@clear-capabilities/agentic-security-scanner 0.166.0 → 0.168.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-37394bc97ebb4c287b4baa85822494bda80e330e4d55194ad5fb63598bce4eb0  agentic-security.mjs
+9444e40759885491c495ceb57ff8e0e475ee277434236667a9ebf8ac9d29be83  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.166.0",
+  "version": "0.168.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -74,7 +74,7 @@
     "test:ollama-e2e": "AGENTIC_SECURITY_OLLAMA_E2E=1 node --test test/ollama-e2e.test.js",
     "test:glob": "node --test test/glob-compat.test.js",
     "test:sast": "node --test test/cpp-hardcoded-secret.test.js test/sibling-guard.test.js test/comment-blindness.test.js test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/zip-slip-containment-guard.test.js test/redos-anchoring.test.js test/path-guard-validator-call.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/csharp-cross-file.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/java-structural-cross-file.test.js test/guard-recognition.test.js test/guard-window-identifier-correlation.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js test/juliet-path-filter-gate.test.js test/java-bench-shape-opt-in.test.js test/java-ast-folding.test.js test/java-bench-extras.test.js test/reachability-missing-callgraph-data.test.js test/rate-limit.test.js test/auth-signals.test.js test/convention-deviation.test.js test/resource-exhaustion.test.js test/resource-exhaustion-realworld.test.js test/redirect-toctou.test.js test/redirect-toctou-realworld.test.js test/codegen-sink.test.js test/ownership-authz.test.js test/ownership-authz-realworld.test.js test/t21-precision-audit.test.js test/secrets-coverage.test.js test/prompt-injection-payloads.test.js test/iac-cloud-templates.test.js test/ruby-path-join.test.js test/sast/manifest-line-tracking.test.js test/rust-sast.test.js test/java-deserialization-precision.test.js test/pipeline-env-secret.test.js test/mark-used-vuln-functions.test.js",
-    "test:posture": "node --test test/threat-model.test.js test/git-hardening.test.js test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/temp-leak-guard.test.js test/release-workflow.test.js test/release-workflow-structure.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/obligation-evidence-pack.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/ollama-provider.test.js test/ollama-capabilities.test.js test/ollama-offline-egress.test.js test/ollama-fix-proposal.test.js test/ollama-explain-proposal.test.js test/ollama-poc-proposal.test.js test/ollama-model-probe.test.js test/ollama-agent-tools.test.js test/ollama-agent-loop.test.js test/ollama-e2e.test.js test/ollama-oom-feedback.test.js test/ollama-doc-drift.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/module-artifact-liveness.test.js test/supply-chain-provenance-completeness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/framework-provenance-controlrefs.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js test/posture/provenance-schema.test.js test/posture/provenance-cache.test.js test/helpers/build-git-fixture.test.js test/posture/provenance-git-evidence.test.js test/posture/provenance-dag-walk.test.js test/posture/provenance-confidence.test.js test/posture/provenance-predicate-replay.test.js test/posture/provenance-origin-resolver.test.js test/posture/provenance-ai-authorship.test.js test/posture/provenance-branch-entry.test.js test/posture/provenance-evidence-attribution.test.js test/posture/provenance-lifecycle.test.js test/posture/provenance-missing-control-resolver.test.js test/posture/provenance-missing-control-wiring.test.js test/posture/provenance-coordinator.test.js test/posture/provenance-sca-origin.test.js test/posture/provenance-transitive-sca.test.js test/posture/provenance-coordinator-sca.test.js test/posture/provenance-providers.test.js test/posture/provenance-evidence-bundle.test.js test/posture/provenance-repo-lineage.test.js test/posture/provenance-secrets-logic.test.js test/cli/provenance-flags.test.js test/cli/attest-provenance.test.js test/cli/attest-obligations.test.js test/cli/models.test.js test/cli/setup-llm.test.js test/cli/fix-retry.test.js test/cli/compliance-walkthrough-lineage.test.js test/cli/dataflow-export-privacy.test.js test/cli/dataflow-export-briefing.test.js test/cli/lineage-snapshot-persist.test.js test/cli/dataflow-diff.test.js test/cli/dataflow-watch.test.js test/cli/dataflow-recipients.test.js test/cli/dataflow-coverage.test.js test/security/provenance-safety.test.js test/security/provenance-injection.test.js test/posture/remediation-ledger.test.js test/posture/assurance-baseline.test.js test/posture/assurance-contracts.test.js test/posture/assurance-config.test.js test/evidence-issuer.test.js test/load-factor.test.js",
+    "test:posture": "node --test test/threat-model.test.js test/git-hardening.test.js test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/temp-leak-guard.test.js test/release-workflow.test.js test/release-workflow-structure.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/obligation-evidence-pack.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/ollama-provider.test.js test/ollama-capabilities.test.js test/ollama-offline-egress.test.js test/ollama-fix-proposal.test.js test/ollama-explain-proposal.test.js test/ollama-poc-proposal.test.js test/ollama-model-probe.test.js test/ollama-agent-tools.test.js test/ollama-agent-loop.test.js test/ollama-e2e.test.js test/ollama-oom-feedback.test.js test/ollama-doc-drift.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/module-artifact-liveness.test.js test/supply-chain-provenance-completeness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/framework-provenance-controlrefs.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js test/posture/provenance-schema.test.js test/posture/provenance-cache.test.js test/helpers/build-git-fixture.test.js test/posture/provenance-git-evidence.test.js test/posture/provenance-dag-walk.test.js test/posture/provenance-confidence.test.js test/posture/provenance-predicate-replay.test.js test/posture/provenance-origin-resolver.test.js test/posture/provenance-ai-authorship.test.js test/posture/provenance-branch-entry.test.js test/posture/provenance-evidence-attribution.test.js test/posture/provenance-lifecycle.test.js test/posture/provenance-missing-control-resolver.test.js test/posture/provenance-missing-control-wiring.test.js test/posture/provenance-coordinator.test.js test/posture/provenance-sca-origin.test.js test/posture/provenance-transitive-sca.test.js test/posture/provenance-coordinator-sca.test.js test/posture/provenance-providers.test.js test/posture/provenance-evidence-bundle.test.js test/posture/provenance-repo-lineage.test.js test/posture/provenance-secrets-logic.test.js test/cli/provenance-flags.test.js test/cli/attest-provenance.test.js test/cli/attest-obligations.test.js test/cli/models.test.js test/cli/setup-llm.test.js test/cli/fix-retry.test.js test/cli/compliance-walkthrough-lineage.test.js test/cli/dataflow-export-privacy.test.js test/cli/dataflow-export-briefing.test.js test/cli/lineage-snapshot-persist.test.js test/cli/dataflow-diff.test.js test/cli/dataflow-watch.test.js test/cli/dataflow-recipients.test.js test/cli/dataflow-coverage.test.js test/security/provenance-safety.test.js test/security/provenance-injection.test.js test/posture/remediation-ledger.test.js test/posture/assurance-baseline.test.js test/posture/assurance-contracts.test.js test/posture/assurance-config.test.js test/evidence-issuer.test.js test/load-factor.test.js test/proof-fabric/core.test.js test/proof-fabric/fix-store-runner.test.js test/proof-fabric/fixtures.test.js test/cli/proof-fabric-cli.test.js test/rule-compiler/core.test.js test/cli/rule-compiler-cli.test.js test/fleet/fleet-graph.test.js test/fleet/fleet-manifest.test.js test/fleet/fleet-cli.test.js",
     "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/chrome-probe.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-rust.test.js test/rust-taint-flow.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/catalog-ai-model-provider-precision.test.js test/catalog-orm-write.test.js test/dataflow/provenance-pipeline-integration.test.js test/dataflow-progress.test.js test/scan-progress.test.js test/sard-leakage-pipeline.test.js test/sard-split-scoring.test.js test/sard-llm-isolation.test.js test/sard-mutation-adversarial.test.js test/sard-baseline-adaptive-tolerance.test.js test/sard-independent-holdout.test.js test/sard-flow-aware-scoring.test.js test/sard-macro-score-support-floor.test.js test/sard-php-split.test.js test/parser-java-nary-concat.test.js test/sard-naive-baseline.test.js test/field-taint-cross-method.test.js test/field-taint-engine-unit.test.js test/coercion-sanitizer-kill.test.js test/constant-propagation-path-sensitivity.test.js test/parser-java-assignments.test.js test/catalog-java-sard.test.js test/parser-cs-juliet-shapes.test.js test/catalog-cs-sard-p2.test.js test/sard-cwe-key-merge.test.js test/parser-php-backtick.test.js test/parser-php-include.test.js test/php-include-merge.test.js test/parser-php-array-field-taint.test.js test/parser-php-cond-assign.test.js test/parser-rust-redos.test.js test/multi-sink-taint-chain.test.js test/static-field-cross-class-call-string.test.js test/regex-guard-narrowing.test.js test/object-instance-field-taint.test.js test/param-type-inference.test.js test/smt-path-feasibility.test.js test/cross-service-taint.test.js test/dataflow-expr-taint-scaling.test.js test/evaluation/guard-dominance.test.js test/evaluation/engine-mechanisms.test.js test/rx-exec-receiver.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-apply-fix-multifile.test.js test/mcp-protocol-smoke.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js test/mcp-dataflow-tools.test.js test/cli/governance-propose-edit.test.js test/cli/remediation-open-update.test.js test/cli/remediation-verify-reopen.test.js test/cli/dataflow-observations.test.js test/cli/federate-declare-list.test.js test/capabilities/tools.test.js",
     "test:report": "node --test test/report-scan-invariants.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/scan-health.test.js test/finding-schema.test.js test/pipeline/finding-schema-provenance.test.js test/evidence-provenance.test.js test/report/provenance-output.test.js test/report/provenance-format-parity.test.js test/legacy-compat.test.js test/annotator-runner.test.js test/detector-runner.test.js test/detector-errors.test.js test/analyzer-supervisor.test.js test/cascade-worker-pool.test.js test/cascade-pool-wiring.test.js test/coverage-ledger.test.js test/coverage-ledger-completeness.test.js test/assurance-mode.test.js test/artifact-registry.test.js test/artifact-registry-completeness.test.js test/retention-policy.test.js test/state-lifecycle-report.test.js test/legal-hold.test.js test/production-feedback.test.js test/calibration-feedback.test.js test/encryption-provider.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js test/oscal-conformance.test.js test/cli-fix-apply.test.js test/apply-fix-service.test.js test/high-impact-approval-gate.test.js test/approver-registry.test.js test/suppression-exceptions.test.js test/fix-history.test.js test/producer-registry.test.js test/producer-collector.test.js test/enrichment-completion.test.js",

package/src/posture/artifact-registry.js

@@ -119,6 +119,11 @@ export const ARTIFACT_REGISTRY = [
   // directory-of-files shape re-keyed commit -> import.
   { name: 'runtime-observations', kind: 'dir', classification: 'generated', retentionClass: 'evidence', confidential: true, source: 'src/lineage/observation-store.js (persistObservationImport)', note: 'FR-505 requires an observation store follow artifact encryption, RETENTION, RESET, access-control and no-egress rules. That is why this is `generated` (a plain `reset` MUST be able to delete it) rather than `operator-config`, and why it carries a real retentionClass — deliberately NOT the `remediation`/`legal-holds.json` no-retention call one section down, and deliberately NOT `provenance`\'s permanent-history call. This DOES stretch `generated`\'s usual definition — a rescan does not re-derive an import, the operator re-imports it — and that stretch is disclosed here rather than hidden: FR-505\'s explicit reset requirement breaks the tie. `confidential: true` is enforced by observation-store.js calling maybeEncryptForWrite/maybeDecryptForRead itself (posture/encryption-provider.js), the same per-writer opt-in compliance-evidence.json makes — the flag alone enforces nothing.' },
   { name: 'shadow-findings.json', kind: 'file', classification: 'generated', retentionClass: 'scan' },
+  { name: 'reproducers', kind: 'dir', classification: 'operator-config', source: 'src/posture/proof-fabric/cli.js (loadReproducer)', note: 'Operator-supplied serialized reproducers read by `triage exploit --prove`. Input, never written by the scanner, so reset leaves it alone.' },
+  { name: 'proofs', kind: 'dir', classification: 'generated', retentionClass: 'evidence', confidential: true, source: 'src/posture/proof-fabric/store.js (saveProof)', note: 'Universal Exploit Proof Fabric evidence: hashed records of exploit reproductions. Never holds plaintext credentials, per-run nonces or raw secrets (the runner redacts before persisting). Encrypted per the encryption policy via maybeEncryptForWrite, and purged by retention like any evidence-class artifact; a legal hold on `proofs` blocks the purge.' },
+  { name: 'fleet-state.json', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'src/posture/fleet/cli.js, src/posture/fleet.js (loadFleetState/_saveFleetState)', note: 'Per-repository resume checkpoint for `fleet scan` — which fleet repositories are already complete, so a resumed run skips them. Scanner-managed; a plain reset may delete it.' },
+  { name: 'fleet-rollup.json', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'src/posture/fleet/cli.js', note: 'The last fleet rollup (rollupFleet output), kept only so the NEXT `fleet scan` can compute a delta against it and so `fleet status` has something to read without re-scanning.' },
+  { name: 'fleet-graph.json', kind: 'file', classification: 'generated', retentionClass: 'scan', source: 'src/posture/fleet/cli.js, src/posture/fleet/fleet-graph.js', note: 'The cross-repository dependency graph built from each fleet repository\'s own manifest, consumed by `fleet query --depends-on`. Rebuilt on every `fleet scan`.' },
   { name: 'mcp-audit.log', kind: 'file', classification: 'generated', retentionClass: 'evidence' },
   { name: 'egress-audit.log', kind: 'file', classification: 'generated', retentionClass: 'evidence', note: "FR-604 per-call egress audit log — hash-chained NDJSON written by egress/audit.js's recordEgressCall, never read as config" },
   { name: 'hook-throttle.json', kind: 'file', classification: 'generated', retentionClass: 'cache' },
@@ -222,6 +227,7 @@ export const ARTIFACT_REGISTRY = [
   { name: 'rules.yml', kind: 'file', classification: 'operator-config' },
   { name: 'rules', kind: 'dir', classification: 'operator-config' },
   { name: 'rules-proposed', kind: 'dir', classification: 'operator-config', note: 'proposed rules awaiting human review — not yet approved config, but not scanner-regenerable either' },
+  { name: 'rule-compiler', kind: 'dir', classification: 'generated', retentionClass: 'evidence', source: 'src/posture/rule-compiler/store.js', note: 'Self-Learning Finding-to-Rule Compiler: per-rule lifecycle ledger, IR, evaluation score and regression fixtures. The PROMOTED custom-rule document it publishes lives separately under `rules/` (operator-config, unaffected by reset) once promoted; this directory holds only the scanner-managed provenance and corpus behind that decision.' },
   { name: 'license-policy.yml', kind: 'file', classification: 'operator-config' },
   { name: 'trusted-keys.json', kind: 'file', classification: 'operator-config' },
   { name: 'ruleset-version.json', kind: 'file', classification: 'operator-config', note: 'pinning intent, hand-set' },

package/src/posture/fleet/cli.js

@@ -0,0 +1,103 @@
+// `agentic-security fleet init|scan|status|resume|query`.
+//
+// Reuses the existing posture/fleet.js (runFleet: bounded concurrency, resumable checkpoint, per-repo isolation,
+// honest rollup) for the scanning half — this module adds only the manifest-driven entry point and the
+// cross-repository dependency graph (fleet-graph.js) that runFleet has no notion of.
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadFleetManifest, starterManifestYaml } from './fleet-manifest.js';
+import { buildFleetDependencyGraph, blastRadius } from './fleet-graph.js';
+import { runFleet, rollupFleet, renderFleetSummary } from '../fleet.js';
+import { statePath, ensureStateDir, safeWriteState } from '../state-dir.js';
+
+const GRAPH_FILE = 'fleet-graph.json';
+const STATE_FILE = 'fleet-state.json';
+
+function graphPath(root) { return statePath(root, GRAPH_FILE); }
+function statePathFor(root) { return statePath(root, STATE_FILE); }
+
+export async function cmdFleet(args, root) {
+  const sub = args._[1];
+  if (sub === 'init') return cmdInit(args, root);
+  if (sub === 'scan') return cmdScan(args, root);
+  if (sub === 'status') return cmdStatus(args, root);
+  if (sub === 'resume') return cmdScan(args, root, { resumeOnly: true });
+  if (sub === 'query') return cmdQuery(args, root);
+  console.error('usage: fleet init | scan <manifest.yaml> | status <manifest.yaml> | resume <manifest.yaml> | query --depends-on <repo-id> [<manifest.yaml>]');
+  return 4;
+}
+
+function manifestArg(args) {
+  const m = args._[2];
+  return m && !String(m).startsWith('--') ? m : 'fleet.yaml';
+}
+
+async function cmdInit(args, root) {
+  const target = path.resolve(root, manifestArg(args) === 'fleet.yaml' ? 'fleet.yaml' : manifestArg(args));
+  if (fs.existsSync(target) && !args.flags.force) { console.error(`${target} already exists. Pass --force to overwrite.`); return 4; }
+  fs.writeFileSync(target, starterManifestYaml(args.flags.organization || 'example'));
+  console.log(`Wrote ${target}. Edit it to list your repositories, then run: agentic-security fleet scan ${path.basename(target)}`);
+  return 0;
+}
+
+async function cmdScan(args, root, { resumeOnly = false } = {}) {
+  const manifestFile = path.resolve(root, manifestArg(args));
+  const loaded = loadFleetManifest(manifestFile);
+  if (!loaded.ok) { console.error(`Invalid fleet manifest: ${loaded.errors.join('; ')}`); return 4; }
+  const { manifest } = loaded;
+
+  if (!ensureStateDir(root)) { console.error('No safe state directory for this project.'); return 4; }
+  const prevRollupFile = statePath(root, 'fleet-rollup.json');
+  let previous = null;
+  try { previous = JSON.parse(fs.readFileSync(prevRollupFile, 'utf8')); } catch { /* first run */ }
+
+  const { runScan: runScanFn } = await import('../../runScan.js');
+  // runScanFn resolves to { scan, meta } already — runFleet's worker expects exactly that shape from runScan, so
+  // this must NOT wrap `scan` a second time (an earlier draft did, and every repo silently reported 0 findings:
+  // `_summarise` reads `scan.findings` defensively rather than throwing on the wrong shape).
+  const runScan = (repoPath) => runScanFn(repoPath, { provenance: false });
+
+  console.error(`[fleet] scanning ${manifest.repositories.length} repository(ies) for ${manifest.organization} (${manifest.workers} worker(s))...`);
+  const result = await runFleet({
+    repos: manifest.repositories.map((r) => r.id), concurrency: manifest.workers,
+    stateFile: statePathFor(root), resume: true, previous,
+    runScan: async (repoId) => runScan(manifest.repositories.find((r) => r.id === repoId).path),
+    onProgress: (entry) => { console.error(`[fleet] ${entry.ok ? 'done' : 'FAILED'}: ${entry.repo}${entry.ok ? ` (${entry.total} finding(s))` : ` — ${entry.error}`}`); },
+  });
+  if (resumeOnly && result.skipped.length === manifest.repositories.length) console.error('[fleet] nothing to resume — every repository was already complete.');
+
+  safeWriteState(prevRollupFile, JSON.stringify(result.rollup, null, 2));
+  const graph = buildFleetDependencyGraph(manifest.repositories);
+  safeWriteState(graphPath(root), JSON.stringify({ organization: manifest.organization, builtAt: new Date().toISOString(), ...graph }, null, 2));
+
+  console.log(renderFleetSummary(result.rollup));
+  console.log(`\nRepositories requested: ${manifest.repositories.length}`);
+  console.log(`Complete: ${result.results.filter((r) => r.ok).length + result.skipped.length}`);
+  console.log(`Failed: ${result.results.filter((r) => !r.ok).length}`);
+  const anyFailed = result.results.some((r) => !r.ok);
+  return anyFailed ? 1 : 0;
+}
+
+async function cmdStatus(args, root) {
+  const f = statePath(root, 'fleet-rollup.json');
+  if (!fs.existsSync(f)) { console.error('No fleet scan has been run yet. Run `agentic-security fleet scan <manifest.yaml>` first.'); return 4; }
+  const rollup = JSON.parse(fs.readFileSync(f, 'utf8'));
+  if (args.flags.json) console.log(JSON.stringify(rollup, null, 2));
+  else console.log(renderFleetSummary(rollup));
+  return 0;
+}
+
+async function cmdQuery(args, root) {
+  const target = args.flags['depends-on'];
+  if (!target) { console.error('usage: fleet query --depends-on <repo-id>'); return 4; }
+  const f = graphPath(root);
+  if (!fs.existsSync(f)) { console.error('No fleet dependency graph yet. Run `agentic-security fleet scan <manifest.yaml>` first.'); return 4; }
+  const graph = JSON.parse(fs.readFileSync(f, 'utf8'));
+  if (!graph.nodes.some((n) => n.id === target)) { console.error(`${target} is not a repository in the last fleet scan.`); return 4; }
+  const radius = blastRadius(graph, target);
+  if (args.flags.json) { console.log(JSON.stringify({ target, blastRadius: radius }, null, 2)); return 0; }
+  if (!radius.length) { console.log(`No fleet repository depends on ${target} (by declared package name).`); return 0; }
+  console.log(`Repositories depending on ${target} (directly or transitively):`);
+  for (const r of radius) console.log(`  ${r.id}  (depth ${r.depth}, via ${r.path.slice(1).join(' -> ')})`);
+  return 0;
+}

package/src/posture/fleet/fleet-graph.js

@@ -0,0 +1,142 @@
+// The cross-repository dependency graph for the fleet feature (PRD 4).
+//
+// Reads each repo's own manifest to learn (a) the package name it publishes under, if any, and (b) the package
+// names it depends on. An edge A -> B means "A declares a dependency that resolves to B's own published name" —
+// i.e. B is upstream of A, and a defect in B can affect A. This is a real, lightweight cross-repo dependency graph
+// built purely from manifests already on disk; it does not need deployment config (Kubernetes/compose/Terraform)
+// the way the existing deployment-boundary graph does, so a fleet of plain application repos works out of the box.
+import fs from 'node:fs';
+import path from 'node:path';
+
+const MANIFESTS = Object.freeze([
+  { file: 'package.json', ecosystem: 'npm' },
+  { file: 'go.mod', ecosystem: 'go' },
+  { file: 'Cargo.toml', ecosystem: 'cargo' },
+  { file: 'requirements.txt', ecosystem: 'pypi' },
+  { file: 'pyproject.toml', ecosystem: 'pypi' },
+]);
+
+function readBounded(p, maxBytes = 1024 * 1024) {
+  try {
+    const st = fs.statSync(p);
+    if (!st.isFile() || st.size > maxBytes) return null;
+    return fs.readFileSync(p, 'utf8');
+  } catch { return null; }
+}
+
+function parsePackageJson(text) {
+  let j;
+  try { j = JSON.parse(text); } catch { return { name: null, deps: new Set() }; }
+  const deps = new Set([...Object.keys(j.dependencies || {}), ...Object.keys(j.devDependencies || {}), ...Object.keys(j.peerDependencies || {})]);
+  return { name: typeof j.name === 'string' ? j.name : null, deps };
+}
+
+function parseGoMod(text) {
+  const m = /^module\s+(\S+)/m.exec(text);
+  const deps = new Set();
+  const block = /require\s*\(([\s\S]*?)\)/.exec(text);
+  const lines = block ? block[1].split('\n') : text.split('\n').filter((l) => /^require\s/.test(l.trim()));
+  for (const raw of lines) {
+    const l = raw.replace(/^require\s+/, '').trim();
+    const dm = /^(\S+)\s+v?\S+/.exec(l);
+    if (dm) deps.add(dm[1]);
+  }
+  return { name: m ? m[1] : null, deps };
+}
+
+function parseCargoToml(text) {
+  const nm = /\[package\][\s\S]*?\bname\s*=\s*"([^"]+)"/.exec(text);
+  const deps = new Set();
+  const section = /\[dependencies\]([\s\S]*?)(\n\[|$)/.exec(text);
+  if (section) {
+    for (const line of section[1].split('\n')) {
+      const dm = /^\s*([A-Za-z0-9_-]+)\s*=/.exec(line);
+      if (dm) deps.add(dm[1]);
+    }
+  }
+  return { name: nm ? nm[1] : null, deps };
+}
+
+function parseRequirementsTxt(text) {
+  const deps = new Set();
+  for (const raw of text.split('\n')) {
+    const l = raw.trim();
+    if (!l || l.startsWith('#') || l.startsWith('-')) continue;
+    const dm = /^([A-Za-z0-9._-]+)/.exec(l);
+    if (dm) deps.add(dm[1].toLowerCase());
+  }
+  return { name: null, deps };
+}
+
+function parsePyprojectToml(text) {
+  const nm = /\[project\][\s\S]*?\bname\s*=\s*"([^"]+)"/.exec(text);
+  const deps = new Set();
+  const section = /dependencies\s*=\s*\[([\s\S]*?)\]/.exec(text);
+  if (section) {
+    for (const m of section[1].matchAll(/"([A-Za-z0-9._-]+)/g)) deps.add(m[1].toLowerCase());
+  }
+  return { name: nm ? nm[1] : null, deps };
+}
+
+const PARSERS = { 'package.json': parsePackageJson, 'go.mod': parseGoMod, 'Cargo.toml': parseCargoToml, 'requirements.txt': parseRequirementsTxt, 'pyproject.toml': parsePyprojectToml };
+
+/** One repo's declared identity and dependency names, merged across every manifest file it has. */
+export function readRepoManifest(repoPath) {
+  let name = null;
+  const deps = new Set();
+  const ecosystems = new Set();
+  for (const { file, ecosystem } of MANIFESTS) {
+    const text = readBounded(path.join(repoPath, file));
+    if (text == null) continue;
+    const parsed = PARSERS[file](text);
+    if (parsed.name && !name) name = parsed.name;
+    for (const d of parsed.deps) deps.add(d);
+    ecosystems.add(ecosystem);
+  }
+  return { name, deps, ecosystems: [...ecosystems] };
+}
+
+/**
+ * Build the fleet dependency graph. `repos`: [{id, path}]. An edge {from, to} means `from` depends on `to` (so a
+ * defect in `to` can affect `from`). Matching is by declared package NAME only — two repos that happen to share a
+ * name under different ecosystems are not disambiguated, a disclosed limit, not a guess.
+ */
+export function buildFleetDependencyGraph(repos) {
+  const manifests = new Map();
+  for (const r of repos) manifests.set(r.id, { ...r, manifest: readRepoManifest(r.path) });
+
+  const byName = new Map();
+  for (const [id, r] of manifests) if (r.manifest.name) {
+    if (!byName.has(r.manifest.name)) byName.set(r.manifest.name, []);
+    byName.get(r.manifest.name).push(id);
+  }
+
+  const edges = [];
+  for (const [id, r] of manifests) {
+    for (const dep of r.manifest.deps) {
+      const targets = byName.get(dep);
+      if (!targets) continue;
+      for (const to of targets) if (to !== id) edges.push({ from: id, to, via: dep });
+    }
+  }
+  const nodes = [...manifests.values()].map((r) => ({ id: r.id, path: r.path, declaredName: r.manifest.name, ecosystems: r.manifest.ecosystems }));
+  return { nodes, edges };
+}
+
+/** Transitive downstream closure: which fleet repos depend on `repoId`, directly or transitively, with the shortest path to each. */
+export function blastRadius(graph, repoId) {
+  const incoming = new Map();
+  for (const e of graph.edges) { if (!incoming.has(e.to)) incoming.set(e.to, []); incoming.get(e.to).push(e.from); }
+  const best = new Map();
+  const queue = [{ id: repoId, path: [repoId] }];
+  while (queue.length) {
+    const { id, path: p } = queue.shift();
+    for (const from of incoming.get(id) || []) {
+      if (best.has(from)) continue;
+      const newPath = [...p, from];
+      best.set(from, { depth: newPath.length - 1, path: newPath });
+      queue.push({ id: from, path: newPath });
+    }
+  }
+  return [...best.entries()].map(([id, v]) => ({ id, ...v })).sort((a, b) => a.depth - b.depth || (a.id < b.id ? -1 : 1));
+}

package/src/posture/fleet/fleet-manifest.js

@@ -0,0 +1,77 @@
+// The fleet manifest (PRD 4 "Fleet Manifest"). `fleet.yaml`:
+//
+//   organization: example
+//   repositories:
+//     - id: frontend
+//       path: ../frontend
+//   workers: 4
+//   perRepoTimeout: 20m
+//
+// Parsing reuses util/yaml.js (the one YAML entry point in this codebase). Validation is closed-world: an unknown
+// top-level key, a duplicate repository id, or a path that does not resolve to a real directory all refuse the
+// whole manifest rather than silently skipping one repo.
+import fs from 'node:fs';
+import path from 'node:path';
+import { load as loadYaml } from '../../util/yaml.js';
+
+const FLEET_MANIFEST_SCHEMA_KEYS = Object.freeze(['organization', 'repositories', 'workers', 'perRepoTimeout']);
+const DURATION_RE = /^(\d+)(s|m|h)$/;
+
+export function parseDuration(s, fallbackMs) {
+  if (typeof s === 'number' && s > 0) return s * 1000;
+  const m = DURATION_RE.exec(String(s ?? ''));
+  if (!m) return fallbackMs;
+  const n = Number(m[1]);
+  return m[2] === 's' ? n * 1000 : m[2] === 'm' ? n * 60000 : n * 3600000;
+}
+
+/** Validate a parsed manifest object against the manifest's own base directory (for path resolution). */
+export function validateFleetManifest(doc, { baseDir = '.' } = {}) {
+  const errors = [];
+  if (!doc || typeof doc !== 'object' || Array.isArray(doc)) return { ok: false, errors: ['manifest must be a YAML mapping'] };
+  for (const k of Object.keys(doc)) if (!FLEET_MANIFEST_SCHEMA_KEYS.includes(k)) errors.push(`unknown top-level key: ${k}`);
+  if (typeof doc.organization !== 'string' || !doc.organization) errors.push('organization is required and must be a string');
+  if (!Array.isArray(doc.repositories) || doc.repositories.length === 0) errors.push('repositories must be a non-empty array');
+  const seen = new Set();
+  const repos = [];
+  for (const [i, r] of (Array.isArray(doc.repositories) ? doc.repositories : []).entries()) {
+    if (!r || typeof r !== 'object') { errors.push(`repositories[${i}] must be a mapping`); continue; }
+    if (typeof r.id !== 'string' || !/^[a-z][a-z0-9-]{0,63}$/.test(r.id)) { errors.push(`repositories[${i}].id must be a lowercase kebab-case string`); continue; }
+    if (seen.has(r.id)) { errors.push(`duplicate repository id: ${r.id}`); continue; }
+    seen.add(r.id);
+    if (typeof r.path !== 'string' || !r.path) { errors.push(`repositories[${i}].path is required`); continue; }
+    const abs = path.resolve(baseDir, r.path);
+    let isDir = false;
+    try { isDir = fs.statSync(abs).isDirectory(); } catch { /* reported below */ }
+    if (!isDir) errors.push(`repositories[${i}].path does not resolve to a directory: ${r.path}`);
+    repos.push({ id: r.id, path: abs });
+  }
+  if (doc.workers != null && !(Number.isInteger(doc.workers) && doc.workers >= 1 && doc.workers <= 32)) errors.push('workers must be an integer in 1..32');
+  if (doc.perRepoTimeout != null && parseDuration(doc.perRepoTimeout, null) == null) errors.push(`perRepoTimeout is not a valid duration: ${doc.perRepoTimeout}`);
+  if (errors.length) return { ok: false, errors };
+  return {
+    ok: true, errors: [],
+    manifest: {
+      organization: doc.organization, repositories: repos,
+      workers: doc.workers ?? 4, perRepoTimeoutMs: parseDuration(doc.perRepoTimeout, 20 * 60000),
+    },
+  };
+}
+
+export function loadFleetManifest(filePath) {
+  let text;
+  try { text = fs.readFileSync(filePath, 'utf8'); } catch (e) { return { ok: false, errors: [`cannot read ${filePath}: ${e.message}`] }; }
+  let doc;
+  try { doc = loadYaml(text); } catch (e) { return { ok: false, errors: [`invalid YAML: ${e.message}`] }; }
+  return validateFleetManifest(doc, { baseDir: path.dirname(path.resolve(filePath)) });
+}
+
+export function starterManifestYaml(organization = 'example') {
+  return `organization: ${organization}
+repositories:
+  - id: example-repo
+    path: .
+workers: 4
+perRepoTimeout: 20m
+`;
+}

package/src/posture/proof-fabric/cli.js

@@ -0,0 +1,115 @@
+// CLI surface for the proof fabric: `proof show|replay|doctor`, `triage exploit|validate`. Non-interactive by design: no
+// command reads stdin, every run is bounded by the policy timeouts, and a missing reproducer is a typed exit code, not a
+// prompt. Exit codes: 0 confirmed/ok, 1 not confirmed (any reason), 4 usage/precondition.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { statePath } from '../state-dir.js';
+import { proveFinding } from './orchestrator.js';
+import { saveProof, latestProof, listProofs, findingKey, scrubDeep } from './store.js';
+import { selectEnvironment, hostTools, languageSupport } from './runner.js';
+import { validateReproducer } from './reproducer.js';
+import { LANGUAGES } from './reproducer.js';
+
+function loadFinding(root, id) {
+  const p = statePath(root, 'last-scan.json');
+  if (!fs.existsSync(p)) return null;
+  const last = JSON.parse(fs.readFileSync(p, 'utf8'));
+  return (last.findings || []).find((f) => f.id === id || f.stableId === id) ?? null;
+}
+
+export function loadReproducerFor(root, id, flagPath) { return loadReproducer(root, id, flagPath); }
+
+function loadReproducer(root, id, flagPath) {
+  const candidates = [flagPath && path.resolve(String(flagPath)), statePath(root, 'reproducers', `${findingKey(id)}.json`)].filter(Boolean);
+  for (const c of candidates) {
+    try { return { reproducer: JSON.parse(fs.readFileSync(c, 'utf8')), file: c }; } catch { /* next */ }
+  }
+  return null;
+}
+
+function formatResult(r) {
+  const env = r.environment ? `${r.environment.mode} (${r.environment.assurance} assurance)` : 'none';
+  return [
+    `Finding: ${r.findingId}`,
+    `Evidence: ${r.state}`,
+    `Oracle: ${r.oracle}`,
+    `Reproductions: ${r.attempts?.successes ?? 0}/${r.attempts?.run ?? 0} (required ${r.attempts?.required})`,
+    `Independent replay: ${r.independentReplay?.status ?? 'not-run'}`,
+    `Environment: ${env}`,
+    `Completeness: ${r.completeness}`,
+    `Duration: ${(r.timing.proofMs / 1000).toFixed(1)}s`,
+    ...(r.degradation?.length ? [`Degraded: ${r.degradation.join(', ')}`] : []),
+    ...(r.note ? [`Note: ${r.note}`] : []),
+  ].join('\n');
+}
+
+export async function cmdProve(args, root, { json = false } = {}) {
+  const id = String(args._[2] ?? '');
+  if (!id) { console.error('usage: triage exploit <finding-id> --prove [--reproducer file] [--attempts N] [--required N]'); return 4; }
+  const finding = loadFinding(root, id);
+  if (!finding) { console.error(`Finding ${id} not found in last scan.`); return 4; }
+  const loaded = loadReproducer(root, id, args.flags.reproducer);
+  if (!loaded) { console.error(`No reproducer for ${id}. Supply one with --reproducer <file> or place it at .agentic-security/reproducers/. Nothing was executed.`); return 4; }
+  const errs = validateReproducer(loaded.reproducer);
+  if (errs.length) { console.error(`Invalid reproducer: ${errs.join('; ')}`); return 4; }
+  const policy = {};
+  if (args.flags.attempts) policy.attempts = Number(args.flags.attempts);
+  if (args.flags.required) policy.required = Number(args.flags.required);
+  if (args.flags.timeout) policy.timeoutMs = Number(args.flags.timeout) * 1000;
+  if (args.flags['require-container']) policy.requireContainer = true;
+  const ac = new AbortController();
+  const onSig = () => ac.abort();
+  process.once('SIGINT', onSig);
+  let result;
+  try { result = await proveFinding({ finding, reproducer: loaded.reproducer, revision: args.flags.revision ?? null, policy, signal: ac.signal }); } finally { process.off('SIGINT', onSig); }
+  const saved = saveProof(root, { ...result, reproducer: loaded.reproducer });
+  // Printed output gets the same secret-scrubbing pass as what is persisted (defense in depth: a free-text reason/note
+  // field that captured something from stdout/stderr should never reach a terminal unredacted either).
+  if (json || args.flags.json) console.log(JSON.stringify(scrubDeep({ ...result, stored: saved.ok ? saved.file : null }), null, 2));
+  else { console.log(formatResult(result)); if (!saved.ok) console.log(`(proof not stored: ${saved.reason})`); }
+  return result.state === 'EXPLOIT_CONFIRMED' ? 0 : 1;
+}
+
+export async function cmdProof(args, root) {
+  const sub = args._[1];
+  if (sub === 'doctor') return doctor(args);
+  const id = String(args._[2] ?? '');
+  if (!id) { console.error('usage: proof show <finding-id> | proof replay <finding-id> | proof doctor'); return 4; }
+  if (sub === 'show') {
+    const all = listProofs(root, id);
+    if (!all.length) { console.error(`No stored proof for ${id}.`); return 4; }
+    const latest = all.find((p) => p.record);
+    if (all.some((p) => p.tampered)) console.error(`WARNING: ${all.filter((p) => p.tampered).length} stored record(s) failed their integrity check and are not trusted.`);
+    const good = all.find((p) => p.record && !p.tampered);
+    if (!good) { console.error('No intact proof record.'); return 1; }
+    if (args.flags.json) console.log(JSON.stringify(good.record, null, 2)); else console.log(formatResult(good.record));
+    void latest;
+    return 0;
+  }
+  if (sub === 'replay') {
+    const stored = latestProof(root, id);
+    if (!stored?.record?.reproducer) { console.error(`No stored reproducer for ${id}.`); return 4; }
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'proof-replay-'));
+    const tmp = path.join(tmpDir, 'reproducer.json');
+    fs.writeFileSync(tmp, JSON.stringify(stored.record.reproducer));
+    args.flags.reproducer = tmp;
+    args._ = ['triage', 'exploit', id];
+    try { return await cmdProve(args, root); } finally { fs.rmSync(tmpDir, { recursive: true, force: true }); }
+  }
+  console.error('usage: proof show|replay <finding-id> | proof doctor');
+  return 4;
+}
+
+function doctor(args) {
+  const tools = hostTools();
+  const rows = LANGUAGES.map((l) => ({ lang: l, ...languageSupport(l, tools) }));
+  const envs = ['javascript', 'python'].map((l) => ({ lang: l, ...selectEnvironment({ lang: l }) }));
+  if (args.flags.json) { console.log(JSON.stringify({ tools, languages: rows, environments: envs }, null, 2)); return 0; }
+  console.log('Proof fabric doctor');
+  for (const r of rows) console.log(`  ${r.lang.padEnd(11)} ${r.supported ? 'supported' : `unsupported (${r.reason})`}`);
+  for (const e of envs) console.log(`  environment for ${e.lang}: ${e.mode}, ${e.assurance} assurance${e.reason ? ` (${e.reason})` : ''}${e.containerSkipped ? `; container skipped: ${e.containerSkipped}` : ''}`);
+  const usable = envs.some((e) => e.mode !== 'unavailable');
+  if (!usable) console.log('  RESULT: no execution environment available; proofs will report blocked, never clean.');
+  return usable ? 0 : 1;
+}

package/src/posture/proof-fabric/fix-proof.js

@@ -0,0 +1,73 @@
+// Verified remediation, extended with exploit replay. This EXTENDS the fix-verify vocabulary (`verifiedFull`,
+// `degradedLegs`); it does not define a competing meaning of "verified".
+//
+//   1. pre-patch: the original exploit must be EXPLOIT_CONFIRMED (3/3 + independent replay) on the unpatched code;
+//   2. the candidate patch is overlaid on the imported sources and the SAME exploit is replayed;
+//   3. the patched replay must COMPLETE in every attempt and the oracle must not fire in any: BLOCKED.
+//      An attempt that did not complete (timeout, build failure, no environment) is inconclusive, never "blocked";
+//   4. static legs (re-scan, lint, tests, honesty) come from `verifyFix`, passed in so they are not re-implemented;
+//   5. FIX_VERIFIED only when 1-4 hold and the static verification had no degraded leg.
+import { advance } from './states.js';
+import { proveFinding } from './orchestrator.js';
+import { runAttempt } from './runner.js';
+import { reproducerDigest, sha256, canonicalize } from './reproducer.js';
+
+export async function verifyFixWithProof({ finding, reproducer, files, scanRoot, revision = null, policy = {}, staticVerification = null, siblings = null, signal, deps = {} } = {}) {
+  const t0 = Date.now();
+  const attemptFn = deps.attemptFn ?? runAttempt;
+  const patchHash = sha256(canonicalize(files || {}));
+  const legs = { prePatch: null, postPatch: null, regression: staticVerification ? { ok: !!staticVerification.ok, verifiedFull: !!staticVerification.verifiedFull } : { status: 'not-run' }, rescan: staticVerification?.rescan ?? { status: 'not-run' } };
+  const out = (extra) => ({ schema: 'agentic-security/fix-proof', version: 1, findingId: finding?.stableId ?? finding?.id ?? null, patchHash, reproducerDigest: reproducerDigest(reproducer), legs, durationMs: Date.now() - t0, ...extra });
+
+  const pre = await proveFinding({ finding, revision, reproducer, policy, signal, deps, sourceRoot: scanRoot });
+  legs.prePatch = { state: pre.state, outcome: pre.outcome, completeness: pre.completeness };
+  if (pre.state !== 'EXPLOIT_CONFIRMED') {
+    return out({ state: pre.state, verified: false, completeness: 'INCOMPLETE', incompleteStep: 'pre-patch-exploit', reason: `the original exploit was not confirmed before the patch (${pre.outcome}); a fix cannot be proven against an exploit that does not reproduce` });
+  }
+
+  const attempts = Math.max(1, Math.min(10, policy.attempts ?? 3));
+  const results = [];
+  for (let i = 0; i < attempts; i++) {
+    if (signal?.aborted) break;
+    results.push(await attemptFn(structuredClone(reproducer), { limits: { timeoutMs: policy.timeoutMs }, signal, sourceRoot: scanRoot, overlay: files, requireContainer: policy.requireContainer, force: policy.force }));
+  }
+  const completed = results.filter((r) => r.status === 'completed' && !r.oracle?.inconclusive);
+  const fired = completed.filter((r) => r.oracle?.fired).length;
+  legs.postPatch = { attempts: results.length, completed: completed.length, exploitSucceeded: fired, statuses: results.map((r) => r.status) };
+
+  if (fired > 0) return out({ state: 'EXPLOIT_CONFIRMED', verified: false, completeness: 'FULL', incompleteStep: 'post-patch-exploit', reason: 'the exploit still succeeds against the patched code' });
+  if (completed.length < results.length || results.length === 0) {
+    return out({ state: 'EXPLOIT_CONFIRMED', verified: false, completeness: 'INCOMPLETE', incompleteStep: 'post-patch-replay', reason: 'the patched replay did not complete in every attempt, so the patch is not shown to block the exploit' });
+  }
+  let state = advance('EXPLOIT_CONFIRMED', 'FIX_REPLAY_BLOCKED').state;
+
+  const degraded = [];
+  if (!staticVerification) degraded.push('static-verification-not-run');
+  else {
+    if (!staticVerification.ok) return out({ state, verified: false, completeness: 'FULL', incompleteStep: 'static-verification', reason: `exploit blocked, but static verification failed: ${staticVerification.rescan?.reason || 'a leg failed'}` });
+    for (const d of staticVerification.degradedLegs || []) degraded.push(d);
+  }
+  const lowAssurance = pre.environment?.assurance === 'lower';
+  if (lowAssurance) degraded.push('lower-assurance-local-confinement');
+  const siblingCount = Array.isArray(siblings) ? siblings.length : null;
+  if (siblingCount === null) degraded.push('sibling-search-not-run');
+  else if (siblingCount > 0) degraded.push(`sibling-exposures:${siblingCount}`);
+
+  const full = degraded.length === 0;
+  // Same split as fix-verify: `ok` (nothing that ran failed) earns FIX_VERIFIED; `completeness` says whether anything was skipped.
+  if (staticVerification && staticVerification.ok) state = advance(state, 'FIX_VERIFIED').state;
+  return out({ state, verified: state === 'FIX_VERIFIED', completeness: full ? 'FULL' : 'DEGRADED', degradedLegs: degraded, siblings: siblings ?? null });
+}
+
+export function formatFixProof(r) {
+  const L = r.legs || {};
+  return [
+    `Pre-patch exploit: ${L.prePatch?.state === 'EXPLOIT_CONFIRMED' ? 'PASS' : 'NOT CONFIRMED'}`,
+    `Post-patch exploit: ${!L.postPatch ? 'NOT RUN' : L.postPatch.exploitSucceeded > 0 ? 'STILL SUCCEEDS' : L.postPatch.completed === L.postPatch.attempts ? 'BLOCKED' : 'INCONCLUSIVE'}`,
+    `Regression tests: ${L.regression?.status === 'not-run' ? 'not run' : L.regression?.verifiedFull ? 'PASS' : L.regression?.ok ? 'PASS (degraded)' : 'FAIL'}`,
+    `Security rescan: ${L.rescan?.ok === true ? 'PASS' : L.rescan?.status === 'not-run' ? 'not run' : 'FAIL'}`,
+    `Completeness: ${r.completeness}${r.degradedLegs?.length ? ` (${r.degradedLegs.join('; ')})` : ''}`,
+    '',
+    `Evidence: ${r.state}${r.verified ? '' : ` (not verified: ${r.reason || r.incompleteStep || 'degraded'})`}`,
+  ].join('\n');
+}