@clear-capabilities/agentic-security-scanner 0.168.0 → 0.170.0

package/dist/agentic-security.mjs.sha256

@@ -1 +1 @@
-9444e40759885491c495ceb57ff8e0e475ee277434236667a9ebf8ac9d29be83  agentic-security.mjs
+40d5efd2eaa9410528e168bd5055148ac0de203d57c44b68abc12c25618db762  agentic-security.mjs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.168.0",
+  "version": "0.170.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -74,11 +74,11 @@
     "test:ollama-e2e": "AGENTIC_SECURITY_OLLAMA_E2E=1 node --test test/ollama-e2e.test.js",
     "test:glob": "node --test test/glob-compat.test.js",
     "test:sast": "node --test test/cpp-hardcoded-secret.test.js test/sibling-guard.test.js test/comment-blindness.test.js test/crypto-specialist.test.js test/llm.test.js test/llm-cost-advisor.test.js test/llm-owasp.test.js test/logic.test.js test/authz.test.js test/model-load.test.js test/prompt-template.test.js test/business-logic.test.js test/python-sinks.test.js test/phase1-detectors.test.js test/phase2-detectors.test.js test/phase3-v3.test.js test/phase7-extensions.test.js test/phase8-extensions.test.js test/new-cwe-detectors.test.js test/file-upload.test.js test/llmsecops-detectors.test.js test/db-taint.test.js test/dart-swift.test.js test/zip-slip-containment-guard.test.js test/redos-anchoring.test.js test/path-guard-validator-call.test.js test/redos-nfa.test.js test/weak-randomness.test.js test/csharp-pipeline.test.js test/csharp-cross-file.test.js test/post-quantum-crypto.test.js test/web3-advanced.test.js test/cloud-iam-k8s.test.js test/crypto-protocol.test.js test/ml-supply-chain.test.js test/mcp-audit-scan.test.js test/wrong-context-sanitizer.test.js test/sanitizer-context.test.js test/frontend-hygiene.test.js test/csv-injection.test.js test/stored-taint.test.js test/tree-sitter-sinks.test.js test/kotlin-structural.test.js test/ruby-php-structural.test.js test/java-csharp-structural.test.js test/java-structural-cross-file.test.js test/guard-recognition.test.js test/guard-window-identifier-correlation.test.js test/js-python-framework-structural.test.js test/go-structural.test.js test/secret-concat.test.js test/secret-redaction.test.js test/xss-reflected-multilang.test.js test/code-injection-multilang.test.js test/xxe-multilang.test.js test/xpath-injection-multilang.test.js test/gapfill-batch13.test.js test/agent-untrusted-flow.test.js test/api-authz.test.js test/event-entrypoint.test.js test/iac-terraform.test.js test/cross-service.test.js test/rbac-consistency.test.js test/adversarial-robustness.test.js test/secret-entropy.test.js test/comment-strip.test.js test/juliet-path-filter-gate.test.js test/java-bench-shape-opt-in.test.js test/java-ast-folding.test.js test/java-bench-extras.test.js test/reachability-missing-callgraph-data.test.js test/rate-limit.test.js test/auth-signals.test.js test/convention-deviation.test.js test/resource-exhaustion.test.js test/resource-exhaustion-realworld.test.js test/redirect-toctou.test.js test/redirect-toctou-realworld.test.js test/codegen-sink.test.js test/ownership-authz.test.js test/ownership-authz-realworld.test.js test/t21-precision-audit.test.js test/secrets-coverage.test.js test/prompt-injection-payloads.test.js test/iac-cloud-templates.test.js test/ruby-path-join.test.js test/sast/manifest-line-tracking.test.js test/rust-sast.test.js test/java-deserialization-precision.test.js test/pipeline-env-secret.test.js test/mark-used-vuln-functions.test.js",
-    "test:posture": "node --test test/threat-model.test.js test/git-hardening.test.js test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/temp-leak-guard.test.js test/release-workflow.test.js test/release-workflow-structure.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/obligation-evidence-pack.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/ollama-provider.test.js test/ollama-capabilities.test.js test/ollama-offline-egress.test.js test/ollama-fix-proposal.test.js test/ollama-explain-proposal.test.js test/ollama-poc-proposal.test.js test/ollama-model-probe.test.js test/ollama-agent-tools.test.js test/ollama-agent-loop.test.js test/ollama-e2e.test.js test/ollama-oom-feedback.test.js test/ollama-doc-drift.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/module-artifact-liveness.test.js test/supply-chain-provenance-completeness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/framework-provenance-controlrefs.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js test/posture/provenance-schema.test.js test/posture/provenance-cache.test.js test/helpers/build-git-fixture.test.js test/posture/provenance-git-evidence.test.js test/posture/provenance-dag-walk.test.js test/posture/provenance-confidence.test.js test/posture/provenance-predicate-replay.test.js test/posture/provenance-origin-resolver.test.js test/posture/provenance-ai-authorship.test.js test/posture/provenance-branch-entry.test.js test/posture/provenance-evidence-attribution.test.js test/posture/provenance-lifecycle.test.js test/posture/provenance-missing-control-resolver.test.js test/posture/provenance-missing-control-wiring.test.js test/posture/provenance-coordinator.test.js test/posture/provenance-sca-origin.test.js test/posture/provenance-transitive-sca.test.js test/posture/provenance-coordinator-sca.test.js test/posture/provenance-providers.test.js test/posture/provenance-evidence-bundle.test.js test/posture/provenance-repo-lineage.test.js test/posture/provenance-secrets-logic.test.js test/cli/provenance-flags.test.js test/cli/attest-provenance.test.js test/cli/attest-obligations.test.js test/cli/models.test.js test/cli/setup-llm.test.js test/cli/fix-retry.test.js test/cli/compliance-walkthrough-lineage.test.js test/cli/dataflow-export-privacy.test.js test/cli/dataflow-export-briefing.test.js test/cli/lineage-snapshot-persist.test.js test/cli/dataflow-diff.test.js test/cli/dataflow-watch.test.js test/cli/dataflow-recipients.test.js test/cli/dataflow-coverage.test.js test/security/provenance-safety.test.js test/security/provenance-injection.test.js test/posture/remediation-ledger.test.js test/posture/assurance-baseline.test.js test/posture/assurance-contracts.test.js test/posture/assurance-config.test.js test/evidence-issuer.test.js test/load-factor.test.js test/proof-fabric/core.test.js test/proof-fabric/fix-store-runner.test.js test/proof-fabric/fixtures.test.js test/cli/proof-fabric-cli.test.js test/rule-compiler/core.test.js test/cli/rule-compiler-cli.test.js test/fleet/fleet-graph.test.js test/fleet/fleet-manifest.test.js test/fleet/fleet-cli.test.js",
+    "test:posture": "node --test test/threat-model.test.js test/git-hardening.test.js test/privacy-framework.test.js test/material-change.test.js test/drift.test.js test/scorecard.test.js test/accuracy-scorecard.test.js test/scorecard-gate.test.js test/predeploy-gate.test.js test/release-check.test.js test/pre-push-gate.test.js test/dependency-currency.test.js test/package-contents-check.test.js test/gate-verdict-cache.test.js test/run-unit-tests.test.js test/temp-leak-guard.test.js test/release-workflow.test.js test/release-workflow-structure.test.js test/independent-population.test.js test/why-missed.test.js test/independent-scoring.test.js test/evidence-bundle.test.js test/obligation-evidence-pack.test.js test/policy-bundle.test.js test/discovery-memory.test.js test/mttr.test.js test/license-policy.test.js test/aibom.test.js test/sbom.test.js test/api-inventory.test.js test/iam-policy.test.js test/container.test.js test/container-runtime.test.js test/image-packages.test.js test/kev.test.js test/dep-confusion.test.js test/sca-deprecated.test.js test/sca-batch.test.js test/composite-risk.test.js test/epss-enrich.test.js test/sca-coverage.test.js test/gradle-deps.test.js test/sca-route-reachable.test.js test/sca-policy.test.js test/sca-verdict.test.js test/install-script.test.js test/sca-linked-findings.test.js test/packs.test.js test/flow-narration.test.js test/regression-test-gen.test.js test/deterministic-fix.test.js test/falsification.test.js test/verification-separation.test.js test/logic-claims.test.js test/attestation.test.js test/verify-attestation-cli.test.js test/comparison.test.js test/determinism-cross-machine.test.js test/fix-honesty-gate.test.js test/model-routing.test.js test/root-cause-sweep.test.js test/entrypoint-inventory.test.js test/relevance.test.js test/untrusted.test.js test/agent-hardening.test.js test/rule-synthesis.test.js test/policy-gate.test.js test/agents-memory.test.js test/cve-lookup.test.js test/cve-alert-daemon.test.js test/fix-verify-loop.test.js test/fix-verify-tests.test.js test/fix-acceptance.test.js test/exploitability-probability.test.js test/history-scan.test.js test/viral-features.test.js test/viral-v074.test.js test/state-dir.test.js test/ignore-pragma.test.js test/license-graph.test.js test/secret-live-check.test.js test/attack-taxonomy.test.js test/triage-memory.test.js test/pr-augment.test.js test/chat-batch2.test.js test/chat-batch3.test.js test/chat-batch4.test.js test/chat-batch5.test.js test/chat-batch6.test.js test/risk-scenario-disclosure.test.js test/egress-policy.test.js test/egress-policy-completeness.test.js test/egress-policy-integration.test.js test/router.test.js test/legacy-alias-redirect.test.js test/cache-economics.test.js test/coverage-report.test.js test/corpus-status.test.js test/provenance.test.js test/secret-history.test.js test/execution-proof.test.js test/fix-metrics.test.js test/corpus-enroll.test.js test/prove-findings.test.js test/corpus-match.test.js test/corpus-provenance.test.js test/learning-quorum.test.js test/llm-cache-integrity.test.js test/proof-artifact.test.js test/providers.test.js test/fleet.test.js test/autopilot.test.js test/autopilot-cli.test.js test/verifier-independence.test.js test/integrity-legacy-key.test.js test/suppression-visibility.test.js test/cost-ceiling.test.js test/local-endpoint.test.js test/ollama-provider.test.js test/ollama-capabilities.test.js test/ollama-offline-egress.test.js test/ollama-fix-proposal.test.js test/ollama-explain-proposal.test.js test/ollama-poc-proposal.test.js test/ollama-model-probe.test.js test/ollama-agent-tools.test.js test/ollama-agent-loop.test.js test/ollama-e2e.test.js test/ollama-oom-feedback.test.js test/ollama-doc-drift.test.js test/model-trust.test.js test/vuln-archaeology.test.js test/scan-checkpoint.test.js test/llm-redact.test.js test/world-class-batch2.test.js test/world-class-modules.test.js test/privacy-ir-adapter.test.js test/privacy-taxonomy.test.js test/privacy-sink-policy.test.js test/privacy-governance.test.js test/privacy-inventory.test.js test/integration-end-to-end.test.js test/streak-cli-wiring.test.js test/stack-playbook.test.js test/machine-output-flag.test.js test/stdout-flush.test.js test/format-determinism.test.js test/only-flag-channels.test.js test/confidence.test.js test/security-trend.test.js test/calibration-drift.test.js test/validator-metrics.test.js test/clustering-ir-taint-line.test.js test/concurrency-cwe.test.js test/compliance-mapping-liveness.test.js test/module-artifact-liveness.test.js test/supply-chain-provenance-completeness.test.js test/compliance-severity-threshold.test.js test/compliance-severity-policy.test.js test/compliance-evidence-binding.test.js test/compliance-evidence-signing.test.js test/compliance-file-contains.test.js test/label-isolation.test.js test/evidence-grade-wording.test.js test/llm-model-status.test.js test/egress-policy-constraints.test.js test/egress-redact.test.js test/egress-audit.test.js test/egress-approved-providers.test.js test/family-registry.test.js test/coverage-strength.test.js test/framework-provenance.test.js test/framework-provenance-controlrefs.test.js test/third-party-verification.test.js test/proof-coverage.test.js test/calibration-holdout.test.js test/independent-population-gate.test.js test/catalog-freshness.test.js test/incremental-parity.test.js test/surface-smoke.test.js test/fix-coverage.test.js test/raw-source-carveout.test.js test/mlbom-conformance.test.js test/deploy-gate-replay.test.js test/sbom-conformance.test.js test/unscored-claims.test.js test/mcp-rug-pull.test.js test/agent-boundary-taint.test.js test/confinement-adversarial.test.js test/comment-strip-cost.test.js test/reachability-claim.test.js test/entrypoint-breadth.test.js test/dep-file-admission.test.js test/custom-rules-freshness.test.js test/posture/provenance-schema.test.js test/posture/provenance-cache.test.js test/helpers/build-git-fixture.test.js test/posture/provenance-git-evidence.test.js test/posture/provenance-dag-walk.test.js test/posture/provenance-confidence.test.js test/posture/provenance-predicate-replay.test.js test/posture/provenance-origin-resolver.test.js test/posture/provenance-ai-authorship.test.js test/posture/provenance-branch-entry.test.js test/posture/provenance-evidence-attribution.test.js test/posture/provenance-lifecycle.test.js test/posture/provenance-missing-control-resolver.test.js test/posture/provenance-missing-control-wiring.test.js test/posture/provenance-coordinator.test.js test/posture/provenance-sca-origin.test.js test/posture/provenance-transitive-sca.test.js test/posture/provenance-coordinator-sca.test.js test/posture/provenance-providers.test.js test/posture/provenance-evidence-bundle.test.js test/posture/provenance-repo-lineage.test.js test/posture/provenance-secrets-logic.test.js test/cli/provenance-flags.test.js test/cli/attest-provenance.test.js test/cli/attest-obligations.test.js test/cli/models.test.js test/cli/setup-llm.test.js test/cli/fix-retry.test.js test/cli/compliance-walkthrough-lineage.test.js test/cli/dataflow-export-privacy.test.js test/cli/dataflow-export-briefing.test.js test/cli/lineage-snapshot-persist.test.js test/cli/dataflow-diff.test.js test/cli/dataflow-watch.test.js test/cli/dataflow-recipients.test.js test/cli/dataflow-coverage.test.js test/security/provenance-safety.test.js test/security/provenance-injection.test.js test/posture/remediation-ledger.test.js test/posture/assurance-baseline.test.js test/posture/assurance-contracts.test.js test/posture/assurance-config.test.js test/evidence-issuer.test.js test/load-factor.test.js test/proof-fabric/core.test.js test/proof-fabric/fix-store-runner.test.js test/proof-fabric/fixtures.test.js test/cli/proof-fabric-cli.test.js test/rule-compiler/core.test.js test/cli/rule-compiler-cli.test.js test/fleet/fleet-graph.test.js test/fleet/fleet-manifest.test.js test/fleet/fleet-cli.test.js test/artifact/safe-tar.test.js test/artifact/image-archive.test.js test/artifact/filesystem.test.js test/artifact/layer-secrets.test.js test/artifact/inventory.test.js test/artifact/vuln-correlate.test.js test/artifact/signature.test.js test/artifact/provenance-graph.test.js test/artifact/mismatch.test.js test/artifact/vex.test.js test/cli/artifact-provenance-cli.test.js",
     "test:dataflow": "node --test test/privacy-catalog.test.js test/privacy-deep-walker.test.js test/privacy-deep-e2e.test.js test/container-taint.test.js test/stored-taint-families.test.js test/py-annotation-sources.test.js test/fn-reach.test.js test/deep-taint.test.js test/calibration.test.js test/holdout-eval.test.js test/cross-lang-meta.test.js test/cross-lang-queues.test.js test/phase5-xlang.test.js test/phase5-coverage.test.js test/phase6-taint.test.js test/llm-validator-consistency.test.js test/llm-validator-default-on.test.js test/llm-validator-preset.test.js test/parser-py-cst.test.js test/chrome-probe.test.js test/parser-cs-kt.test.js test/parser-cs-annotations.test.js test/parser-cs-control-flow.test.js test/parser-kt-control-flow.test.js test/parser-js-annotations.test.js test/parser-java-annotations.test.js test/parser-java-control-flow.test.js test/parser-java-calls.test.js test/parser-go.test.js test/parser-rust.test.js test/rust-taint-flow.test.js test/parser-php-rb.test.js test/parser-php-control-flow.test.js test/interproc-k2.test.js test/proven-clean.test.js test/backward-default.test.js test/incremental-cache.test.js test/string-regex-lattice.test.js test/closure-capture.test.js test/points-to.test.js test/type-stubs.test.js test/soft-taint.test.js test/ifds.test.js test/symbolic-exec-proof.test.js test/ifds-summary-edges.test.js test/stub-aware-filter.test.js test/cross-repo.test.js test/proof-gate.test.js test/layer-recall.test.js test/java-taint-flow.test.js test/kt-taint-flow.test.js test/sanitizer-typed-flow.test.js test/sanitizer-gate-unit.test.js test/proof-safe.test.js test/collection-taint.test.js test/kcfa-context.test.js test/kcfa-callstring.test.js test/flow-parity.test.js test/callgraph-resolve.test.js test/import-reachability.test.js test/ir-stats.test.js test/parser-cpp.test.js test/parser-js-decorators.test.js test/parser-js-if-else-cfg.test.js test/cpp-integration.test.js test/engine-reconnect.test.js test/phase2-scoping.test.js test/engine-recall.test.js test/catalog-annotation-source.test.js test/catalog-cs-p1.test.js test/catalog-expanded.test.js test/builtin-summaries.test.js test/interproc-mutation-crash.test.js test/mutated-param-taint.test.js test/return-sink-check.test.js test/higher-order-inline-callback.test.js test/interproc-findings-discard.test.js test/runscan-deep-option.test.js test/summary-cache-convergence.test.js test/parser-rb-calls.test.js test/parser-rb-module-level.test.js test/balanced-call.test.js test/destructuring-taint.test.js test/computed-member-taint.test.js test/string-interpolation-taint.test.js test/dataflow-deadcode-severity.test.js test/catalog-dotted-callee-lookup.test.js test/builtin-summary-family-blind-kill.test.js test/deep-mode-annotator-pipeline.test.js test/receiver-type-and-nested-calls.test.js test/member-write-and-loop-taint.test.js test/parser-py-module-level.test.js test/parser-php-module-level.test.js test/r14b-module-level-e2e.test.js test/annotation-taint-engine.test.js test/interproc-nested-call-taint.test.js test/catalog-xpath-injection.test.js test/catalog-ldap-injection.test.js test/catalog-xxe.test.js test/catalog-response-splitting.test.js test/catalog-code-injection.test.js test/parser-rb-control-flow.test.js test/catalog-ruby-p1.test.js test/callee-receiver-taint.test.js test/catalog-command-injection-p4.test.js test/catalog-xss-p4.test.js test/catalog-path-ssrf-p3.test.js test/catalog-ai-model-provider-precision.test.js test/catalog-orm-write.test.js test/dataflow/provenance-pipeline-integration.test.js test/dataflow-progress.test.js test/scan-progress.test.js test/sard-leakage-pipeline.test.js test/sard-split-scoring.test.js test/sard-llm-isolation.test.js test/sard-mutation-adversarial.test.js test/sard-baseline-adaptive-tolerance.test.js test/sard-independent-holdout.test.js test/sard-flow-aware-scoring.test.js test/sard-macro-score-support-floor.test.js test/sard-php-split.test.js test/parser-java-nary-concat.test.js test/sard-naive-baseline.test.js test/field-taint-cross-method.test.js test/field-taint-engine-unit.test.js test/coercion-sanitizer-kill.test.js test/constant-propagation-path-sensitivity.test.js test/parser-java-assignments.test.js test/catalog-java-sard.test.js test/parser-cs-juliet-shapes.test.js test/catalog-cs-sard-p2.test.js test/sard-cwe-key-merge.test.js test/parser-php-backtick.test.js test/parser-php-include.test.js test/php-include-merge.test.js test/parser-php-array-field-taint.test.js test/parser-php-cond-assign.test.js test/parser-rust-redos.test.js test/multi-sink-taint-chain.test.js test/static-field-cross-class-call-string.test.js test/regex-guard-narrowing.test.js test/object-instance-field-taint.test.js test/param-type-inference.test.js test/smt-path-feasibility.test.js test/cross-service-taint.test.js test/dataflow-expr-taint-scaling.test.js test/evaluation/guard-dominance.test.js test/evaluation/engine-mechanisms.test.js test/rx-exec-receiver.test.js",
     "test:mcp": "node --test test/mcp.test.js test/mcp-apply-fix-multifile.test.js test/mcp-protocol-smoke.test.js test/mcp-audit.test.js test/audit-cli.test.js test/mcp-scratchpad.test.js test/mcp-offload.test.js test/sca-upgrade.test.js test/lsp-server.test.js test/mcp-dataflow-tools.test.js test/cli/governance-propose-edit.test.js test/cli/remediation-open-update.test.js test/cli/remediation-verify-reopen.test.js test/cli/dataflow-observations.test.js test/cli/federate-declare-list.test.js test/capabilities/tools.test.js",
     "test:report": "node --test test/report-scan-invariants.test.js test/junit.test.js test/ci.test.js test/poc-generator.test.js test/verifier.test.js test/verifier-target.test.js test/annotator-errors.test.js test/scan-health.test.js test/finding-schema.test.js test/pipeline/finding-schema-provenance.test.js test/evidence-provenance.test.js test/report/provenance-output.test.js test/report/provenance-format-parity.test.js test/legacy-compat.test.js test/annotator-runner.test.js test/detector-runner.test.js test/detector-errors.test.js test/analyzer-supervisor.test.js test/cascade-worker-pool.test.js test/cascade-pool-wiring.test.js test/coverage-ledger.test.js test/coverage-ledger-completeness.test.js test/assurance-mode.test.js test/artifact-registry.test.js test/artifact-registry-completeness.test.js test/retention-policy.test.js test/state-lifecycle-report.test.js test/legal-hold.test.js test/production-feedback.test.js test/calibration-feedback.test.js test/encryption-provider.test.js test/grader-calibration.test.js test/pr-delta-gate.test.js test/vex.test.js test/report-render.test.js test/oscal-conformance.test.js test/cli-fix-apply.test.js test/apply-fix-service.test.js test/high-impact-approval-gate.test.js test/approver-registry.test.js test/suppression-exceptions.test.js test/fix-history.test.js test/producer-registry.test.js test/producer-collector.test.js test/enrichment-completion.test.js",
-    "test:lineage": "node --test test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js",
+    "test:lineage": "node --test test/lineage/schema.test.js test/lineage/ids.test.js test/lineage/protection.test.js test/lineage/classification.test.js test/lineage/validate.test.js test/lineage/json-schema-parity.test.js test/lineage/flagship-fixture.test.js test/lineage/flagship-fixture-semantics.test.js test/lineage/field-identity.test.js test/lineage/engine-expr-resolver.test.js test/lineage/engine-walker.test.js test/lineage/engine-integration.test.js test/lineage/engine-receiver-identity.test.js test/lineage/summaries.test.js test/lineage/driver.test.js test/lineage/engine-provenance.test.js test/lineage/engine-provenance-interprocedural.test.js test/lineage/path-store.test.js test/lineage/path-query.test.js test/lineage/flow-grade.test.js test/lineage/source-registry.test.js test/lineage/sink-registry.test.js test/lineage/transform-catalog.test.js test/lineage/handling-analyzer.test.js test/lineage/registry-real-code.test.js test/lineage/source-seeding.test.js test/lineage/graph-builder.test.js test/lineage/coverage.test.js test/lineage/resolve-destination.test.js test/lineage/queue-detail.test.js test/lineage/index.test.js test/lineage/obligation-mapping.test.js test/lineage/obligation-predicates.test.js test/lineage/obligation-predicates-walkthrough.test.js test/lineage/transit-protection.test.js test/lineage/at-rest-protection.test.js test/lineage/protection-summary.test.js test/lineage/ac01-multi-sink.test.js test/lineage/policy-verdict.test.js test/lineage/governance-refs.test.js test/lineage/export-privacy.test.js test/lineage/export-json.test.js test/lineage/export-csv.test.js test/lineage/decision-story.test.js test/lineage/export-briefing.test.js test/lineage/graph-snapshot.test.js test/lineage/graph-diff.test.js test/lineage/drift-policy.test.js test/lineage/recipient-profile.test.js test/lineage/recipient-registry.test.js test/lineage/recipient-wiring.test.js test/lineage/redact-graph.test.js test/lineage-scan-wiring.test.js test/lineage-artifact-write.test.js test/bench-data-lineage-runner.test.js test/bundle-frontend.test.js test/bundle-frontend-golden.test.js test/generate-html-report.test.js test/export-image.test.js test/lineage/scenario.test.js test/lineage/scenario-engine.test.js test/lineage/scenario-diff.test.js test/lineage/scenario-no-obligation-wiring.test.js test/lineage/impact-assessment.test.js test/lineage/impact-engine.test.js test/lineage/impact-no-obligation-wiring.test.js test/lineage/governance-edit.test.js test/lineage/remediation.test.js test/lineage/runtime-observation.test.js test/lineage/observation-correlation.test.js test/lineage/observation-adapters.test.js test/lineage/observation-store.test.js test/lineage/runtime-corroboration-wiring.test.js test/lineage/cross-repo-link.test.js test/lineage/federation-loader.test.js test/lineage/cross-repo-link-wiring.test.js test/lineage/runtime-assurance.test.js test/cli/runtime-twin-cli.test.js",
     "test:bench-modules": "node --test test/phase4-harness.test.js test/pipeline.test.js test/proof-corpus-lib.test.js test/proof-corpus-runner.test.js",
     "test:server": "node --test test/server/graph-loader.test.js test/server/security.test.js test/server/routes.test.js test/server/http-server.test.js test/server/cmd-explore.test.js test/server/cmd-dataflow-export.test.js test/server/static-assets.test.js test/server/dataflow-scenario-cli.test.js test/server/dataflow-impact-cli.test.js",
     "test:haskell": "node --test test/haskell/haskell-injection.test.js test/haskell/haskell-ir.test.js test/haskell/haskell-manifests.test.js test/haskell/haskell-parser.test.js test/haskell/haskell-remediation.test.js test/haskell/haskell-resolved-graph.test.js test/haskell/haskell-sca.test.js test/haskell/haskell-sca-severity.test.js test/haskell/haskell-web-guards.test.js test/haskell/haskell-advisory-feed.test.js test/haskell/haskell-security-rules.test.js test/haskell/haskell-taint.test.js test/haskell/haskell-boundaries.test.js test/haskell/haskell-live-feed-scan.test.js test/haskell/haskell-supply-bounds.test.js test/haskell/haskell-ir-scaling.test.js",

package/src/artifact/CLAUDE.md

@@ -0,0 +1,100 @@
+# src/artifact/
+
+PRD 5 — Source-to-Artifact Security & Provenance. Binds a finding to the actual **built artifact** (a
+container image, today) that ships it, closing the gap between "this source file has a vulnerability" and
+"this specific image digest contains it." Isolated from every other subsystem this package already uses the
+word "provenance" for — see the naming section below before adding a new field or function name here.
+
+## Naming discipline (read this before adding a field)
+
+This repo already has 5 unrelated uses of "provenance"/"artifact": `posture/provenance/`'s `findingProvenance`
+(git-commit origin), `posture/provenance.js`'s `annotateFindingProvenance` (parser corroboration),
+`sca/sigstore-verify.js`'s `annotateProvenance` (package-build Sigstore verification), a pre-existing bare
+`finding.provenance` field, and `posture/artifact-registry.js` (internal `.agentic-security/*` state
+classification — nothing to do with container images). **Never** introduce a bare `.provenance`/`*Provenance`
+field or a module/field literally named `artifact-registry` here. This package's own graph field is
+`artifactProvenanceGraph`, built by `buildArtifactProvenanceGraph` — the compound name is deliberate. The
+PRD's own literal CLI surface (`agentic-security provenance trace`) is honored as user-facing text regardless;
+the discipline is about internal names, not the CLI vocabulary the PRD mandates.
+
+## Module map (read in this order — each builds on the last)
+
+- `safe-tar.js` — hardened POSIX/GNU tar reader. Every byte any other module in this package reads passes
+  through here first. Hard caps on entry count/size/archive size (`DEFAULT_LIMITS`), gzip decompression with
+  Node's native `maxOutputLength` guard (no custom streaming counter needed — see the file header), and an
+  entry-name safety check (`isSafeEntryName`) that flags `..`/absolute/NUL paths rather than normalizing
+  them. No caller ever writes extracted content to a real filesystem path — every result is an in-memory
+  `Map`/object keyed by the (safety-checked) tar entry name, which is what makes zip-slip structurally
+  impossible here rather than merely guarded against.
+- `image-archive.js` — parses a `docker save`-shaped archive (`manifest.json` + a config blob + per-layer
+  tars) or an OCI-layout archive (`oci-layout` + `index.json` + `blobs/sha256/*`) into one normalized shape.
+  Rejects (never guesses) a multi-image archive, a missing referenced blob, or malformed JSON.
+- `filesystem.js` — merges an image's layers in order, applying AUFS/overlay whiteout semantics
+  (`.wh.<name>` deletes, `.wh..wh..opq` makes a directory opaque to earlier layers). `readLayers` keeps the
+  RAW per-layer, pre-merge view (what `layer-secrets.js` needs to see "this existed in layer 3" even after a
+  later layer's whiteout hides it); `mergeLayers` produces the final filesystem view, bounded by
+  `DEFAULT_FS_LIMITS` (per-file and total materialization caps — large/binary files are tracked in `files`
+  metadata but never fully read into memory).
+- `inventory.js` — PRD P0 §1-2 (OCI image scanning + inventory). Ties the above together and feeds the merged
+  filesystem's text content through the EXISTING SCA pipeline: `sca/image-packages.js#extractImagePackages`
+  for OS packages, and an injected `manifestParser` (the engine's own `parseManifests`, from `sca/index.js`)
+  for application packages — no parallel manifest-parsing logic. `baseImage` is read ONLY from the
+  `org.opencontainers.image.base.name`/`.digest` labels when present; absent that, it is `null`, never a
+  guess from layer-content heuristics (no base-image fingerprint table exists in this codebase, and inventing
+  one would produce a confident-looking wrong answer).
+- `vuln-correlate.js` — PRD P0 §4. A thin wrapper handing `inventory`'s components to an injected
+  `queryOSVFn` (the engine's own `queryOSV`) — "reuse current SCA semantics" literally, not a reimplementation.
+- `layer-secrets.js` — PRD P0 §3 (layer secret analysis). `detectFn` is injected, mirroring
+  `posture/secret-history.js`'s own `(filePath, rawText) -> Finding[]` detector-injection shape for the exact
+  same reason: this package never imports `engine.js` directly, and the real `scanCredentials` detector
+  already returns redacted/masked values — this module never re-touches raw content once a finding exists,
+  so there's no second place a secret value could leak back in. `deletedButRecoverable` is the subset of
+  findings whose path (or an ancestor opaque-marked directory) was removed by a LATER layer's whiteout — the
+  PRD's named scenario ("added in layer 3, deleted in layer 5, but remains recoverable").
+- `signature.js` — PRD P0 §5. States are exactly the PRD's own four (`verified`/`invalid`/`missing`/
+  `unavailable`) — deliberately different words from `sigstore-verify.js`'s own vocabulary so the two are
+  never confused. `verifyImageSignature` is this tool's own local detached-signature convention (NOT cosign's
+  "simple signing" format). `verifyProvenanceAttestation` implements the REAL DSSE PAE (Pre-Authentication
+  Encoding) cosign/Sigstore attestations actually use — a real cosign-keyed attestation bundle verifies here
+  given the matching public key. Keyless/Rekor-transparency-log verification is NOT implemented (disclosed
+  gap; `sigstore-verify.js`'s Rekor-query pattern is the template a future increment could extend this with).
+- `provenance-graph.js` — PRD P0 §6. Assembles Git Commit → Build → OCI Digest → SBOM Component → Finding →
+  Deployment from evidence the modules above already computed — no new detection. The Git-Commit edge's only
+  evidence source is the `org.opencontainers.image.revision` label; absent that, the commit node is
+  `known: false`, never inferred from local git history by heuristic. `deployment` is always
+  OPERATOR-DECLARED (`{id, environment, digest}`) — nothing in this codebase discovers "which digest is
+  running where" on its own (`lineage/deployment/` models topology, not running digests), so a missing
+  `deployment` argument means the graph simply stops short, never a fabricated edge.
+- `mismatch.js` — PRD P0 §7, the PRD's own "Killer Demonstration". Compares a source-tree SCA scan against
+  one artifact's correlation by **OSV advisory id alone** — never by purl (which bakes in the version). Keying
+  by purl was tried first and is wrong: source and artifact are usually running different versions of the
+  same package by the entire premise of this comparison, so a purl-keyed match would report every version
+  difference as a double mismatch instead of asking "does this specific advisory affect each side's own
+  installed version." Scenario A ("Git: fixed / Production: still vulnerable") = an advisory present against
+  the artifact's version, absent against source's. Scenario B ("Git: vulnerable / Built artifact: absent") =
+  an advisory source flags whose PACKAGE (ecosystem+name, not version) never appears in the artifact's
+  inventory at all.
+- `vex.js` — PRD P0 §8. `not_affected` is reachable from exactly two evidence paths (component absent from
+  the artifact; confirmed-unreachable per existing dataflow/reachability evidence) — never from the absence
+  of information, per the PRD's own "`not affected` requires positive evidence" rule. Symmetrically,
+  `affected` requires CONFIRMED reachability, not merely "OSV lists this version as vulnerable"; absent that
+  confirmation the honest status is `under_investigation`, never a confident `affected` the evidence doesn't
+  support. `fixed` requires a clean dotted-numeric version comparison against a real `fixedVersions` entry —
+  an unparseable version pair skips that check rather than guessing.
+
+## CLI (`bin/agentic-security.js`)
+
+`image scan`/`image verify`/`provenance trace`/`supply vex` — the PRD's own literal CLI shape (NOT a mode of
+the `/supply` SLASH COMMAND, which is a different layer: Claude Code UI sugar that shells out to `scan --only
+sca`/`cve-watch`). A scanned artifact persists to `.agentic-security/artifact-scans/<digest-hex>.json`
+(registered in `posture/artifact-registry.js`) so `provenance trace <digest>`/`supply vex <digest>` can
+re-reference it without re-parsing the archive. Local-daemon image input (`docker save`) and a remote OCI
+registry reference are **NOT implemented** — only `docker save`/OCI-layout TAR FILE input — disclosed in
+`docs/implementation-status/source-to-artifact-provenance.md`, not silently dropped.
+
+## Test scope
+
+`test/artifact/*.test.js` + `test/cli/artifact-provenance-cli.test.js`, wired into `npm run test:posture`
+(same precedent as `fleet/`, `rule-compiler/`, `proof-fabric/` — not large enough for its own scoped script).
+`test/helpers/build-tar-fixture.js` is a test-only tar/OCI-archive WRITER (production code only ever reads
+tar, via `safe-tar.js`) — mirrors `build-git-fixture.js`'s role for the lineage/deployment suites.

package/src/artifact/filesystem.js

@@ -0,0 +1,100 @@
+// Merges an image's layers (in order) into one virtual filesystem view,
+// applying AUFS/overlay whiteout semantics (`.wh.<name>` deletes a file,
+// `.wh..wh..opq` makes a directory opaque to everything below it in earlier
+// layers). Nothing here ever writes to a real filesystem path — the merged
+// view is an in-memory Map keyed by the tar entry's (already path-safety-
+// checked) name, which is what makes this immune to zip-slip by construction
+// rather than by convention.
+import { readTarEntries, isWhiteoutName, whiteoutTarget, DEFAULT_LIMITS } from './safe-tar.js';
+
+export const DEFAULT_FS_LIMITS = Object.freeze({
+  maxFileBytes: 1 * 1024 * 1024, // per-file materialization cap
+  maxMaterializedTotalBytes: 256 * 1024 * 1024, // total content kept in memory
+});
+
+/**
+ * Reads every layer's tar into per-layer entry lists (bounded by the same
+ * safe-tar limits as the outer archive) without merging — the raw, ordered
+ * per-layer view that layer-secrets.js needs to see what a LATER layer
+ * deleted while it was still present in an EARLIER one.
+ */
+export function readLayers(layers, tarLimits = DEFAULT_LIMITS) {
+  const result = [];
+  const unsafeEntries = [];
+  for (const layer of layers) {
+    const entries = [];
+    for (const e of readTarEntries(layer.tar, tarLimits)) {
+      if (e.unsafe) {
+        unsafeEntries.push({ layerIndex: layer.index, name: e.name });
+        continue;
+      }
+      entries.push(e);
+    }
+    result.push({ layerIndex: layer.index, entries });
+  }
+  return { layers: result, unsafeEntries };
+}
+
+/**
+ * Merges the per-layer entry lists (from readLayers) into one final
+ * filesystem view, applying whiteouts in layer order. Returns:
+ *   - `files`: Map<path, { sizeBytes, sourceLayerIndex, typeflag }> — every
+ *     surviving path, metadata only.
+ *   - `fileContents`: { path: string } — decoded text content, capped per
+ *     file and in total (see DEFAULT_FS_LIMITS); large/binary files are
+ *     present in `files` but absent here.
+ *   - `deletedPaths`: [{ path, deletedAtLayer, opaque }] — every whiteout
+ *     seen, in order, regardless of whether the path ever existed.
+ *   - `materializationTruncated`: true once the total content cap was hit —
+ *     disclosed, not silent.
+ */
+export function mergeLayers(readLayersResult, fsLimits = DEFAULT_FS_LIMITS) {
+  const files = new Map(); // path -> { sizeBytes, sourceLayerIndex, typeflag, data }
+  const deletedPaths = [];
+  let materializedTotal = 0;
+  let materializationTruncated = false;
+
+  for (const { layerIndex, entries } of readLayersResult.layers) {
+    const opaqueDirs = [];
+    for (const e of entries) {
+      if (isWhiteoutName(e.name)) {
+        const wh = whiteoutTarget(e.name);
+        if (wh.opaque) {
+          opaqueDirs.push(wh.dir);
+          deletedPaths.push({ path: wh.dir, deletedAtLayer: layerIndex, opaque: true });
+          for (const existing of [...files.keys()]) {
+            if (existing === wh.dir || existing.startsWith(`${wh.dir}/`)) files.delete(existing);
+          }
+        } else {
+          deletedPaths.push({ path: wh.path, deletedAtLayer: layerIndex, opaque: false });
+          files.delete(wh.path);
+        }
+        continue;
+      }
+      // An opaque marker earlier in THIS layer hides any further entry in
+      // this same layer that would resurrect something under that dir —
+      // real overlay semantics scope opaque to "everything from layers
+      // BELOW this one", so same-layer adds after the marker still apply.
+      files.set(e.name, { sizeBytes: e.size, sourceLayerIndex: layerIndex, typeflag: e.typeflag, data: e.data });
+    }
+  }
+
+  const fileContents = {};
+  for (const [path, meta] of files) {
+    if (meta.typeflag !== '0' && meta.typeflag !== '') continue; // only regular files get content
+    if (meta.sizeBytes > fsLimits.maxFileBytes) continue;
+    if (materializedTotal + meta.sizeBytes > fsLimits.maxMaterializedTotalBytes) {
+      materializationTruncated = true;
+      continue;
+    }
+    fileContents[path] = meta.data.toString('utf8');
+    materializedTotal += meta.sizeBytes;
+  }
+
+  const fileMeta = new Map();
+  for (const [path, meta] of files) {
+    fileMeta.set(path, { sizeBytes: meta.sizeBytes, sourceLayerIndex: meta.sourceLayerIndex, typeflag: meta.typeflag });
+  }
+
+  return { files: fileMeta, fileContents, deletedPaths, materializationTruncated };
+}

package/src/artifact/image-archive.js

@@ -0,0 +1,159 @@
+// Parses a Docker-save ("docker-archive") or OCI-layout ("oci-archive") tar
+// into one normalized shape, without executing or daemon-mounting the image
+// (PRD 5 Safety Requirements: "OCI inspection should not require executing
+// the image"). Built entirely on `safe-tar.js` — every byte read here passes
+// through the same entry-count/size/path/decompression guards.
+import crypto from 'node:crypto';
+import { readTarEntries, decompressIfGzip, DEFAULT_LIMITS } from './safe-tar.js';
+
+export class ImageArchiveError extends Error {
+  constructor(message, code) {
+    super(message);
+    this.name = 'ImageArchiveError';
+    this.code = code;
+  }
+}
+
+function safeJsonParse(buf, what) {
+  try {
+    return JSON.parse(buf.toString('utf8'));
+  } catch (err) {
+    throw new ImageArchiveError(`${what} is not valid JSON: ${err.message}`, 'malformed_manifest');
+  }
+}
+
+function readOuterEntries(buf, limits) {
+  const outer = decompressIfGzip(buf, limits);
+  const byName = new Map();
+  const unsafeEntries = [];
+  for (const e of readTarEntries(outer, limits)) {
+    if (e.unsafe) {
+      unsafeEntries.push({ name: e.name });
+      continue;
+    }
+    byName.set(e.name, e);
+  }
+  return { byName, unsafeEntries };
+}
+
+function extractConfigShape(configObj) {
+  const cfg = (configObj && configObj.config) || {};
+  return {
+    architecture: configObj.architecture || null,
+    os: configObj.os || null,
+    labels: (cfg.Labels && typeof cfg.Labels === 'object') ? { ...cfg.Labels } : {},
+    entrypoint: Array.isArray(cfg.Entrypoint) ? [...cfg.Entrypoint] : null,
+    cmd: Array.isArray(cfg.Cmd) ? [...cfg.Cmd] : null,
+    history: Array.isArray(configObj.history)
+      ? configObj.history.map((h) => ({ createdBy: h.created_by || null, created: h.created || null, emptyLayer: !!h.empty_layer }))
+      : [],
+    rootfsDiffIds: (configObj.rootfs && Array.isArray(configObj.rootfs.diff_ids)) ? [...configObj.rootfs.diff_ids] : [],
+  };
+}
+
+function parseDockerArchive(byName, outerUnsafe, limits) {
+  const manifestEntry = byName.get('manifest.json');
+  const manifestArr = safeJsonParse(manifestEntry.data, 'manifest.json');
+  if (!Array.isArray(manifestArr) || manifestArr.length === 0) {
+    throw new ImageArchiveError('manifest.json contains no images', 'empty_manifest');
+  }
+  if (manifestArr.length > 1) {
+    throw new ImageArchiveError(`manifest.json describes ${manifestArr.length} images; image scan expects exactly one`, 'multi_image_archive');
+  }
+  const m = manifestArr[0];
+  if (typeof m.Config !== 'string' || !Array.isArray(m.Layers)) {
+    throw new ImageArchiveError('manifest.json entry is missing Config or Layers', 'malformed_manifest');
+  }
+  const configEntry = byName.get(m.Config);
+  if (!configEntry) throw new ImageArchiveError(`manifest.json references missing config "${m.Config}"`, 'missing_blob');
+  const configObj = safeJsonParse(configEntry.data, m.Config);
+  const configDigest = `sha256:${crypto.createHash('sha256').update(configEntry.data).digest('hex')}`;
+
+  const layers = [];
+  for (let i = 0; i < m.Layers.length; i++) {
+    const layerPath = m.Layers[i];
+    const entry = byName.get(layerPath);
+    if (!entry) throw new ImageArchiveError(`manifest.json references missing layer "${layerPath}"`, 'missing_blob');
+    const tar = decompressIfGzip(entry.data, limits);
+    layers.push({ index: i, path: layerPath, diffId: configObj?.rootfs?.diff_ids?.[i] || null, tar, sizeBytes: entry.size });
+  }
+
+  return {
+    format: 'docker-archive',
+    digest: configDigest,
+    digestKind: 'config',
+    repoTags: Array.isArray(m.RepoTags) ? m.RepoTags : [],
+    config: extractConfigShape(configObj),
+    layers,
+    unsafeEntries: outerUnsafe,
+  };
+}
+
+function parseOciArchive(byName, outerUnsafe, limits) {
+  const indexObj = safeJsonParse(byName.get('index.json').data, 'index.json');
+  const manifests = Array.isArray(indexObj.manifests) ? indexObj.manifests : [];
+  if (manifests.length === 0) throw new ImageArchiveError('index.json lists no manifests', 'empty_manifest');
+  if (manifests.length > 1) {
+    throw new ImageArchiveError(`index.json describes ${manifests.length} manifests; image scan expects exactly one`, 'multi_image_archive');
+  }
+  const manifestDigest = manifests[0].digest;
+  if (typeof manifestDigest !== 'string' || !manifestDigest.startsWith('sha256:')) {
+    throw new ImageArchiveError('index.json manifest entry has no sha256 digest', 'malformed_manifest');
+  }
+  const manifestBlobPath = `blobs/sha256/${manifestDigest.slice('sha256:'.length)}`;
+  const manifestEntry = byName.get(manifestBlobPath);
+  if (!manifestEntry) throw new ImageArchiveError(`index.json references missing manifest blob "${manifestBlobPath}"`, 'missing_blob');
+  const manifestObj = safeJsonParse(manifestEntry.data, manifestBlobPath);
+
+  const configDigest = manifestObj.config && manifestObj.config.digest;
+  if (typeof configDigest !== 'string' || !configDigest.startsWith('sha256:')) {
+    throw new ImageArchiveError('image manifest has no config digest', 'malformed_manifest');
+  }
+  const configBlobPath = `blobs/sha256/${configDigest.slice('sha256:'.length)}`;
+  const configEntry = byName.get(configBlobPath);
+  if (!configEntry) throw new ImageArchiveError(`manifest references missing config blob "${configBlobPath}"`, 'missing_blob');
+  const configObj = safeJsonParse(configEntry.data, configBlobPath);
+
+  const layerDescs = Array.isArray(manifestObj.layers) ? manifestObj.layers : [];
+  const layers = [];
+  for (let i = 0; i < layerDescs.length; i++) {
+    const d = layerDescs[i];
+    if (typeof d.digest !== 'string' || !d.digest.startsWith('sha256:')) {
+      throw new ImageArchiveError(`layer ${i} has no sha256 digest`, 'malformed_manifest');
+    }
+    const blobPath = `blobs/sha256/${d.digest.slice('sha256:'.length)}`;
+    const entry = byName.get(blobPath);
+    if (!entry) throw new ImageArchiveError(`manifest references missing layer blob "${blobPath}"`, 'missing_blob');
+    const tar = decompressIfGzip(entry.data, limits);
+    layers.push({ index: i, path: blobPath, diffId: d.digest, mediaType: d.mediaType || null, tar, sizeBytes: entry.size });
+  }
+
+  return {
+    format: 'oci-archive',
+    digest: manifestDigest,
+    digestKind: 'manifest',
+    repoTags: [],
+    config: extractConfigShape(configObj),
+    layers,
+    unsafeEntries: outerUnsafe,
+  };
+}
+
+/**
+ * Parses an in-memory tar buffer (already read from disk/stdin by the
+ * caller — this module never touches the filesystem or network) as either a
+ * `docker save`-shaped archive or an OCI-layout archive. Throws
+ * ImageArchiveError for anything it cannot recognize or whose manifest
+ * references a blob that isn't present — never guesses or substitutes a
+ * default.
+ */
+export function parseImageArchive(buf, limits = DEFAULT_LIMITS) {
+  if (!Buffer.isBuffer(buf)) throw new ImageArchiveError('image archive input must be a Buffer', 'bad_input');
+  const { byName, unsafeEntries } = readOuterEntries(buf, limits);
+  if (byName.has('manifest.json')) return parseDockerArchive(byName, unsafeEntries, limits);
+  if (byName.has('index.json') && byName.has('oci-layout')) return parseOciArchive(byName, unsafeEntries, limits);
+  throw new ImageArchiveError(
+    'archive is neither a docker-archive (manifest.json) nor an oci-archive (oci-layout + index.json)',
+    'unrecognized_format',
+  );
+}

package/src/artifact/inventory.js

@@ -0,0 +1,69 @@
+// PRD 5 P0 §1-2 — OCI image scanning + inventory. Ties image-archive.js
+// (manifest/config/layer parsing) and filesystem.js (whiteout-aware layer
+// merge) into the single inventory shape the PRD names: digest, OS, OS
+// packages, application packages, architecture, base image, layers,
+// entrypoint, build labels.
+import { parseImageArchive } from './image-archive.js';
+import { readLayers, mergeLayers, DEFAULT_FS_LIMITS } from './filesystem.js';
+import { extractImagePackages } from '../sca/image-packages.js';
+import { DEFAULT_LIMITS as DEFAULT_TAR_LIMITS } from './safe-tar.js';
+
+// Buildkit/Docker provenance convention — not an OCI spec requirement, so
+// its absence is reported as "not declared", never guessed from layer
+// heuristics (no base-image fingerprint table exists in this codebase, and
+// inventing one would produce a confident-looking wrong answer, which is the
+// one failure mode PRD 5's own Safety Requirements single out by name for
+// signature state — the same discipline applies here).
+const BASE_IMAGE_NAME_LABEL = 'org.opencontainers.image.base.name';
+const BASE_IMAGE_DIGEST_LABEL = 'org.opencontainers.image.base.digest';
+
+/**
+ * `buf` is an already-read image archive buffer (tar, optionally
+ * gzip-wrapped). `manifestParser` is the engine's existing
+ * `parseManifests(allFileContents)` (injected, mirroring
+ * `src/posture/secret-history.js`'s detectFn injection, so this module never
+ * imports `engine.js` directly and `src/sca/index.js` stays the one seam).
+ * Returns `{ image, inventory }` where `image` is the raw parsed archive
+ * (image-archive.js's shape, kept for callers that need layer tars — vuln
+ * correlation, signature verification) and `inventory` is the PRD-named
+ * report.
+ */
+export function buildImageInventory(buf, { manifestParser, tarLimits = DEFAULT_TAR_LIMITS, fsLimits = DEFAULT_FS_LIMITS } = {}) {
+  if (typeof manifestParser !== 'function') throw new TypeError('buildImageInventory requires manifestParser(allFileContents)');
+  const image = parseImageArchive(buf, tarLimits);
+  const rl = readLayers(image.layers, tarLimits);
+  const merged = mergeLayers(rl, fsLimits);
+
+  const osPackages = extractImagePackages(merged.fileContents);
+  let appPackages = [];
+  try {
+    appPackages = manifestParser(merged.fileContents) || [];
+  } catch {
+    appPackages = []; // a parser failure on hostile layer content must never abort inventory extraction
+  }
+
+  const labels = image.config.labels || {};
+  const baseImage = labels[BASE_IMAGE_NAME_LABEL]
+    ? { name: labels[BASE_IMAGE_NAME_LABEL], digest: labels[BASE_IMAGE_DIGEST_LABEL] || null, source: 'label' }
+    : null;
+
+  const inventory = {
+    digest: image.digest,
+    digestKind: image.digestKind,
+    repoTags: image.repoTags,
+    os: image.config.os,
+    architecture: image.config.architecture,
+    baseImage,
+    osPackages,
+    appPackages,
+    layers: image.layers.map((l) => ({ index: l.index, sizeBytes: l.sizeBytes, diffId: l.diffId || null })),
+    entrypoint: image.config.entrypoint,
+    cmd: image.config.cmd,
+    buildLabels: { ...labels },
+    history: image.config.history,
+    unsafeEntries: [...image.unsafeEntries, ...rl.unsafeEntries],
+    materializationTruncated: merged.materializationTruncated,
+  };
+
+  return { image, inventory, mergedFilesystem: merged, readLayersResult: rl };
+}

package/src/artifact/layer-secrets.js

@@ -0,0 +1,92 @@
+// PRD 5 P0 §3 — Layer Secret Analysis: a secret added in one layer and later
+// deleted (via an overlay whiteout) is still sitting in that earlier layer's
+// raw tar bytes inside the image archive — recoverable by anyone who has the
+// archive, even though it is invisible in `docker run`'s final filesystem.
+//
+// The actual credential detection is INJECTED as `detectFn` (the exact
+// `(filePath, rawText) -> Finding[]` shape `src/posture/secret-history.js`
+// already uses for the git-history analog of this same idea), so this module
+// never imports `engine.js` and stays a pure, independently-testable
+// transform over the layer data `filesystem.js` already extracted. The
+// injected detector (`scanCredentials`) already returns only redacted/masked
+// values (`masked`, a redacted `snippet`) — this module never re-touches raw
+// file content once a finding exists, so there is no second place a value
+// could leak back in.
+import { isWhiteoutName } from './safe-tar.js';
+
+export const DEFAULT_SECRET_SCAN_LIMITS = Object.freeze({
+  maxFileBytes: 512 * 1024,
+});
+
+/**
+ * `readLayersResult` is `filesystem.js#readLayers`'s output (ordered,
+ * per-layer, pre-merge entries — the only shape that preserves "this path
+ * existed in layer 3" even after a later layer's whiteout removes it from
+ * the merged view). `deletedPaths` is `mergeLayers`'s output.
+ *
+ * Returns `{ findings, deletedButRecoverable, materializationSkipped }`:
+ *   - `findings`: every detector hit across every layer's added files, each
+ *     tagged with `path`/`layerIndex` and the detector's own (already
+ *     redacted) finding fields — this is the full history sweep, not just
+ *     the deleted-but-recoverable subset.
+ *   - `deletedButRecoverable`: the subset of `findings` whose `path` was
+ *     later removed by a whiteout in a LATER layer — PRD 5's named scenario.
+ *   - `materializationSkipped`: paths whose content was too large to scan
+ *     (disclosed, never silently treated as "no secret found").
+ */
+export function analyzeLayerSecrets({ readLayersResult, deletedPaths, detectFn, limits = DEFAULT_SECRET_SCAN_LIMITS }) {
+  if (typeof detectFn !== 'function') throw new TypeError('analyzeLayerSecrets requires a detectFn(filePath, rawText) -> Finding[]');
+  if (!readLayersResult || !Array.isArray(readLayersResult.layers)) throw new TypeError('analyzeLayerSecrets requires filesystem.js#readLayers output');
+
+  const deletedAtByPath = new Map(); // path -> earliest layer index that deleted it
+  for (const d of deletedPaths || []) {
+    if (d.opaque) continue; // opaque-directory deletions are reported separately below
+    if (!deletedAtByPath.has(d.path) || d.deletedAtLayer < deletedAtByPath.get(d.path)) {
+      deletedAtByPath.set(d.path, d.deletedAtLayer);
+    }
+  }
+  const opaqueDirs = (deletedPaths || []).filter((d) => d.opaque);
+
+  const findings = [];
+  const materializationSkipped = [];
+
+  for (const { layerIndex, entries } of readLayersResult.layers) {
+    for (const e of entries) {
+      if (isWhiteoutName(e.name)) continue;
+      if (e.typeflag !== '0' && e.typeflag !== '') continue; // regular files only
+      if (e.size > limits.maxFileBytes) {
+        materializationSkipped.push({ path: e.name, layerIndex, sizeBytes: e.size });
+        continue;
+      }
+      let text;
+      try {
+        text = e.data.toString('utf8');
+      } catch {
+        continue; // not decodable as text — not a candidate for a text-pattern secret scan
+      }
+      let hits;
+      try {
+        hits = detectFn(e.name, text) || [];
+      } catch {
+        hits = []; // a detector failure on hostile/malformed content must never abort the sweep
+      }
+      for (const hit of hits) {
+        const deletedAtLayer = deletedAtByPath.has(e.name) && deletedAtByPath.get(e.name) > layerIndex
+          ? deletedAtByPath.get(e.name)
+          : null;
+        const underOpaqueDir = opaqueDirs.some((d) => d.deletedAtLayer > layerIndex && (e.name === d.path || e.name.startsWith(`${d.path}/`)));
+        findings.push({
+          ...hit,
+          path: e.name,
+          addedAtLayer: layerIndex,
+          deletedAtLayer: deletedAtLayer ?? (underOpaqueDir ? opaqueDirs.find((d) => d.deletedAtLayer > layerIndex && (e.name === d.path || e.name.startsWith(`${d.path}/`))).deletedAtLayer : null),
+          recoverable: deletedAtLayer != null || underOpaqueDir,
+        });
+      }
+    }
+  }
+
+  const deletedButRecoverable = findings.filter((f) => f.recoverable);
+
+  return { findings, deletedButRecoverable, materializationSkipped };
+}