@clear-capabilities/agentic-security-scanner 0.153.1 → 0.154.0

package/src/posture/accuracy-scorecard.js

@@ -205,6 +205,23 @@ export function buildScorecard(inputs) {
       corpusBaseline: committed.corpusBaseline
         ? { source: 'bench/cve-replay/corpus-baseline.json', generatedAt: committed.corpusBaseline.generatedAt, total: committed.corpusBaseline.total, passing: committed.corpusBaseline.passing }
         : null,
+      // Haskell and Nix support (HASKELL_NIXOS_FULL_CAPABILITY_PRD.md DOC-002): the committed support registry, passed through with
+      // its denominators, layers, corpus revision, date and tool availability. Read, never re-measured here.
+      languageSupport: committed.languageSupport
+        ? {
+          source: 'docs/language-support.json',
+          generatedAt: committed.languageSupport.generatedAt || null,
+          node: committed.languageSupport.node || null,
+          tools: committed.languageSupport.tools || null,
+          targets: committed.languageSupport.targets || null,
+          limits: committed.languageSupport.limits || [],
+          languages: Object.fromEntries(Object.entries(committed.languageSupport.languages || {}).map(([k, v]) => [k, {
+            frozen: v.frozen || null, measuredOn: v.measuredOn || null,
+            rows: Object.values(v.rows || {}).map((r) => ({ capability: r.capability, status: r.status, reasons: r.reasons || [], evidence: r.evidence ? { metric: r.evidence.metric || null, layer: r.evidence.layer || null, tp: r.evidence.tp ?? null, fp: r.evidence.fp ?? null, fn: r.evidence.fn ?? null, tn: r.evidence.tn ?? null, precision: r.evidence.precision ?? null, recall: r.evidence.recall ?? null, f1: r.evidence.f1 ?? null, cases: r.evidence.cases ?? null, familyCount: r.evidence.families ? Object.keys(r.evidence.families).length : null } : null })),
+            unknownOutcomes: v.unknownOutcomes || null, metamorphic: v.metamorphic || null,
+          }])),
+        }
+        : null,
       independent: committed.independent
         ? {
           source: 'bench/independent/RESULT.json',
@@ -621,6 +638,40 @@ export function renderScorecardMarkdown(m) {
     }
   }
 
+  const ls = m.committedInputs.languageSupport;
+  if (ls) {
+    L.push('## Haskell and Nix/NixOS support');
+    L.push('');
+    L.push(`*Committed artifact:* \`${ls.source}\`, measured ${ls.generatedAt || 'unknown date'} on node ${ls.node || '?'}. It is read here, not re-measured by this command.`);
+    L.push('');
+    L.push('Every row is **supported** only from passing evidence of its own metric kind. Layers are scored independently (the taint layer');
+    L.push('is the injection families, the SAST layer is every other family) and a finding of a different family inside a case is counted');
+    L.push('separately (family-scoped scoring); the strict precision that counts it is stored in the registry. Denominators are cases, with');
+    L.push('TP/FP/FN/TN shown; a row without a denominator carries a different kind of evidence (parse counts, fix gates, manifests).');
+    L.push('');
+    for (const [lang, v] of Object.entries(ls.languages)) {
+      L.push(`### ${lang === 'haskell' ? 'Haskell' : 'Nix and NixOS'}`);
+      L.push('');
+      L.push('| Capability | Status | Layer | Cases | TP | FP | FN | TN | Precision | Recall | F1 | Families |');
+      L.push('| --- | --- | --- | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: | ---: |');
+      const pct = (x) => (typeof x === 'number' ? `${(x * 100).toFixed(1)}%` : ', ');
+      for (const r of v.rows) {
+        const e = r.evidence;
+        L.push(`| ${r.capability} | ${r.status} | ${e && e.layer ? e.layer : '—'} | ${e && e.cases != null ? e.cases : '—'} | ${e && e.tp != null ? e.tp : '—'} | ${e && e.fp != null ? e.fp : '—'} | ${e && e.fn != null ? e.fn : '—'} | ${e && e.tn != null ? e.tn : '—'} | ${e ? pct(e.precision) : '—'} | ${e ? pct(e.recall) : '—'} | ${e ? pct(e.f1) : '—'} | ${e && e.familyCount != null ? e.familyCount : '—'} |`);
+      }
+      L.push('');
+      const blocked = v.rows.filter((r) => r.status !== 'supported');
+      if (blocked.length) { L.push(`Not supported here: ${blocked.map((r) => `${r.capability} (${r.status}: ${(r.reasons[0] || '').slice(0, 140)})`).join('; ')}.`); L.push(''); }
+      if (v.unknownOutcomes) L.push(`Unknown and unmodelled cases: ${JSON.stringify(v.unknownOutcomes)}.`);
+      if (v.metamorphic) L.push(`Metamorphic pairs: ${JSON.stringify(v.metamorphic)}.`);
+      L.push('');
+    }
+    if (ls.tools) L.push(`Tools present where this was measured: ${Object.entries(ls.tools).map(([k, x]) => `${k}=${x === false ? 'absent' : x}`).join(', ')}.`);
+    L.push('');
+    for (const lim of ls.limits) L.push(`- ${lim}`);
+    L.push('');
+  }
+
   const ind = m.committedInputs.independent;
   if (ind && ind.overall) {
     L.push('## Independent evaluation population — the number that matters');

package/src/posture/aibom.js

@@ -20,6 +20,7 @@
 // scan.components. Extraction precision is verified by a smoke test against
 // a labelled fixture set.
 
+import { extractLanguageAI } from '../language/aibom.js';
 import * as crypto from 'node:crypto';
 import { statePath, safeWriteState } from './state-dir.js';
 
@@ -199,6 +200,16 @@ export function buildAIBOM(scan, fileContents = {}, meta = {}) {
     if (classes.includes('vector-store')) vectorStores.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
     if (classes.includes('embedding-provider')) embeddings.push({ ecosystem: c.ecosystem, name: c.name, version: c.version });
   }
+  // 4. Haskell and Nix (X-002): declared / installed / enabled / invoked are kept apart, evidence is a list,
+  //    and anything source does not spell out is `unresolved` rather than guessed.
+  let lang = { models: [], endpoints: [], services: [], frameworks: [], vectorStores: [], embeddings: [], promptTemplates: [], unresolved: [], links: [], gaps: [] };
+  try { lang = extractLanguageAI({ ...(meta.manifests || {}), ...(fileContents || {}) }); } catch { /* best effort: the JS/Python inventory above stands */ }
+  const knownModel = new Set(models.map((m) => `${m.provider}:${m.modelId}`));
+  for (const m of lang.models) { const k = `${m.provider}:${m.modelId}`; if (!knownModel.has(k)) { knownModel.add(k); models.push({ ...m, file: (m.evidence && m.evidence[0] && m.evidence[0].file) || null, line: (m.evidence && m.evidence[0] && m.evidence[0].line) || null }); } }
+  promptTemplates.push(...lang.promptTemplates);
+  const knownFw = new Set(frameworks.map((f) => `${f.ecosystem}:${f.name}`));
+  for (const f of lang.frameworks) { const k = `${f.ecosystem}:${f.name}`; if (!knownFw.has(k)) { knownFw.add(k); frameworks.push(f); } }
+  vectorStores.push(...lang.vectorStores); embeddings.push(...lang.embeddings);
   return {
     aibomFormat: 'agentic-security AI-BOM',
     version: '1',
@@ -221,6 +232,15 @@ export function buildAIBOM(scan, fileContents = {}, meta = {}) {
     frameworks,
     vectorStores,
     embeddings,
+    endpoints: lang.endpoints,
+    services: lang.services,
+    unresolved: lang.unresolved,
+    links: lang.links,
+    limits: [
+      'an AI component being declared, installed or enabled does not show that a model is called or that data is sent to it',
+      'models, endpoints and providers that source does not spell out are listed under `unresolved`, not guessed',
+      ...(lang.gaps || []).map((g) => g.detail || g.kind),
+    ],
     summary: {
       totalModels: models.length,
       totalProviders: new Set(models.map(m => m.provider)).size,
@@ -229,6 +249,10 @@ export function buildAIBOM(scan, fileContents = {}, meta = {}) {
       promptTemplates: promptTemplates.length,
       frameworks: frameworks.length,
       vectorStores: vectorStores.length,
+      endpoints: lang.endpoints.length,
+      services: lang.services.length,
+      embeddings: embeddings.length,
+      unresolved: lang.unresolved.length,
     },
   };
 }
@@ -297,6 +321,30 @@ export function aibomToMarkdown(aibom) {
     out.push('');
   }
 
+  const row = (cells) => `| ${cells.map((c) => String(c ?? '—').replace(/\|/g, '\\|').replace(/\n/g, ' ')).join(' | ')} |`;
+  if ((aibom.endpoints || []).length) {
+    out.push('## Endpoints'); out.push(''); out.push('| Provider | Purpose | URL (redacted) | Evidence |'); out.push('|---|---|---|---|');
+    for (const e of aibom.endpoints) out.push(row([e.provider, e.purpose, e.url, (e.evidence || []).map((x) => `${x.file}:${x.line}`).join(', ')]));
+    out.push('');
+  }
+  if ((aibom.services || []).length) {
+    out.push('## Services'); out.push(''); out.push('| Service | Kind | Status | Evidence |'); out.push('|---|---|---|---|');
+    for (const x of aibom.services) out.push(row([x.name, x.kind, x.status, (x.evidence || []).map((e) => `${e.file}:${e.line}`).join(', ')]));
+    out.push('');
+  }
+  if ((aibom.embeddings || []).length) {
+    out.push('## Embeddings'); out.push(''); out.push('| Name | Provider | Status |'); out.push('|---|---|---|');
+    for (const e of aibom.embeddings) out.push(row([e.name, e.provider, e.status]));
+    out.push('');
+  }
+  if ((aibom.unresolved || []).length) {
+    out.push('## Unresolved'); out.push(''); out.push('| Kind | Location | Reason |'); out.push('|---|---|---|');
+    for (const u of aibom.unresolved) out.push(row([u.kind, `${u.file}:${u.line}`, u.reason]));
+    out.push('');
+  }
+  if ((aibom.limits || []).length) { out.push('## Limits'); out.push(''); for (const l of aibom.limits) out.push(`- ${l}`); out.push(''); }
+  out.push('> This document is the proprietary agentic-security AI-BOM, not a CycloneDX document. A CycloneDX 1.6 ML-BOM view is available separately.');
+  out.push('');
   return out.join('\n');
 }
 
@@ -324,9 +372,9 @@ export function toCycloneDXMLBOM(aibom, meta = {}) {
   const models = (aibom && aibom.models) || [];
   const components = models.map((m) => ({
     type: 'machine-learning-model',
-    'bom-ref': `model:${m.provider || 'unknown'}/${m.name || 'unknown'}${m.version ? `@${m.version}` : ''}`,
-    name: m.name || 'unknown',
-    ...(m.version ? { version: m.version } : {}),
+    'bom-ref': `model:${m.provider || 'unknown'}/${m.name || m.modelId || 'unknown'}${m.version || m.revision ? `@${m.version || m.revision}` : ''}`,
+    name: m.name || m.modelId || 'unknown',
+    ...(m.version || m.revision ? { version: m.version || m.revision } : {}),
     modelCard: {
       modelParameters: {
         ...(m.provider ? { approach: { type: 'supervised' } } : {}),
@@ -359,6 +407,10 @@ export function toCycloneDXMLBOM(aibom, meta = {}) {
       component: { type: 'application', name: 'scan-target', version: '1.0.0' },
     },
     components,
+    ...(((aibom && aibom.services) || []).length || ((aibom && aibom.endpoints) || []).length ? { services: [
+      ...(aibom.services || []).map((x) => ({ 'bom-ref': `service:${x.name}`, name: x.name, provider: { name: x.provider || 'unknown' }, description: `${x.kind} (${x.status})`, properties: [{ name: 'agentic-security:status', value: String(x.status) }, { name: 'agentic-security:egress', value: 'not-established' }] })),
+      ...(aibom.endpoints || []).map((e) => ({ 'bom-ref': `endpoint:${e.url}`, name: `${e.provider} ${e.purpose}`, provider: { name: e.provider }, endpoints: [e.url], properties: [{ name: 'agentic-security:status', value: String(e.status) }] })),
+    ] } : {}),
   };
 }
 
@@ -394,6 +446,12 @@ export function validateMLBOM(doc) {
         `components[${i}] is a machine-learning-model but carries no modelCard — that is the whole ML-BOM extension`);
     }
   }
+  for (const [i, sv] of (Array.isArray(doc.services) ? doc.services : []).entries()) {
+    req(typeof sv.name === 'string' && sv.name, `services[${i}].name is required`);
+    if (sv.endpoints !== undefined) req(Array.isArray(sv.endpoints) && sv.endpoints.every((u) => typeof u === 'string' && !/\/\/[^/@]*:[^/@]*@/.test(u)), `services[${i}].endpoints must be URL strings without credentials`);
+  }
+  const refs = (Array.isArray(doc.components) ? doc.components : []).concat(Array.isArray(doc.services) ? doc.services : []).map((c) => c && c['bom-ref']).filter(Boolean);
+  req(new Set(refs).size === refs.length, 'bom-ref values must be unique');
   return { ok: errors.length === 0, errors, checked: 'structural (required fields + ML-BOM component shape), NOT full JSON-Schema validation' };
 }
 

package/src/posture/artifact-registry.js

@@ -95,6 +95,16 @@ export const ARTIFACT_REGISTRY = [
   // clears by default, same as last-scan.json itself.
   { name: 'lineage-graph.json', kind: 'file', classification: 'generated', retentionClass: 'scan' },
   { name: 'lineage-graph.json.sig', kind: 'file', classification: 'generated', retentionClass: 'scan' },
+  // X-016: Haskell/Nix analysis metadata (capability status, parser/resolver ledger, limitations, input digests) and the
+  // language BOM, written by src/language/state-artifacts.js beside last-scan.json. Paths and digests only, never source
+  // text. Scan-class retention for the metadata; the BOM is evidence.
+  { name: 'language-analysis.json', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'src/language/state-artifacts.js (persistLanguageArtifacts)' },
+  { name: 'language-analysis.json.sig', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'src/language/state-artifacts.js (persistLanguageArtifacts)' },
+  { name: 'language-bom.json', kind: 'file', classification: 'generated', retentionClass: 'evidence', source: 'src/language/state-artifacts.js (persistLanguageArtifacts)' },
+  { name: 'language-bom.json.sig', kind: 'file', classification: 'generated', retentionClass: 'evidence', source: 'src/language/state-artifacts.js (persistLanguageArtifacts)' },
+  // X-016: pre-image of every file a Haskell/Nix fix rewrote (original text + meta), the undo source. It holds customer
+  // source, so it is a backup-class artifact and marked confidential for the encryption policy.
+  { name: 'fix-backups', kind: 'dir', classification: 'generated', retentionClass: 'backup', confidential: true, source: 'src/language/fix-lifecycle.js (writeWithBackup)' },
   // M4 deliverable #8 (FR-503 §14, DFG-022, sub-project 8a): the "Data-Flow
   // Time Machine" foundation — one commit-keyed GraphSnapshot per scan,
   // written by src/lineage/graph-snapshot.js's persistGraphSnapshot(),
@@ -237,6 +247,8 @@ export const ARTIFACT_REGISTRY = [
   { name: 'provenance-providers.yml', kind: 'file', classification: 'operator-config', note: 'Finding Provenance M3 §3.4 GitHub/GitLab provider enrichment opt-in ({token} or provider-scoped tokens) — read by posture/provenance/providers/config.js, never written by the scanner; env vars (AGENTIC_SECURITY_GITHUB_TOKEN/AGENTIC_SECURITY_GITLAB_TOKEN) take precedence when set' },
   { name: 'repo-lineage.json', kind: 'file', classification: 'operator-config', note: 'Finding Provenance M4 §4.2 cross-repository lineage declaration ({linkedFrom: {path, atCommit}}) — read by posture/provenance/repo-lineage.js, never written by the scanner; the linked path is verified as a real local git repo before use, no remote fetch' },
   { name: 'recipient-profiles.json', kind: 'file', classification: 'operator-config', note: 'FR-506 recipient/subprocessor governance profiles — hand- or agent-authored via `governance propose-edit`, never scanner-regenerable, so a routine reset must never delete it' },
+  { name: 'hackage-advisories.json', kind: 'file', classification: 'operator-config', note: 'X-016: operator-supplied Hackage advisory snapshot read by language/haskell-supply.js; never written by the scanner, so `reset` preserves it' },
+  { name: 'nix-advisories.json', kind: 'file', classification: 'operator-config', note: 'QA-005: operator-supplied Nix advisory snapshot read by language/resolved-pass.js; never written by the scanner, so `reset` preserves it' },
   { name: 'cross-repo-links.json', kind: 'file', classification: 'operator-config', note: 'M5 deliverable #8 (FR-304 "declared" half) — declared local<->remote node links between two independently-scanned repos, written via `federate declare --yes`, never scanner-regenerable, so a routine reset must never delete it' },
   { name: 'logic-claims.json', kind: 'file', classification: 'operator-config', note: 'authored by an external reviewing agent; engine.js only ever reads it (fs.readFileSync, never written)' },
   { name: 'current-intent.md', kind: 'file', classification: 'operator-config', note: 'developer-authored; no writer exists anywhere in src/ or bin/' },

package/src/posture/auditor-walkthrough.js

@@ -43,11 +43,13 @@
 // attestation" describes independent certification, not attestation).
 
 import * as fs from 'node:fs';
+import * as crypto from 'node:crypto';
 import * as path from 'node:path';
 
 import { statePath, stateWritesEnabled } from './state-dir.js';
 import { EVIDENCE_GRADE_DISCLAIMER_SHORT } from './evidence-grade-wording.js';
 import { COMPLIANCE_FAMILY_ALIAS, resolveFamilyKeys } from './family-resolve.js';
+import { LANGUAGE_COMPLIANCE_FAMILIES, languageAnalysisGaps } from '../language/compliance-map.js';
 import { strengthOfControl as _strengthOfControl } from './coverage-strength.js';
 // FR-PROV-026: earliestOrigin.authorName below is untrusted git commit
 // metadata. renderWalkthrough()'s output is console.log'd verbatim by
@@ -497,6 +499,7 @@ export function evaluateFramework(scanRoot, fw, scan) {
     || logicVulns.length > 0
     || supplyChain.length > 0;
 
+  const langIncomplete = languageAnalysisGaps(scan);
   const results = [];
   for (const c of fw.controls || []) {
     const obs = [];
@@ -599,6 +602,12 @@ export function evaluateFramework(scanRoot, fw, scan) {
           allCleared = false;
           contributingFindings.push(...open);
           obs.push(`${open.length} open ${fam} finding(s) at ${minSeverity}+.`);
+        } else if (langIncomplete.incomplete && LANGUAGE_COMPLIANCE_FAMILIES.has(fam)) {
+          // Empty bucket, but Haskell/Nix analysis in this scan did not complete (a parser failed, a required analyzer
+          // was off, an effective configuration is partial): an empty bucket is then not evidence, and an unknown
+          // option or an unresolved taint result must never read as satisfied.
+          obs.push(`⚠ ${fam}: Haskell/Nix analysis was incomplete (${langIncomplete.reasons[0]}${langIncomplete.reasons.length > 1 ? `; +${langIncomplete.reasons.length - 1} more` : ''}), so an empty finding bucket is not evidence (not assessed).`);
+          hasUnverifiableMapping = true;
         } else if (!assessable) {
           // Empty bucket, but the scan examined nothing — see the guard above.
           // Not evidence, and deliberately not a failure either.
@@ -855,4 +864,36 @@ export function persistWalkthrough(scanRoot, fw, body) {
   return fp;
 }
 
+/**
+ * A signable evidence document for one framework evaluation (the same shape `signComplianceEvidence` covers), so a
+ * walkthrough can be handed to an auditor with an integrity signature. Statuses, observations and finding references
+ * are copied from the evaluation; nothing is added. The language-analysis gaps that capped any control travel in
+ * `provenance`, so a reader of the signed document sees why a control is "partial".
+ */
+export function walkthroughToEvidenceJsonLd(fw, evaluation, { scan = null, engineVersion = null, generatedAt = null } = {}) {
+  const controls = (evaluation || []).map((e) => ({
+    '@type': 'Control', id: e.control && e.control.id, title: e.control && e.control.summary, status: e.status,
+    observations: e.observations || [], controlRefs: e.controlRefs || [],
+    codeTestable: (e.control && e.control.codeTestable) || null,
+  }));
+  const count = (st) => controls.filter((c) => c.status === st).length;
+  const gaps = languageAnalysisGaps(scan);
+  const digest = crypto.createHash('sha256').update(JSON.stringify(controls)).digest('hex');
+  return {
+    '@context': { '@vocab': 'https://agentic-security.io/compliance/v1/', schema: 'https://schema.org/' },
+    '@type': 'ComplianceEvidence',
+    schemaVersion: 1,
+    statusSemantics: 'present = no open findings on every mapped family and nothing capped it; partial = evidence with a gap or an unverifiable mapping; absent = nothing checked out; manual = no automated mapping',
+    policySource: `bundled:${fw.id}`,
+    framework: fw.id,
+    version: fw.controlsDigest || null,
+    generatedAt: generatedAt || new Date().toISOString(),
+    disclaimer: EVIDENCE_GRADE_DISCLAIMER_SHORT,
+    provenance: { engineVersion, languageAnalysis: { present: gaps.present, incomplete: gaps.incomplete, reasons: gaps.reasons } },
+    evidenceDigest: digest,
+    summary: { total: controls.length, present: count('present'), partial: count('partial'), absent: count('absent'), manual: count('manual') },
+    controls,
+  };
+}
+
 export const _internals = { _readJson, _resolveOpenFindingMinSeverity, SEVERITY_POLICY_FILE };

package/src/posture/clustering.js

@@ -38,8 +38,8 @@ function sinkKey(f) {
   // finding reaching this point has a distinct line — folding the line into
   // the key here can only split buckets more finely, never wrongly merge one.
   const sinkExpr = (parser === 'IR-TAINT'
-    ? `L${f.sink?.line || f.line || 0}:${f.sink?.label || ''}`
-    : (f.sink?.label || f.sink?.snippet || f.snippet || ''))
+    ? `L${f.sink?.line || f.line || 0}:${f.sink?.label || ''}${f.siteKey ? `:${f.siteKey}` : ''}`   // Haskell: distinct sinks on one line stay distinct
+    : `${f.sink?.label || f.sink?.snippet || f.snippet || ''}${f.siteKey ? `|${f.siteKey}` : ''}`)
     .replace(/['"`][^'"`]*['"`]/g, '_S_')
     .replace(/\s+/g, ' ')
     .trim()

package/src/posture/evidence-bundle.js

@@ -197,6 +197,12 @@ export function buildEvidenceBundle(finding, { engineVersion, rulesetVersion, bu
       cwe: finding.cwe ?? null,
       family: finding.family ?? null,
       parser: finding.parser ?? null,
+      // Haskell/Nix findings carry where the code is and what kind of evidence decided them. Added only when present, so
+      // the canonical bytes (and signatures) of every existing bundle are unchanged.
+      ...(finding.language ? { language: finding.language } : {}),
+      ...(finding.evidenceKind ? { evidenceKind: finding.evidenceKind } : {}),
+      ...(finding.originalLocation ? { originalLocation: finding.originalLocation } : {}),
+      ...(finding.generatedLocation ? { generatedLocation: finding.generatedLocation } : {}),
     },
     evidence: {
       // The honest chain, in the vocabulary the engine already uses.
@@ -206,7 +212,7 @@ export function buildEvidenceBundle(finding, { engineVersion, rulesetVersion, bu
       exploitability: finding.exploitability ?? null,
       unreachable: finding.unreachable ?? null,
       // Present only for the layers that produce them; absent means absent.
-      taintPath: finding.pathSteps ?? finding.exampleFlows ?? null,
+      taintPath: finding.pathSteps ?? finding.exampleFlows ?? (Array.isArray(finding.chain) && finding.language ? finding.chain : null),
       discovery: finding.discovery ?? null,
     },
     engine: {

package/src/posture/execution-proof.js

@@ -80,6 +80,21 @@ export async function proveFinding(finding, { timeoutMs = DEFAULT_PROOF_TIMEOUT_
   if (!poc?.code) {
     return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: 'no proof-of-concept attached' }));
   }
+  // X-009: language witnesses (generated Nix shell scripts; Haskell programs when a toolchain exists). The proof is the
+  // same marker file; the SCOPE is recorded so a configuration/generated-script proof is never read as runtime
+  // exploitation of a deployed system.
+  if (poc.lang === 'nix-shell' || poc.lang === 'haskell') {
+    const W = await import('../language/witness.js');
+    const r = poc.lang === 'haskell' ? W.runHaskellWitness(poc.code, { timeoutMs, force }) : W.runNixScriptWitness(poc.witness, { timeoutMs, force });
+    const scope = poc.lang === 'nix-shell'
+      ? { proofKind: 'generated-script-execution', doesNotProve: 'that a deployed host evaluates this configuration or that the interpolated option is attacker-controlled there' }
+      : { proofKind: 'source-witness-execution', doesNotProve: 'that the deployed application receives attacker input on this path' };
+    return attachProofTier(finding, _evidence({
+      tier: r.status === 'reproduced' ? 'execution-proven' : r.status === 'not-reproduced' ? 'proof-failed' : proofTierOf(finding),
+      backend: r.backend || detectBackend(), ran: !!r.ran, observed: r.observed || null, reason: r.reason || null, exitCode: r.exitCode ?? null, timedOut: !!r.timedOut,
+      witnessStatus: r.status, ...scope,
+    }));
+  }
   if (poc.lang !== 'js') {
     return attachProofTier(finding, _evidence({ tier: proofTierOf(finding), reason: `unsupported poc language: ${poc.lang}` }));
   }

package/src/posture/falsification.js

@@ -90,6 +90,13 @@ export function classifyFinding(finding, fileContents) {
   if (finding.sanitizerMismatch) {
     return { verdict: 'survived', reasons: ['wrong-context sanitizer does not neutralize this sink'] };
   }
+  // Haskell and Nix findings are judged on the IR / effective configuration, never on adjacent text: the taint
+  // engine already refuses a flow that a DOMINATING, context-matched guard covers (language/haskell-guards.js), and
+  // a NixOS value is decided by option precedence. A sanitizer-looking word near the sink (a comment, a helper that
+  // is not on the path, a control for a different family) is not control evidence, so text proximity never blocks.
+  if (/\.(?:l?hs|nix)$/i.test(String(finding.file || ''))) {
+    return { verdict: 'survived', reasons: ['judged on the IR/effective configuration: adjacent text is not control evidence'] };
+  }
   const window = _pathWindow(finding, fileContents);
   if (!window || !window.trim()) {
     return { verdict: 'unproven', reasons: ['no source context available to attempt falsification'] };

package/src/posture/family-resolve.js

@@ -10,6 +10,8 @@
 //
 // One definition, no cycle, both callers import from here.
 
+import { LANGUAGE_FAMILY_ALIASES } from '../language/compliance-map.js';
+
 export const COMPLIANCE_FAMILY_ALIAS = {
   // ASVS spells it `sqli`; every detector emits `sql-injection` (or a
   // language-prefixed variant, which the suffix rule below does NOT cover
@@ -45,3 +47,8 @@ export function resolveFamilyKeys(fam, availableKeys) {
   return out;
 }
 
+// Haskell/Nix producers emit finer families than the frameworks name; those are evidence for the framework family
+// (language/compliance-map.js). Merged without disturbing any existing alias.
+for (const [fam, extra] of Object.entries(LANGUAGE_FAMILY_ALIASES)) {
+  COMPLIANCE_FAMILY_ALIAS[fam] = [...new Set([...(COMPLIANCE_FAMILY_ALIAS[fam] || []), ...extra])];
+}

package/src/posture/fix-history.js

@@ -356,6 +356,46 @@ export async function applyFix({ scanRoot, file, originalContent, newContent, fi
   });
 }
 
+/**
+ * Records a fix that a language lifecycle (Haskell, Nix) has ALREADY written, with its own backup, so one ledger
+ * serves every ecosystem: `agentic-security undo` reverts it, the attempt budget counts it, and its tier (FULL,
+ * MITIGATION, WORKAROUND) and the gates it passed are kept on the entry beside the timestamp. No second write happens
+ * here; `backup.original` is the file the lifecycle saved before it wrote.
+ */
+export async function recordExternalFix({ scanRoot, file, originalContent, newContent, findingId, ruleId, vuln, stableId, fixLabel = null, verification = null, backup = null, source = 'language-lifecycle', findingProvenance = null }) {
+  return _withLogLock(scanRoot, async () => {
+    if (!ensure(scanRoot)) return null;
+    const log = readLog(scanRoot);
+    const priorAttempts = _countPriorAttempts(log, stableId || null, findingId);
+    const bakAbs = backup && backup.dir ? path.join(backup.dir, 'original') : null;
+    const entry = {
+      id: `fix-${Date.now().toString(36)}-${sha(file + findingId).slice(0, 6)}`,
+      findingId, stableId: stableId || null, ruleId: ruleId || null, vuln: vuln || null, file, fileExisted: true,
+      backupPath: bakAbs ? path.relative(scanRoot, bakAbs) : null,
+      originalSha: sha(originalContent), newSha: sha(newContent),
+      appliedAt: new Date().toISOString(), status: 'applied', reverted: false, attemptOrdinal: priorAttempts + 1,
+      provenanceAtFix: _snapshotProvenanceAtFix(findingProvenance, new Date().toISOString()),
+      fixLabel, verification, source, languageBackupId: backup ? backup.id : null,
+    };
+    log.push(entry);
+    await _writeLogAndSync(scanRoot, log);
+    return entry;
+  });
+}
+
+/** Marks the history entry written for a language-lifecycle backup as reverted (sync: the lifecycle's undo is sync). */
+export function markRevertedByBackup(scanRoot, backupId) {
+  try {
+    const fp = logPath(scanRoot);
+    if (!fs.existsSync(fp)) return false;
+    const log = JSON.parse(fs.readFileSync(fp, 'utf8'));
+    let hit = false;
+    for (const e of log) if (e && e.languageBackupId === backupId && !e.reverted) { e.reverted = true; e.revertedAt = new Date().toISOString(); hit = true; }
+    if (hit) { const tmp = `${fp}.tmp-${process.pid}`; fs.writeFileSync(tmp, JSON.stringify(log, null, 2)); fs.renameSync(tmp, fp); }
+    return hit;
+  } catch { return false; }
+}
+
 async function _writeAndSync(fp, content) {
   await fsp.mkdir(path.dirname(fp), { recursive: true });
   const handle = await fsp.open(fp, 'w');

package/src/posture/fix-verify.js

@@ -35,8 +35,17 @@ export async function verifyPatch({
   depFileContents = {},
 } = {}) {
   if (!files || typeof files !== 'object') return { ok: false, reason: 'no-files-provided' };
-  const fileContents = { ...files };
+  let fileContents = { ...files };
   let scan;
+  // Haskell/Nix findings come from the deep (IR) layer and depend on imported modules: verifying a patch without
+  // either would never see the original finding at all, so a patch that fixes nothing would read "verified". The
+  // patched files are scanned deep, together with their import closure and manifests read from disk.
+  let deep;
+  if (Object.keys(fileContents).some((f) => /\.(?:l?hs|hs-boot|hsc|nix)$/i.test(f))) {
+    const { withLanguageContext } = await import('../language/context.js');
+    const lc = withLanguageContext(scanRoot, fileContents, depFileContents);
+    fileContents = lc.fileContents; depFileContents = lc.depFileContents; deep = true;
+  }
   try {
     // `provenance:false` is REQUIRED here, not an optimisation. This scan is
     // deliberately scoped to just the patched file(s), so its finding set is a
@@ -46,7 +55,7 @@ export async function verifyPatch({
     // would mass-mark the rest of the project as remediated, then
     // `reintroduced` on the next real scan. The patched content is also not
     // committed, so there is no history to resolve provenance against anyway.
-    scan = await runFullScan({ fileContents, depFileContents, scanRoot, provenance: false }, () => {});
+    scan = await runFullScan({ fileContents, depFileContents, scanRoot, provenance: false, ...(deep ? { deep: true } : {}) }, () => {});
   } catch (e) {
     return { ok: false, reason: 'rescan-failed', error: e.message };
   }
@@ -56,8 +65,11 @@ export async function verifyPatch({
   if (stillHasOriginal) {
     return { ok: false, reason: 'original-finding-still-present', stableId: originalFindingStableId };
   }
+  // With language context in play, files that were only read for context carry findings that predate the patch;
+  // only findings in the PATCHED files can be introduced by it.
+  const patchedSet = new Set(Object.keys(files));
   const introducedHighOrAbove = findings.filter(f =>
-    (SEVERITY_RANK[f.severity] ?? 9) <= SEVERITY_RANK.medium);
+    (SEVERITY_RANK[f.severity] ?? 9) <= SEVERITY_RANK.medium && (!deep || patchedSet.has(f.file)));
   // Don't count findings on lines outside the patched files — but our
   // fileContents map IS the patched files, so every finding is in-scope.
   return {

package/src/posture/provenance/git-evidence.js

@@ -233,6 +233,30 @@ export function getBlobAtCommit(scanRoot, sha, file) {
   return r.ok ? r.stdout : null;
 }
 
+/** Files in the tree at `sha` (relative to scanRoot) whose path matches `re`, capped. Empty on any failure. */
+export function listFilesAtCommit(scanRoot, sha, re, { max = 400 } = {}) {
+  if (!_isSha(sha) || !(re instanceof RegExp)) return [];
+  const r = _run(scanRoot, ['ls-tree', '-r', '--name-only', sha, '--', '.']);
+  if (!r.ok) return [];
+  return r.stdout.split('\n').map((x) => x.trim()).filter((x) => x && re.test(x)).slice(0, max);
+}
+
+/**
+ * Commits, oldest first, that touched ANY of `files`. Used when a finding is decided by several files (an import
+ * chain, a module graph) so the commit that changed any of them is a candidate origin. No rename following.
+ */
+export function candidateCommitsForFiles(scanRoot, files, { since } = {}) {
+  const rels = (files || []).map((f) => _relPath(scanRoot, f)).filter(Boolean);
+  if (!rels.length) return [];
+  if (since && !_isSafeRevision(since)) return [];
+  const args = ['log', '--format=%H', '--reverse'];
+  if (since) args.push(`${since}..HEAD`);
+  args.push('--', ...rels);
+  const r = _run(scanRoot, args);
+  if (!r.ok) return [];
+  return [...new Set(r.stdout.split('\n').map((x) => x.trim()).filter(Boolean))];
+}
+
 export function candidateCommitsForLine(scanRoot, file, line, { since } = {}) {
   const rel = _relPath(scanRoot, file);
   if (!rel) return [];

package/src/posture/provenance/origin-resolver.js

@@ -23,7 +23,7 @@
 // that disambiguates them; see the branch below for exactly how each is
 // handled.
 
-import { candidateCommitsForLine, commitMeta, getBlobAtCommit, isAncestor } from './git-evidence.js';
+import { candidateCommitsForLine, candidateCommitsForFiles, commitMeta, getBlobAtCommit, isAncestor } from './git-evidence.js';
 import { replayAt } from './predicate-replay.js';
 import { PROVENANCE_METHOD } from './schema.js';
 import { checkAbsentInSomeParent, detectRevert, detectCherryPick } from './dag-walk.js';
@@ -38,6 +38,11 @@ function relevantFiles(finding) {
   if (Array.isArray(finding.pathSteps)) {
     for (const step of finding.pathSteps) if (step.file) files.add(step.file);
   }
+  // Haskell/Nix findings are decided by more than the line they point at: a taint chain crosses modules, and a
+  // NixOS option is decided by imported modules. Replaying only the anchor file would attribute the finding to the
+  // commit that last touched that one file, so the files that decided it are replayed together.
+  if (Array.isArray(finding.chain)) for (const step of finding.chain) if (step && typeof step.file === 'string' && step.file) files.add(step.file);
+  if (Array.isArray(finding.controlFiles)) for (const f of finding.controlFiles) if (typeof f === 'string' && f) files.add(f);
   return [...files];
 }
 
@@ -173,7 +178,14 @@ export async function resolveOrigin(scanRoot, finding, { since, deadlineAt, repo
     return { status: 'not_available', reason: 'missing-file-line-or-stableId', commitsConsidered: 0 };
   }
 
-  const candidates = candidateCommitsForLine(scanRoot, file, line, { since });
+  let candidates = candidateCommitsForLine(scanRoot, file, line, { since });
+  // Haskell/Nix: more than the anchor line decides a finding (an import chain, a module graph), so the commits that
+  // touched ANY of the deciding files are candidates too, in chronological order.
+  const decidingFiles = relevantFiles(finding);
+  if (/\.nix$/i.test(file) || (decidingFiles.length > 1 && /\.l?hs$/i.test(file))) {
+    const wide = candidateCommitsForFiles(scanRoot, decidingFiles, { since });
+    if (wide.length) candidates = [...new Set([...wide, ...candidates])];
+  }
   if (candidates.length === 0) {
     return { status: 'not_available', reason: 'no-candidate-commits', commitsConsidered: 0 };
   }

package/src/posture/provenance/predicate-replay.js

@@ -11,7 +11,7 @@
 
 import { runFullScan, _snapshotSuppressionLog, _restoreSuppressionLog } from '../../engine.js';
 import { computeStableId } from '../stable-id.js';
-import { getBlobAtCommit } from './git-evidence.js';
+import { getBlobAtCommit, listFilesAtCommit } from './git-evidence.js';
 
 // Task 11 concurrency fix: `coordinator.js` resolves several findings' origins
 // CONCURRENTLY (its own comment: "the scheduler runs these four at a time"),
@@ -59,6 +59,12 @@ export function _runExclusive(fn) {
 
 export async function replayAt(scanRoot, sha, files, targetStableId) {
   const fileContents = {};
+  // A NixOS option is decided by every module the configuration imports, including ones deleted later, so a Nix
+  // finding is replayed against ALL Nix sources and the lock file as they existed at that commit.
+  if (files.some((f) => /\.nix$/i.test(f))) {
+    const all = listFilesAtCommit(scanRoot, sha, /(?:\.nix|(?:^|\/)flake\.lock)$/i);
+    files = [...new Set([...files, ...all])];
+  }
   for (const f of files) {
     const content = getBlobAtCommit(scanRoot, sha, f);
     if (content != null) fileContents[f] = content;
@@ -100,7 +106,10 @@ export async function replayAt(scanRoot, sha, files, targetStableId) {
         // identical computeStableId output with and without annotators, over
         // a real scan) before this was wired in — see the FR-PROV-029 commit
         // message for methodology.
-        return await runFullScan({ fileContents, scanRoot, provenance: false, skipAnnotators: true }, () => {});
+        // Haskell/Nix findings come from the IR-taint layer, which only runs in deep mode: a replay that skips it
+        // can never see the finding at ANY commit, so origin resolution would end "never confirmed" for every one.
+        const _langDeep = Object.keys(fileContents).some((f) => /\.(?:l?hs|nix)$/i.test(f)) ? { deep: true } : {};
+        return await runFullScan({ fileContents, scanRoot, provenance: false, skipAnnotators: true, ..._langDeep }, () => {});
       } finally {
         _restoreSuppressionLog(_suppSnapshot);
       }

package/src/posture/provenance/sca-origin.js

@@ -1,6 +1,7 @@
 import * as crypto from 'node:crypto';
 import { candidateCommitsForFile, getFirstParent, getBlobAtCommit, commitMeta } from './git-evidence.js';
 import { PROVENANCE_METHOD } from './schema.js';
+import { compareVersions } from '../../language/haskell-manifests.js';
 
 function parseSemver(v) {
   const m = String(v || '').replace(/^[^\d]*/, '').match(/^(\d+)\.(\d+)\.(\d+)/);
@@ -13,7 +14,17 @@ function cmpSemver(a, b) {
   return 0;
 }
 
-export function versionInRange(version, range) {
+// Hackage versions follow the PVP: any number of components, compared numerically component by component. The
+// three-component semver comparison below would call 2.1.2.1 and 2.1.2.9 equal.
+function pvpInRange(version, range) {
+  if (!version) return false;
+  if (range.introduced && compareVersions(version, range.introduced) < 0) return false;
+  if (range.fixed && compareVersions(version, range.fixed) >= 0) return false;
+  return true;
+}
+
+export function versionInRange(version, range, ecosystem = null) {
+  if (ecosystem && String(ecosystem).toLowerCase() === 'hackage') return pvpInRange(version, range);
   const v = parseSemver(version);
   if (!v) return false;
   if (range.introduced) {
@@ -42,6 +53,12 @@ function extractDeclaredVersion(blobText, depName, filePath) {
       return null;
     }
   }
+  // Hackage: the version is exact only where a freeze, a Stack lock or an extra-deps pin states it.
+  const esc = String(depName).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  if (base === 'cabal.project.freeze') { const m = new RegExp(`any\\.${esc}\\s*==\\s*([0-9][0-9.]*)`).exec(blobText); return m ? m[1] : null; }
+  if (base === 'stack.yaml.lock') { const m = new RegExp(`hackage:\\s*${esc}-([0-9][0-9.]*)(?:@|\\s|$)`).exec(blobText); return m ? m[1] : null; }
+  if (base === 'stack.yaml') { const m = new RegExp(`^\\s*-\\s*${esc}-([0-9][0-9.]*)\\s*$`, 'm').exec(blobText); return m ? m[1] : null; }
+  if (/\.cabal$/i.test(base)) { const m = new RegExp(`(?:^|[\\s,:])${esc}\\s*==\\s*([0-9][0-9.]*)(?![\\w.*])`, 'm').exec(blobText); return m ? m[1] : null; }
   if (/^requirements(?:[._-][\w.-]+)?\.txt$/i.test(base)) {
     for (const line of blobText.split('\n')) {
       const m = line.trim().match(/^([A-Za-z0-9_.-]+)\s*[=~<>!]+\s*([^\s;#,]*)/);
@@ -98,7 +115,7 @@ export async function resolveDirectSCAOrigin(scanRoot, scaEntry, { since, deadli
     const blob = getBlobAtCommit(scanRoot, sha, file);
     if (blob == null) continue;
     const declaredVersion = extractDeclaredVersion(blob, scaEntry.name, file);
-    if (!declaredVersion || !versionInRange(declaredVersion, range)) continue;
+    if (!declaredVersion || !versionInRange(declaredVersion, range, scaEntry.ecosystem)) continue;
 
     const parent = getFirstParent(scanRoot, sha);
     if (!parent) {
@@ -111,7 +128,7 @@ export async function resolveDirectSCAOrigin(scanRoot, scaEntry, { since, deadli
 
     const parentBlob = getBlobAtCommit(scanRoot, parent, file);
     const parentVersion = parentBlob ? extractDeclaredVersion(parentBlob, scaEntry.name, file) : null;
-    const parentOutOfRange = !parentVersion || !versionInRange(parentVersion, range);
+    const parentOutOfRange = !parentVersion || !versionInRange(parentVersion, range, scaEntry.ecosystem);
     if (!parentOutOfRange) {
       // Parent was already in the vulnerable range too. If the declared value
       // actually changed here, this is the ambiguous "still-vulnerable bump"