@clear-capabilities/agentic-security-scanner 0.80.0 → 0.86.0

package/src/posture/.agentic-security/last-scan.json.sig

@@ -1 +1 @@
-0919325c261eaa45c69db6fb89a2f7cb50e0fcc3ccc054359606823ec194693e
+39996421280552970646e4a1035a28ab4226d74f4ff8ed29cfeae2fa5c693ec8

package/src/posture/.agentic-security/pqc-migration-plan.json

@@ -0,0 +1,65 @@
+{
+  "generatedAt": "2026-05-30T05:08:00.813Z",
+  "summary": {
+    "total": 1,
+    "hndlCritical": 0,
+    "standard": 1,
+    "filesAffected": 1,
+    "primitivesNeeded": [
+      "ML-DSA-65"
+    ]
+  },
+  "milestones": [
+    {
+      "id": "M1",
+      "title": "Inventory & policy",
+      "target": "90 days",
+      "owner": "security",
+      "items": [
+        "Confirm scanner findings against design docs",
+        "Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)",
+        "Establish KMS support for hybrid keys"
+      ]
+    },
+    {
+      "id": "M2",
+      "title": "HNDL-critical paths to PQ-hybrid",
+      "target": "180 days",
+      "owner": "platform",
+      "items": []
+    },
+    {
+      "id": "M3",
+      "title": "Standard signing/KEX migration",
+      "target": "12 months",
+      "owner": "platform",
+      "items": [
+        {
+          "finding": "pqc-ed25519:rule-pack-signing.js:187",
+          "file": "rule-pack-signing.js",
+          "line": 187,
+          "replacement": "ML-DSA-65"
+        }
+      ]
+    },
+    {
+      "id": "M4",
+      "title": "Deprecate classical primitives",
+      "target": "24 months",
+      "owner": "security",
+      "items": [
+        "Remove dual-stack libraries once peers are PQ-capable",
+        "Rotate root CA / long-lived signing keys to ML-DSA"
+      ]
+    }
+  ],
+  "perFile": {
+    "rule-pack-signing.js": {
+      "count": 1,
+      "subfamilies": [
+        "pqc-ed25519"
+      ],
+      "hndlCritical": false
+    }
+  }
+}

package/src/posture/.agentic-security/pqc-migration-plan.md

@@ -0,0 +1,30 @@
+# Post-quantum cryptography migration plan
+
+Generated 2026-05-30.
+
+**1** pre-quantum primitive sites across **1** files.  
+HNDL-critical: **0** | Standard: **1**
+
+## Recommended PQ primitives
+- ML-DSA-65
+
+## M1 — Inventory & policy (target 90 days, owner security)
+- Confirm scanner findings against design docs
+- Adopt PQC migration policy (CNSA 2.0 / NIST IR 8547 alignment)
+- Establish KMS support for hybrid keys
+
+## M2 — HNDL-critical paths to PQ-hybrid (target 180 days, owner platform)
+
+## M3 — Standard signing/KEX migration (target 12 months, owner platform)
+- `rule-pack-signing.js:187` → ML-DSA-65
+
+## M4 — Deprecate classical primitives (target 24 months, owner security)
+- Remove dual-stack libraries once peers are PQ-capable
+- Rotate root CA / long-lived signing keys to ML-DSA
+
+## References
+- NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA)
+- NIST IR 8547 — Transition to Post-Quantum Cryptographic Standards
+- CNSA 2.0 — Commercial National Security Algorithm Suite, Sept 2022
+- RFC 9794 — X25519MLKEM768 hybrid key exchange for TLS 1.3
+- Open Quantum Safe project (liboqs, oqs-provider for OpenSSL 3)

package/src/posture/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json

@@ -0,0 +1,6 @@
+{
+  "sha": "7d45b5e03804aac084b4a2b4dc8c6f10107d2005",
+  "ts": "2026-05-30T05:08:00.812Z",
+  "componentCount": 0,
+  "components": []
+}