult.capabilities;
       const capSourceLabel = caps.source?.runtimeProbe ? (capsResult.cached ? 'runtime-probed, cached' : 'runtime-probed')
         : caps.source?.metadata ? 'Ollama metadata' : 'family hint — not runtime-probed';
       lines.push(`  chat=${caps.chat ? 'yes' : 'no'} structuredJson=${caps.structuredJson} tools=${caps.tools} (${capSourceLabel})`);
-      if (wantsProbe) lines.push(capsResult.cached ? '  ✓ capability probe cached' : '  ✓ capability probe ran (now cached)');
+      if (wantsProbe) lines.push(capsResult.cached ? '  ✓ capability probe cached (pass --force to re-probe)' : '  ✓ capability probe ran (now cached)');
       else lines.push('  ↗ run with --probe to runtime-verify structured output / tool calling (consumes inference time)');
     } else {
       lines.push('Default model: (none resolved)');
@@ -2039,7 +2044,7 @@ async function cmdModels(args) {
     if (!modelsResult.ok) { console.log(`✗ Ollama server is not reachable at ${cfg.config.host} (${modelsResult.code})`); return 1; }
     const info = modelsResult.models.find((m) => m.name === name);
     const family = classifyModelFamily(name);
-    const capsResult = await getModelCapabilities({ host: cfg.config.host, model: name, probe: wantsProbe });
+    const capsResult = await getModelCapabilities({ host: cfg.config.host, model: name, probe: wantsProbe, force: wantsForceProbe });
     const caps = capsResult.capabilities;
     const out = { name, installed: !!info, family, capabilities: caps, cached: capsResult.cached, metadata: info || null };
     if (args.flags.json) { writeStdout(JSON.stringify(out, null, 2) + '\n'); return 0; }
@@ -2073,19 +2078,25 @@ async function cmdModels(args) {
       console.log(`✗ Model '${name}' is not installed. Run \`ollama pull ${name}\` first.`);
       return 1;
     }
-    const capsResult = await getModelCapabilities({ host: cfg.config.host, model: name, probe: true });
+    // ollama-offline-prd.md premortem fix (2026-09): the capability cache has
+    // no expiry beyond its version+digest+name key, which doesn't always
+    // change on a same-tag re-pull — `--force` is the documented way to get
+    // a definitively fresh answer right now, mirroring the existing
+    // `validator-cache stats|gc --older-than <days>` convention rather than
+    // leaving `test` unable to ever overrule its own past result.
+    const capsResult = await getModelCapabilities({ host: cfg.config.host, model: name, probe: true, force: !!args.flags.force });
     const caps = capsResult.capabilities;
     if (args.flags.json) {
       writeStdout(JSON.stringify({ ok: true, name, capabilities: caps, cached: capsResult.cached }, null, 2) + '\n');
       return 0;
     }
-    console.log(`agentic-security models test ${name}`);
+    console.log(`agentic-security models test ${name}${args.flags.force ? ' --force' : ''}`);
     console.log('');
     console.log(`  chat:            ${caps.chat ? '✓ yes' : '✗ no'}`);
     console.log(`  structured JSON: ${caps.structuredJson === true ? '✓ yes' : caps.structuredJson === false ? '✗ no' : '? unknown (probe inconclusive)'}`);
     console.log(`  tool calling:    ${caps.tools === true ? '✓ yes' : caps.tools === false ? '✗ no' : '? unknown (probe inconclusive)'}`);
     if (caps.contextTokens) console.log(`  context window:  ${caps.contextTokens} tokens`);
-    console.log(`  ${capsResult.cached ? '✓ capability probe cached (already ran before)' : '✓ capability probe ran (now cached)'}`);
+    console.log(`  ${capsResult.cached ? '✓ capability probe cached (already ran before — pass --force to re-probe)' : '✓ capability probe ran (now cached)'}`);
     return 0;
   }
 
@@ -2109,7 +2120,7 @@ async function cmdModels(args) {
     return 1;
   }
 
-  console.error('Usage: agentic-security models <list|status|doctor|inspect <model>|test <model>|pull <model>> [--host <url>] [--json] [--probe]');
+  console.error('Usage: agentic-security models <list|status|doctor|inspect <model>|test <model>|pull <model>> [--host <url>] [--json] [--probe] [--force]');
   console.error(`Default Ollama host: ${DEFAULT_OLLAMA_HOST}`);
   return 4;
 }
@@ -2126,17 +2137,29 @@ async function cmdModels(args) {
 // "does this project have a rate limiter").
 async function cmdAsk(args) {
   const goal = args._[1];
-  if (!goal) { console.error('Usage: agentic-security ask "<question>" [target] [--max-iterations N]'); return 4; }
+  if (!goal) { console.error('Usage: agentic-security ask "<question>" [target] [--max-iterations N] [--timeout-ms N]'); return 4; }
   const target = path.resolve(args._[2] && !args._[2].startsWith('--') ? args._[2] : '.');
   const { runAgentLoop, AGENT_LOOP_ERROR, DEFAULT_MAX_TOOL_ITERATIONS } = await import('../src/llm-validator/agent-loop.js');
 
   const envOverride = {};
   if (args.flags.host) envOverride.AGENTIC_SECURITY_OLLAMA_HOST = String(args.flags.host);
   if (args.flags['allow-remote-ollama']) envOverride.AGENTIC_SECURITY_OLLAMA_ALLOW_REMOTE = '1';
+  // ollama-offline-prd.md premortem fix (2026-09): --timeout-ms sets the
+  // LOOP's own wall-clock budget (AGENTIC_SECURITY_LLM_AGENT_TIMEOUT_MS),
+  // which used to be a fixed 5 minutes no matter how high
+  // AGENTIC_SECURITY_LLM_TIMEOUT_MS (the PER-CALL timeout, still the right
+  // knob for "this one model reply is slow") was raised — raising only the
+  // per-call setting could not extend the loop, since a single slow call
+  // could already exceed the whole fixed budget.
+  if (args.flags['timeout-ms']) envOverride.AGENTIC_SECURITY_LLM_AGENT_TIMEOUT_MS = String(args.flags['timeout-ms']);
   const env = { ...process.env, ...envOverride };
   const maxToolIterations = args.flags['max-iterations'] ? parseInt(args.flags['max-iterations'], 10) : DEFAULT_MAX_TOOL_ITERATIONS;
 
   const r = await runAgentLoop({ goal, scanRoot: target, env, maxToolIterations });
+  // Adversarial-review fix (2026-09): surfaced here, not just in `models
+  // doctor`, so a user who never runs `doctor` still sees it before/after
+  // the exact command that would otherwise repeat a known OOM.
+  if (r.priorOOMWarning) console.log(`⚠ ${r.priorOOMWarning}`);
 
   if (!r.ok) {
     if (r.code === AGENT_LOOP_ERROR.NOT_CONFIGURED) {
@@ -2170,7 +2193,7 @@ async function cmdAsk(args) {
     console.log(`✗ Stopped after the ${DEFAULT_MAX_TOOL_ITERATIONS}-iteration bound without a final answer. Try narrowing the question.`);
     return 1;
   }
-  console.log('✗ Stopped: wall-clock timeout reached without a final answer.');
+  console.log('✗ Stopped: wall-clock timeout reached without a final answer. Try --timeout-ms <N> for a slow/cold-loading model (raising AGENTIC_SECURITY_LLM_TIMEOUT_MS alone does not extend this budget).');
   return 1;
 }
 
@@ -3475,12 +3498,51 @@ async function cmdFix(args) {
   const fixMeta = (approvedBy || approvalReason || patchAuthor)
     ? { approval: { approvedBy: approvedBy || '', reason: approvalReason || '' }, ...(patchAuthor ? { author: patchAuthor } : {}) }
     : null;
-  const result = await applyVerifiedFix({
+  let result = await applyVerifiedFix({
     scanRoot,
     finding: { file: f.file, id: f.id, stableId: f.stableId || null, ruleId: f.cwe || f.title, vuln: f.vuln || f.title },
     files: { [f.file]: newContent },
     fixMeta,
   });
+  // Adversarial-review fix (2026-09): an Ollama-sourced patch that gets
+  // rejected used to just fail outright — at temperature 0, a bare re-run
+  // of `fix` would almost certainly ask the identical question and get the
+  // identical bad patch back, burning the finite retry budget
+  // (applyVerifiedFix's own maxAttempts) with no chance of a better outcome.
+  // Orchestration test coverage: test/cli/fix-retry.test.js (real spawned
+  // CLI + fake Ollama server; statically skipped in this sandbox's
+  // documented child-process-loopback limitation, same as
+  // test/cli/models.test.js — flip to `test` where a spawned child can
+  // reach the parent's loopback server).
+  // ONE bounded retry, feeding the gate's own rejection reason back into the
+  // prompt so the model has an actual reason to propose something different
+  // — never more than one, matching this codebase's existing "exactly one
+  // retry" philosophy for model output elsewhere (callOllamaStructured's
+  // schema retry). A deterministic/stored patch (no ollamaFixMeta) is never
+  // retried — asking the same static template again cannot produce a
+  // different answer.
+  if (!result.ok && ollamaFixMeta && !result.budgetExceeded) {
+    console.log(`AI-assisted proposal was rejected (${result.reason}) — asking for one revised attempt...`);
+    const { proposeOllamaFix } = await import('../src/llm-validator/fix-proposal.js');
+    const retryProposal = await proposeOllamaFix({
+      finding: { file: f.file, line: f.line, vuln: f.vuln, cwe: f.cwe, severity: f.severity },
+      fileContent: originalContent,
+      scanRoot,
+      rejectionFeedback: result.reason,
+    });
+    if (retryProposal.ok) {
+      const retryResult = await applyVerifiedFix({
+        scanRoot,
+        finding: { file: f.file, id: f.id, stableId: f.stableId || null, ruleId: f.cwe || f.title, vuln: f.vuln || f.title },
+        files: { [f.file]: retryProposal.replacement },
+        fixMeta,
+      });
+      result = retryResult;
+      if (retryResult.ok) {
+        console.log(`  revised proposal accepted (rationale: ${retryProposal.rationale || 'n/a'})`);
+      }
+    }
+  }
   if (!result.ok) {
     console.error(`Refusing to apply: ${result.reason}`);
     if (result.budgetExceeded) console.error(`  (${result.attempts}/${result.maxAttempts} attempts already made for this finding)`);
@@ -3620,6 +3682,7 @@ async function cmdSetupLlmOllama(args) {
   if (!admission.admitted) {
     console.log(`  ↗ Memory admission check: ${admission.reason}`);
   }
+  if (admission.priorOOMWarning) console.log(`  ⚠ ${admission.priorOOMWarning}`);
   console.log('');
   console.log('To use this configuration, export:');
   console.log('  export AGENTIC_SECURITY_LLM_PRESET=ollama');

package/dist/1122.index.js

@@ -2,7 +2,7 @@ export const id = 1122;
 export const ids = [1122,3180];
 export const modules = {
 
-/***/ 1122:
+/***/ 21122:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -16,17 +16,17 @@ __webpack_require__.d(__webpack_exports__, {
 // UNUSED EXPORTS: _validTimeoutMs
 
 // EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __webpack_require__(3024);
+var external_node_fs_ = __webpack_require__(73024);
 // EXTERNAL MODULE: external "node:os"
-var external_node_os_ = __webpack_require__(8161);
+var external_node_os_ = __webpack_require__(48161);
 // EXTERNAL MODULE: external "node:path"
-var external_node_path_ = __webpack_require__(6760);
+var external_node_path_ = __webpack_require__(76760);
 // EXTERNAL MODULE: external "node:child_process"
-var external_node_child_process_ = __webpack_require__(1421);
+var external_node_child_process_ = __webpack_require__(31421);
 // EXTERNAL MODULE: external "node:url"
-var external_node_url_ = __webpack_require__(3136);
+var external_node_url_ = __webpack_require__(73136);
 // EXTERNAL MODULE: ./scripts/generate-html-report.mjs + 1 modules
-var generate_html_report = __webpack_require__(3180);
+var generate_html_report = __webpack_require__(73180);
 ;// CONCATENATED MODULE: ./src/ir/chrome-probe.mjs
 // chrome-probe.mjs — Milestone 4, sub-project PNG/SVG/PDF export.
 //
@@ -402,7 +402,7 @@ async function exportSvg(graph, opts = {}) {
 
 /***/ }),
 
-/***/ 3180:
+/***/ 73180:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -412,11 +412,11 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __webpack_require__(3024);
+var external_node_fs_ = __webpack_require__(73024);
 // EXTERNAL MODULE: external "node:path"
-var external_node_path_ = __webpack_require__(6760);
+var external_node_path_ = __webpack_require__(76760);
 // EXTERNAL MODULE: external "node:url"
-var external_node_url_ = __webpack_require__(3136);
+var external_node_url_ = __webpack_require__(73136);
 ;// CONCATENATED MODULE: ./scripts/bundle-frontend.mjs
 // bundle-frontend.mjs — Milestone 4, sub-project Self-contained HTML
 // report. A minimal, hand-rolled ES-module bundler, deliberately NOT a
@@ -596,9 +596,9 @@ function bundleFrontendModules(entryAbsPath) {
 }
 
 // EXTERNAL MODULE: ./src/lineage/export-json.js
-var export_json = __webpack_require__(859);
+var export_json = __webpack_require__(40859);
 // EXTERNAL MODULE: ./src/shared/frontend-root.js
-var frontend_root = __webpack_require__(1185);
+var frontend_root = __webpack_require__(61185);
 ;// CONCATENATED MODULE: ./scripts/generate-html-report.mjs
 // generate-html-report.mjs — Milestone 4, sub-project Self-contained
 // HTML report. Assembles ONE offline-safe HTML document: inline CSS,
@@ -712,14 +712,14 @@ ${bundledJs}
 
 /***/ }),
 
-/***/ 1185:
+/***/ 61185:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   D: () => (/* binding */ resolveFrontendRoot)
 /* harmony export */ });
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
 // frontend-root.js — locates the Data Flow Explorer's `frontend/` assets
 // (index.html/src/styles) regardless of whether this code is running:
 //   - unbundled, straight out of scanner/src/ or scanner/scripts/ (dev/test —

package/dist/1208.index.js

@@ -0,0 +1,23 @@
+export const id = 1208;
+export const ids = [1208];
+export const modules = {
+
+/***/ 91208:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+__webpack_require__.r(__webpack_exports__);
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   BaseJavaCstVisitor: () => (/* reexport safe */ _node_modules_java_parser_src_index_js__WEBPACK_IMPORTED_MODULE_0__.ak),
+/* harmony export */   BaseJavaCstVisitorWithDefaults: () => (/* reexport safe */ _node_modules_java_parser_src_index_js__WEBPACK_IMPORTED_MODULE_0__.C5),
+/* harmony export */   "default": () => (/* reexport safe */ _node_modules_java_parser_src_index_js__WEBPACK_IMPORTED_MODULE_0__.Ay),
+/* harmony export */   lexAndParse: () => (/* reexport safe */ _node_modules_java_parser_src_index_js__WEBPACK_IMPORTED_MODULE_0__.Ch),
+/* harmony export */   parse: () => (/* reexport safe */ _node_modules_java_parser_src_index_js__WEBPACK_IMPORTED_MODULE_0__.qg)
+/* harmony export */ });
+/* harmony import */ var _node_modules_java_parser_src_index_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(65724);
+
+
+
+
+/***/ })
+
+};

package/dist/1301.index.js

@@ -2,7 +2,7 @@ export const id = 1301;
 export const ids = [1301];
 export const modules = {
 
-/***/ 1301:
+/***/ 81301:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -11,8 +11,8 @@ export const modules = {
 /* harmony export */   validateTarget: () => (/* binding */ validateTarget)
 /* harmony export */ });
 /* unused harmony export _internals */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
 // Verifier target harness (FR-LIVE-HARNESS).
 //
 // Customer projects describe how to bring up the app they want the verifier

package/dist/1379.index.js

@@ -2,7 +2,7 @@ export const id = 1379;
 export const ids = [1379];
 export const modules = {
 
-/***/ 1379:
+/***/ 31379:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -322,9 +322,9 @@ function renderStageCell(cell, row) {
 }
 
 // EXTERNAL MODULE: ./src/dataflow/privacy-governance.js
-var privacy_governance = __webpack_require__(3308);
+var privacy_governance = __webpack_require__(63308);
 // EXTERNAL MODULE: ./src/lineage/export-json.js
-var export_json = __webpack_require__(859);
+var export_json = __webpack_require__(40859);
 ;// CONCATENATED MODULE: ./src/lineage/export-privacy.js
 // export-privacy.js — Milestone 4 deliverable #10 (DFG-020): graph-derived
 // DPIA/RoPA export, migrating off the Layer-2 taint engine's

package/dist/1444.index.js

@@ -2,15 +2,15 @@ export const id = 1444;
 export const ids = [1444];
 export const modules = {
 
-/***/ 1444:
+/***/ 51444:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   sweepGitHistory: () => (/* binding */ sweepGitHistory)
 /* harmony export */ });
 /* unused harmony exports extractAddedLines, scanHistoryDiff */
-/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8844);
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(31421);
+/* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(78844);
 // R15 (PRD §5) — git-history secret sweep.
 //
 // A secret removed from HEAD but present in any past commit is still

package/dist/1660.index.js

@@ -2,7 +2,7 @@ export const id = 1660;
 export const ids = [1660];
 export const modules = {
 
-/***/ 1660:
+/***/ 51660:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {

package/dist/1700.index.js

@@ -2,17 +2,17 @@ export const id = 1700;
 export const ids = [1700];
 export const modules = {
 
-/***/ 1700:
+/***/ 31700:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   validateOsvFunctionsExist: () => (/* binding */ validateOsvFunctionsExist)
 /* harmony export */ });
 /* unused harmony export extractPythonPackageFunctions */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
-/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1421);
-/* harmony import */ var _ir_parser_py_cst_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(682);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31421);
+/* harmony import */ var _ir_parser_py_cst_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(40682);
 // Python package function extraction via the CST parser.
 //
 // Locates an installed Python package in site-packages or .venv,

package/dist/1905.index.js

@@ -2,7 +2,7 @@ export const id = 1905;
 export const ids = [1905,3499];
 export const modules = {
 
-/***/ 4286:
+/***/ 11905:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -14,7 +14,7 @@ __webpack_require__.d(__webpack_exports__, {
 // UNUSED EXPORTS: makeBudget, makeTaintProbe
 
 // EXTERNAL MODULE: external "node:crypto"
-var external_node_crypto_ = __webpack_require__(7598);
+var external_node_crypto_ = __webpack_require__(77598);
 ;// CONCATENATED MODULE: ./src/discovery/partition.js
 //
 // Split the codebase into disjoint focus areas so parallel hunters cannot
@@ -110,13 +110,13 @@ function partitionCallGraph(callGraph, opts = {}) {
 }
 
 // EXTERNAL MODULE: ./src/discovery/lenses.js
-var discovery_lenses = __webpack_require__(3499);
+var discovery_lenses = __webpack_require__(33499);
 // EXTERNAL MODULE: ./src/egress/policy.js
-var policy = __webpack_require__(5712);
+var policy = __webpack_require__(45712);
 // EXTERNAL MODULE: ./src/llm-validator/providers.js
-var providers = __webpack_require__(8947);
+var providers = __webpack_require__(38947);
 // EXTERNAL MODULE: ./src/llm-validator/ollama-provider.js
-var ollama_provider = __webpack_require__(3837);
+var ollama_provider = __webpack_require__(23837);
 ;// CONCATENATED MODULE: ./src/discovery/llm-invoke.js
 //
 // Shared LLM endpoint caller. Both the hunter and the refutation panel need
@@ -643,7 +643,7 @@ async function disprovePanel(candidates, opts = {}) {
 }
 
 // EXTERNAL MODULE: ./src/posture/stable-id.js
-var stable_id = __webpack_require__(838);
+var stable_id = __webpack_require__(90838);
 ;// CONCATENATED MODULE: ./src/discovery/judge.js
 //
 // Turn surviving candidates into findings, then decide which are actually new.
@@ -744,11 +744,11 @@ function judgeCandidates(candidates, priorScan, triageFeedback) {
 }
 
 // EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __webpack_require__(3024);
+var external_node_fs_ = __webpack_require__(73024);
 // EXTERNAL MODULE: external "node:path"
-var external_node_path_ = __webpack_require__(6760);
+var external_node_path_ = __webpack_require__(76760);
 // EXTERNAL MODULE: ./src/posture/state-dir.js
-var state_dir = __webpack_require__(1174);
+var state_dir = __webpack_require__(31174);
 ;// CONCATENATED MODULE: ./src/discovery/memory.js
 // Cross-run discovery memory — PRD Phase 3 / C4.
 //
@@ -961,7 +961,7 @@ function makeTaintProbe(perFileIR, callGraph) {
 
 async function runDeepAnalysisSafe(perFileIR, callGraph) {
   try {
-    const { runDeepAnalysis } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 2555));
+    const { runDeepAnalysis } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 72555));
     return runDeepAnalysis(perFileIR, callGraph, {});
   } catch {
     return null;
@@ -1250,7 +1250,7 @@ async function runDiscovery(ctx = {}, opts = {}) {
 
 /***/ }),
 
-/***/ 3499:
+/***/ 33499:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {

package/dist/1920.index.js

@@ -2,7 +2,7 @@ export const id = 1920;
 export const ids = [1920,2238];
 export const modules = {
 
-/***/ 2238:
+/***/ 32238:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -12,9 +12,9 @@ export const modules = {
 /* harmony export */   sU: () => (/* binding */ loadFixAttempts)
 /* harmony export */ });
 /* unused harmony exports FIX_STAGES, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31174);
 // Time-to-validated-fix (R5, the reporting half).
 //
 // `verifyFix` already RUNS the stages and `test-runner.js` already times the
@@ -292,7 +292,7 @@ function renderFixAxes(sum) {
 
 /***/ }),
 
-/***/ 1920:
+/***/ 61920:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -300,11 +300,11 @@ function renderFixAxes(sum) {
 /* harmony export */   renderProductionFeedbackSummary: () => (/* binding */ renderProductionFeedbackSummary)
 /* harmony export */ });
 /* unused harmony exports CATEGORIES, collectFeedbackEvents, summarizeFeedbackTrend, _internals */
-/* harmony import */ var _suppressions_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9277);
-/* harmony import */ var _triage_memory_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1905);
-/* harmony import */ var _sca_policy_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(123);
-/* harmony import */ var _fix_history_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(4407);
-/* harmony import */ var _fix_metrics_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(2238);
+/* harmony import */ var _suppressions_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(89277);
+/* harmony import */ var _triage_memory_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(21905);
+/* harmony import */ var _sca_policy_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(30123);
+/* harmony import */ var _fix_history_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(84407);
+/* harmony import */ var _fix_metrics_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(32238);
 // FR-907 (assurance-hardening PRD): "Add longitudinal production feedback
 // measurement | Metrics separate user suppression, accepted risk, invalid
 // finding, fixed finding, and verification outcome."

package/dist/2238.index.js

@@ -2,7 +2,7 @@ export const id = 2238;
 export const ids = [2238];
 export const modules = {
 
-/***/ 2238:
+/***/ 32238:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -12,9 +12,9 @@ export const modules = {
 /* harmony export */   sU: () => (/* binding */ loadFixAttempts)
 /* harmony export */ });
 /* unused harmony exports FIX_STAGES, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31174);
 // Time-to-validated-fix (R5, the reporting half).
 //
 // `verifyFix` already RUNS the stages and `test-runner.js` already times the

package/dist/2271.index.js

@@ -2,7 +2,7 @@ export const id = 2271;
 export const ids = [2271];
 export const modules = {
 
-/***/ 2271:
+/***/ 22271:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -12,8 +12,8 @@ export const modules = {
 /* harmony export */   signProvenanceEvidenceBundle: () => (/* binding */ signProvenanceEvidenceBundle),
 /* harmony export */   verifyProvenanceEvidenceBundle: () => (/* binding */ verifyProvenanceEvidenceBundle)
 /* harmony export */ });
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
-/* harmony import */ var _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8317);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+/* harmony import */ var _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(98317);
 // Signed provenance evidence bundles (Finding Provenance PRD, M4 §4.1).
 //
 // Sibling to posture/evidence-bundle.js, not a generalization of it — that