@clear-capabilities/agentic-security-scanner 0.179.0 → 0.182.0

package/CHANGELOG.md

@@ -9,6 +9,36 @@
 > make the history less accurate, not more.
 
 
+## 0.182.0 - Five Labs capabilities freeze their interfaces and move to Preview, and the strategic metrics become product numbers
+
+Preview is not GA. Each move below gives a capability a reference page that lists every field, flag and exit code, and a compatibility test that runs the real commands and fails when the output gains or loses a field the page does not list.
+
+- **Five capabilities leave Labs for Preview:** Eval Lab and the model router, fleet scanning, the finding-to-rule compiler, release assurance, and detection and response. Detector spec synthesis and runner-level capability enforcement stay Labs, with their exit criteria written on the Labs page.
+- **Release assurance has a command and a release check.** `agentic-security release-package build|verify` assembles a signed package from the last scan (refusing a scan whose signature does not verify) and checks one offline. The new `release-assurance-gate` builds a package from a scan of a shipped project, requires the independent offline verifier to accept it, and requires it to refuse a lowered severity, a restated verdict and an unsigned scan.
+- **The exposure window joins the artifact provenance graph.** `dnr window --artifact-graph` places a deployment that names only an image digest at the commit the image declares, refuses a record that disagrees with its image, and never infers a commit the image does not declare.
+- **Three strategic metrics are reported with their counts.** `agentic-security metrics` (and `posture --metrics`, and the scorecard) report Assurance Coverage, Evidence Conversion and Verified Remediation Rate, each with numerator, denominator and basis. The Security Learning Rate is reported as not measured.
+- **The proof gate on fixes is measured.** `bench/fix-verification/proof-gate.mjs` runs `fix --apply --require-proof` over the fix-verification corpus: 0 of 15 unsafe fixes applied, 1 of 8 safe fixes applied and 7 refused for want of a reproducer (generation covers command injection, path-writing traversal and request forgery). The gate fails closed. An exploit-proof contract page and test freeze the proof result and the fix proof record.
+- **Hosted legs for real tools are written** (`scripts/artifact-real-check.mjs`, `scripts/local-model-check.mjs`); the local-model script was run against a real model server on a laptop and found and fixed one wrong assertion about where the validator lists what it rejects.
+
+## 0.181.0 - Three capabilities earn GA: the sibling sweep, blast radius and federation
+
+Registry, documentation and release-gate tooling, plus one precision fix to the sibling sweep. No capability was relabeled without evidence: each promotion below meets the GA bar, and four others were assessed and held at Preview with the measured reason recorded in `docs/implementation-status/ga-promotion.md`.
+
+- **0.180.0 was tagged but never published, and the reason is fixed here.** Its hosted release gate failed on `sca-replay-gate`: the engine reads today's advisory data while `labels.json` is a months-old snapshot, so every advisory published since counted as an engine false positive (precision 95.6% against a committed 100%). The check now re-labels in the same run (`bench/sca-replay/check.mjs`, labels in a temp file, nothing written to the repository) so both sides read the same data, holds precision to 2 points and recall to 6 (recall moves with how fresh the engine's own advisory lookups are). Everything 0.180.0 described ships in this release.
+- **Repository-wide sibling sweep is GA.** New `bench/sibling-sweep` seeds eight sink kinds across JavaScript, Python and Java plus a 150-sibling case, and the new `sibling-sweep-gate` release check compares it for equality. It finds every same-shape copy (159 of 159) and 1 of 9 siblings built another way, and it can match a mention in a comment; both are written on the contract page. The bench exposed a defect that is fixed: a chain of argument-less calls such as `Runtime.getRuntime().exec(x)` anchored on its first call, so every other use of `Runtime.getRuntime()` counted as a sibling.
+- **Blast-radius assessment is GA.** New `bench/blast-radius` compares the assessment with an independent reference on 300 seeded graphs (7856 targets) and the new `blast-radius-gate` release check holds it. The command's exit codes and the record's fields are now a contract page with a test that fails when either changes.
+- **Cross-repository graph federation is GA.** A contract page and a test that runs the real `federate declare` and `federate list`, and checks that neither graph file changes, a dry run writes nothing, the same fact is one link, and a declaration can never claim to be observed.
+- **Held at Preview, with evidence:** Code Boundaries (the lineage corpus passes 17 of 24), deterministic context intelligence (Flask routes mostly unresolved), compliance control evidence (coverage maps for 5 of 10 frameworks), finding provenance (accuracy, coverage and overhead below their targets).
+
+## 0.180.0 - The GA bar: GA is earned against named evidence, and checked
+
+Documentation, registry and release-gate tooling only. No scanner behavior changed, and no capability changed maturity.
+
+- **What GA means is now written and checked.** `docs/how-it-works/maturity-model.md` states seven criteria. Five are mechanical: a GA capability in `docs/capabilities.yaml` names `since`, a `contract` page, a `contractTest`, a release `gate`, `platforms` (`os:job` pairs with a Linux job) and a `limits` section. `scripts/check-positioning-docs.mjs` fails when any named page, test, gate, job or section does not exist, when the contract test is run by no scanner test script, or when a limits section lacks a `limits-verified` date within 90 days of the checkout's HEAD commit. A Preview capability needs a contract page or a dated contract note.
+- **Two new release checks.** `contract-conformance` runs exactly the contract tests the registry names. `sca-replay-gate` is the first release gate on dependency risk: it compares the SCA bench to its committed result and fails on a drop of more than half a point in version recall or precision, or on a lost scored entry. It needs network and is not part of the offline pre-push gate.
+- **Fixed a flake the 0.179.0 warm-up introduced.** `git commit` exports the commit's author and committer to its hooks, and the background gate inherited them, so any test that makes its own commit and then reads the author saw the maintainer's name (`provenance-flags` failed only in warm-up runs). The gate's environment scrub now drops `GIT_AUTHOR_*` and `GIT_COMMITTER_*`, and a test proves both that the leak was real and that the scrub closes it.
+- **The twelve capabilities already GA meet the bar; none was demoted.** Five of them had no limits section and now have one (assurance modes, model egress, AI-written-code guardrails, CI gating, scanning, which also states the measured dependency-matching figures: 77.9% version recall, 100% precision). Two contract tests are weaker than the bar wants and are recorded as open in `docs/implementation-status/ga-promotion.md`.
+
 ## 0.179.0 - Faster releases: checks run at commit time, and the release gate stops repeating itself
 
 Release tooling only. No scanner behavior changed. The last full release took 68 minutes: push 15.5, hosted CI wait 14.5, local release gate 25, hosted release workflow 8, npm 4.5. Two changes cut the local share, and nothing the hosted gate proves was removed.

package/bin/agentic-security.js

@@ -142,6 +142,8 @@ Commands:
   verify [--finding <id>]      Re-run the verifier loop on last-scan findings (use --live --target <url> to execute PoCs)
   ask "<question>" [target]    Bounded local-model Q&A with read-only tool access (requires AGENTIC_SECURITY_LLM_PRESET=ollama)
   release-view <package.json>  Developer, CISO and auditor views of one signed release package (--view, --format text|json|html, --previous, --public-key)
+  metrics [path]               Assurance Coverage, Evidence Conversion and Verified Remediation Rate for the last scan, each with numerator and denominator (--format text|json)
+  release-package build|verify Build a signed release package from the last scan (--private-key, --output, --fix-records), or check one offline (--public-key)
   reset [--yes] [--keep ...]   Right-to-delete: wipe accumulated learned state under .agentic-security/ (preserves operator-authored config)
                                --expired    only remove artifacts past their retention-class TTL
                                Every run writes a deletion-report.json proving what was planned/deleted/preserved/failed.
@@ -7858,6 +7860,12 @@ async function main() {
       case 'attest':   process.exit(await cmdAttest(args));
       case 'verify-attestation': process.exit(await cmdVerifyAttestation(args));
       case 'release-view': process.exit(await cmdReleaseView(args));
+      case 'metrics': process.exit(await (await import('../src/posture/strategic-metrics-cli.js')).cmdMetrics(args));
+      case 'release-package': {
+        const { spawnSync } = await import('node:child_process');
+        const git = (root, ...a) => { const r = spawnSync('git', a, { cwd: root, encoding: 'utf8' }); return r.status === 0 ? r.stdout.trim() : null; };
+        process.exit(await (await import('../src/posture/assurance/release-package-cli.js')).cmdReleasePackage(args, { git }));
+      }
       case 'policy-explain': process.exit(await cmdPolicyExplain(args));
       case 'policy-sign': process.exit(await cmdPolicySign(args));
       case 'rule-synth': process.exit(await cmdRuleSynth(args));