@fourier-labs/harbour-contracts 0.66.0 → 0.68.0

package/README.md

@@ -55,8 +55,8 @@ exist here first.
 | `transform-parked-result.schema.json` | Sequential-preview result after a durable checkpoint when builder input is required; not a successful report | — |
 | `builder-input-proposal.schema.json` | Value-free proposal emitted when sequential preview cannot continue without builder-owned input | — |
 | `deployment-continuation.schema.json` | Immutable reference admitting one child deployment from a parked input request; never credential values | — |
-| `security-scan-input.schema.json` | Input to the Security Assurance machine: SOURCE (M1) scans an ingested commit, ARTIFACT (M2) scans built outputs | Security Assurance §2 |
-| `security-verdict.schema.json` | Security Assurance decision; `BLOCKED` surfaces as the non-retryable `gate.security-scan` category | Security Assurance §2 |
+| `security-scan-input-v2.schema.json` | Input to the Security Assurance machine (`harbour.security-scan-input/2.0`, replaces v1): one package validated at source intake, scanned in the tenant's execution account | ADR 0014 |
+| `security-verdict.schema.json` | Security Assurance decision; `BLOCKED` surfaces as the non-retryable `gate.security-scan` category | ADR 0014 |
 | `data-source.schema.json` | Admin-registered external data source; `credentialRef` is a secretref URI and the credential never crosses this boundary | Data-Access MVP |
 | `data-dependency.schema.json` | One external data dependency of an app, declared or detected, classified against the tenant's data-source inventory | Data-Access MVP |
 | `secret-reference.schema.json` | Named secret slot an app depends on; only the reference and its lifecycle cross, never the value | Secret-Manager MVP |

package/contract-release.json

@@ -1,12 +1,12 @@
 {
   "schema": "harbour.contract-release/1.0",
-  "repositoryVersion": "0.66.0.0",
-  "publishVersion": "0.66.0",
-  "publishTag": "v0.66.0",
-  "schemasDigest": "sha256:80c014af364c39472dc57ca097f4994daa0e8d57d094a3e4ca5631985246093e",
+  "repositoryVersion": "0.68.0.0",
+  "publishVersion": "0.68.0",
+  "publishTag": "v0.68.0",
+  "schemasDigest": "sha256:3860585b4a4a55334e788faca34018dfaa21bf7ee5fa42bb50b0a454a77047b3",
   "aiFixturesDigest": "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6",
-  "generatedGoDigest": "sha256:2af05118fbdbb3d3e16a506074f50338d4646288d4ce530a60765028221041b2",
-  "generatedTypeScriptDigest": "sha256:39dcf887d9d5b39603eee342a27029feff32e505bb9d8ba79c8607f87d2bca1e",
+  "generatedGoDigest": "sha256:0c97fd145737bf8fba6de780187033f04e52fe524284cd95c084fcda38e31a28",
+  "generatedTypeScriptDigest": "sha256:bd9927f250e96a91958f078ea29d1420ca3d6545ce93b2b2901033ac09e52827",
   "generatedExclusions": {
     "gen-go/contract_release.go": "contains the generated aggregate digests (self-reference)",
     "gen-ts/contract-release.ts": "contains the generated aggregate digests (self-reference)"
@@ -21,7 +21,7 @@
     "schema/ai-gateway-key-lookup.schema.json": "sha256:7d362ded73c0da6b433f3c73afeabea4c38c5d6fc92c391c7ded727324deddf2",
     "schema/ai-governance-decision.schema.json": "sha256:d650762a428350748deafd6b251cbd4a03ba564650e74204f1a77bbe923e145f",
     "schema/ai-metering-policy.schema.json": "sha256:044115938d254d914feac162219d20ee48f741cd7ad32df4613b45f9c862fe8c",
-    "schema/ai-policy-snapshot.schema.json": "sha256:709e2d24ac0176295cee1c85b6892461c97c3c1c088cbdefbebd07be7f69e2cb",
+    "schema/ai-policy-snapshot.schema.json": "sha256:40c0c4af4245a479c9b6d11d79f107ae3a6002a83de632ee9a92deb9ae9a630b",
     "schema/ai-pricing-revision.schema.json": "sha256:5ddb40c23712c0cec37b733678e4bb34811f5db44a233773c21a7dfaec188375",
     "schema/ai-runtime-binding.schema.json": "sha256:e99f983e78478b50114e0b2c940bb5bb30a4645cfd7fbddb7e0cf161d6d28502",
     "schema/ai-runtime-contract.schema.json": "sha256:bfa2f8968b1c0678b328c178c7b9c6563f7a363ae04bf74a1078a1cd9679fa14",
@@ -66,8 +66,8 @@
     "schema/saas-connection.schema.json": "sha256:82ed8018201800a95aa792bde1d22568e86b55b3be926aa094a260c8c78a58d7",
     "schema/sanitized-binding-evidence.schema.json": "sha256:1191ab88e2764df927e5f17837674cebebe068d480da2b2fdb390e589f96b51f",
     "schema/secret-reference.schema.json": "sha256:db4e3c2c6a2dbd72d7ea0f9c91cb3b2343a7e67b601996c6818b2ef08e440895",
-    "schema/security-scan-input.schema.json": "sha256:9d221c27aba1937944d6e30eae92d6b7699b12e3ed088117ef8a628d32ffbbb5",
-    "schema/security-verdict.schema.json": "sha256:639cb83291b4c276b4cdc0ee8ba82a8a2a9792481ad2a1ab6d9ff3ba1f89dd7d",
+    "schema/security-scan-input-v2.schema.json": "sha256:adf90e7e158e2a29145fa9696219dad82d294cac14614bcd10910a251ebe6940",
+    "schema/security-verdict.schema.json": "sha256:6650c327b58431c6a567bbbf1e59bb9d4a8dc2f0ff2efc92ca4c2fd5b2cf28b6",
     "schema/transform-parked-result.schema.json": "sha256:11729980d4c89d4a9e18f5f213232cd3359739c85626b36c20c2a37ba794c9af",
     "schema/transform-report.schema.json": "sha256:b9b4b09f88714b49d855f01ab9b611f34fb856447c0d063be409bb12a6c2700a",
     "schema/version-state.schema.json": "sha256:3b190007e2f8e3821c41ef11c6f5b226da7d5a18d34d4077f4618004846fd444",
@@ -112,7 +112,7 @@
     "gen-go/integration_execute_input_rules.go": "sha256:52a405aa7a97f7b4e2ed3c314a7bd28b7698cc7883ee72ad4c027637be602ab9",
     "gen-go/integration_execute_input_rules_test.go": "sha256:c437a8406a2f062a0173b9419e4cb176fc6eb54e569506225d5162323f55b40b",
     "gen-go/schema_documents.go": "sha256:c19c0d540f602ee997a84b90e20702d9bc63ed7d27aec267e76c04655fc182e0",
-    "gen-go/types.go": "sha256:11c13bc1f8f9d953eacd5cff4c5a08ed1b1126b3606a16e0b350af4c5b15dced",
+    "gen-go/types.go": "sha256:e700fb22b4e2eb59f8531da4bdac154ac22991f9fd39e72b2f4483e1fa2e0264",
     "gen-go/version_state.go": "sha256:4ef8abb126414c0025cf2c59bc9c79a74ef4a2ff89e8f316cbf05acc872371c1"
   },
   "generatedTypeScript": {
@@ -127,7 +127,7 @@
     "gen-ts/ai-gateway-key-token.ts": "sha256:ff6551ad3332cc665878d7ec93f42ce185c375e637531b2fbc82c697b877e784",
     "gen-ts/ai-governance-decision.ts": "sha256:4a04e116f2ec281104e616a8ba414f23a9d34d398f850888d27510173e39c5c3",
     "gen-ts/ai-metering-policy.ts": "sha256:dd261d57646a509cd46efaefac4aad58d018c7f7da98326dd8859e4ce951c56a",
-    "gen-ts/ai-policy-snapshot.ts": "sha256:f4768dba29713053f7d1dd34746fe2f8162ed755eb17d2b7e288db612fcb7b8a",
+    "gen-ts/ai-policy-snapshot.ts": "sha256:d0515a20dae4c6ae25220d1bb5025339918c8c9bc66817ea3fb2090a9b6bed02",
     "gen-ts/ai-pricing-revision.ts": "sha256:48afdea7fb09b9a392147a0a62bcee013157a9d536c07e0782ef28781a3000de",
     "gen-ts/ai-runtime-binding.ts": "sha256:3930989c01e2b90041b5a8f9eaf9d8612854c9088090ca82e5687b85f26e106f",
     "gen-ts/ai-runtime-contract.ts": "sha256:6ed3bde6ab7a3f7e2e298c2904eb52d35e06699c5e284f98fb39abfc76858beb",
@@ -160,7 +160,7 @@
     "gen-ts/error-category-registry.ts": "sha256:7466a502c0723a77db825cdeaa9556a244201b55d9b7acbf2c098e9e84351df1",
     "gen-ts/error-category.ts": "sha256:9bda89180c3b740c9aa8be466216592e8ca9d0d368c274333edf6ea5c45afd8e",
     "gen-ts/error-envelope.ts": "sha256:4457309be794f9d4fc0cf62530cc2d442c007bac9ae84aff66df099cc9e40310",
-    "gen-ts/index.ts": "sha256:01441fefa9a5df07a12663f83444cafca89f28e82567aa80566e8fb9de4af4aa",
+    "gen-ts/index.ts": "sha256:8459b1cf136a0c822795154e2df2a28c848cddfadced329604be893ae6eef069",
     "gen-ts/integration-connect-result.ts": "sha256:4b10f169b6e1af364e9b418de21caa9fadbfb77b43cbff77d741cfae0b52180c",
     "gen-ts/integration-error-details.ts": "sha256:ad7ecec9dd4533a6e86b3508886a7d69937052f52105497285797f77106bcc6f",
     "gen-ts/integration-execute-input-rules.ts": "sha256:0da117ac9f3109462e5862d658edf0f50e4b71fdcbb675d3a9dcb08489bcadd0",
@@ -177,8 +177,8 @@
     "gen-ts/sanitized-binding-digest-helper.ts": "sha256:c47d7fdc20500e2e72c23fe39ecdd610fc397c47fcba51335ebec3c380fe6872",
     "gen-ts/sanitized-binding-evidence.ts": "sha256:f3fb7b1d7d2e0929eb0ea981eaf32db3104010647185f6ae59f67167d42538a9",
     "gen-ts/secret-reference.ts": "sha256:731fbcde7315cb4128d5b01bdbe6e6f248f13c7ad8dea04a3a4e927ac4890198",
-    "gen-ts/security-scan-input.ts": "sha256:c9e2a95e488c1d19c543d87be5dac8408939e3ff955e373c2c57408a3430fa69",
-    "gen-ts/security-verdict.ts": "sha256:f87f43ba45ee2adbe2121c11ba462c7b83a4f027032f5a8daa7074e740e3754d",
+    "gen-ts/security-scan-input-v2.ts": "sha256:ec703b8fe1734a623ce138adc54dc7acbe3b0880e469c70e8bf8f94d7ddb85c2",
+    "gen-ts/security-verdict.ts": "sha256:c7c4c82183e7996941cee93a9cdb4dcaa8a4dab2d607ce29aab8683ee5ced8eb",
     "gen-ts/transform-parked-result.ts": "sha256:6279e27cee8d75c29f3ede45580fef1daa0ca300867a78e43ead8a7689ec613f",
     "gen-ts/transform-report.ts": "sha256:d83f1c34c4a082bd80bf9588b08e2fba3b7e25cd1855375ca3073ab9fafddfec",
     "gen-ts/version-state-machine.ts": "sha256:c67af3e86ac306743345b850dfd3ae5201c19d10c40e2c149cf8c38258320d5f",

package/dist/gen-ts/ai-policy-snapshot.d.ts

@@ -106,6 +106,12 @@ export interface AiPolicyModel {
     capabilities: ('generation' | 'embeddings' | 'transcription' | 'translation' | 'speech' | 'image' | 'video' | 'realtime')[];
     approved: boolean;
     pricing: AiPolicyPricing;
+    /**
+     * What the development kit can do with this model through the Gateway, declared by the tenant for a model it adds beyond the Isomorph catalogue (ADR 0015). Absent keeps the earlier vendor-derived answers; an empty list declares none. Governance ignores it on a catalogue model and caps kitSdkCompatible, streaming and imageEdit by the vendor. The Gateway does not read it.
+     *
+     * @maxItems 5
+     */
+    features?: ('kitSdkCompatible' | 'toolCalling' | 'streaming' | 'imageInput' | 'imageEdit')[];
 }
 export interface AiPolicyPricing {
     revision: AiPolicyIdentifier;

package/dist/gen-ts/contract-release.d.ts

@@ -1,7 +1,7 @@
-export declare const ContractRepositoryVersion: "0.66.0.0";
-export declare const ContractPublishVersion: "0.66.0";
-export declare const ContractPublishTag: "v0.66.0";
-export declare const ContractSchemasDigest: "sha256:80c014af364c39472dc57ca097f4994daa0e8d57d094a3e4ca5631985246093e";
+export declare const ContractRepositoryVersion: "0.68.0.0";
+export declare const ContractPublishVersion: "0.68.0";
+export declare const ContractPublishTag: "v0.68.0";
+export declare const ContractSchemasDigest: "sha256:3860585b4a4a55334e788faca34018dfaa21bf7ee5fa42bb50b0a454a77047b3";
 export declare const ContractAiFixturesDigest: "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export declare const ContractGeneratedGoDigest: "sha256:2af05118fbdbb3d3e16a506074f50338d4646288d4ce530a60765028221041b2";
-export declare const ContractGeneratedTypeScriptDigest: "sha256:39dcf887d9d5b39603eee342a27029feff32e505bb9d8ba79c8607f87d2bca1e";
+export declare const ContractGeneratedGoDigest: "sha256:0c97fd145737bf8fba6de780187033f04e52fe524284cd95c084fcda38e31a28";
+export declare const ContractGeneratedTypeScriptDigest: "sha256:bd9927f250e96a91958f078ea29d1420ca3d6545ce93b2b2901033ac09e52827";

package/dist/gen-ts/contract-release.js

@@ -1,9 +1,9 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-export const ContractRepositoryVersion = "0.66.0.0";
-export const ContractPublishVersion = "0.66.0";
-export const ContractPublishTag = "v0.66.0";
-export const ContractSchemasDigest = "sha256:80c014af364c39472dc57ca097f4994daa0e8d57d094a3e4ca5631985246093e";
+export const ContractRepositoryVersion = "0.68.0.0";
+export const ContractPublishVersion = "0.68.0";
+export const ContractPublishTag = "v0.68.0";
+export const ContractSchemasDigest = "sha256:3860585b4a4a55334e788faca34018dfaa21bf7ee5fa42bb50b0a454a77047b3";
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6";
-export const ContractGeneratedGoDigest = "sha256:2af05118fbdbb3d3e16a506074f50338d4646288d4ce530a60765028221041b2";
-export const ContractGeneratedTypeScriptDigest = "sha256:39dcf887d9d5b39603eee342a27029feff32e505bb9d8ba79c8607f87d2bca1e";
+export const ContractGeneratedGoDigest = "sha256:0c97fd145737bf8fba6de780187033f04e52fe524284cd95c084fcda38e31a28";
+export const ContractGeneratedTypeScriptDigest = "sha256:bd9927f250e96a91958f078ea29d1420ca3d6545ce93b2b2901033ac09e52827";

package/dist/gen-ts/index.d.ts

@@ -59,7 +59,7 @@ export * from './saas-connection.js';
 export * from './sanitized-binding-digest-helper.js';
 export * from './sanitized-binding-evidence.js';
 export * from './secret-reference.js';
-export * from './security-scan-input.js';
+export * from './security-scan-input-v2.js';
 export * from './security-verdict.js';
 export * from './transform-parked-result.js';
 export * from './transform-report.js';

package/dist/gen-ts/index.js

@@ -61,7 +61,7 @@ export * from './saas-connection.js';
 export * from './sanitized-binding-digest-helper.js';
 export * from './sanitized-binding-evidence.js';
 export * from './secret-reference.js';
-export * from './security-scan-input.js';
+export * from './security-scan-input-v2.js';
 export * from './security-verdict.js';
 export * from './transform-parked-result.js';
 export * from './transform-report.js';

package/dist/gen-ts/security-scan-input-v2.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Input to the Security Assurance machine, second shape, replacing security-scan-input.schema.json. V1 scanned a deployed commit located through the deployment state; v2 scans exactly one thing: an uploaded package that governance validated at source intake, identified by the zip sha256 the stager verifies before extraction and by the tree digest governance computed from the unzipped bytes (`sourceDigestOf`, `sha256:`-prefixed), which keys the governance scan record and the check report on the laptop. Commit-mode and ARTIFACT-phase inputs are deliberately absent: the console's later on-demand scan uses this same package path against the deploy upload, and the Transform lane runs the scanner in-process; an image scan, if it returns, is an additive v3. The policy profile is named by the caller when it knows better than the data classification (the kit lane names BASELINE); `profile` and `classification` are mutually exclusive, and both absent still defaults to STANDARD with `classificationDefaulted: true`. Nothing here carries a scanner version: the scanner stamps its own into verdict provenance, and governance decides validity by comparing that against its MINIMUM_SCANNER_VERSION. `org`/`app` are the tenant and app ids for kit apps; `env` stays required because the evidence key carries it (governance passes `preview` for a package scan; promotion never re-scans). The `execution` block names the tenant's execution-account scanner, invoke role and artifacts bucket, resolved by governance the way admission resolves them for the deploy machine.
+ */
+export interface SecurityScanInputV2 {
+    schema: 'harbour.security-scan-input/2.0';
+    /**
+     * Isomorph organization id (the governance tenant id for kit apps), e.g. fourier.
+     */
+    org: string;
+    /**
+     * Isomorph app id within the org (the governance appId for kit apps).
+     */
+    app: string;
+    /**
+     * Evidence-key segment and provenance only; governance passes `preview` for a package scan.
+     */
+    env: 'preview' | 'prod';
+    package: PackageSource;
+    execution: Execution;
+    /**
+     * Policy profile named by the caller. Takes the place of deriving one from `classification`; the verdict echoes the profile evaluated and stamps `classificationDefaulted: false`. Governance names BASELINE for kit-lane scans; the default when nothing is named is STANDARD.
+     */
+    profile?: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
+    /**
+     * Data classification, mapped to a profile as in v1 (GREEN → BASELINE, YELLOW → STANDARD, ORANGE → HIGH, RED → CRITICAL). Not allowed beside `profile`. Absent with no `profile` means STANDARD and `classificationDefaulted: true`; an invalid value fails closed.
+     */
+    classification?: 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
+}
+/**
+ * The bytes `isomorph secure` (or a later console re-run against a deploy upload) put through source intake.
+ */
+export interface PackageSource {
+    /**
+     * Bucket holding the uploaded package zip (the governance upload bucket; the stage-package role holds a prefix-scoped read grant and the key's decrypt).
+     */
+    bucket: string;
+    /**
+     * Object key of the package zip as the completed multipart upload left it, under the `scan/` prefix.
+     */
+    key: string;
+    /**
+     * S3 object version to read, when the bucket is versioned, so a later re-upload under the same key cannot change what was scanned.
+     */
+    versionId?: string;
+    /**
+     * SHA-256 of the zip bytes. The stager verifies it before extraction and it becomes the verdict's `snapshotSha256`. Governance already checked it equals the manifest's packageSha256 at intake.
+     */
+    sha256: string;
+    /**
+     * Tree digest governance computed from the unzipped, validated package with the shared source-digest algorithm, `sha256:` prefixed as `sourceDigestOf` emits it (the same value `isomorph check` pins in check-report.json). Caller-supplied provenance echoed into the verdict; the scan record and the deploy gate are keyed by it.
+     */
+    sourceDigest: string;
+    /**
+     * Digest of the file manifest the CLI sent, for the evidence record. Provenance only.
+     */
+    manifestDigest?: string;
+}
+/**
+ * Where the scan runs. The machine passes the function ARN and role to its one execution-account task as FunctionName and Credentials.RoleArn, exactly as the deploy machine does with its execution block.
+ */
+export interface Execution {
+    /**
+     * The tenant's execution-account security-scan Lambda.
+     */
+    securityScanFunctionArn: string;
+    /**
+     * Role the machine assumes to invoke the scanner and the Harbour-side stage-package Lambda assumes to write the staged zip (harbour-preview-v2-invoke in beta).
+     */
+    invocationRoleArn: string;
+    /**
+     * The execution account's artifacts bucket; the Harbour-side stage-package Lambda writes scan-sources/… into it through the invoke role, and the scanner writes scan-evidence/… beside it.
+     */
+    artifactsBucket: string;
+}

package/dist/gen-ts/security-verdict.d.ts

@@ -1,5 +1,5 @@
 /**
- * Decision produced by the Isomorph Security Assurance machine (Security Assurance LLD §2). `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.
+ * Decision produced by the Isomorph Security Assurance machine. `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. A BLOCKED verdict is the output of a successful execution; a stage that crashes fails the execution and produces no verdict. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.
  */
 export interface SecurityVerdict {
     /**
@@ -7,11 +7,11 @@ export interface SecurityVerdict {
      */
     outcome: 'PASS' | 'BLOCKED';
     /**
-     * Policy profile the evidence was evaluated against (derived from the input classification; STANDARD when the classification was absent).
+     * Policy profile the evidence was evaluated against: the input's `profile` when the caller named one, else derived from the input classification, else STANDARD.
      */
     profile: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
     /**
-     * Human-readable cause, present when outcome is BLOCKED; becomes the cause carried by the Security Assurance state machine's `HarbourSecurityBlocked` fail state.
+     * Human-readable cause, present when outcome is BLOCKED: the sentence of the first policy rule that fired.
      */
     reason?: string;
     /**
@@ -25,7 +25,7 @@ export interface SecurityVerdict {
 }
 export interface ScanEvidence {
     /**
-     * UNAVAILABLE means the tool did not run or did not produce parseable output; policy treats it as blocking for required categories.
+     * What the tool reported, not whether it blocks (each finding's `blocking` says that): PASS when it found nothing, including when there was nothing to scan (no dependencies declared); FAIL when it has findings; UNAVAILABLE when the tool did not run or did not produce parseable output, which policy treats as blocking for required categories.
      */
     status: 'PASS' | 'FAIL' | 'UNAVAILABLE';
     /**
@@ -62,14 +62,30 @@ export interface Finding {
      * Suggested fix, when the tool provides one.
      */
     remediation?: string;
+    /**
+     * Dependency name, for a dependency-sca finding.
+     */
+    package?: string;
+    /**
+     * Installed version of `package` the vulnerability applies to.
+     */
+    installedVersion?: string;
+    /**
+     * First version of `package` that fixes the vulnerability, when the tool knows one.
+     */
+    fixedVersion?: string;
+    /**
+     * Set by policy on every finding it evaluated: true when the finding on its own fires a block rule under the evaluated profile, false when it is reported only.
+     */
+    blocking?: boolean;
 }
 export interface EvidenceRef {
     /**
-     * S3 bucket holding the full evidence object.
+     * S3 bucket holding the full evidence object; for a package scan, the artifacts bucket of the execution account the scanner ran in.
      */
     bucket: string;
     /**
-     * S3 key of the full evidence object, e.g. security-evidence/<org>/<app>/<env>/<commit>/<scannedAt>.json.
+     * S3 key of the full evidence object, e.g. scan-evidence/<org>/<app>/<sourceDigest-hex>/<executionName>/evidence.json for a package scan.
      */
     key: string;
 }
@@ -77,11 +93,12 @@ export interface Provenance {
     org: string;
     app: string;
     env: 'preview' | 'prod';
-    repo: string;
-    commit: string;
-    branch: string;
     /**
-     * SHA-256 of the exact source snapshot tarball that was scanned, verified before extraction.
+     * Tree digest of the scanned source (`sourceDigestOf`, `sha256:`-prefixed), echoed from the scan input's package block. Present for a package scan. Never compared with `snapshotSha256`, which hashes the zip bytes.
+     */
+    sourceDigest?: string;
+    /**
+     * SHA-256 of the exact bytes that were extracted and scanned (the package zip for a package scan), verified before extraction. Bare hex.
      */
     snapshotSha256: string;
     /**
@@ -93,7 +110,11 @@ export interface Provenance {
      */
     toolManifestDigest: string;
     /**
-     * True iff the input omitted classification and the machine assumed STANDARD (decision 2026-08-27). An invalid classification fails closed and never reaches a verdict.
+     * Orderable release version of the runner image that produced the evidence. Governance compares its numeric core with MINIMUM_SCANNER_VERSION to decide whether a PASS still counts.
+     */
+    scannerVersion: string;
+    /**
+     * True iff the input named neither a profile nor a classification and the machine assumed STANDARD (decision 2026-08-27). An invalid classification fails closed and never reaches a verdict.
      */
     classificationDefaulted: boolean;
 }

package/gen-ts/ai-policy-snapshot.ts

@@ -112,6 +112,12 @@ export interface AiPolicyModel {
   )[];
   approved: boolean;
   pricing: AiPolicyPricing;
+  /**
+   * What the development kit can do with this model through the Gateway, declared by the tenant for a model it adds beyond the Isomorph catalogue (ADR 0015). Absent keeps the earlier vendor-derived answers; an empty list declares none. Governance ignores it on a catalogue model and caps kitSdkCompatible, streaming and imageEdit by the vendor. The Gateway does not read it.
+   *
+   * @maxItems 5
+   */
+  features?: ('kitSdkCompatible' | 'toolCalling' | 'streaming' | 'imageInput' | 'imageEdit')[];
 }
 export interface AiPolicyPricing {
   revision: AiPolicyIdentifier;

package/gen-ts/contract-release.ts

@@ -1,10 +1,10 @@
 /* eslint-disable */
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
-export const ContractRepositoryVersion = "0.66.0.0" as const;
-export const ContractPublishVersion = "0.66.0" as const;
-export const ContractPublishTag = "v0.66.0" as const;
-export const ContractSchemasDigest = "sha256:80c014af364c39472dc57ca097f4994daa0e8d57d094a3e4ca5631985246093e" as const;
+export const ContractRepositoryVersion = "0.68.0.0" as const;
+export const ContractPublishVersion = "0.68.0" as const;
+export const ContractPublishTag = "v0.68.0" as const;
+export const ContractSchemasDigest = "sha256:3860585b4a4a55334e788faca34018dfaa21bf7ee5fa42bb50b0a454a77047b3" as const;
 export const ContractAiFixturesDigest = "sha256:edac31c92e146ca1c40130f2fb5649db82e24b8cd1ac758153b90612052fddb6" as const;
-export const ContractGeneratedGoDigest = "sha256:2af05118fbdbb3d3e16a506074f50338d4646288d4ce530a60765028221041b2" as const;
-export const ContractGeneratedTypeScriptDigest = "sha256:39dcf887d9d5b39603eee342a27029feff32e505bb9d8ba79c8607f87d2bca1e" as const;
+export const ContractGeneratedGoDigest = "sha256:0c97fd145737bf8fba6de780187033f04e52fe524284cd95c084fcda38e31a28" as const;
+export const ContractGeneratedTypeScriptDigest = "sha256:bd9927f250e96a91958f078ea29d1420ca3d6545ce93b2b2901033ac09e52827" as const;

package/gen-ts/index.ts

@@ -62,7 +62,7 @@ export * from './saas-connection.js';
 export * from './sanitized-binding-digest-helper.js';
 export * from './sanitized-binding-evidence.js';
 export * from './secret-reference.js';
-export * from './security-scan-input.js';
+export * from './security-scan-input-v2.js';
 export * from './security-verdict.js';
 export * from './transform-parked-result.js';
 export * from './transform-report.js';

package/gen-ts/security-scan-input-v2.ts

@@ -0,0 +1,77 @@
+/* eslint-disable */
+// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
+
+/**
+ * Input to the Security Assurance machine, second shape, replacing security-scan-input.schema.json. V1 scanned a deployed commit located through the deployment state; v2 scans exactly one thing: an uploaded package that governance validated at source intake, identified by the zip sha256 the stager verifies before extraction and by the tree digest governance computed from the unzipped bytes (`sourceDigestOf`, `sha256:`-prefixed), which keys the governance scan record and the check report on the laptop. Commit-mode and ARTIFACT-phase inputs are deliberately absent: the console's later on-demand scan uses this same package path against the deploy upload, and the Transform lane runs the scanner in-process; an image scan, if it returns, is an additive v3. The policy profile is named by the caller when it knows better than the data classification (the kit lane names BASELINE); `profile` and `classification` are mutually exclusive, and both absent still defaults to STANDARD with `classificationDefaulted: true`. Nothing here carries a scanner version: the scanner stamps its own into verdict provenance, and governance decides validity by comparing that against its MINIMUM_SCANNER_VERSION. `org`/`app` are the tenant and app ids for kit apps; `env` stays required because the evidence key carries it (governance passes `preview` for a package scan; promotion never re-scans). The `execution` block names the tenant's execution-account scanner, invoke role and artifacts bucket, resolved by governance the way admission resolves them for the deploy machine.
+ */
+export interface SecurityScanInputV2 {
+  schema: 'harbour.security-scan-input/2.0';
+  /**
+   * Isomorph organization id (the governance tenant id for kit apps), e.g. fourier.
+   */
+  org: string;
+  /**
+   * Isomorph app id within the org (the governance appId for kit apps).
+   */
+  app: string;
+  /**
+   * Evidence-key segment and provenance only; governance passes `preview` for a package scan.
+   */
+  env: 'preview' | 'prod';
+  package: PackageSource;
+  execution: Execution;
+  /**
+   * Policy profile named by the caller. Takes the place of deriving one from `classification`; the verdict echoes the profile evaluated and stamps `classificationDefaulted: false`. Governance names BASELINE for kit-lane scans; the default when nothing is named is STANDARD.
+   */
+  profile?: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
+  /**
+   * Data classification, mapped to a profile as in v1 (GREEN → BASELINE, YELLOW → STANDARD, ORANGE → HIGH, RED → CRITICAL). Not allowed beside `profile`. Absent with no `profile` means STANDARD and `classificationDefaulted: true`; an invalid value fails closed.
+   */
+  classification?: 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
+}
+/**
+ * The bytes `isomorph secure` (or a later console re-run against a deploy upload) put through source intake.
+ */
+export interface PackageSource {
+  /**
+   * Bucket holding the uploaded package zip (the governance upload bucket; the stage-package role holds a prefix-scoped read grant and the key's decrypt).
+   */
+  bucket: string;
+  /**
+   * Object key of the package zip as the completed multipart upload left it, under the `scan/` prefix.
+   */
+  key: string;
+  /**
+   * S3 object version to read, when the bucket is versioned, so a later re-upload under the same key cannot change what was scanned.
+   */
+  versionId?: string;
+  /**
+   * SHA-256 of the zip bytes. The stager verifies it before extraction and it becomes the verdict's `snapshotSha256`. Governance already checked it equals the manifest's packageSha256 at intake.
+   */
+  sha256: string;
+  /**
+   * Tree digest governance computed from the unzipped, validated package with the shared source-digest algorithm, `sha256:` prefixed as `sourceDigestOf` emits it (the same value `isomorph check` pins in check-report.json). Caller-supplied provenance echoed into the verdict; the scan record and the deploy gate are keyed by it.
+   */
+  sourceDigest: string;
+  /**
+   * Digest of the file manifest the CLI sent, for the evidence record. Provenance only.
+   */
+  manifestDigest?: string;
+}
+/**
+ * Where the scan runs. The machine passes the function ARN and role to its one execution-account task as FunctionName and Credentials.RoleArn, exactly as the deploy machine does with its execution block.
+ */
+export interface Execution {
+  /**
+   * The tenant's execution-account security-scan Lambda.
+   */
+  securityScanFunctionArn: string;
+  /**
+   * Role the machine assumes to invoke the scanner and the Harbour-side stage-package Lambda assumes to write the staged zip (harbour-preview-v2-invoke in beta).
+   */
+  invocationRoleArn: string;
+  /**
+   * The execution account's artifacts bucket; the Harbour-side stage-package Lambda writes scan-sources/… into it through the invoke role, and the scanner writes scan-evidence/… beside it.
+   */
+  artifactsBucket: string;
+}

package/gen-ts/security-verdict.ts

@@ -2,7 +2,7 @@
 // Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
 
 /**
- * Decision produced by the Isomorph Security Assurance machine (Security Assurance LLD §2). `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.
+ * Decision produced by the Isomorph Security Assurance machine. `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. A BLOCKED verdict is the output of a successful execution; a stage that crashes fails the execution and produces no verdict. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.
  */
 export interface SecurityVerdict {
   /**
@@ -10,11 +10,11 @@ export interface SecurityVerdict {
    */
   outcome: 'PASS' | 'BLOCKED';
   /**
-   * Policy profile the evidence was evaluated against (derived from the input classification; STANDARD when the classification was absent).
+   * Policy profile the evidence was evaluated against: the input's `profile` when the caller named one, else derived from the input classification, else STANDARD.
    */
   profile: 'BASELINE' | 'STANDARD' | 'HIGH' | 'CRITICAL';
   /**
-   * Human-readable cause, present when outcome is BLOCKED; becomes the cause carried by the Security Assurance state machine's `HarbourSecurityBlocked` fail state.
+   * Human-readable cause, present when outcome is BLOCKED: the sentence of the first policy rule that fired.
    */
   reason?: string;
   /**
@@ -28,7 +28,7 @@ export interface SecurityVerdict {
 }
 export interface ScanEvidence {
   /**
-   * UNAVAILABLE means the tool did not run or did not produce parseable output; policy treats it as blocking for required categories.
+   * What the tool reported, not whether it blocks (each finding's `blocking` says that): PASS when it found nothing, including when there was nothing to scan (no dependencies declared); FAIL when it has findings; UNAVAILABLE when the tool did not run or did not produce parseable output, which policy treats as blocking for required categories.
    */
   status: 'PASS' | 'FAIL' | 'UNAVAILABLE';
   /**
@@ -65,14 +65,30 @@ export interface Finding {
    * Suggested fix, when the tool provides one.
    */
   remediation?: string;
+  /**
+   * Dependency name, for a dependency-sca finding.
+   */
+  package?: string;
+  /**
+   * Installed version of `package` the vulnerability applies to.
+   */
+  installedVersion?: string;
+  /**
+   * First version of `package` that fixes the vulnerability, when the tool knows one.
+   */
+  fixedVersion?: string;
+  /**
+   * Set by policy on every finding it evaluated: true when the finding on its own fires a block rule under the evaluated profile, false when it is reported only.
+   */
+  blocking?: boolean;
 }
 export interface EvidenceRef {
   /**
-   * S3 bucket holding the full evidence object.
+   * S3 bucket holding the full evidence object; for a package scan, the artifacts bucket of the execution account the scanner ran in.
    */
   bucket: string;
   /**
-   * S3 key of the full evidence object, e.g. security-evidence/<org>/<app>/<env>/<commit>/<scannedAt>.json.
+   * S3 key of the full evidence object, e.g. scan-evidence/<org>/<app>/<sourceDigest-hex>/<executionName>/evidence.json for a package scan.
    */
   key: string;
 }
@@ -80,11 +96,12 @@ export interface Provenance {
   org: string;
   app: string;
   env: 'preview' | 'prod';
-  repo: string;
-  commit: string;
-  branch: string;
   /**
-   * SHA-256 of the exact source snapshot tarball that was scanned, verified before extraction.
+   * Tree digest of the scanned source (`sourceDigestOf`, `sha256:`-prefixed), echoed from the scan input's package block. Present for a package scan. Never compared with `snapshotSha256`, which hashes the zip bytes.
+   */
+  sourceDigest?: string;
+  /**
+   * SHA-256 of the exact bytes that were extracted and scanned (the package zip for a package scan), verified before extraction. Bare hex.
    */
   snapshotSha256: string;
   /**
@@ -96,7 +113,11 @@ export interface Provenance {
    */
   toolManifestDigest: string;
   /**
-   * True iff the input omitted classification and the machine assumed STANDARD (decision 2026-08-27). An invalid classification fails closed and never reaches a verdict.
+   * Orderable release version of the runner image that produced the evidence. Governance compares its numeric core with MINIMUM_SCANNER_VERSION to decide whether a PASS still counts.
+   */
+  scannerVersion: string;
+  /**
+   * True iff the input named neither a profile nor a classification and the machine assumed STANDARD (decision 2026-08-27). An invalid classification fails closed and never reaches a verdict.
    */
   classificationDefaulted: boolean;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fourier-labs/harbour-contracts",
-  "version": "0.66.0",
+  "version": "0.68.0",
   "description": "Single source of truth for every data shape that crosses a boundary between Isomorph components.",
   "license": "UNLICENSED",
   "private": false,

package/schema/ai-policy-snapshot.schema.json

@@ -159,7 +159,14 @@
           "items": { "type": "string", "enum": ["generation", "embeddings", "transcription", "translation", "speech", "image", "video", "realtime"] }
         },
         "approved": { "type": "boolean" },
-        "pricing": { "$ref": "#/definitions/AiPolicyPricing" }
+        "pricing": { "$ref": "#/definitions/AiPolicyPricing" },
+        "features": {
+          "type": "array",
+          "maxItems": 5,
+          "uniqueItems": true,
+          "items": { "type": "string", "enum": ["kitSdkCompatible", "toolCalling", "streaming", "imageInput", "imageEdit"] },
+          "description": "What the development kit can do with this model through the Gateway, declared by the tenant for a model it adds beyond the Isomorph catalogue (ADR 0015). Absent keeps the earlier vendor-derived answers; an empty list declares none. Governance ignores it on a catalogue model and caps kitSdkCompatible, streaming and imageEdit by the vendor. The Gateway does not read it."
+        }
       }
     },
     "AiPolicyRouteTarget": {

package/schema/security-scan-input-v2.schema.json

@@ -0,0 +1,79 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://schemas.harbour.dev/security-scan-input-v2.schema.json",
+  "title": "SecurityScanInputV2",
+  "description": "Input to the Security Assurance machine, second shape, replacing security-scan-input.schema.json. V1 scanned a deployed commit located through the deployment state; v2 scans exactly one thing: an uploaded package that governance validated at source intake, identified by the zip sha256 the stager verifies before extraction and by the tree digest governance computed from the unzipped bytes (`sourceDigestOf`, `sha256:`-prefixed), which keys the governance scan record and the check report on the laptop. Commit-mode and ARTIFACT-phase inputs are deliberately absent: the console's later on-demand scan uses this same package path against the deploy upload, and the Transform lane runs the scanner in-process; an image scan, if it returns, is an additive v3. The policy profile is named by the caller when it knows better than the data classification (the kit lane names BASELINE); `profile` and `classification` are mutually exclusive, and both absent still defaults to STANDARD with `classificationDefaulted: true`. Nothing here carries a scanner version: the scanner stamps its own into verdict provenance, and governance decides validity by comparing that against its MINIMUM_SCANNER_VERSION. `org`/`app` are the tenant and app ids for kit apps; `env` stays required because the evidence key carries it (governance passes `preview` for a package scan; promotion never re-scans). The `execution` block names the tenant's execution-account scanner, invoke role and artifacts bucket, resolved by governance the way admission resolves them for the deploy machine.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "org", "app", "env", "package", "execution"],
+  "properties": {
+    "schema": { "type": "string", "const": "harbour.security-scan-input/2.0" },
+    "org": { "type": "string", "minLength": 1, "description": "Isomorph organization id (the governance tenant id for kit apps), e.g. fourier." },
+    "app": { "type": "string", "minLength": 1, "description": "Isomorph app id within the org (the governance appId for kit apps)." },
+    "env": {
+      "type": "string",
+      "enum": ["preview", "prod"],
+      "description": "Evidence-key segment and provenance only; governance passes `preview` for a package scan."
+    },
+    "package": { "$ref": "#/definitions/PackageSource" },
+    "execution": { "$ref": "#/definitions/Execution" },
+    "profile": {
+      "type": "string",
+      "enum": ["BASELINE", "STANDARD", "HIGH", "CRITICAL"],
+      "description": "Policy profile named by the caller. Takes the place of deriving one from `classification`; the verdict echoes the profile evaluated and stamps `classificationDefaulted: false`. Governance names BASELINE for kit-lane scans; the default when nothing is named is STANDARD."
+    },
+    "classification": {
+      "type": "string",
+      "enum": ["GREEN", "YELLOW", "ORANGE", "RED"],
+      "description": "Data classification, mapped to a profile as in v1 (GREEN → BASELINE, YELLOW → STANDARD, ORANGE → HIGH, RED → CRITICAL). Not allowed beside `profile`. Absent with no `profile` means STANDARD and `classificationDefaulted: true`; an invalid value fails closed."
+    }
+  },
+  "not": { "required": ["profile", "classification"] },
+  "definitions": {
+    "PackageSource": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["bucket", "key", "sha256", "sourceDigest"],
+      "properties": {
+        "bucket": { "type": "string", "minLength": 1, "description": "Bucket holding the uploaded package zip (the governance upload bucket; the stage-package role holds a prefix-scoped read grant and the key's decrypt)." },
+        "key": { "type": "string", "minLength": 1, "description": "Object key of the package zip as the completed multipart upload left it, under the `scan/` prefix." },
+        "versionId": { "type": "string", "minLength": 1, "description": "S3 object version to read, when the bucket is versioned, so a later re-upload under the same key cannot change what was scanned." },
+        "sha256": { "type": "string", "pattern": "^[0-9a-f]{64}$", "description": "SHA-256 of the zip bytes. The stager verifies it before extraction and it becomes the verdict's `snapshotSha256`. Governance already checked it equals the manifest's packageSha256 at intake." },
+        "sourceDigest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "description": "Tree digest governance computed from the unzipped, validated package with the shared source-digest algorithm, `sha256:` prefixed as `sourceDigestOf` emits it (the same value `isomorph check` pins in check-report.json). Caller-supplied provenance echoed into the verdict; the scan record and the deploy gate are keyed by it." },
+        "manifestDigest": { "type": "string", "pattern": "^[0-9a-f]{64}$", "description": "Digest of the file manifest the CLI sent, for the evidence record. Provenance only." }
+      },
+      "description": "The bytes `isomorph secure` (or a later console re-run against a deploy upload) put through source intake."
+    },
+    "Execution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["securityScanFunctionArn", "invocationRoleArn", "artifactsBucket"],
+      "properties": {        "securityScanFunctionArn": { "type": "string", "pattern": "^arn:aws:lambda:", "description": "The tenant's execution-account security-scan Lambda." },
+        "invocationRoleArn": { "type": "string", "pattern": "^arn:aws:iam::", "description": "Role the machine assumes to invoke the scanner and the Harbour-side stage-package Lambda assumes to write the staged zip (harbour-preview-v2-invoke in beta)." },
+        "artifactsBucket": { "type": "string", "minLength": 1, "description": "The execution account's artifacts bucket; the Harbour-side stage-package Lambda writes scan-sources/… into it through the invoke role, and the scanner writes scan-evidence/… beside it." }
+      },
+      "description": "Where the scan runs. The machine passes the function ARN and role to its one execution-account task as FunctionName and Credentials.RoleArn, exactly as the deploy machine does with its execution block."
+    }
+  },
+  "examples": [
+    {
+      "schema": "harbour.security-scan-input/2.0",
+      "org": "fourier",
+      "app": "app-1f2e3d4c",
+      "env": "preview",
+      "package": {
+        "bucket": "harbour-governance-source-uploads",
+        "key": "scan/fourier/app-1f2e3d4c/scan-01J9Q8ZT4M6K7Q3R8V5X2N1P0W/package.zip",
+        "versionId": "3HL4kqtJlcpXroDTDmJ+rmSpXd3dIbrHY+MTRCxf3vjVBH40Nr8X8gdRQBpUMLUo",
+        "sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
+        "sourceDigest": "sha256:2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae",
+        "manifestDigest": "fcde2b2edba56bf408601fb721fe9b5c338d10ee429ea04fae5511b68fbf8fb9"
+      },
+      "execution": {        "securityScanFunctionArn": "arn:aws:lambda:us-east-1:195236889504:function:harbour-preview-v2-security-scan",
+        "invocationRoleArn": "arn:aws:iam::195236889504:role/harbour-preview-v2-invoke",
+        "artifactsBucket": "harbour-preview-v2-artifacts-195236889504"
+      },
+      "profile": "BASELINE"
+    }
+  ]
+}

package/schema/security-verdict.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://schemas.harbour.dev/security-verdict.schema.json",
   "title": "SecurityVerdict",
-  "description": "Decision produced by the Isomorph Security Assurance machine (Security Assurance LLD §2). `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.",
+  "description": "Decision produced by the Isomorph Security Assurance machine. `outcome: BLOCKED` surfaces to callers as the registered non-retryable `gate.security-scan` error category; `reason` is present exactly when BLOCKED. A BLOCKED verdict is the output of a successful execution; a stage that crashes fails the execution and produces no verdict. The S3 evidence object named by `evidenceRef` is the full record — in-payload findings may be truncated.",
   "type": "object",
   "additionalProperties": false,
   "required": ["outcome", "profile", "evidence", "evidenceRef", "provenance"],
@@ -15,12 +15,12 @@
     "profile": {
       "type": "string",
       "enum": ["BASELINE", "STANDARD", "HIGH", "CRITICAL"],
-      "description": "Policy profile the evidence was evaluated against (derived from the input classification; STANDARD when the classification was absent)."
+      "description": "Policy profile the evidence was evaluated against: the input's `profile` when the caller named one, else derived from the input classification, else STANDARD."
     },
     "reason": {
       "type": "string",
       "minLength": 1,
-      "description": "Human-readable cause, present when outcome is BLOCKED; becomes the cause carried by the Security Assurance state machine's `HarbourSecurityBlocked` fail state."
+      "description": "Human-readable cause, present when outcome is BLOCKED: the sentence of the first policy rule that fired."
     },
     "evidence": {
       "type": "object",
@@ -39,7 +39,7 @@
         "status": {
           "type": "string",
           "enum": ["PASS", "FAIL", "UNAVAILABLE"],
-          "description": "UNAVAILABLE means the tool did not run or did not produce parseable output; policy treats it as blocking for required categories."
+          "description": "What the tool reported, not whether it blocks (each finding's `blocking` says that): PASS when it found nothing, including when there was nothing to scan (no dependencies declared); FAIL when it has findings; UNAVAILABLE when the tool did not run or did not produce parseable output, which policy treats as blocking for required categories."
         },
         "findings": {
           "type": "array",
@@ -59,7 +59,11 @@
         "path": { "type": "string", "description": "Repository-relative file path, when the finding is file-anchored." },
         "line": { "type": "integer", "minimum": 1, "description": "1-based line number, when the finding is line-anchored." },
         "message": { "type": "string", "minLength": 1, "description": "Human-readable finding description. Secret values are never included — only locations." },
-        "remediation": { "type": "string", "description": "Suggested fix, when the tool provides one." }
+        "remediation": { "type": "string", "description": "Suggested fix, when the tool provides one." },
+        "package": { "type": "string", "minLength": 1, "description": "Dependency name, for a dependency-sca finding." },
+        "installedVersion": { "type": "string", "minLength": 1, "description": "Installed version of `package` the vulnerability applies to." },
+        "fixedVersion": { "type": "string", "minLength": 1, "description": "First version of `package` that fixes the vulnerability, when the tool knows one." },
+        "blocking": { "type": "boolean", "description": "Set by policy on every finding it evaluated: true when the finding on its own fires a block rule under the evaluated profile, false when it is reported only." }
       }
     },
     "EvidenceRef": {
@@ -67,34 +71,41 @@
       "additionalProperties": false,
       "required": ["bucket", "key"],
       "properties": {
-        "bucket": { "type": "string", "minLength": 1, "description": "S3 bucket holding the full evidence object." },
-        "key": { "type": "string", "minLength": 1, "description": "S3 key of the full evidence object, e.g. security-evidence/<org>/<app>/<env>/<commit>/<scannedAt>.json." }
+        "bucket": { "type": "string", "minLength": 1, "description": "S3 bucket holding the full evidence object; for a package scan, the artifacts bucket of the execution account the scanner ran in." },
+        "key": { "type": "string", "minLength": 1, "description": "S3 key of the full evidence object, e.g. scan-evidence/<org>/<app>/<sourceDigest-hex>/<executionName>/evidence.json for a package scan." }
       }
     },
     "Provenance": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["org", "app", "env", "repo", "commit", "branch", "snapshotSha256", "scannedAt", "toolManifestDigest", "classificationDefaulted"],
+      "required": ["org", "app", "env", "snapshotSha256", "scannedAt", "toolManifestDigest", "scannerVersion", "classificationDefaulted"],
       "properties": {
         "org": { "type": "string", "minLength": 1 },
         "app": { "type": "string", "minLength": 1 },
         "env": { "type": "string", "enum": ["preview", "prod"] },
-        "repo": { "type": "string", "minLength": 1, "pattern": "^[^/\\s]+/[^/\\s]+$" },
-        "commit": { "type": "string", "pattern": "^[0-9a-f]{40}$" },
-        "branch": { "type": "string", "minLength": 1 },
+        "sourceDigest": {
+          "type": "string",
+          "pattern": "^sha256:[0-9a-f]{64}$",
+          "description": "Tree digest of the scanned source (`sourceDigestOf`, `sha256:`-prefixed), echoed from the scan input's package block. Present for a package scan. Never compared with `snapshotSha256`, which hashes the zip bytes."
+        },
         "snapshotSha256": {
           "type": "string",
           "pattern": "^[0-9a-f]{64}$",
-          "description": "SHA-256 of the exact source snapshot tarball that was scanned, verified before extraction."
+          "description": "SHA-256 of the exact bytes that were extracted and scanned (the package zip for a package scan), verified before extraction. Bare hex."
         },
         "scannedAt": { "type": "string", "format": "date-time", "description": "UTC timestamp the scan completed." },
         "toolManifestDigest": {
           "type": "string",
           "description": "Digest of the runner image's tool-manifest.json — pins which tool versions produced this evidence."
         },
+        "scannerVersion": {
+          "type": "string",
+          "pattern": "^v?\\d+\\.\\d+\\.\\d+(?:[-+].*)?$",
+          "description": "Orderable release version of the runner image that produced the evidence. Governance compares its numeric core with MINIMUM_SCANNER_VERSION to decide whether a PASS still counts."
+        },
         "classificationDefaulted": {
           "type": "boolean",
-          "description": "True iff the input omitted classification and the machine assumed STANDARD (decision 2026-08-27). An invalid classification fails closed and never reaches a verdict."
+          "description": "True iff the input named neither a profile nor a classification and the machine assumed STANDARD (decision 2026-08-27). An invalid classification fails closed and never reaches a verdict."
         }
       }
     }

package/dist/gen-ts/security-scan-input.d.ts

@@ -1,88 +0,0 @@
-/**
- * Input to the Isomorph Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.
- */
-export interface SecurityScanInput {
-    /**
-     * Scan phase. SOURCE (M1) scans the ingested snapshot for the commit; ARTIFACT (M2) scans built outputs named by imageDigest/bundleRef/infraRefs — at least one of which must be present.
-     */
-    phase: 'SOURCE' | 'ARTIFACT';
-    /**
-     * Isomorph organization id, e.g. fourier.
-     */
-    org: string;
-    /**
-     * Isomorph app id within the org, e.g. focuslist.
-     */
-    app: string;
-    /**
-     * Environment whose ingested snapshots are searched for the commit. M1 deploys preview-only; prod is contract-stable for M3.
-     */
-    env: 'preview' | 'prod';
-    /**
-     * GitHub owner/name of the source repository, e.g. Fourier-Labs-AI/focus-list.
-     */
-    repo: string;
-    /**
-     * Full 40-hex lowercase commit SHA — the identity being scanned.
-     */
-    commit: string;
-    /**
-     * Branch name, supplied authoritatively by the caller in v1 (provenance only — never used for resolution).
-     */
-    branch: string;
-    /**
-     * Data classification of the app. Optional in v1 (decided 2026-08-27): when ABSENT the machine assumes the STANDARD profile and stamps classificationDefaulted: true in the verdict provenance. An invalid value still fails closed — only absence defaults. No classifier exists until M4; until then callers state it or accept the default.
-     */
-    classification?: 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
-    /**
-     * ARTIFACT phase: container image to scan, as either a digest-qualified ECR reference (<ecr-uri>@sha256:<64-hex>) or a bare sha256:<64-hex> digest. Digest-addressed only — tags are not accepted, so the scanned bytes are the deployed bytes.
-     */
-    imageDigest?: string;
-    bundleRef?: S3Ref;
-    /**
-     * ARTIFACT phase: S3 locations of synthesized infrastructure documents (e.g. CloudFormation templates) evaluated by policy (OPA/rego) checks.
-     *
-     * @minItems 1
-     */
-    infraRefs?: S3Ref1[];
-    /**
-     * Optional build-source provenance for ARTIFACT calls where the top-level repo/commit describe the source of the build rather than the artifact itself; stamped into verdict provenance verbatim.
-     */
-    provenance?: {
-        /**
-         * GitHub owner/name of the build-source repository.
-         */
-        repo: string;
-        /**
-         * Full 40-hex lowercase commit SHA the artifact was built from.
-         */
-        commit: string;
-        /**
-         * Branch the artifact was built from, caller-supplied provenance.
-         */
-        branch?: string;
-    };
-}
-/**
- * ARTIFACT phase: S3 location of the built deployable bundle to scan.
- */
-export interface S3Ref {
-    /**
-     * S3 bucket name.
-     */
-    bucket: string;
-    /**
-     * S3 object key.
-     */
-    key: string;
-}
-export interface S3Ref1 {
-    /**
-     * S3 bucket name.
-     */
-    bucket: string;
-    /**
-     * S3 object key.
-     */
-    key: string;
-}

package/gen-ts/security-scan-input.ts

@@ -1,91 +0,0 @@
-/* eslint-disable */
-// Code generated by tools/gen/gen.mjs from schema/*.json. DO NOT EDIT.
-
-/**
- * Input to the Isomorph Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.
- */
-export interface SecurityScanInput {
-  /**
-   * Scan phase. SOURCE (M1) scans the ingested snapshot for the commit; ARTIFACT (M2) scans built outputs named by imageDigest/bundleRef/infraRefs — at least one of which must be present.
-   */
-  phase: 'SOURCE' | 'ARTIFACT';
-  /**
-   * Isomorph organization id, e.g. fourier.
-   */
-  org: string;
-  /**
-   * Isomorph app id within the org, e.g. focuslist.
-   */
-  app: string;
-  /**
-   * Environment whose ingested snapshots are searched for the commit. M1 deploys preview-only; prod is contract-stable for M3.
-   */
-  env: 'preview' | 'prod';
-  /**
-   * GitHub owner/name of the source repository, e.g. Fourier-Labs-AI/focus-list.
-   */
-  repo: string;
-  /**
-   * Full 40-hex lowercase commit SHA — the identity being scanned.
-   */
-  commit: string;
-  /**
-   * Branch name, supplied authoritatively by the caller in v1 (provenance only — never used for resolution).
-   */
-  branch: string;
-  /**
-   * Data classification of the app. Optional in v1 (decided 2026-08-27): when ABSENT the machine assumes the STANDARD profile and stamps classificationDefaulted: true in the verdict provenance. An invalid value still fails closed — only absence defaults. No classifier exists until M4; until then callers state it or accept the default.
-   */
-  classification?: 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
-  /**
-   * ARTIFACT phase: container image to scan, as either a digest-qualified ECR reference (<ecr-uri>@sha256:<64-hex>) or a bare sha256:<64-hex> digest. Digest-addressed only — tags are not accepted, so the scanned bytes are the deployed bytes.
-   */
-  imageDigest?: string;
-  bundleRef?: S3Ref;
-  /**
-   * ARTIFACT phase: S3 locations of synthesized infrastructure documents (e.g. CloudFormation templates) evaluated by policy (OPA/rego) checks.
-   *
-   * @minItems 1
-   */
-  infraRefs?: S3Ref1[];
-  /**
-   * Optional build-source provenance for ARTIFACT calls where the top-level repo/commit describe the source of the build rather than the artifact itself; stamped into verdict provenance verbatim.
-   */
-  provenance?: {
-    /**
-     * GitHub owner/name of the build-source repository.
-     */
-    repo: string;
-    /**
-     * Full 40-hex lowercase commit SHA the artifact was built from.
-     */
-    commit: string;
-    /**
-     * Branch the artifact was built from, caller-supplied provenance.
-     */
-    branch?: string;
-  };
-}
-/**
- * ARTIFACT phase: S3 location of the built deployable bundle to scan.
- */
-export interface S3Ref {
-  /**
-   * S3 bucket name.
-   */
-  bucket: string;
-  /**
-   * S3 object key.
-   */
-  key: string;
-}
-export interface S3Ref1 {
-  /**
-   * S3 bucket name.
-   */
-  bucket: string;
-  /**
-   * S3 object key.
-   */
-  key: string;
-}

package/schema/security-scan-input.schema.json

@@ -1,110 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://schemas.harbour.dev/security-scan-input.schema.json",
-  "title": "SecurityScanInput",
-  "description": "Input to the Isomorph Security Assurance machine (Security Assurance LLD §2). SOURCE (M1) scans an ingested commit; ARTIFACT (M2) scans built outputs — a container image digest, a deployable bundle, and/or synthesized infrastructure — named directly by the caller. `commit` is the identity being scanned; `org/app/env` locate the snapshot (the control-state table has no commit GSI, so a bare commit is not resolvable); `branch` is caller-supplied provenance. When phase is ARTIFACT at least one of `imageDigest`, `bundleRef`, or `infraRefs` must be present.",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["phase", "org", "app", "env", "repo", "commit", "branch"],
-  "if": { "properties": { "phase": { "const": "ARTIFACT" } }, "required": ["phase"] },
-  "then": {
-    "anyOf": [
-      { "required": ["imageDigest"] },
-      { "required": ["bundleRef"] },
-      { "required": ["infraRefs"] }
-    ]
-  },
-  "properties": {
-    "phase": {
-      "type": "string",
-      "enum": ["SOURCE", "ARTIFACT"],
-      "description": "Scan phase. SOURCE (M1) scans the ingested snapshot for the commit; ARTIFACT (M2) scans built outputs named by imageDigest/bundleRef/infraRefs — at least one of which must be present."
-    },
-    "org": {
-      "type": "string",
-      "minLength": 1,
-      "description": "Isomorph organization id, e.g. fourier."
-    },
-    "app": {
-      "type": "string",
-      "minLength": 1,
-      "description": "Isomorph app id within the org, e.g. focuslist."
-    },
-    "env": {
-      "type": "string",
-      "enum": ["preview", "prod"],
-      "description": "Environment whose ingested snapshots are searched for the commit. M1 deploys preview-only; prod is contract-stable for M3."
-    },
-    "repo": {
-      "type": "string",
-      "minLength": 1,
-      "pattern": "^[^/\\s]+/[^/\\s]+$",
-      "description": "GitHub owner/name of the source repository, e.g. Fourier-Labs-AI/focus-list."
-    },
-    "commit": {
-      "type": "string",
-      "pattern": "^[0-9a-f]{40}$",
-      "description": "Full 40-hex lowercase commit SHA — the identity being scanned."
-    },
-    "branch": {
-      "type": "string",
-      "minLength": 1,
-      "description": "Branch name, supplied authoritatively by the caller in v1 (provenance only — never used for resolution)."
-    },
-    "classification": {
-      "type": "string",
-      "enum": ["GREEN", "YELLOW", "ORANGE", "RED"],
-      "description": "Data classification of the app. Optional in v1 (decided 2026-08-27): when ABSENT the machine assumes the STANDARD profile and stamps classificationDefaulted: true in the verdict provenance. An invalid value still fails closed — only absence defaults. No classifier exists until M4; until then callers state it or accept the default."
-    },
-    "imageDigest": {
-      "type": "string",
-      "pattern": "^([^@\\s]+@)?sha256:[0-9a-f]{64}$",
-      "description": "ARTIFACT phase: container image to scan, as either a digest-qualified ECR reference (<ecr-uri>@sha256:<64-hex>) or a bare sha256:<64-hex> digest. Digest-addressed only — tags are not accepted, so the scanned bytes are the deployed bytes."
-    },
-    "bundleRef": {
-      "$ref": "#/definitions/S3Ref",
-      "description": "ARTIFACT phase: S3 location of the built deployable bundle to scan."
-    },
-    "infraRefs": {
-      "type": "array",
-      "items": { "$ref": "#/definitions/S3Ref" },
-      "minItems": 1,
-      "description": "ARTIFACT phase: S3 locations of synthesized infrastructure documents (e.g. CloudFormation templates) evaluated by policy (OPA/rego) checks."
-    },
-    "provenance": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["repo", "commit"],
-      "properties": {
-        "repo": {
-          "type": "string",
-          "minLength": 1,
-          "pattern": "^[^/\\s]+/[^/\\s]+$",
-          "description": "GitHub owner/name of the build-source repository."
-        },
-        "commit": {
-          "type": "string",
-          "pattern": "^[0-9a-f]{40}$",
-          "description": "Full 40-hex lowercase commit SHA the artifact was built from."
-        },
-        "branch": {
-          "type": "string",
-          "minLength": 1,
-          "description": "Branch the artifact was built from, caller-supplied provenance."
-        }
-      },
-      "description": "Optional build-source provenance for ARTIFACT calls where the top-level repo/commit describe the source of the build rather than the artifact itself; stamped into verdict provenance verbatim."
-    }
-  },
-  "definitions": {
-    "S3Ref": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["bucket", "key"],
-      "properties": {
-        "bucket": { "type": "string", "minLength": 1, "description": "S3 bucket name." },
-        "key": { "type": "string", "minLength": 1, "description": "S3 object key." }
-      }
-    }
-  }
-}