@clear-capabilities/agentic-security-scanner 0.150.1 → 0.150.2

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-188a70d75f1a823e67422f8af02d42d14bc8dd476bf66136e02d6e59abc51f4d  agentic-security.mjs
+54183e4ed75d70aeec00ba53f44450879c52d23fc1bd3ccc834719531f18a017  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.150.1",
+  "version": "0.150.2",
   "description": "Scanner engine for the agentic-security Claude Code plugin — SAST, SCA (function-level reachability + CISA KEV), secrets, IaC, prompt-injection, MCP/agent-tool audit, auth/authZ deep analysis, attack chains, PoC generation, business logic, toxic-combinations scoring, SBOM, pipeline integrity, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -66,9 +66,10 @@
     "test": "node ../scripts/run-unit-tests.mjs && AGENTIC_SECURITY_CPP_DATAFLOW=1 node --test test/cpp-dataflow.test.js && node --experimental-test-module-mocks --test test/fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection.test.js && node --experimental-test-module-mocks --test test/detector-fault-injection-k8s-admission.test.js && node --experimental-test-module-mocks --test test/lineage-fault-injection.test.js && npm run test:python",
     "test:python": "node ../scripts/run-python-tests.mjs",
     "test:smoke": "node --test test/smoke.test.js test/demo-app.test.js",
+    "test:ollama-e2e": "AGENTIC_SECURITY_OLLAMA_E2E=1 node --test test/ollama-e2e.test.js",
     "test:glob": "node --test test/glob-compat.test.js",
     "test:sast": "node --test test/cpp-hardcoded-secret.test.js test/sibling-guard.test.js test/comment-blindness.test.js test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/zip-slip-containment-guard.test.js test/redos-anchoring.test.js test/path-guard-validator-call.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/guard-recognition.test.js test/guard-window-identifier-correlation.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js test/juliet-path-filter-gate.test.js test/java-bench-shape-opt-in.test.js test/reachability-missing-callgraph-data.test.js test/rate-limit.test.js test/auth-signals.test.js test/convention-deviation.test.js test/resource-exhaustion.test.js test/resource-exhaustion-realworld.test.js test/redirect-toctou.test.js test/redirect-toctou-realworld.test.js test/codegen-sink.test.js test/ownership-authz.test.js test/ownership-authz-realworld.test.js test/t21-precision-audit.test.js test/secrets-coverage.test.js test/prompt-injection-payloads.test.js test/iac-cloud-templates.test.js test/ruby-path-join.test.js test/sast/manifest-line-tracking.test.js",
-    "test:posture": "node --test test/threat-model.test.js test/git-hardening.test.js test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/release-workflow.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/obligation-evidence-pack.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/ollama-provider.test.js test/ollama-capabilities.test.js test/ollama-offline-egress.test.js test/ollama-fix-proposal.test.js test/ollama-explain-proposal.test.js test/ollama-poc-proposal.test.js test/ollama-model-probe.test.js test/ollama-agent-tools.test.js test/ollama-agent-loop.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/module-artifact-liveness.test.js test/supply-chain-provenance-completeness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/framework-provenance-controlrefs.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js test/posture/provenance-schema.test.js test/posture/provenance-cache.test.js test/helpers/build-git-fixture.test.js test/posture/provenance-git-evidence.test.js test/posture/provenance-dag-walk.test.js test/posture/provenance-confidence.test.js test/posture/provenance-predicate-replay.test.js test/posture/provenance-origin-resolver.test.js test/posture/provenance-ai-authorship.test.js test/posture/provenance-branch-entry.test.js test/posture/provenance-evidence-attribution.test.js test/posture/provenance-lifecycle.test.js test/posture/provenance-missing-control-resolver.test.js test/posture/provenance-missing-control-wiring.test.js test/posture/provenance-coordinator.test.js test/posture/provenance-sca-origin.test.js test/posture/provenance-transitive-sca.test.js test/posture/provenance-coordinator-sca.test.js test/posture/provenance-providers.test.js test/posture/provenance-evidence-bundle.test.js test/posture/provenance-repo-lineage.test.js test/posture/provenance-secrets-logic.test.js test/cli/provenance-flags.test.js test/cli/attest-provenance.test.js test/cli/attest-obligations.test.js test/cli/models.test.js test/cli/setup-llm.test.js test/cli/compliance-walkthrough-lineage.test.js test/cli/dataflow-export-privacy.test.js test/cli/dataflow-export-briefing.test.js test/cli/lineage-snapshot-persist.test.js test/cli/dataflow-diff.test.js test/cli/dataflow-watch.test.js test/cli/dataflow-recipients.test.js test/cli/dataflow-coverage.test.js test/security/provenance-safety.test.js test/security/provenance-injection.test.js test/posture/remediation-ledger.test.js",
+    "test:posture": "node --test test/threat-model.test.js test/git-hardening.test.js test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/release-workflow.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/obligation-evidence-pack.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/ollama-provider.test.js test/ollama-capabilities.test.js test/ollama-offline-egress.test.js test/ollama-fix-proposal.test.js test/ollama-explain-proposal.test.js test/ollama-poc-proposal.test.js test/ollama-model-probe.test.js test/ollama-agent-tools.test.js test/ollama-agent-loop.test.js test/ollama-e2e.test.js test/ollama-oom-feedback.test.js test/ollama-doc-drift.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/module-artifact-liveness.test.js test/supply-chain-provenance-completeness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/framework-provenance-controlrefs.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js test/posture/provenance-schema.test.js test/posture/provenance-cache.test.js test/helpers/build-git-fixture.test.js test/posture/provenance-git-evidence.test.js test/posture/provenance-dag-walk.test.js test/posture/provenance-confidence.test.js test/posture/provenance-predicate-replay.test.js test/posture/provenance-origin-resolver.test.js test/posture/provenance-ai-authorship.test.js test/posture/provenance-branch-entry.test.js test/posture/provenance-evidence-attribution.test.js test/posture/provenance-lifecycle.test.js test/posture/provenance-missing-control-resolver.test.js test/posture/provenance-missing-control-wiring.test.js test/posture/provenance-coordinator.test.js test/posture/provenance-sca-origin.test.js test/posture/provenance-transitive-sca.test.js test/posture/provenance-coordinator-sca.test.js test/posture/provenance-providers.test.js test/posture/provenance-evidence-bundle.test.js test/posture/provenance-repo-lineage.test.js test/posture/provenance-secrets-logic.test.js test/cli/provenance-flags.test.js test/cli/attest-provenance.test.js test/cli/attest-obligations.test.js test/cli/models.test.js test/cli/setup-llm.test.js test/cli/fix-retry.test.js test/cli/compliance-walkthrough-lineage.test.js test/cli/dataflow-export-privacy.test.js test/cli/dataflow-export-briefing.test.js test/cli/lineage-snapshot-persist.test.js test/cli/dataflow-diff.test.js test/cli/dataflow-watch.test.js test/cli/dataflow-recipients.test.js test/cli/dataflow-coverage.test.js test/security/provenance-safety.test.js test/security/provenance-injection.test.js test/posture/remediation-ledger.test.js",
     "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/chrome-probe.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/catalog-ai-model-provider-precision.test.js test/catalog-orm-write.test.js test/dataflow/provenance-pipeline-integration.test.js test/dataflow-progress.test.js test/scan-progress.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-protocol-smoke.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js test/mcp-dataflow-tools.test.js test/cli/governance-propose-edit.test.js test/cli/remediation-open-update.test.js test/cli/remediation-verify-reopen.test.js test/cli/dataflow-observations.test.js test/cli/federate-declare-list.test.js",
     "test:report": "node --test test/report-scan-invariants.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/scan-health.test.js test/finding-schema.test.js test/pipeline/finding-schema-provenance.test.js test/evidence-provenance.test.js test/report/provenance-output.test.js test/report/provenance-format-parity.test.js test/legacy-compat.test.js test/annotator-runner.test.js test/detector-runner.test.js test/detector-errors.test.js test/analyzer-supervisor.test.js test/cascade-worker-pool.test.js test/cascade-pool-wiring.test.js test/coverage-ledger.test.js test/coverage-ledger-completeness.test.js test/assurance-mode.test.js test/artifact-registry.test.js test/artifact-registry-completeness.test.js test/retention-policy.test.js test/state-lifecycle-report.test.js test/legal-hold.test.js test/production-feedback.test.js test/calibration-feedback.test.js test/encryption-provider.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js test/oscal-conformance.test.js test/cli-fix-apply.test.js test/apply-fix-service.test.js test/high-impact-approval-gate.test.js test/approver-registry.test.js test/suppression-exceptions.test.js test/fix-history.test.js test/producer-registry.test.js test/producer-collector.test.js test/enrichment-completion.test.js",

package/src/egress/redact.js

@@ -156,7 +156,7 @@ export function redactPayload({ text, filePath = null, scanRoot = null, taxonomy
 
   let out = text;
 
-  const secretResult = redactSecrets(out);
+  const secretResult = redactSecrets(out, { filePath });
   out = secretResult.text;
   categories.secrets = secretResult.redactions;
 

package/src/engine.js

@@ -191,7 +191,7 @@ import { annotateExploitability, detectProjectContext } from './posture/exploita
 import { applyFeedback as applyLearnedFeedback } from './posture/learning.js';
 import { validateMany as llmValidateMany, applyValidatorVerdicts } from './llm-validator/index.js';
 import { MODEL_STATUS, stageSummaryFromModelStatus } from './llm-validator/model-status.js';
-import { resolveProvider as resolveLlmProvider } from './llm-validator/providers.js';
+import { resolveProvider as resolveLlmProvider, otherRemoteRoles as llmOtherRemoteRoles, NO_CLOUD_FALLBACK } from './llm-validator/providers.js';
 import { scanCrossLangOpenAPI } from './posture/cross-lang-openapi.js';
 import { scanCrossLangGrpc } from './posture/cross-lang-grpc.js';
 import { scanCrossLangGraphql } from './posture/cross-lang-graphql.js';
@@ -9993,12 +9993,23 @@ function _deterministicFileTimings(timings) {
       const status = finalFindings.llmValidatorStatus;
       if (status && status.counts[MODEL_STATUS.DISABLED] !== status.total) {
         const resolved = resolveLlmProvider({ role: 'validate' });
+        // Adversarial-review finding (Ollama offline PRD premortem, 2026-09):
+        // this block only ever checked the `validate` role, but printed an
+        // unqualified "LLM inference was loopback-only" claim a reader could
+        // reasonably take as describing the WHOLE scan — while `verify`/
+        // `explain`/`fix`/`poc`/`logic`/`hunt` each have their own
+        // independent per-role provider override (providers.js's `_forRole`)
+        // and could genuinely be pointed at a cloud vendor at the same time.
+        // `otherRolesRemote` makes that visible instead of silent.
+        const otherRolesRemote = llmOtherRemoteRoles('validate');
         _aiAssistance = {
+          scopeRole: 'validate',
           provider: resolved.ok ? resolved.config.provider : null,
           model: resolved.ok ? resolved.config.model : null,
           endpoint: resolved.ok ? resolved.config.endpoint : null,
           egress: resolved.ok ? resolved.config.egress : null,
-          cloudFallback: false,
+          cloudFallback: !NO_CLOUD_FALLBACK,
+          otherRolesRemote,
           stages: { validate: stageSummaryFromModelStatus(status) },
         };
       }

package/src/llm-validator/agent-loop.js

@@ -26,6 +26,7 @@ import { evaluateEgress } from '../egress/policy.js';
 import { TOOL_DEFINITIONS, TOOL_ERROR, runTool } from './agent-tools.js';
 import { getModelCapabilities } from './model-probe.js';
 import { statePath as defaultStatePath } from '../posture/state-dir.js';
+import { priorOOMFor } from './oom-feedback.js';
 
 export const AGENT_LOOP_ERROR = Object.freeze({
   NOT_CONFIGURED: 'agent-loop-not-configured',
@@ -37,6 +38,35 @@ export const AGENT_LOOP_ERROR = Object.freeze({
 export const DEFAULT_MAX_TOOL_ITERATIONS = 12;
 const DEFAULT_WALL_CLOCK_TIMEOUT_MS = 5 * 60 * 1000;
 
+// Adversarial-review finding (2026-09), confirmed against a real, slow
+// (CPU-only) Ollama server: the wall-clock deadline used to be checked ONLY
+// at the top of each iteration, never around the in-flight callOllamaChat
+// itself. `docs/guides/ollama.md` tells users to raise
+// AGENTIC_SECURITY_LLM_TIMEOUT_MS for a cold-loading model — that value
+// flows into the PER-CALL requestTimeoutMs, which used to be entirely
+// independent of this loop's own wall-clock budget. A single call already
+// running when the wall clock expires would complete anyway (its own
+// timeout could be minutes longer), and only the NEXT iteration's top-of-
+// loop check would notice — reporting `wall-clock-timeout` after exactly
+// one useful call, no matter how high the per-call timeout was raised,
+// which made the documented remedy for slow models actively useless.
+//
+// Fix: cap the PER-CALL requestTimeoutMs at whatever wall-clock budget
+// actually remains, every iteration. A slow call now gets cut off by ITS
+// OWN timeout mechanism (producing the same clean `{ok:false,
+// code:'ollama-timeout'}` every other caller already handles) at exactly
+// the moment the wall clock would have run out anyway — never later. This
+// also makes the two settings coherent for the first time: raising
+// AGENTIC_SECURITY_LLM_TIMEOUT_MS now genuinely helps, as long as the loop's
+// OWN budget (wallClockTimeoutMs / AGENTIC_SECURITY_LLM_AGENT_TIMEOUT_MS)
+// is raised enough to give it room.
+function _cappedTimeouts(baseTimeouts, remainingMs) {
+  if (!baseTimeouts) return { requestTimeoutMs: Math.max(1, remainingMs) };
+  const base = Number(baseTimeouts.requestTimeoutMs);
+  const capped = Number.isFinite(base) ? Math.min(base, remainingMs) : remainingMs;
+  return { ...baseTimeouts, requestTimeoutMs: Math.max(1, capped) };
+}
+
 function systemPrompt(scanRoot) {
   return [
     'You are a security-scan assistant with READ-ONLY access to the scanned',
@@ -54,14 +84,49 @@ function systemPrompt(scanRoot) {
  *   maxToolIterations?:number, wallClockTimeoutMs?:number}} opts
  * `statePath` defaults to posture/state-dir.js's real implementation;
  * overridable only for tests that need a fixture-scoped state dir.
+ * `wallClockTimeoutMs`, when not passed explicitly, falls back to
+ * `AGENTIC_SECURITY_LLM_AGENT_TIMEOUT_MS` — a SEPARATE setting from
+ * `AGENTIC_SECURITY_LLM_TIMEOUT_MS` (the per-call timeout) on purpose: the
+ * two used to be incoherent (raising the per-call setting alone did nothing
+ * for a loop that could still time out after one call), so a caller who
+ * genuinely needs a longer overall budget for a slow model must raise BOTH.
  * @returns {{ok:true, finalText, iterations, toolCalls, stopReason} |
  *   {ok:false, code, reason}}
  */
-export async function runAgentLoop({
+export async function runAgentLoop(opts = {}) {
+  const result = await _runAgentLoopCore(opts);
+  // Adversarial-review fix (2026-09, second pass): Round 1's original OOM-
+  // feedback fix only surfaced `priorOOMWarning` in `models doctor`'s
+  // advisory output — a user who never happens to run `doctor` would OOM
+  // again on the exact same model via `ask` with no warning at all, since
+  // `recommendAdmission` (where the warning lives) is never consulted on
+  // this real call path. Surface it here too, on any outcome where a real
+  // call was actually attempted (a pure config/capability refusal before
+  // any call has nothing useful to warn about).
+  const attemptedARealCall = result.ok || result.code === AGENT_LOOP_ERROR.FAILED;
+  if (attemptedARealCall) {
+    const resolved = resolveProvider({ role: 'hunt', env: opts.env || process.env });
+    const prior = resolved.ok ? priorOOMFor(resolved.config.model) : null;
+    if (prior) {
+      return {
+        ...result,
+        priorOOMWarning: `'${resolved.config.model}' has previously failed with an out-of-memory error on this machine ` +
+          `(${prior.count} time${prior.count === 1 ? '' : 's'}, most recently ${new Date(prior.lastAt).toISOString()}).`,
+      };
+    }
+  }
+  return result;
+}
+
+async function _runAgentLoopCore({
   goal, scanRoot, env = process.env, statePath = defaultStatePath,
-  maxToolIterations = DEFAULT_MAX_TOOL_ITERATIONS, wallClockTimeoutMs = DEFAULT_WALL_CLOCK_TIMEOUT_MS,
+  maxToolIterations = DEFAULT_MAX_TOOL_ITERATIONS, wallClockTimeoutMs,
 } = {}) {
   const boundedIterations = Math.max(1, Math.min(maxToolIterations, DEFAULT_MAX_TOOL_ITERATIONS));
+  if (wallClockTimeoutMs === undefined) {
+    const fromEnv = Number(env.AGENTIC_SECURITY_LLM_AGENT_TIMEOUT_MS);
+    wallClockTimeoutMs = Number.isFinite(fromEnv) && fromEnv > 0 ? fromEnv : DEFAULT_WALL_CLOCK_TIMEOUT_MS;
+  }
 
   const resolved = resolveProvider({ role: 'hunt', env });
   if (!resolved.ok || resolved.config.provider !== 'ollama') {
@@ -97,15 +162,30 @@ export async function runAgentLoop({
   const deadline = Date.now() + boundedTimeoutMs;
 
   for (let iteration = 0; iteration < boundedIterations; iteration++) {
-    if (Date.now() >= deadline) {
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) {
       return { ok: true, finalText: null, iterations: iteration, toolCalls: toolCallLog, stopReason: 'wall-clock-timeout' };
     }
 
+    // Cap this call's own timeout at whatever wall-clock budget remains, so
+    // a slow call can never silently outlive the loop's overall bound (see
+    // the header comment above _cappedTimeouts for the incident this fixes).
+    const callTimeouts = _cappedTimeouts(timeouts, remainingMs);
+    const deadlineWasBinding = timeouts && Number(timeouts.requestTimeoutMs) > remainingMs;
     const r = await callOllamaChat({
       host: resolved.config.endpoint, model: resolved.config.model, messages,
-      tools: TOOL_DEFINITIONS, keepAlive: oc?.keepAlive, timeouts,
+      tools: TOOL_DEFINITIONS, keepAlive: oc?.keepAlive, timeouts: callTimeouts,
     });
-    if (!r.ok) return { ok: false, code: AGENT_LOOP_ERROR.FAILED, reason: r.reason || r.code };
+    if (!r.ok) {
+      // A timeout caused by the WALL CLOCK (not the operator's own per-call
+      // setting) is this loop doing exactly what it's supposed to, not an
+      // unexpected error — report it the same way the pre-flight check
+      // above does, rather than as a hard failure.
+      if (r.code === 'ollama-timeout' && deadlineWasBinding) {
+        return { ok: true, finalText: null, iterations: iteration, toolCalls: toolCallLog, stopReason: 'wall-clock-timeout' };
+      }
+      return { ok: false, code: AGENT_LOOP_ERROR.FAILED, reason: r.reason || r.code };
+    }
 
     const toolCalls = r.result.toolCalls || [];
     if (toolCalls.length === 0) {

package/src/llm-validator/fix-proposal.js

@@ -52,7 +52,7 @@ export const FIX_PROPOSAL_ERROR = Object.freeze({
  * through the same redaction pipeline llm-validator/index.js's renderPrompt
  * uses, and is framed as data the model must never treat as instructions.
  */
-export function buildFixPrompt(finding, fileContent, scanRoot) {
+export function buildFixPrompt(finding, fileContent, scanRoot, rejectionFeedback) {
   const sterileContent = redactPayload({ text: String(fileContent || ''), filePath: finding.file, scanRoot }).text;
   return [
     'You are a security patch-synthesis component. You PROPOSE a fix; a separate',
@@ -71,6 +71,19 @@ export function buildFixPrompt(finding, fileContent, scanRoot) {
     sterileContent,
     '--- END-UNTRUSTED-FILE-CONTENT ---',
     '',
+    // Adversarial-review fix (2026-09): at temperature 0 with the SAME
+    // prompt, a rejected patch would very likely just reproduce itself on
+    // retry — this is the one place cmdFix's bounded one-time retry
+    // (bin/agentic-security.js) feeds the deterministic gate's OWN rejection
+    // reason back in, so the second attempt has an actual reason to differ
+    // rather than repeating the first attempt's exact mistake.
+    ...(rejectionFeedback ? [
+      'Your previous proposal for this exact finding was REJECTED by the',
+      'deterministic verification gate below. Propose a DIFFERENT fix that',
+      'avoids this specific problem — do not repeat the same patch:',
+      `  ${String(rejectionFeedback).slice(0, 500)}`,
+      '',
+    ] : []),
     'Propose a minimal, targeted fix for the finding above. Reply with ONLY a',
     'single JSON object, no other text:',
     '{"target_file": "<must exactly equal the File given above>", ' +
@@ -94,7 +107,7 @@ function validateFixResponse(obj, { file }) {
  * @returns {{ok:true, replacement, rationale, expectedSecurityEffect,
  *   testsToRun, model} | {ok:false, code, reason}}
  */
-export async function proposeOllamaFix({ finding, fileContent, scanRoot, env = process.env }) {
+export async function proposeOllamaFix({ finding, fileContent, scanRoot, env = process.env, rejectionFeedback } = {}) {
   const resolved = resolveProvider({ role: 'fix', env });
   if (!resolved.ok || resolved.config.provider !== 'ollama') {
     return {
@@ -112,7 +125,7 @@ export async function proposeOllamaFix({ finding, fileContent, scanRoot, env = p
     return { ok: false, code: FIX_PROPOSAL_ERROR.POLICY_BLOCKED, reason: decision.reason, egressDecision: decision };
   }
 
-  const prompt = buildFixPrompt(finding, fileContent, scanRoot);
+  const prompt = buildFixPrompt(finding, fileContent, scanRoot, rejectionFeedback);
   const oc = resolved.config.ollama;
   const r = await callOllamaStructured({
     host: resolved.config.endpoint,

package/src/llm-validator/model-capabilities.js

@@ -18,6 +18,7 @@
 // memory to the byte.
 
 import * as os from 'node:os';
+import { priorOOMFor } from './oom-feedback.js';
 
 // PRD §12/§13 FR-1203 — non-authoritative family hint from a model name.
 // Longest/most-specific pattern first so `qwen3.5:4b` doesn't fall through to
@@ -200,7 +201,31 @@ export function evaluateMemoryAdmission({
  * `{admitted:false}` with a human-readable explanation, which callers treat
  * as "run deterministic-only" (PRD §23.4).
  */
-export function recommendAdmission({ profile, freeBytes, requestedContextTokens, requestedModel } = {}) {
+export function recommendAdmission(opts = {}) {
+  const result = _recommendAdmissionCore(opts);
+  // Adversarial-review fix (2026-09): a memory-admission ESTIMATE that
+  // actually caused a real OOM (ollama-provider.js's callOllamaChat now
+  // records this via oom-feedback.js) used to have no way to affect a
+  // future admission decision for the SAME model on the SAME machine — the
+  // exact same "admitted: true" would repeat forever. This does not
+  // recalibrate the underlying estimate (that needs real hardware variety
+  // one machine's observed failures can't substitute for); it attaches an
+  // honest warning so the decision is no longer presented with unqualified
+  // confidence.
+  const chosenModel = result.model || opts.requestedModel;
+  const prior = chosenModel ? priorOOMFor(chosenModel) : null;
+  if (prior) {
+    return {
+      ...result,
+      priorOOMWarning: `'${chosenModel}' has previously failed with an out-of-memory error on this machine ` +
+        `(${prior.count} time${prior.count === 1 ? '' : 's'}, most recently ${new Date(prior.lastAt).toISOString()}). ` +
+        'The memory estimate below may be optimistic for your hardware.',
+    };
+  }
+  return result;
+}
+
+function _recommendAdmissionCore({ profile, freeBytes, requestedContextTokens, requestedModel } = {}) {
   const p = MEMORY_PROFILES[profile];
   if (!p) return { admitted: false, reason: `unknown memory profile '${profile}'` };
 

package/src/llm-validator/model-probe.js

@@ -18,10 +18,21 @@
 // CACHE KEY = Ollama version + model digest + model name (PRD §13.2 exactly).
 // Digest is load-bearing: `ollama pull` replacing a tag's underlying weights
 // must invalidate the cache even though the name/tag string is unchanged.
-// Persisted forever (no TTL) because the key itself is what expires the
-// entry — a version/digest bump makes a new key, not a stale hit on the old
-// one. Same disk-cache directory convention as sca/sigstore-verify.js and
+// Same disk-cache directory convention as sca/sigstore-verify.js and
 // engine.js's OSV cache (`~/.claude/agentic-security/<name>/`).
+//
+// TTL + force-reprobe (adversarial-review fix, 2026-09). The key-based
+// invalidation above is real but not complete: this module's own comment
+// used to claim the entry is safe "forever" because the key changes when
+// the model does — but `/api/show` doesn't expose a digest on every Ollama
+// version (falls back to model NAME alone then, a few lines below), so a
+// same-tag re-pull, or simply an unlucky single-trial probe the first time
+// (see probeStructuredOutput/probeToolCalling's own single-call design),
+// had no way to ever self-correct short of a user manually deleting a file
+// under `~/.claude/agentic-security/`. Two independent fixes, since either
+// alone leaves a real gap: a default TTL as a safety net for the case
+// nobody notices, and an explicit `force` option (`models test --force`)
+// for the case someone DOES suspect a stale answer and wants it right now.
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -32,18 +43,38 @@ import { capabilitiesFromFamilyHint } from './model-capabilities.js';
 
 const CACHE_DIR = path.join(os.homedir(), '.claude', 'agentic-security', 'ollama-capability-cache');
 
+// Default safety-net TTL: 30 days. Not the primary invalidation mechanism
+// (the key is) — a backstop for the cases the key can't see: a same-tag
+// re-pull on an Ollama version that doesn't expose a digest, or a single
+// unlucky probe trial that happened to pass/fail against the model's true
+// behavior. Overridable for anyone who wants a tighter or looser bound.
+export const DEFAULT_CACHE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
+
 function _ensureCacheDir() { try { fs.mkdirSync(CACHE_DIR, { recursive: true }); } catch {} }
 function _cacheKey(ollamaVersion, modelDigest, modelName) {
   return crypto.createHash('sha256').update(`${ollamaVersion}::${modelDigest}::${modelName}`).digest('hex');
 }
 function _cachePath(key) { return path.join(CACHE_DIR, key + '.json'); }
 
-function _readProbeCache(key) {
-  try { return JSON.parse(fs.readFileSync(_cachePath(key), 'utf8')); } catch { return null; }
+/**
+ * @returns {object|null} the cached probe RESULT (not the envelope), or
+ *   `null` on a miss, a parse failure, OR an entry older than `ttlMs`.
+ */
+function _readProbeCache(key, ttlMs) {
+  let envelope;
+  try { envelope = JSON.parse(fs.readFileSync(_cachePath(key), 'utf8')); } catch { return null; }
+  // Backward-compatible with a pre-TTL cache file that was just the bare
+  // result object (no `probedAt`) — treat an entry with no timestamp as
+  // fresh rather than discarding every cache written before this fix.
+  if (envelope && typeof envelope === 'object' && 'probedAt' in envelope && 'result' in envelope) {
+    if (Number.isFinite(ttlMs) && ttlMs > 0 && Date.now() - envelope.probedAt > ttlMs) return null;
+    return envelope.result;
+  }
+  return envelope;
 }
 function _writeProbeCache(key, value) {
   _ensureCacheDir();
-  try { fs.writeFileSync(_cachePath(key), JSON.stringify(value)); } catch {}
+  try { fs.writeFileSync(_cachePath(key), JSON.stringify({ probedAt: Date.now(), result: value })); } catch {}
 }
 
 /**
@@ -146,9 +177,16 @@ function _mergeLayer(base, overlay, sourceFlag) {
  * should use, since Layer C spends real inference time on the user's
  * machine.
  *
+ * `force: true` (adversarial-review fix, 2026-09 — `models test --force`)
+ * skips reading the cache — always runs a fresh probe and overwrites
+ * whatever was there. `ttlMs` (default 30 days, `DEFAULT_CACHE_TTL_MS`)
+ * bounds how long a cached entry is trusted without either; pass `0`/
+ * `Infinity` to disable the TTL safety net entirely and rely on the key
+ * alone, matching this module's original design intent.
+ *
  * @returns {{ok:true, capabilities:object, cached:boolean} | {ok:false, code, reason}}
  */
-export async function getModelCapabilities({ host, model, env = process.env, probe = false, timeouts, keepAlive } = {}) {
+export async function getModelCapabilities({ host, model, env = process.env, probe = false, force = false, ttlMs = DEFAULT_CACHE_TTL_MS, timeouts, keepAlive } = {}) {
   let capabilities = capabilitiesFromFamilyHint(model);
 
   const show = await showOllamaModel({ host, model, timeouts });
@@ -169,7 +207,7 @@ export async function getModelCapabilities({ host, model, env = process.env, pro
   const modelDigest = show.ok && show.details?.digest ? show.details.digest : 'unknown-digest';
   const cacheKey = _cacheKey(ollamaVersion, modelDigest, model);
 
-  const cached = _readProbeCache(cacheKey);
+  const cached = force ? null : _readProbeCache(cacheKey, ttlMs);
   if (cached) {
     return { ok: true, capabilities: _mergeLayer(capabilities, cached, 'runtimeProbe'), cached: true };
   }

package/src/llm-validator/ollama-provider.js

@@ -32,6 +32,7 @@
 // never to this module's error path. See ollama-offline-egress.test.js.
 
 import { isLoopbackUrl } from './local-endpoint.js';
+import { recordOOMEvent } from './oom-feedback.js';
 
 export const DEFAULT_OLLAMA_HOST = 'http://127.0.0.1:11434';
 export const DEFAULT_OLLAMA_MODEL = 'qwen3.5:4b';
@@ -44,6 +45,7 @@ const DEFAULT_MAX_CONCURRENCY = 1;
 // exactly one of these, never an ad-hoc string, so a caller (and a report) can
 // react on `code` instead of parsing prose.
 export const OLLAMA_ERROR_CODES = Object.freeze([
+  'ollama-disabled',
   'ollama-not-running',
   'ollama-unreachable',
   'ollama-non-loopback-refused',
@@ -69,6 +71,18 @@ function _err(code, reason) {
  * @returns {{ok:true, config:object} | {ok:false, code:string, reason:string}}
  */
 export function ollamaEndpointConfig(env = process.env) {
+  // Adversarial-review fix (2026-09): no kill switch existed for this whole
+  // provider, unlike AGENTIC_SECURITY_MCP_DISABLED for the MCP server —
+  // worse, a per-role AGENTIC_SECURITY_LLM_PRESET_<ROLE>=ollama override
+  // (providers.js's _forRole) can keep a role calling Ollama even after an
+  // operator unsets the GLOBAL preset during an incident, so "just unset
+  // the preset" is not reliably enough. This check is here, in the one
+  // function every Ollama call path resolves through (resolveProvider's
+  // ollama branch, and models/setup's direct callers), so it can never be
+  // bypassed by a role-specific override the operator forgot about.
+  if (env.AGENTIC_SECURITY_OLLAMA_DISABLED === '1') {
+    return _err('ollama-disabled', 'Ollama is disabled (AGENTIC_SECURITY_OLLAMA_DISABLED=1). Unset it to re-enable.');
+  }
   const rawHost = env.AGENTIC_SECURITY_OLLAMA_HOST || DEFAULT_OLLAMA_HOST;
   const host = String(rawHost).replace(/\/+$/, '');
   const allowRemote = env.AGENTIC_SECURITY_OLLAMA_ALLOW_REMOTE === '1';
@@ -220,7 +234,18 @@ export async function callOllamaChat({ host, model, messages, maxTokens, schema,
     if (res.status === 404 || /not found/i.test(detail)) {
       return _err('ollama-model-not-installed', `Model '${model}' is not installed. ${detail || ''}`.trim());
     }
-    if (/memory|oom/i.test(detail)) return _err('ollama-model-out-of-memory', detail || `HTTP ${res.status}`);
+    if (/memory|oom/i.test(detail)) {
+      // Adversarial-review fix (2026-09): this was a real, defined error
+      // code with no reactive call site anywhere — a wrong memory-admission
+      // estimate that caused a genuine OOM would repeat the identical wrong
+      // decision forever. Record it so recommendAdmission (model-
+      // capabilities.js) can warn on the NEXT admission check for this
+      // model on this machine, even though the underlying size/KV-cache
+      // ESTIMATES themselves stay uncalibrated (that needs real hardware
+      // variety a single machine's observed failures can't substitute for).
+      recordOOMEvent(model);
+      return _err('ollama-model-out-of-memory', detail || `HTTP ${res.status}`);
+    }
     if (/context/i.test(detail)) return _err('ollama-context-overflow', detail || `HTTP ${res.status}`);
     return _err('ollama-model-load-failed', detail || `HTTP ${res.status}`);
   }

package/src/llm-validator/oom-feedback.js

@@ -0,0 +1,69 @@
+// Adversarial-review fix (2026-09): `ollama-model-out-of-memory` was a real,
+// defined error code (ollama-provider.js's OLLAMA_ERROR_CODES) with ZERO
+// call sites reacting to it anywhere in this codebase — a wrong memory-
+// admission estimate that caused a genuine OOM would silently repeat the
+// identical wrong "admitted: true" decision forever, since nothing recorded
+// the failure for next time.
+//
+// NOT a replacement for real calibration. model-capabilities.js's
+// KNOWN_MODEL_SIZE_GB / ESTIMATED_KV_CACHE_MB_PER_1K_TOKENS /
+// RUNTIME_OVERHEAD_MB remain asserted, unmeasured "best-effort" constants —
+// properly calibrating them needs real hardware variety this session cannot
+// manufacture. This module is the cheapest thing that CAN improve after a
+// wrong estimate without that: a per-machine, per-model OBSERVED-FAILURE
+// ledger. A model that has already OOM'd on THIS machine gets an explicit
+// warning attached to the next admission decision, rather than the same
+// unqualified confidence a first-time estimate gets.
+//
+// Same disk-cache directory convention as model-probe.js's capability
+// cache and sca/sigstore-verify.js's Rekor cache
+// (`~/.claude/agentic-security/<name>/`).
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+
+const LOG_PATH = path.join(os.homedir(), '.claude', 'agentic-security', 'ollama-oom-log.json');
+
+function _readLog() {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(LOG_PATH, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch { return {}; }
+}
+
+function _writeLog(log) {
+  try {
+    fs.mkdirSync(path.dirname(LOG_PATH), { recursive: true });
+    fs.writeFileSync(LOG_PATH, JSON.stringify(log));
+  } catch { /* best-effort; a failure here must never break the caller's real request */ }
+}
+
+/**
+ * Record a real, observed OOM failure for `model` on this machine. Called
+ * from ollama-provider.js's callOllamaChat — the single choke point every
+ * Ollama HTTP call in this codebase goes through, so every role's OOM
+ * failures land in the same ledger regardless of which one hit it.
+ */
+export function recordOOMEvent(model) {
+  if (typeof model !== 'string' || !model) return;
+  const log = _readLog();
+  const entry = log[model] || { count: 0, firstAt: Date.now() };
+  entry.count += 1;
+  entry.lastAt = Date.now();
+  log[model] = entry;
+  _writeLog(log);
+}
+
+/**
+ * @returns {{count:number, firstAt:number, lastAt:number} | null} prior OOM
+ *   history for `model` on this machine, or null if it has never failed
+ *   this way here before.
+ */
+export function priorOOMFor(model) {
+  if (typeof model !== 'string' || !model) return null;
+  const log = _readLog();
+  return log[model] || null;
+}
+
+export const _internals = { LOG_PATH };

package/src/llm-validator/providers.js

@@ -237,6 +237,18 @@ export function buildProviderRequest(config, prompt, maxTokens) {
   };
 }
 
+// Architectural invariant, not a per-scan observation: nothing in this
+// module (or any caller of resolveProvider) ever reacts to a failed/refused
+// resolution by silently trying a DIFFERENT provider — a refusal is refused,
+// full stop (see the local/ollama loopback-refusal branches above, both of
+// which return `{ok:false}` rather than falling through to a vendor preset).
+// Declared once, HERE, so every place in the codebase that asserts "no cloud
+// fallback" (currently only engine.js's AI-Assistance report) reads the same
+// single source of truth instead of each hardcoding its own `false` literal
+// — if this invariant ever needs to become conditional, there is exactly one
+// place to change it and everything downstream updates with it.
+export const NO_CLOUD_FALLBACK = true;
+
 /** Which provider each role would use, for reporting. Never includes keys. */
 export function providerMatrix(env = process.env) {
   const out = {};
@@ -249,4 +261,42 @@ export function providerMatrix(env = process.env) {
   return out;
 }
 
+// `hunt` is deliberately NOT one of `ROLES` above (discovery/hunter.js's own
+// comment: it has no per-role override of its own, always falling back to
+// whatever the GLOBAL preset resolves to) — which means `providerMatrix()`,
+// built by iterating `ROLES`, structurally never sees it. Adversarial-review
+// fix (2026-09, second pass): that made `otherRemoteRoles` blind to hunt by
+// construction, not by an oversight in its filter — and hunt is exactly the
+// role most likely to diverge from `validate` in the scenario this function
+// exists to catch (a global cloud preset with `validate` given its own
+// `ollama` override: hunt then silently follows the global cloud preset).
+// Checked explicitly, alongside the `ROLES`-iterated matrix, rather than
+// added to `ROLES` itself — doing that would wrongly imply hunt supports a
+// `_HUNT`-suffixed per-role override, which it does not and this fix does
+// not add.
+const ROLES_WITH_NO_PER_ROLE_OVERRIDE = Object.freeze(['hunt']);
+
+/**
+ * Which roles OTHER than `excludeRole` resolve to a remote (non-loopback)
+ * provider right now. Exists so a report scoped to one role (the AI
+ * Assistance block's `validate`-only measurement) can disclose when a
+ * DIFFERENT role is genuinely configured for a cloud vendor at the same
+ * time, instead of leaving that role invisible to a reader who reasonably
+ * generalizes a single-role loopback claim onto the whole scan.
+ *
+ * @returns {{role:string, provider:string}[]}
+ */
+export function otherRemoteRoles(excludeRole, env = process.env) {
+  const matrix = providerMatrix(env);
+  const out = Object.entries(matrix)
+    .filter(([role, r]) => role !== excludeRole && r.provider && r.egress === 'remote')
+    .map(([role, r]) => ({ role, provider: r.provider }));
+  for (const role of ROLES_WITH_NO_PER_ROLE_OVERRIDE) {
+    if (role === excludeRole) continue;
+    const r = resolveProvider({ role, env });
+    if (r.ok && r.config.egress === 'remote') out.push({ role, provider: r.config.provider });
+  }
+  return out;
+}
+
 export const _internals = { SHAPES, DEFAULT_MODEL, _forRole };