@mstar-harness/engine 3.2.6 → 3.4.0

package/dist/audit.js

@@ -1,4 +1,5 @@
 // src/audit.ts
+import { execFileSync } from "node:child_process";
 import { existsSync as existsSync3, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, rmdirSync as rmdirSync2, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { basename as basename2, join as join4, resolve as resolve4, sep as sep2 } from "node:path";
 
@@ -113,38 +114,6 @@ var CONFIG_KEYS = {
   [MSTARC_ENFORCEMENT_KEY]: "enforcement"
 };
 
-// src/path.ts
-function assertSafePathComponent(value, what) {
-  if (value === "" || value === "." || value === ".." || !/^[A-Za-z0-9._-]+$/.test(value)) {
-    throw new Error(`${what} must be a single safe path component ([A-Za-z0-9._-]+; not "", ".", "..", or containing "/" or "\\") — got ${JSON.stringify(value)}`);
-  }
-}
-var GITIGNORE_SNIPPET = `# Morning Star harness (.mstar/)
-# Principle: process stays local; results are shared with the team.
-# Default-ignore everything under .mstar/, then re-include the tracked results.
-.mstar/**
-!.mstar/AGENTS.md
-!.mstar/knowledge/
-!.mstar/knowledge/**
-!.mstar/specs/
-!.mstar/specs/**
-# .mstarc — repo-local harness config (may declare [config] harness_dir=<name>)
-.mstarc
-`;
-var GITIGNORE_SNIPPET_AGENTS = `# Morning Star harness (.agents/) — legacy
-# Default-ignore everything under .agents/, then re-include the tracked results.
-.agents/**
-!.agents/AGENTS.md
-!.agents/knowledge/
-!.agents/knowledge/**
-!.agents/specs/
-!.agents/specs/**
-`;
-var GITIGNORE_PROCESS_ENTRIES = GITIGNORE_SNIPPET.split(`
-`).filter((line) => line.startsWith(".mstar/") || line.startsWith("!.mstar/")).map((line) => line.trim());
-var GITIGNORE_PROCESS_ENTRIES_AGENTS = GITIGNORE_SNIPPET_AGENTS.split(`
-`).filter((line) => line.startsWith(".agents/") || line.startsWith("!.agents/")).map((line) => line.trim());
-
 // src/status.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync, realpathSync } from "node:fs";
 import { dirname as dirname3, join as join3, resolve as resolve3, sep } from "node:path";
@@ -336,6 +305,38 @@ function registerWorkflowEntryLocked(statusPath, entry) {
   return doc;
 }
 
+// src/path.ts
+function assertSafePathComponent(value, what) {
+  if (value === "" || value === "." || value === ".." || !/^[A-Za-z0-9._-]+$/.test(value)) {
+    throw new Error(`${what} must be a single safe path component ([A-Za-z0-9._-]+; not "", ".", "..", or containing "/" or "\\") — got ${JSON.stringify(value)}`);
+  }
+}
+var GITIGNORE_SNIPPET = `# Morning Star harness (.mstar/)
+# Principle: process stays local; results are shared with the team.
+# Default-ignore everything under .mstar/, then re-include the tracked results.
+.mstar/**
+!.mstar/AGENTS.md
+!.mstar/knowledge/
+!.mstar/knowledge/**
+!.mstar/specs/
+!.mstar/specs/**
+# .mstarc — repo-local harness config (may declare [config] harness_dir=<name>)
+.mstarc
+`;
+var GITIGNORE_SNIPPET_AGENTS = `# Morning Star harness (.agents/) — legacy
+# Default-ignore everything under .agents/, then re-include the tracked results.
+.agents/**
+!.agents/AGENTS.md
+!.agents/knowledge/
+!.agents/knowledge/**
+!.agents/specs/
+!.agents/specs/**
+`;
+var GITIGNORE_PROCESS_ENTRIES = GITIGNORE_SNIPPET.split(`
+`).filter((line) => line.startsWith(".mstar/") || line.startsWith("!.mstar/")).map((line) => line.trim());
+var GITIGNORE_PROCESS_ENTRIES_AGENTS = GITIGNORE_SNIPPET_AGENTS.split(`
+`).filter((line) => line.startsWith(".agents/") || line.startsWith("!.agents/")).map((line) => line.trim());
+
 // src/audit.ts
 function violation2(severity, code, message, fix) {
   return { ok: false, severity, code, message, fix };
@@ -343,6 +344,7 @@ function violation2(severity, code, message, fix) {
 var AUDIT_PRIORITIES = ["P1", "P2", "P3"];
 var AUDIT_EFFORTS = ["XS", "S", "M", "L", "XL"];
 var AUDIT_RISKS = ["LOW", "MED", "HIGH"];
+var AUDIT_CONFIDENCES = ["HIGH", "MED", "LOW"];
 var AUDIT_CATEGORIES = [
   "bug",
   "security",
@@ -409,9 +411,11 @@ function validateAuditStatusBlocks(planText) {
   return { ok: violations.length === 0, violations };
 }
 var WHOLE_MATCH_PATTERNS = [
-  { type: "private-key", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/g },
+  { type: "private-key", re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g },
   { type: "aws-access-key", re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
   { type: "github-token", re: /\bgh[pousr]_[A-Za-z0-9]{36,}\b/g },
+  { type: "github-pat", re: /\bgithub_pat_[A-Za-z0-9_]{40,}\b/g },
+  { type: "stripe-live-key", re: /\bsk_live_[A-Za-z0-9]{16,}\b/g },
   { type: "slack-token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
   { type: "jwt", re: /\beyJ[A-Za-z0-9_-]{10,1024}\.[A-Za-z0-9_-]{10,1024}\.[A-Za-z0-9_-]{10,1024}\b/g },
   { type: "api-secret-key", re: /\bsk-[A-Za-z0-9-]{20,}\b/g }
@@ -422,6 +426,36 @@ var VALUE_PATTERNS = [
     re: /(["']?)\b(password|passwd|api[_-]?key|access[_-]?token|auth[_-]?token|secret|token)\b(["']?)(\s*[:=]\s*)("[^"\n]{8,}"|'[^'\n]{8,}'|[A-Za-z0-9_./+\-=]{16,})/gi
   }
 ];
+var NEVER_COMMIT_FILENAMES = [
+  { type: "env-file", re: /^\.env/i },
+  { type: "private-key-file", re: /\.(?:pem|key)$/i },
+  { type: "ssh-private-key-file", re: /^id_(?:rsa|ed25519|ecdsa|dsa)$/ },
+  { type: "credentials-json", re: /^credentials\.json$/i },
+  { type: "service-account-json", re: /^service-account\.json$/i },
+  { type: "git-credentials", re: /^\.?git-credentials$/i }
+];
+var CI_IAC_LEAK_SHAPES = [
+  {
+    kind: "actions-plaintext-env",
+    description: "GitHub Actions env assignment with plaintext literal",
+    re: /^\s*(?:-\s+)?env:\s*[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|KEY)[A-Z0-9_]*\s*[:=]\s*["']?[A-Za-z0-9_/+=-]{8,}["']?\s*$/
+  },
+  {
+    kind: "actions-secret-echo",
+    description: "echo of a GitHub Actions secrets context value",
+    re: /\becho\b[^#\n]*\$\{\{\s*secrets\.[A-Za-z0-9_]+\s*\}\}/
+  },
+  {
+    kind: "dockerfile-credential-env",
+    description: "Dockerfile ENV/ARG with credential-looking name",
+    re: /^\s*(?:ENV|ARG)\s+[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|APIKEY|API_KEY|ACCESS_KEY|PRIVATE_KEY)[A-Z0-9_]*\b/i
+  },
+  {
+    kind: "terraform-hardcoded-password",
+    description: "Terraform hardcoded password attribute",
+    re: /^\s*password\s*=\s*"[^$\{][^"]*"\s*$/
+  }
+];
 function buildLineStarts(text) {
   const starts = [0];
   for (let i = 0;i < text.length; i++) {
@@ -443,17 +477,25 @@ function lineAt(starts, index) {
   }
   return lo + 1;
 }
+function lineStartOf(text, index) {
+  return text.lastIndexOf(`
+`, index - 1) + 1;
+}
 function redactSecrets(text, filePath) {
   const starts = buildLineStarts(text);
   const marker = (type, index) => `[REDACTED ${type}@${lineAt(starts, index)}${filePath === undefined ? "" : ` in ${filePath}`}]`;
-  const replacements = [];
-  const findings = [];
+  const spans = [];
   for (const pattern of WHOLE_MATCH_PATTERNS) {
     for (const match of text.matchAll(pattern.re)) {
       if (match.index === undefined)
         continue;
-      replacements.push({ index: match.index, length: match[0].length, text: marker(pattern.type, match.index) });
-      findings.push({ line: lineAt(starts, match.index), type: pattern.type });
+      spans.push({
+        start: match.index,
+        end: match.index + match[0].length,
+        priority: 0,
+        text: marker(pattern.type, match.index),
+        type: pattern.type
+      });
     }
   }
   for (const pattern of VALUE_PATTERNS) {
@@ -462,20 +504,287 @@ function redactSecrets(text, filePath) {
         continue;
       const type = pattern.typeOf(match[2]);
       const replacement = `${match[1]}${match[2]}${match[3]}${match[4]}${marker(type, match.index)}`;
-      replacements.push({ index: match.index, length: match[0].length, text: replacement });
-      findings.push({ line: lineAt(starts, match.index), type });
+      spans.push({ start: match.index, end: match.index + match[0].length, priority: 1, text: replacement, type });
     }
   }
-  replacements.sort((a, b) => b.index - a.index);
+  for (const shape of CI_IAC_LEAK_SHAPES) {
+    const lineScoped = new RegExp(shape.re.source, shape.re.ignoreCase ? "gim" : "gm");
+    for (const match of text.matchAll(lineScoped)) {
+      if (match.index === undefined)
+        continue;
+      const lineEnd = text.indexOf(`
+`, match.index);
+      const end = lineEnd === -1 ? text.length : lineEnd;
+      spans.push({
+        start: match.index,
+        end,
+        priority: 2,
+        text: `${" ".repeat(match.index - lineStartOf(text, match.index))}${marker(shape.kind, match.index)}`,
+        type: shape.kind
+      });
+    }
+  }
+  spans.sort((a, b) => a.start - b.start || b.end - a.end || b.priority - a.priority);
+  const merged = [];
+  let groupMaxEnd = -1;
+  let best = null;
+  for (const span of spans) {
+    if (span.start < groupMaxEnd) {
+      if (groupMaxEnd < span.end)
+        groupMaxEnd = span.end;
+      if (span.end - span.start > best.end - best.start)
+        best = span;
+    } else {
+      if (best !== null)
+        merged.push(best);
+      groupMaxEnd = span.end;
+      best = span;
+    }
+  }
+  if (best !== null)
+    merged.push(best);
   let out = text;
-  for (const r of replacements)
-    out = out.slice(0, r.index) + r.text + out.slice(r.index + r.length);
+  for (let i = merged.length - 1;i >= 0; i--) {
+    const r = merged[i];
+    out = out.slice(0, r.start) + r.text + out.slice(r.end);
+  }
+  const findings = merged.map((r) => ({ line: lineAt(starts, r.start), type: r.type }));
   const deduped = new Map;
   for (const f of findings)
     deduped.set(`${f.line}:${f.type}`, f);
   const sorted = [...deduped.values()].sort((a, b) => a.line - b.line || a.type.localeCompare(b.type));
   return { text: out, findings: sorted };
 }
+var SAFE_PLACEHOLDER_SHAPES = [
+  /\$\{[A-Za-z_][A-Za-z0-9_]*\}/g,
+  /process\.env\.[A-Za-z_][A-Za-z0-9_]*/g,
+  /os\.environ(?:\.get)?\(?\s*["']/g
+];
+var SAFE_PLACEHOLDER_VALUES = ["your-api-key-here", "<your_api_key>", "<your-api-key>"];
+function maskSafePlaceholders(line) {
+  let masked = line;
+  for (const shape of [...SAFE_PLACEHOLDER_VALUES, ...SAFE_PLACEHOLDER_SHAPES]) {
+    if (typeof shape === "string") {
+      let at = masked.toLowerCase().indexOf(shape);
+      while (at !== -1) {
+        let from = at;
+        let to = at + shape.length;
+        if (masked[from - 1] === '"' || masked[from - 1] === "'")
+          from--;
+        if (masked[to] === '"' || masked[to] === "'")
+          to++;
+        masked = masked.slice(0, from) + " ".repeat(to - from) + masked.slice(to);
+        at = masked.toLowerCase().indexOf(shape);
+      }
+    } else {
+      for (const match of masked.matchAll(shape)) {
+        if (match.index === undefined)
+          continue;
+        let from = match.index;
+        let to = match.index + match[0].length;
+        if (masked[from - 1] === '"' || masked[from - 1] === "'")
+          from--;
+        if (masked[to] === '"' || masked[to] === "'")
+          to++;
+        masked = masked.slice(0, from) + " ".repeat(to - from) + masked.slice(to);
+      }
+    }
+  }
+  return masked;
+}
+var ACTIONS_ENV_KEY = /[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|KEY)[A-Z0-9_]*/;
+function scanActionsEnvMap(lines) {
+  const out = [];
+  let inMap = false;
+  let mapIndent = 0;
+  for (let i = 0;i < lines.length; i++) {
+    const rawLine = lines[i] ?? "";
+    if (!rawLine.trim())
+      continue;
+    const indent = rawLine.length - rawLine.trimStart().length;
+    const line = maskSafePlaceholders(rawLine);
+    if (inMap) {
+      if (indent <= mapIndent) {
+        inMap = false;
+      } else if (line.trim() !== "") {
+        const child = /^\s*(?:["']?)([A-Za-z0-9_-]+)(?:["']?)\s*:\s*(.+?)\s*$/.exec(line);
+        const value = child?.[2] ?? "";
+        if (child !== null && ACTIONS_ENV_KEY.test(child[1]) && !/^\$\{\{[^}]*\}\}$/.test(value) && !/^\$\{[^}]*\}$/.test(value)) {
+          out.push(i + 1);
+        }
+      }
+      if (inMap)
+        continue;
+    }
+    if (/^\s*(?:-\s+)?env:\s*(?:#.*)?$/.test(line)) {
+      inMap = true;
+      mapIndent = indent;
+    }
+  }
+  return out;
+}
+function scanSecrets(files) {
+  const findings = [];
+  let unreadableFiles = 0;
+  const privateKeyRow = WHOLE_MATCH_PATTERNS.find((pattern) => pattern.type === "private-key");
+  if (privateKeyRow === undefined) {
+    throw new Error("scanSecrets: WHOLE_MATCH_PATTERNS is missing its private-key row (full-text PEM pass)");
+  }
+  for (const file of files) {
+    let text;
+    try {
+      text = readFileSync3(file, "utf8");
+    } catch {
+      unreadableFiles++;
+      continue;
+    }
+    const base = basename2(file);
+    for (const entry of NEVER_COMMIT_FILENAMES) {
+      if (entry.re.test(base))
+        findings.push({ file, line: 1, type: entry.type });
+    }
+    const starts = buildLineStarts(text);
+    for (const match of text.matchAll(privateKeyRow.re)) {
+      if (match.index === undefined)
+        continue;
+      findings.push({ file, line: lineAt(starts, match.index), type: privateKeyRow.type });
+    }
+    const lines = text.split(`
+`);
+    for (const lineNo of scanActionsEnvMap(lines)) {
+      findings.push({ file, line: lineNo, type: "actions-plaintext-env" });
+    }
+    for (let i = 0;i < lines.length; i++) {
+      const line = maskSafePlaceholders(lines[i] ?? "");
+      for (const pattern of WHOLE_MATCH_PATTERNS) {
+        if (line.match(pattern.re) !== null)
+          findings.push({ file, line: i + 1, type: pattern.type });
+      }
+      for (const pattern of VALUE_PATTERNS) {
+        const match = pattern.re.exec(line);
+        pattern.re.lastIndex = 0;
+        if (match !== null && !/^\$\{[^}]*\}$/.test(match[5])) {
+          findings.push({ file, line: i + 1, type: pattern.typeOf(match[2]) });
+        }
+      }
+      for (const shape of CI_IAC_LEAK_SHAPES) {
+        if (shape.re.test(line))
+          findings.push({ file, line: i + 1, type: shape.kind });
+      }
+    }
+  }
+  return { findings, unreadableFiles };
+}
+var LOCKFILE_NAMES = [
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "bun.lock",
+  "bun.lockb",
+  "Cargo.lock",
+  "poetry.lock",
+  "uv.lock",
+  "Gemfile.lock",
+  "composer.lock"
+];
+function rootLockfiles(root) {
+  let entries;
+  try {
+    entries = readdirSync2(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const names = new Set(LOCKFILE_NAMES);
+  const present = entries.filter((entry) => entry.isFile() && names.has(entry.name)).map((entry) => join4(root, entry.name));
+  if (present.length === 0)
+    return [];
+  try {
+    const tracked = new Set(execFileSync("git", ["ls-files", "-z", "--", "."], {
+      cwd: root,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).split("\x00").filter((f) => f !== ""));
+    return present.filter((p) => tracked.has(basename2(p)));
+  } catch {
+    return present;
+  }
+}
+function supplyChainChecks(repoRoot) {
+  const findings = [];
+  const violations = [];
+  const lockfiles = rootLockfiles(repoRoot);
+  if (lockfiles.length === 0) {
+    findings.push({ kind: "lockfile-missing", file: repoRoot });
+    violations.push(violation2("medium", "audit.supply.lockfile-missing", `no recognized lockfile at ${repoRoot}`, "commit a lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock, …)"));
+  } else if (lockfiles.length > 1) {
+    findings.push({ kind: "lockfile-duplicate", file: lockfiles.map((f) => f.replace(`${repoRoot}/`, "")).join(", ") });
+    violations.push(violation2("medium", "audit.supply.lockfile-duplicate", `multiple lockfiles at ${repoRoot}: ${lockfiles.join(", ")}`, "keep exactly one lockfile per package manager"));
+  }
+  const workflowsDir = join4(repoRoot, ".github", "workflows");
+  let wfEntries = [];
+  try {
+    wfEntries = readdirSync2(workflowsDir, { withFileTypes: true });
+  } catch {
+    wfEntries = [];
+  }
+  for (const entry of wfEntries) {
+    if (!entry.isFile() || !/\.(?:ya?ml)$/.test(entry.name))
+      continue;
+    const wfPath = join4(workflowsDir, entry.name);
+    const relPath = `.github/workflows/${entry.name}`;
+    let text;
+    try {
+      text = readFileSync3(wfPath, "utf8");
+    } catch {
+      continue;
+    }
+    const lines = text.split(`
+`);
+    const hasPrt = /(?:^|\n)\s*(?:(?:-\s+)?pull_request_target\b|on:\s*(?:\[[^\]]*\s*)?pull_request_target\b)/.test(text);
+    const prtHeadSteps = new Set;
+    for (let i = 0;i < lines.length; i++) {
+      const line = lines[i] ?? "";
+      if (!/uses:\s*actions\/checkout\b/.test(line))
+        continue;
+      let stepIndent = line.length - line.trimStart().length;
+      for (let k = i - 1;k >= 0; k--) {
+        const up = lines[k] ?? "";
+        const ind = up.length - up.trimStart().length;
+        if (up.trimStart().startsWith("- ") && ind < stepIndent) {
+          stepIndent = ind;
+          break;
+        }
+      }
+      for (let j = i + 1;j < lines.length; j++) {
+        const l2 = lines[j] ?? "";
+        if (l2.trim() && l2.length - l2.trimStart().length <= stepIndent)
+          break;
+        if (/github\.event\.pull_request\.head\.(?:sha|ref)\b/.test(l2)) {
+          prtHeadSteps.add(i);
+          break;
+        }
+      }
+    }
+    for (let i = 0;i < lines.length; i++) {
+      const line = lines[i] ?? "";
+      const uses = /^\s*(?:-\s+)?uses:\s*(\S+)@(\S+)\s*(?:#.*)?$/.exec(line);
+      if (uses !== null) {
+        const ref = uses[2].replace(/^["']|["']$/g, "");
+        const shaLike = /^[0-9a-f]{40}$/.test(ref);
+        const versionLike = /^v\d+(?:\.\d+)*$/.test(ref);
+        if (!shaLike && !versionLike) {
+          findings.push({ kind: "action-unpinned", file: relPath, line: i + 1 });
+          violations.push(violation2("high", "audit.supply.action-unpinned", `${relPath}:${i + 1} uses \`${uses[1]}@${ref}\` — mutable ref`, "pin the action to a full commit SHA"));
+        }
+      }
+      if (hasPrt && prtHeadSteps.has(i)) {
+        findings.push({ kind: "pull_request_target-head", file: relPath, line: i + 1 });
+        violations.push(violation2("high", "audit.supply.pull_request_target-head", `${relPath}:${i + 1} checks out the PR head under pull_request_target`, "check out the base ref or use a pull_request trigger for untrusted code"));
+      }
+    }
+  }
+  return { ok: violations.length === 0, violations, findings };
+}
 function slugify(title) {
   return title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
@@ -509,14 +818,36 @@ function renderPlanFile(finding, plannedAt) {
 `)}
 `;
 }
+function redactText(text) {
+  return redactSecrets(text).text;
+}
+function redactFinding(finding) {
+  return {
+    ...finding,
+    title: redactText(finding.title),
+    impact: redactText(finding.impact),
+    evidence: finding.evidence.map(redactText),
+    ...finding.fixSketch !== undefined ? { fixSketch: redactText(finding.fixSketch) } : {},
+    ...finding.verification !== undefined ? { verification: redactText(finding.verification) } : {}
+  };
+}
 function readPlanFileSummary(filePath) {
   const text = readFileSync3(filePath, "utf8");
   const title = (text.match(/^# (.+)$/m) ?? [])[1] ?? filePath;
   const blocks = parseStatusBlocks(text);
   return { title: title.trim(), fields: blocks.length > 0 ? blocks[0].fields : new Map };
 }
+function extractSecurityDispositionSections(text) {
+  const grab = (heading) => {
+    const match = text.match(new RegExp(`(?:^|\\r?\\n)##[ \\t]+${heading}[ \\t]*\\r?\\n(?:[ \\t]*\\r?\\n)?([\\s\\S]*?)(?=\\r?\\n## |$)`, "i"));
+    if (!match)
+      return [];
+    return match[1].split(/\r?\n/).map((line) => line.replace(/\r$/, "")).filter((line) => line.startsWith("- "));
+  };
+  return { needsVerification: grab("Needs verification"), hardeningChecked: grab("Hardening & checked notes") };
+}
 function renderIndex(params) {
-  const { date, repoName, repoShortSha, rows, rejected } = params;
+  const { date, repoName, repoShortSha, rows, rejected, needsVerification, hardeningChecked } = params;
   const findingsRows = rows.map((r) => `| ${r.num} | ${escapeCell(r.title)} | ${r.category} | ${escapeCell(truncate(r.impact, 80))} | ${r.effort} | ${r.risk} | ${r.confidence} | ${escapeCell(truncate(r.evidence, 80))} |`).join(`
 `);
   const directionRows = rows.filter((r) => r.category === "direction").map((r) => `- ${escapeCell(r.title)} — ${escapeCell(truncate(r.impact, 120))}`).join(`
@@ -537,6 +868,12 @@ function renderIndex(params) {
   if (directionRows !== "") {
     sections.push("", "## Direction", "", directionRows);
   }
+  if (needsVerification.length > 0) {
+    sections.push("", "## Needs verification", "", ...needsVerification);
+  }
+  if (hardeningChecked.length > 0) {
+    sections.push("", "## Hardening & checked notes", "", ...hardeningChecked);
+  }
   sections.push("", "## Execution order & status", "", "| Plan | Title | Priority | Effort | Depends on | Status |", "|------|-------|----------|--------|------------|--------|", executionRows);
   if (rejectedRows !== "") {
     sections.push("", "## Findings considered and rejected", "", rejectedRows);
@@ -550,11 +887,14 @@ function scaffoldAuditPlan(outDir, findings, options = {}) {
   const date = options.date ?? new Date().toISOString().slice(0, 10);
   const plannedAt = options.plannedAt ?? { commit: options.repoShortSha ?? "unknown", date };
   mkdirSync3(outDir, { recursive: true });
+  const existingReadme = join4(outDir, "README.md");
+  const carried = existsSync3(existingReadme) ? extractSecurityDispositionSections(readFileSync3(existingReadme, "utf8")) : { needsVerification: [], hardeningChecked: [] };
   const existing = readdirSync2(outDir).filter((f) => /^\d{3}-.*\.md$/.test(f));
   let next = existing.reduce((max, f) => Math.max(max, Number(f.slice(0, 3))), 0) + 1;
+  const redactedFindings = findings.map(redactFinding);
   const written = [];
   const usedSlugs = new Set;
-  for (const finding of findings) {
+  for (const finding of redactedFindings) {
     const num = String(next).padStart(3, "0");
     let slug = slugify(finding.title);
     if (usedSlugs.has(slug)) {
@@ -588,7 +928,7 @@ function scaffoldAuditPlan(outDir, findings, options = {}) {
   });
   const byNum = new Map(rows.map((r) => [r.num, r]));
   written.forEach((file, i) => {
-    const finding = findings[i];
+    const finding = redactedFindings[i];
     if (finding === undefined)
       return;
     const row = byNum.get(file.slice(0, 3));
@@ -603,12 +943,16 @@ function scaffoldAuditPlan(outDir, findings, options = {}) {
       row.dependsOn = finding.dependsOn ?? "none";
     }
   });
+  const needsVerificationLines = options.needsVerification !== undefined ? options.needsVerification.map((nv) => `- ${escapeCell(redactText(nv.lead))}: ${escapeCell(redactText(nv.how))}${nv.evidence ? ` (${escapeCell(redactText(nv.evidence))})` : ""}`) : carried.needsVerification;
+  const hardeningCheckedLines = options.hardeningChecked !== undefined ? options.hardeningChecked.map((hc) => `- ${hc.kind}: ${escapeCell(redactText(hc.text))}`) : carried.hardeningChecked;
   writeFileSync3(join4(outDir, "README.md"), renderIndex({
     date,
     repoName: options.repoName ?? "repo",
     repoShortSha: options.repoShortSha ?? "unknown",
     rows,
-    rejected: options.rejected ?? []
+    rejected: (options.rejected ?? []).map((r) => ({ title: redactText(r.title), reason: redactText(r.reason) })),
+    needsVerification: needsVerificationLines,
+    hardeningChecked: hardeningCheckedLines
   }));
   return { outDir: resolve4(outDir), date, files: written, nextNumber: next };
 }
@@ -745,11 +1089,18 @@ function planFileRel(outDir, planFile) {
 }
 export {
   validateAuditStatusBlocks,
+  supplyChainChecks,
+  scanSecrets,
   scaffoldAuditPlan,
   redactSecrets,
   promoteAuditPlans,
+  WHOLE_MATCH_PATTERNS,
+  VALUE_PATTERNS,
+  NEVER_COMMIT_FILENAMES,
+  CI_IAC_LEAK_SHAPES,
   AUDIT_RISKS,
   AUDIT_PRIORITIES,
   AUDIT_EFFORTS,
+  AUDIT_CONFIDENCES,
   AUDIT_CATEGORIES
 };